reverse-engineer a RF remote using software-defined radio
I have a device that allows a remote controller to turn on or off any device I have connected to it, and in my case, a clock. For this project, I reverse-engineered the signal that my RF remote sends using RTL-SDR, GQRX, Arduino, and a 315 MHz transmitter.
The first thing I did was look at the FCC ID on my remote: PAGTR-009N and search that online at FCC.io. After looking at the data sheets and reports, I found that the remote transmits at 315 MHz using Amplitude Shift-Keying (ASK) modulation. This helped me understand what frequency to look at when using my software-defined radio.
The next step was to use my RTL-SDR and GQRX to visually inspect the signal being transmitted by my RF remote. By looking at the waterfall display, I assured myself that this remote was indeed using ASK modulation at 315 MHz.
After confirming that the signal was transmitting at 315 MHz, I used RTL_FM to record the signal as a .wav file. Then I opened the .wav file in Audacity, where I inspected the signal to see how to re-engineer and re-transmit the signal myself.
When zooming in at the signal I noticed that each tiny chunk where the signal looks like its "turned on" can be interpreted as a "1". Each of these little segments was about 190 microseconds long. Knowing this, I can begin to reconstruct the signal as a sequence of 1s and 0s, which are going to tell the transmitter for how long to turn on and off.
After reinterpreting the signal, the next step is to transmit. I bought a 315 MHz transmitter from SparkFun that uses ASK modulation and used the code I wrote to transmit the re-interpreted signal, which does turn on my clock, just like the remote.