Nothing to see here ... - Tag - 433MHzA blog about hacking, programming, astronomy, and other unrelated stuff2022-05-09T07:27:03+02:00Jean-Christophe Ronaurn:md5:4aca13830534db85deafa89a62b675acDotclearSomfy and Blyss protocols added to rf-ctrlurn:md5:d6c9a5a81ecf1a3fa2de4220ce5c5c612016-11-09T19:01:00+01:002022-04-24T22:35:51+02:00JCHacking433MHzBlyssHome AutomationHome-RFrf-ctrlSomfy<p><a href="http://blog.rona.fr/public/Somfy-Blyss.jpg"><img src="http://blog.rona.fr/public/.Somfy-Blyss_m.jpg" alt="Somfy-Blyss.jpg" style="display:table; margin:0 auto;" title="Somfy-Blyss.jpg, nov. 2016" /></a></p>
<p>The <strong><a href="https://github.com/jcrona/rf-ctrl">rf-ctrl</a></strong> tool is now able to control plugs and rolling shutter controllers from the well known Somfy and Blyss brands. Regarding Somfy, only the 433,42 MHz RTS protocol is supported, but devices based on it are still widely available. Of course, most 433 MHz transmitters work at 433,92 MHz, which is obviously off compared to the 433,42 MHz used by Somfy. However, it works well enough, even if the range is a little bit smaller compared to what you could get with a proper 433,42 MHz transmitter.</p> <p>To control a Somfy device with <strong>rf-ctrl</strong>, you must pair <strong>rf-ctrl</strong> with your device first ! To do so, you need to put your device in association mode (long press on the device's button most of the time), choose the remote ID (0-255) and the device ID (1024-16777215) to use for this device (and stick to them), then send a <em><strong>Prog</strong></em> command. The device should acknowledge the reception of the pairing request somehow (a led blinking for instance).<br />
Now you should be able to control this device using the device and remote IDs you chose.</p>
<p>For instance, to send an association request:<br />
<code># rf-ctrl -p somfy -r 0xC0 -d 0x042420 -c prog</code></p>
<p>Then to control the device:<br />
<code># rf-ctrl -p somfy -r 0xC0 -d 0x042420 -c on</code></p>
<p>If you have any issue during the association, make sure that:</p>
<ul>
<li>the device ID you are using is higher than 1024</li>
<li>the device has not reach the maximum number allowed of associated remotes</li>
</ul>
<p>To reset completely the device and be sure it will accept an association request, hold its button for at least 10 seconds (around 3 seconds starts the association procedure, while around 10 seconds will reset the device).
<br />
<br /></p>
<p><strong>rf-ctrl</strong> also gains the ability to control plugs from the Blyss brand. These plugs are easy to find, at least in France. In order to use a Blyss device, you also need to associate <strong>rf-ctrl</strong> with it. To do so, put your device in association mode (long press on the device's button most of the time), choose the remote ID (0-1048575) and the device ID (0-16) to use for this device (and stick to them), then send an "<strong>ON</strong>" command. The device should acknowledge the reception of the pairing request somehow (a led blinking for instance).<br />
Now you should be able to control this device using the device and remote IDs you chose.
<br />
<br /></p>
<p>The <strong><a href="https://github.com/jcrona/ook-gpio">ook-gpio</a></strong> driver has been updated to support the new RAW bit format needed by the Somfy protocol, and since <strong><a href="https://github.com/jcrona/home-rf">Home-RF</a></strong> is just a Web UI on top of <strong>rf-ctrl</strong>, it is compatible with these new protocols as well ! All these projects can be found on <a href="https://github.com/jcrona">my GitHub</a>.</p>
<p>If you want to create a little gateway capable of controlling all these devices, among other things, check out <a href="http://blog.rona.fr/post/2016/10/22/Home-automation-with-cheap-433MHz-plugs-a-1%24-433MHz-transmitter-and-a-TP-Link-TL-WR703N-router">my previous post</a>.</p>Home automation with cheap 433MHz plugs, a 1$ 433MHz transmitter, and a TP-Link TL-WR703N routerurn:md5:d5552678975863c9c0154d94f49a00782016-10-22T17:42:00+02:002022-04-24T22:36:21+02:00JCHacking433MHzHome AutomationHome-RFrf-ctrlTPLINKWR703N<p>Two years ago, I started playing around with cheap 433MHz plugs that can be found almost everywhere. At that time, I got several from different brands, from the well known Chacon Di-O plugs, to the most obscure chinese/no-name ones, and my goal was to reverse engineer as much protocols as possible. I compiled the result into a little tool I called <strong>rf-ctrl</strong> (now available on <a href="https://github.com/jcrona/rf-ctrl">my GitHub</a>), and forgot about it.
However, this summer, I needed to find a solution to remotely control my electric heaters (not because I was cold obviously, but because I had the time to do it), and thought it was time to dig up <strong>rf-ctrl</strong> with a bit of polishing (a Web UI called <strong>Home-RF</strong>).</p>
<a href="http://blog.rona.fr/public/Blue-RF4.jpg"><img style="display:block; margin:0 auto; max-width: 100%; height: auto; width: auto\9" src="http://blog.rona.fr/public/Blue-RF4.jpg" alt="Blue-RF4.jpg" title="Blue-RF4.jpg, oct. 2016"></a>
<p><br /></p>
<h2>ON/OFF Keying (OOK)</h2>
<p>Let's first talk about OOK a little bit. Most of the cheap 433MHz plugs (but also chimes, rolling shutter controllers, thermometers ...) use the ON/OFF Keying or OOK modulation. The idea is that data are sent in binary form, by alternatively enabling and disabling the transmitter, thus the carrier frequency. I found mainly two ways of doing so:</p>
<ul>
<li>coding a 0 with an ON/OFF transition that has particular ON and OFF durations, and coding a 1 with another ON/OFF transition that has other particular ON and OFF durations</li>
</ul>
<p>Most of the plugs I found use this scheme, and this is the kind of modulation that <strong>rf-ctrl</strong> implements.
This technique, which could be seen as some kind of Manchester code, allows the receiver to easily recover the clock and sync, since the carrier frequency cannot be enabled or disabled longer than a particular amount of time. The timings for a 0 are often inverted compared to those of a 1, for instance, <strong>160µs-ON/420µs-OFF</strong> represents a <strong>0</strong> with the OTAX protocol, while <strong>420µs-ON/160µs-OFF</strong> represents a <strong>1</strong>. However, this is not systematic, and some protocols use totally different timings, for instance <strong>260µs-ON/260µs-OFF</strong> for a <strong>0</strong> and <strong>260µs-ON/1300µs-OFF</strong> for a <strong>1</strong> with the Di-O protocol.
The data part of the frame is sometimes encapsulated between a starting marker and an ending marker. These markers are also represented with an ON/OFF transition, but with different timings. The whole frame is then repeated a specific number of times, with a delay between the frames that can also be assimilated to either a starting marker without ON state, or an ending one with a long OFF state. Last thing to note is the transition order which is often ON/OFF, but can be OFF/ON as well.</p>
<ul>
<li>coding a 0 by disabling the carrier frequency for a time Tb, and coding a 1 by enabling it for the same time Tb</li>
</ul>
<p>This is actually the “real” low-level way of doing OOK things. You can even describe the previous one that way by choosing a bit-rate (1/Tb) high enough to represent the previous ON/OFF transitions by a succession of ones and zeros that will match the timings. This kind of coding is rather found in high-end devices, like old car keys and more secure plugs/rolling shutters. It was not compatible with the <a href="http://www.elro.eu/en/products/cat/home-automation/home-easy-next/transmitters2/pc-remote-control-usb-dongle">HE853 dongle</a> I had at that time, and thus is not supported by <strong>rf-ctrl</strong>. However I played with it at a point in order to control the rolling shutters and plugs from the Somfy brand, and to test TI's CC110x transceiver, but that's not the purpose of this post.
<br />
<br /></p>
<h2>Reversing the protocol of a 433MHz plug</h2>
<p>To replicate a protocol, one must understand two things. The OOK timings (physical characteristics) is the first one and the easiest, while the actual data format of the frame will be the second one.
<br />
<br /></p>
<h3>OOK timings</h3>
<p>The easiest way to capture a frame is to use a <a href="https://www.aliexpress.com/item/HOT-1Lot-1-pair-2pcs-RF-wireless-receiver-module-transmitter-module-Ordinary-super-regeneration-315-433MHZ/32267862145.html">1$ 433MHz (433,92Mhz actually) receiver</a> connected to either an oscilloscope or a digital analyzer. You will get something like this (Sumtech protocol):</p>
<a href="http://blog.rona.fr/public/OOK_da.png"><img style="display:block; margin:0 auto; max-width: 100%; height: auto; width: auto\9" src="http://blog.rona.fr/public/OOK_da.png" alt="OOK_da.png" title="OOK_da.png, oct. 2016"></a>
<p>But if you do not have this kind of receiver but have an oscilloscope laying around, you can also use a simple wire of around 17 cm (= 3x10<sup>8/(4x433x10</sup>6) = lambda/4) connected to one of the inputs ! You will get something like this, which is enough to understand the underlaying timings (Idk protocol this time):</p>
<p><a href="http://blog.rona.fr/public/OOK_scope.jpg"><img src="http://blog.rona.fr/public/.OOK_scope_m.jpg" alt="OOK_scope.jpg" style="display:table; margin:0 auto;" title="OOK_scope.jpg, oct. 2016" /></a></p>
<p>Thanks to this, you can measure the expected timings and the number of times the frame needs to be repeated. It's time to start writing down zeros and ones on a sheet of paper.
<br />
<br /></p>
<h3>Frame format</h3>
<p>Now, what remains is the actual data to send. Most of the time, a frame consists of a remote ID which is the ID of the remote that sends the frame, a device ID which is just the number of the button pressed on the remote, an action, like ON or OFF, which is most likely 1 or 0, some kind of checksum, and some fixed values. In some cases there are additional values that change every time a button is pressed. They are called rolling codes, and are found in brands like Somfy. This kind of codes are often harder to reverse, but the cheap plugs do not use that ;-). Finally, some protocols add a simple obfuscation layer on top of the frame, like a XOR for instance.
<br />
To understand a protocol, the best method remains to gather as much frames as possible, while writing down what generated them.
The first step is to determine if two frames generated by pushing the same button are indeed the same. It will most likely be the case, but if not, you need to find out which part of the frame changes. It can be a simple counter, or something more clever. Remember that if there is some kind of encryption/obfuscation, the whole frame can change because of a simple counter. Anyway, you need to scratch your head and find the solution by comparing as much frames as possible.
<br />
Assuming all frames generated by one button are the same, the next thing to do is to change one parameter at a time, and look at the result to identify the different fields. For instance, press the ON and OFF button of the same plug number, on the same remote, and compare the resulting frames. Only a small part of it should change, part that you can now identify as the action field.
<br />
Then press the ON button for another plug, and compare to the ON button for the first plug. Check that 1) the action field remains the same, 2) something else changed. This something else is probably the device ID.
You can then try to open the remote, and look for some kind of multi-switch or jumpers. You will not necessarily find something in all remotes since some will have their ID stored in an Eeprom or something like that, but if you do find something, try to change it and check the generated frames. This will most likely help to find the remote ID.
<br />
If you see a part of the frame that seems to change only when something else changes, then you might just have identified a checksum. Try to find how these bits can be computed from the other ones. It can be a for instance a simple sum, or a XOR.
Repeat the procedure until you are convinced that all those fields behave as assumed.
<br />
Now, keep in mind this is just a generic description of a 433MHz device. Some will not fit the mold and might have, for instance, more or less fields. The frame format can even be completely different.
<br />
<br />
Once the frame format understood, it's time to test ! For this you will need a 433MHz transmitter. I first used this <a href="http://www.elro.eu/en/products/cat/home-automation/home-easy-next/transmitters2/pc-remote-control-usb-dongle">HE853 USB dongle</a>, which works fine with a regular PC, but I found out it was easier to just use <a href="https://www.aliexpress.com/item/HOT-1Lot-1-pair-2pcs-RF-wireless-receiver-module-transmitter-module-Ordinary-super-regeneration-315-433MHZ/32267862145.html">this 1$ transmitter</a> connected to a Raspberry PI, a TP-Link TL-WR703N router, or any device that offers GPIOs. And this is where <strong>rf-ctrl</strong> comes in handy. It uses a back-end/front-end (transmitter driver/protocol driver) logic allowing to implement new protocols easily.
Here is how to do so:</p>
<ul>
<li>copy an existing protocol like <strong>auchan.c</strong> as <strong><my_protocol>.c</strong> and add it to the Makefile by appending <strong><my_protocol>.o</strong> to the <strong><code>OBJECTS</code></strong> variable</li>
<li>fill in the <strong><code>timing_config</code></strong> structure with the values you measured (values are expected in µs)</li>
<li>implement the <strong><code>int (*format<sub>cmd)(uint8</sub>t *data, size<sub>t data</sub>len, uint32<sub>t remote</sub>code, uint32<sub>t device</sub>code, rf<sub>command</sub>t command);</code></strong> function which is supposed to generate the final frame in the pre-allocated <strong><code>*data</code></strong> array of <strong><code>data_len</code></strong> bytes from the remote ID, the device ID and the command.</li>
<li>fill in the <strong><code>rf<sub>protocol</sub>driver</code></strong> structure with a short and long name for the protocol, the pointer to the <strong><code>format_cmd()</code></strong> function and to the <strong><code>timing_config</code></strong> structure, the max allowed remote and device IDs, and the actual parameters this protocol needs (most likely <strong><code>PARAM<sub>REMOTE</sub>ID | PARAM<sub>DEVICE</sub>ID | PARAM_COMMAND</code></strong>)</li>
<li>add your new protocol to the <strong><code>struct rf<sub>protocol</sub>driver *(protocol_drivers<a href="http://blog.rona.fr/post/2016/10/22/"></a>)</code></strong> list in <strong>rf-ctrl.c</strong></li>
</ul>
<p>That's all ! You should be able to build <strong>rf-ctrl</strong> and control your plug with it. If it does not work, do not hesitate to check the generated signal with your oscilloscope or digital analyzer.
<br />
<br /></p>
<h2>Controlling my electric heaters remotely</h2>
<p>Let's get back to the main topic. To control my heaters, I thought I would buy plugs from one of the brands I already reversed, and went to buy the "auchan" ones. Unfortunately, they were still selling 433MHz plugs under the same name, but the underlaying supplier had clearly changed. I decided to buy three of them anyway, but knew I would have to reverse yet another protocol, with the risk it might have used some kind of rolling codes... Hopefully, it did not, and was pretty straightforward to understand. For your information it's the protocol I called "auchan2".
<br />
Now regarding the actual setup, I used the well known <a href="https://wiki.openwrt.org/toh/tp-link/tl-wr703n">TP-Link TL-WR703N router</a> running <a href="https://openwrt.org/">OpenWrt</a> and a 1$ 433MHz transmitter (<a href="https://www.aliexpress.com/item/HOT-1Lot-1-pair-2pcs-RF-wireless-receiver-module-transmitter-module-Ordinary-super-regeneration-315-433MHZ/32267862145.html">again, like this one</a>) connected, through a 2V -> 5V level shifter, to the GPIO 7 of the router. I wrote the needed Makefile to build <strong>rf-ctrl</strong> as an OpenWrt package, and also created a kernel driver that generates the proper OOK signal on GPIO 7 once fed with the correct timings and data. This driver, called <strong>ook-gpio</strong>, is directly provided as an OpenWrt package on <a href="https://github.com/jcrona/ook-gpio">my GitHub</a>. Since the WR703N does not have much free space, I chose to build a special firmware for it with everything in it, removing what was useless.
Once the firmware flashed, I verified that I was indeed able to control my heaters. But to do that remotely, I had to connect trough SSH and use my command line tool, which looked like something that could have been improved. So I made a little Web UI called <strong>Home-RF</strong>, which is a little shell script that allows to control <strong>rf-ctrl</strong> by generating a web page with configurable presets. It looks like this:</p>
<div align="center" >
<p><a href="http://blog.rona.fr/public/Home-RF2.png"><img src="http://blog.rona.fr/public/.Home-RF2_m.png" alt="Home-RF2.png" title="Home-RF2.png, oct. 2016" /></a>
<a href="http://blog.rona.fr/public/Home-RF3.png"><img src="http://blog.rona.fr/public/.Home-RF3_m.png" alt="Home-RF3.png" title="Home-RF3.png, oct. 2016" /></a></p>
</div>
<p>The idea is that you can add presets for devices like plugs, rolling shutters or chimes, and they will be displayed like a remote. As a bonus, It also supports WakeOnLan compatible computers (using <strong>etherwake</strong>). There is a simple preset editor included in the interface, as well as an advanced panel that allows to manually control <strong>rf-ctrl</strong> or <strong>etherwake</strong>. <strong>Home-RF</strong> will be nicely displayed on a PC, as well as on mobile phones. It is available <a href="https://github.com/jcrona/home-rf">here on my GitHub</a>, and can be built as an OpenWrt package.
<br />
At that point, I rebuilt a firmware with <strong>Home-RF</strong> inside, and flashed it. I'm using a VPN at home, so I do not care about authentication directly in <strong>Home-RF</strong>. However, if you plan to use it remotely, do not forget to add some kind of access control on top of it (htaccess, SSH, VPN...) ! I will explain later how to use the basic authentication system of <strong>uhttpd</strong>.
<br />
<br /></p>
<h2>How-to do the same</h2>
<p>In order to build your own RF gateway, you will need:</p>
<ul>
<li>a TP-Link TL-WR703N router that you can find <a href="https://www.aliexpress.com/item/Portable-Mini-TP-LINK-150Mbps-USB-Wireless-3G-Router-WR703N-Wi-Fi-Router-For-Travel-Outdoor/32671694971.html">here</a> for instance</li>
<li>a 5V 433MHz transmitter like <a href="https://www.aliexpress.com/item/HOT-1Lot-1-pair-2pcs-RF-wireless-receiver-module-transmitter-module-Ordinary-super-regeneration-315-433MHZ/32267862145.html">this one</a></li>
<li>an N-MOSFET in enhancement mode with a threshold voltage smaller than 2V for the level shifter (I used <a href="https://cdn.sparkfun.com/datasheets/BreakoutBoards/BSS138.pdf">this BSS138</a>)</li>
<li>one 10k Ohm resistor</li>
<li>a 17,3cm long wire for the antenna</li>
<li>a 3 pins female connector with 2.54mm pitch (optional)</li>
<li>a piece of prototyping PCB</li>
<li>some wire</li>
<li>some <a href="https://en.wikipedia.org/wiki/Kapton">Kapton</a></li>
</ul>
<p>The provided instructions assume you are working on a PC running Linux.
<br />
<br /></p>
<h3>First, the hardware</h3>
<p>The schematic for the level shifter is the following:</p>
<p><a href="http://blog.rona.fr/public/2V_to_5V_LS.png"><img src="http://blog.rona.fr/public/.2V_to_5V_LS_m.png" alt="2V_to_5V_LS.png" style="display:table; margin:0 auto;" title="2V_to_5V_LS.png, oct. 2016" /></a></p>
<p>- Solder the MOSFET and the resistor to match the schematic above
<br />
- Use one pad of the PCB as Ground, and solder three wires on Output, +5V Transmitter, and GND Transmitter
<br />
- Either solder the 3 pins connector to the other end of the wires, or solder the RF transmitter directly (remove the male pins of the transmitter if any)
<br />
- Open the WR703N router, and look for the four signals below:</p>
<ul>
<li>Gnd is on a little pad, top side of the PCB</li>
<li>GPIO 7 is on R15, top side of the PCB</li>
<li>+2V is on C47 (or TP2V0), bottom side of the PCB</li>
<li>+5V is on R113, bottom side of the PCB</li>
</ul>
<div align="center" >
<p><a href="http://blog.rona.fr/public/WR703N_bottom.jpg"><img src="http://blog.rona.fr/public/.WR703N_bottom_m.jpg" alt="WR703N_bottom.jpg" title="WR703N_bottom.jpg, oct. 2016" /></a>
<a href="http://blog.rona.fr/public/WR703N_top.jpg"><img src="http://blog.rona.fr/public/.WR703N_top_m.jpg" alt="WR703N_top.jpg" title="WR703N_top.jpg, oct. 2016" /></a></p>
</div>
<p>- Solder one end of four wires on these signals, and the other end to the level shifter previously made</p>
<p><a href="http://blog.rona.fr/public/WR703N_module.jpg"><img src="http://blog.rona.fr/public/.WR703N_module_m.jpg" alt="WR703N_module.jpg" style="display:table; margin:0 auto;" title="WR703N_module.jpg, oct. 2016" /></a></p>
<p>- Solder the 17,3 cm long wire to the antenna pad of the transmitter and put Kapton everywhere to prevent any short-circuit (I tried without antenna at first, that's why it is missing on my picture)</p>
<p><a href="http://blog.rona.fr/public/WR703N_module2.jpg"><img src="http://blog.rona.fr/public/.WR703N_module2_m.jpg" alt="WR703N_module2.jpg" style="display:table; margin:0 auto;" title="WR703N_module2.jpg, oct. 2016" /></a></p>
<p>- Put the board back in its casing, use its <strong>reset</strong> hole to get the antenna out of it (you will have to bend the antenna to do so, so make sure it does not push the reset button), and close it</p>
<p>You should get something like this:</p>
<p><a href="http://blog.rona.fr/public/WR703N_antenna.jpg"><img src="http://blog.rona.fr/public/.WR703N_antenna_m.jpg" alt="WR703N_antenna.jpg" style="display:table; margin:0 auto;" title="WR703N_antenna.jpg, oct. 2016" /></a>
<br />
<br /></p>
<h3>Now, the software</h3>
<p>I attached a prebuilt Barrier Breaker (14.07) OpenWrt firmware with all the tools in it, but it is funnier to build it yourself:</p>
<p>- Create your root folder for the build, for instance <strong>my-gateway</strong>:</p>
<p><code>$ mkdir my-gateway</code></p>
<p>- Go to that folder, and checkout a Barrier Breaker OpenWrt tree (I did not try Chaos Calmer, so let me know if it works):</p>
<p><code>$ cd my-gateway</code>
<br />
<code>$ git clone -b barrier_breaker git://github.com/openwrt/openwrt.git</code></p>
<p>- Checkout <strong>rf-ctrl v0.5</strong>, <strong>Home-RF v0.6</strong> and <strong>ook-gpio v0.2</strong> (these versions are known to work, but feel free to test more recent ones):</p>
<p><code>$ git clone -b "v0.5" https://github.com/jcrona/rf-ctrl.git</code>
<br />
<code>$ git clone -b "v0.6" https://github.com/jcrona/home-rf.git</code>
<br />
<code>$ git clone -b "v0.2" https://github.com/jcrona/ook-gpio.git</code></p>
<p>- Create the packages folders in OpenWrt:</p>
<p><code>$ mkdir -p openwrt/package/utils/home-rf/files</code>
<br />
<code>$ mkdir -p openwrt/package/utils/rf-ctrl/src</code>
<br />
<code>$ mkdir -p openwrt/package/kernel/ook-gpio</code></p>
<p>- Copy the packages content:</p>
<p><code>$ cp -a home-rf/www openwrt/package/utils/home-rf/files/</code>
<br />
<code>$ cp home-rf/OpenWrt/Makefile openwrt/package/utils/home-rf/</code>
<br />
<code>$ cp rf-ctrl/* openwrt/package/utils/rf-ctrl/src/</code>
<br />
<code>$ cp rf-ctrl/OpenWrt/Makefile openwrt/package/utils/rf-ctrl/</code>
<br />
<code>$ cp -a ook-gpio/* openwrt/package/kernel/ook-gpio/</code></p>
<p>- Update external feeds in OpenWrt and add <strong>etherwake</strong> to the build system:</p>
<p><code>$ cd openwrt</code>
<br />
<code>$ ./scripts/feeds update -a</code>
<br />
<code>$ ./scripts/feeds install etherwake</code></p>
<p>- Download the attached <strong><a href="http://blog.rona.fr/public/home-rf_openwrt.config">home-rf_openwrt.config</a></strong> into the <strong>my-gateway</strong> folder, and use it:</p>
<p><code>$ cp ../home-rf_openwrt.config .config</code>
<br />
<code>$ make oldconfig</code></p>
<p>- Build the OpenWrt firmware</p>
<p><code>$ make</code></p>
<p>- You should have your firmware ready in <strong>my-gateway/openwrt/bin/ar71xx/</strong>.
<br />
<br />
If you have any issue buidling the <strong>mac80211</strong> package, it might be because the build system failed to clone the <strong>linux-firmware</strong> Git. In that case, download the <strong>linux-firmware-2014-06-04-7f388b4885cf64d6b7833612052d20d4197af96f.tar.bz2</strong> archive from <a href="https://github.com/jslink/openwrt-trunk-dl/blob/master/linux-firmware-2014-06-04-7f388b4885cf64d6b7833612052d20d4197af96f.tar.bz2">here</a>, copy it into the <strong>my-gateway/openwrt/dl/</strong> folder, and restart the build.</p>
<p>Now, you need to flash your WR703N router. If you never flashed OpenWrt before on your router, use <strong>openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-factory.bin</strong> as explained <a href="https://wiki.xinchejian.com/wiki/Install_OpenWRT_on_TPlink_WR703N">here</a>. Otherwise, use <strong>openwrt-ar71xx-generic-tl-wr703n-v1-squashfs-sysupgrade.bin</strong> with the <a href="https://wiki.openwrt.org/doc/howto/generic.sysupgrade#sysupgrade_sshterminal_upgrade_procedure">sysupgrade</a> tool.
<br />
<br /></p>
<h3>Final touch</h3>
<p>At that point, you should have your router up and running. You still need to configure it like a regular OpenWrt router, as explained <a href="https://wiki.openwrt.org/doc/howto/firstlogin">here</a>. You can, for instance, configure it in WiFi station mode, so that you can find the best place to reach all your 433MHz devices.
<br />
Once properly configured, open a browser and go to <strong>http://<your<sub>router</sub>ip>/home-rf</strong>. If everything went well, you will get the <strong>Home-RF</strong> interface ready to be configured !</p>
<p>If you want to add basic authentication to Home-RF, open an SSH connection to the router, and run the following commands on it (replace <strong><em>username</em></strong> and <strong><em>password</em></strong> by the username and password of your choice):</p>
<p><code># echo "/cgi-bin/home-rf:<strong><em>username</em></strong>:$(uhttpd -m <strong><em>password</em></strong>)" >> /etc/httpd.conf</code>
<br />
<code># /etc/init.d/uhttpd restart</code>
<br />
<br /></p>
<h2>Final words</h2>
<p>So now I'm able to control my electric heaters from my phone for around 20$, and I hope you will be able to do the same with your own 433MHz devices. All the discussed tools are available on my <a href="https://github.com/jcrona">GitHub</a>. I will be happy to extend the list of supported protocols in <strong>rf-ctrl</strong>, so feel free to add more.
<br />
If you want to play around, try the "scan" mode of <strong>rf-ctrl</strong> ! It allows to send all possible frames within a range of given remote IDs, device IDs, and protocols.
<br />
<br />
That's all for now !</p>