Talk about how to connect proprietary devices to your network understanding protocols with low-cost tools.

1. OSHUG #15
Hacking Commodity Wireless
Paul Tanner
@paul_tanner
slideshare.net/paul_tanner

2. Background
● Why make what you
can buy?
● Proprietary tech but
with benefits
● Very limited doc
● Not easy without
sophisticated tools
● Let's mess around

3. Approach
● Observe the protocol
● Increase the doc
● Deduce the protocol
● Code and test
● Transmitter (easy)
● Receiver (hard)
● Iterate (potentially for
ever :)

4. Nah! El-cheapo version
● Some of these
devices use 433Mhz
signalling
● In which case use
audio recording
● PC or Mac + software
e.g. Audacity
● Otherwise start
saving up

5. RF-to-audio etc
● Ard. shield makes for
convenient mounting
● Receiver has digital
output and no
embedded protocol
● Transmitter likewise
● Alternatives available
● Could add switches to
power down when not
in use.

6. Some Results
Somewhat inconsistent snapshots but you get the idea

7. Get Measurements
● Simple program can
capture pulse widths
● Inevitably there's
noise – shield?
● Triggering needed for
infrequent
transmissions
● Then add decoder

8. Magic happens here
● Look for clues e.g
Blogs etc
● Expect e.g.
Manchester encoding
● Expect redundancy,
e.g. checksums
● Hope for inspiration
● Test and iterate

9. Conclusion
● It can be done
● Most successful with
output devices
● Very hard with
devices that send
infrequently
● Online help limited
but does exist