Reverse engineering remote control fireworks system - Page 1
Forum section: electronics / beginners

author: CoryV
author_rank: Newbie
timestamp: November 13, 2021, 09:51:46 pm
content: Hello EEVBlog! I am a novice to circuit reverse engineering; and frankly, for this project, I'm hoping for a shortcut.I recently picked up this 20 cue remote control firing system:https://www.aliexpress.com/item/1005001737207464.html?spm=a2g0s.9042311.0.0.3b534c4dZm7MhxThe kit was originally advertised as "expandable to 100 cues". After much back and forth with the seller, they finally stopped responding to me and changed the listing (it now no longer says "expandable" - hah!). However, I noticed that the controller unit can train the receiver unit cues to whatever it transmits, and all the units appear to support digits up to 99. I decided to open the controller and see if there was an easy way to change the controller to train cue numbers greater than 20 (even though the keypad would still show 1 - 20).Immediately, I noticed that there were solder points labeled 40, 60, 80, 100, suggesting that a simple modification would get what I want. Unfortunately, I tried a straight shunt, and then a 330 Ohm resistor, but neither changed the behavior of the controller unit.I started with the photos (attached), and I'm prepared to do the tracing and component measurements like what is recommended here:https://www.eevblog.com/forum/beginners/pcb-to-scheme/msg2325273/#msg2325273However, I am concerned about 2 completely unmarked ICs that appear to be central to the controller's operation. I'm afraid that no matter how much tracing I do, I'll never figure out how to modify the device correctly because of these unknown ICs.My questions:1. Is anyone experienced with a device like this and can recommend the correct modification?2. Should I go through the whole tracing/measuring process even though I don't know what the ICs do?3. Any advice on identifying the 2 ICs?Thank you in advance for any help you can offer!-Cory

author: Manul
author_rank: Super Contributor
timestamp: November 13, 2021, 10:31:08 pm
content: I have slightly offtopic question: in the first picture, have you resoldered all SMT parts or the device came like this?

author: CoryV
author_rank: Newbie
timestamp: November 13, 2021, 10:45:34 pm
content: I had a feeling someone would ask that. No, I have not resoldered any existing parts. The device came like that

author: Manul
author_rank: Super Contributor
timestamp: November 13, 2021, 11:26:19 pm
content: Wow, that board looks like garbage...Anyway,1. Can't help.2. I don't think that you should reverse engineer whole PCB, unless you want to make your own clone or something like that.3. ICs without markings sometimes can be identified by knowing their type (for example, op amp, MCU, etc.) and comparing their package and pinout with various datasheets. Worst case, buying and testing candidate parts, performing signature analysis, etc. Very hard, often without luck. Sometimes even decaping IC package and identifying / reverse engineering the die. Can end up being madness unless you are lucky.Through quick internet search I saw a similar unit with 60 channels. But not 40 or 100. Are you sure that 100 channel version even exist? Maybe they planned, but never did and all or some of these jumpers really do nothing. But even if they work, to make it useable you need a different keypad layout and many more receivers.

author: CoryV
author_rank: Newbie
timestamp: November 14, 2021, 03:49:16 am
content: I think "planned, but never did" is exactly what happened.Keypad is not that big a deal. I can mark it up, or label the controller units uniquely. Many more receivers, I have. I have a plan to use them regardless of whether I get them all uniquely addressable or not.I do have more than one controller now. Perhaps decaping the ICs is the way to go. Antoine's method seems achievable to me:Can you link me to the 60 channel unit?

author: james_s
author_rank: Super Contributor
timestamp: November 14, 2021, 05:11:31 am
content: I don't think you'll gain much by de-capping the chip, it is almost certainly a microcontroller which means that even if you figure out exactly what microcontroller it is, you won't have the code that runs it. It might be easier to build something similar from scratch, the hardware looks pretty trivial, 95% of the work is going to be developing the firmware.

author: ledtester
author_rank: Super Contributor
timestamp: November 14, 2021, 05:41:56 am
content: Here is how I think it works...The controller sends out messages like "fire #7" and then unit 7 will fire.I think the 40-60-80-100 jumpers simply add an offset to the unit number in the sent messages. So if the 40 jumper is connected and you press the "#7" button, the message sent out is "fire #27" instead of "fire #7".This means that the receiver units also have to be modified to recognize their new unit numbers.If you want to use two of these systems together there must be a way to make sure they don't send out messages for the same units and perhaps the jumpers are part of that solution.

author: ledtester
author_rank: Super Contributor
timestamp: November 14, 2021, 06:02:49 am
content: Also noticed in the documentation that "two remote controls can be paired".I would get in touch with the company listed in the documentation and ask about it:

author: CoryV
author_rank: Newbie
timestamp: November 14, 2021, 06:22:07 am
content: @james_sI see where you are going here. Arguably, the controller is a completely unnecessary component if you can emulate the signals. The receiver is really doing all the work. I actually took a stab at decoding the 433 Mhz protocol being used. I setup a Raspberry Pi with an RFM69 and tried to sniff packets but I hit a wall (wasn't getting signal at all). Maybe it's time I picked this back up.@ledtesterI have given up trying to get information from the manufacturer/seller. They don't seem to be interested in helping me with expanding the units. I also saw that note in the documentation, but I can assure you, I have no idea what it means! Interesting idea about the receivers needing to be modified too. I just pulled apart a receiver to check, but unfortunately I do not see the expected 40, 60, 80, 100 jumpers. I do see what appears to be the same 2 unlabeled ICs. I still think the receivers are limited only by the capability of the controller.

author: ledtester
author_rank: Super Contributor
timestamp: November 14, 2021, 07:16:51 pm
content: Quote from: CoryV on November 14, 2021, 06:22:07 amI would try probing inside one of the receiver units with an oscilloscope for a digital signal related to the transmission.

author: gcewing
author_rank: Regular Contributor
timestamp: November 15, 2021, 09:48:39 am
content: Quote from: CoryV on November 14, 2021, 06:22:07 amIf the receivers are trainable, presumably you just train them to respond to whatever the jumpered controllers are transmitting.

author: CoryV
author_rank: Newbie
timestamp: November 15, 2021, 03:58:39 pm
content: Quote from: gcewing on November 15, 2021, 09:48:39 amExactly what I'm trying to do. Only none of my jumper attempts have changed the behavior of the controller. I've tried a straight jumper wire, and a 330 Ohm resistor so far. Let me know if you other ideas.

author: CoryV
author_rank: Newbie
timestamp: November 15, 2021, 04:06:57 pm
content: Quote from: ledtester on November 14, 2021, 07:16:51 pmYou're giving me a good reason to buy some equipment! I'm thinking of going right to a USB logic probe. I see a probe point on the antenna, and a handful by the cable connector. Any recommendations?

author: james_s
author_rank: Super Contributor
timestamp: November 15, 2021, 08:18:25 pm
content: I think you mean a logic analyzer, not a logic probe. A logic probe just tells you in real time the logic state of a particular line.You will probably need to sniff the traffic to the RF module, can you identify what module it uses? It may take some detective work to determine the interface used, probably SPI or something like that. This could be quite a substantial project.

author: CoryV
author_rank: Newbie
timestamp: November 15, 2021, 11:18:56 pm
content: Quote from: james_s on November 15, 2021, 08:18:25 pmYes, I did mean logic analyzer, sorry about that. I don't even know which module is the RF module. I assume it's buried in the code in one of the unmarked ICs. The manufacturer also doesn't disclose the protocol (some other firing devices do disclose it; this one does not.)

author: james_s
author_rank: Super Contributor
timestamp: November 16, 2021, 12:30:58 am
content: You have a long road ahead of you if you want to reverse engineer this thing. I can't help but think it would be easier to build an entire system from scratch using documented off the shelf RF modules such as the RFM69.