Just for some analysis with SDR and for fun I bought a wireless door bell, a Silvercrest model Z31370B. This is a low power 433 MHz device (LPD433).

 

SDR Sharp
Quickly after starting up SDR Sharp, tune-in to the 433 MHz band, and pressing the button of my door bell, I had the following visual and audible (AF-stream) result.

 

Analysis
Audacity is an audio editor. With this tool we can visualise the IQ-stream, also recorded with SDR Sharp (Baseband). In the following picture we see a part of the IQ-stream which in total has a duration of 2 seconds.

We already recognize a pattern in here. We see a lot of parts send after each other with some space in between.

If we look a bit closer then we see that one part is about 35 msec long:

After zooming in we notice that there are long and short pulses. Hmmm…, I think that a long pulse represents a binary 1 and a short pulse represents a binary 0. So lets give this a go….

And after giving every pulse a value (‘0’ or ‘1’) we see a bit pattern of in total 57 bits for one part.

And this results in the following bit pattern:

10100011 01011010 01110111 00110011 00100111 01000111 10100001 1

And as all parts in the IQ-stream are the same, we notice that this pattern is send 17 times within the total burst which had a period of 2 seconds.

 

rtl_433
Running rtl_433 in analyze mode gives me the following


*** signal_start = 6211550, signal_end = 6744531
signal_len = 532981, pulses = 3192
Iteration 1. t: 76 min: 32 (473) max: 120 (527) delta 181
Iteration 2. t: 76 min: 32 (473) max: 120 (527) delta 0
Pulse coding: Short pulse length 32 - Long pulse length 120

Short distance: 29, long distance: 128, packet distance: 338

p_limit: 76

[00] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[01] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[02] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[03] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[04] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[05] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[06] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[07] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[08] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[09] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[10] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[11] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[12] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[13] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[14] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[15] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[16] {57} a3 5a 77 33 27 47 a1 80 : 10100011 01011010 01110111 00110011 00100111 01000111 10100001 10000000
[17] {31} a3 5a 77 32 : 10100011 01011010 01110111 00110010

The wireless button of the door bell is always sending 17 times the same 8 bytes.

---

Continue Reading...