Trying to reverse engineer the RF transceiver of an LED Controller - Page 1
Forum section: electronics / projects

author: Kinsi55
author_rank: Newbie
timestamp: August 19, 2023, 12:19:57 am
content: I got myself aWT5LED Strip controller. With the limited documentation available, I assumed when running in CCT Mode (Coldwhite + Warmwhite), I would be able to use one Controller for two zones (Which I assumed based off the Print on the Case). Unfortunately, this is not the case, both the CW/WW outputs are linked.So I figured I'd try to do the sensical thing here - Which is to not order a second controller but instead try to make it work with this one (It has 5 Mosfets, why they havent went the extra mile so it can run multiple zones is beyond me)My problem now is that RF is handled by an IC that I cannot find any info on whatsoever. Its labeled20_CP6A71.1 (Picture attached). Since I have no info on it I did some continuity testing and there seem to be 5 connections between it and the secondary MCU. I attached my Logic Analyzer and captured what happens when I press a button (Screenshots attached)The reason I need to figure out this communication is because the Remote has 4 buttons to switch between the 4 Channels it can control, however the currently active channel is in no way or shape forwarded to the WB3S, while it must be in the original communication since you can either pair a channel to this controller, or not.Additional Info- The communication may or may not be bi-directional. These controllers re-emit whatever they receive. If this is handled within the RF Chip or not, I dont know.- If anyone wants to take a deeper look, I can provide the saved Logic capture- As far as I know, its 2.4G RF (This is only based off the product description and might not be correct)Thanks in advance!TL;DRDoes anyone got a clue as to what the IC<>MCU communication might be seen in the captured data, or would someone be able to find a Datasheet for the IC?

author: RoGeorge
author_rank: Super Contributor
timestamp: August 19, 2023, 05:59:51 am
content: I don't know the device, but since you said 2.4GHz without mentioning the FCC-ID, here's some generic steps that might help:- 1. First, you should search if there are alternative applications that can do what you need, someone might have reverse engineered the same device already.- 2. If not, start from the user manual. Even the briefest leaflet might give valuable hints about the device.- 3. If the device has RF, most probably it will have an FCC-ID printed on it, and specified in the product manual/specs, too. Search online for the FCC-ID number, and you should find more clues in the pdf testing reports, RF band, pics of the opened device, block schematic, sometimes you'll even get a complete schematic.- 4. Then, search online for videos with disassembled/dismantled devices of the same model, or at least the same family. Even the very simple operating/unboxing videos can give good clues about unknown devices.- 5. Get any existing software for the device, either PC and/or mobile platforms, if there is any application for it.From there, either try to dissasemble the official software, or try to sniff the data with a SDR, depending on weather you are more software or hardware inclined.From my experience, even a partial reverse engineer is a very rewarding process if you like hacking, often with a lot of new things to learn. However, it is not unusual to fail (rather the norm), so never set any expectations too high.In terms of commercial value, most of the time it doesn't worth reverse engineering. Most often it would be faster and easier to use the same hardware, and rewrite the software/firmware to do what you need. There are usually free libraries and free software examples for the most common applications for each chip.

author: gamalot
author_rank: Super Contributor
timestamp: August 19, 2023, 06:58:14 am
content: Try this:https://datasheetspdf.com/pdf-file/1480873/ETC/LT8900SSK/1

author: Kinsi55
author_rank: Newbie
timestamp: August 19, 2023, 03:26:04 pm
content: Quote from: RoGeorge on August 19, 2023, 05:59:51 amYou're expecting a lot from a device ordered on AliexpressIt has 2.4G printed on its case, and has an FCClogoin the manual, but I guess thats just BS because in the accompanying remotes manual, theres none.Quote from: RoGeorge on August 19, 2023, 05:59:51 amThe part of the device I'm trying to hook into is self-contained / embedded. The secondary MCU that handles the communication with this chip runs propriatary 8051 code, theres no way I am able to replicate that / willing to spend the time that I would need to do so.Quote from: RoGeorge on August 19, 2023, 05:59:51 amI'm very well aware of that, most sensical would be just buying a second one to run a second channel. I'm doing this for the learning experience.Quote from: gamalot on August 19, 2023, 06:58:14 amAt first glance, the pinout of that seems to make sense from what I'm able to see, and it would confirm my theory of it being SPI. Thank you so much! If you'd like to share, how'd you stumble upon this?

author: gamalot
author_rank: Super Contributor
timestamp: August 19, 2023, 03:42:29 pm
content: Quote from: Kinsi55 on August 19, 2023, 03:26:04 pmI searched on Taobao with the keyword "SSOP16 无线", and then I saw this: