Decoding unkown Serial data wireless alarm

[Ginettag20]

Hello all

I recently indulged in my favorite extreme sport of skip diving (dumpster if outside UK) and surfaced with an alarm system and Just for fun I am  doing a bit of a tear down.

The alarm system is relatively new 2009 vintage made by RISC and is a wisdom model. Its has various features such as phone dialing and voice record and playback features. Its is also designed to connector to various sensors and remote controls using RF.

The RF transceiver is operating in the European license free band 870MHz  and i think is using OOK/ASK encoding.   I can see that it  is transmitting every few seconds and I have used a SDR and spectrum analyses  to have a look.   I was hoping to try and do some decoding via the SDR but to be honest this is beyond my competence for the moment.

I have instead  hooked the scope up to the PIC processor output that is driving the transceiver TX and have captured the serial data.  The PIC is 18F452 and its using pin 10 as the output. Pin 10 is listed as RB2/INT1 but importantly its not connected to the PIC EUART which is on pin 44 and I think may be implementing SPI to some other on board peripheral. I am guessing the designer of the alarm could therefore be bit banging RB2 for transmitting.  Perhaps even rolled their own protocol.

 It looks like the unit transmits a relatively long stream of 0 and 1 then takes a break for quarter of a second then sends what looks like data multiple 1s and 0s etc. I am guessing the long preamble could be to give the peripherals time to wake up or perhaps is for  clock syncing.

It looks to me like the bit  length is 200uS  and I think this gives my a baud of 5000.  I have serial decoding on my scope but how to identify the start and stop bits and packet size and parity etc.  I also have a USB style logic analyser that has serial decoding but again if I dont know what the serial parameter are ?

Just after some general advise on what to do next if anything can be done to try and decode the serial data.   I note there a nice in circuit programming header next to the PIC but they must have enabled CP.

Thanks for any comments and helps - Regards Chris

[floobydust]

This kind of reverse-engineering I've seen with low cost weather station transmitters. Usually ISM band 433MHz ASK/FSK/OOK.

Hackaday reverse-engineering-wireless-weather-stations
TX29 Protocol
reverse-engineer-wireless-temperature-humidity-rain-sensors
Hackaday reverse-engineering-a-wireless-protocol

I believe the long preamble is for the receiver AGC.

[Ginettag20]

Thanks Flooby

That's a good link and I'm getting a very similar preamble. Also just noted that I don't appear to have more than 2 bit times for 1s or 0s so perhaps that could also imply Manchester encoding.