Broadlink IR RawData Format

mr_burns42 · December 31, 2018, 4:29pm

I have followed the earlier Forum entries that have some great info. They really helped me get started. For anyone reading this, the link below has the forum with lots of insight.

My TV is a Westinghouse. I have the original remote and also a universal remote. It appears that they use a Sony code format. (The universal remote uses programming code of 11300, but I cannot cross reference that to the appropriate Sony format) I can capture the keys with Broadlink Manager, However, those learned codes do not directly correlate to the Pronto Hex codes that I see on other websites. If I could convert a few of these RawData to Pronto Hex codes then I could download the appropriate Sony codes and have the entire list without having to learn every key.

Looking at the RawData from Broadlink Manager, it appears that the code is repeated four times with a separate header and trailer. I can isolate the repeated pattern, but I cannot decode it because I don’t know what the RawData numbers mean.

Does anyone have any insight as to the format of the RawData?

Thanks.

mr_burns42 · January 1, 2019, 3:11pm

The website below gave me the key to decoding the RawData.

github.com

mjg59/python-broadlink/blob/master/protocol.md

Broadlink RM2 network protocol
==============================

Encryption
----------

Packets include AES-based encryption in CBC mode. The initial key is 0x09, 0x76, 0x28, 0x34, 0x3f, 0xe9, 0x9e, 0x23, 0x76, 0x5c, 0x15, 0x13, 0xac, 0xcf, 0x8b, 0x02. The IV is 0x56, 0x2e, 0x17, 0x99, 0x6d, 0x09, 0x3d, 0x28, 0xdd, 0xb3, 0xba, 0x69, 0x5a, 0x2e, 0x6f, 0x58.

Checksum
--------

Construct the packet and set checksum bytes to zero. Add each byte to the starting value of 0xbeaf, wrapping after 0xffff.

New device setup
----------------

To setup a new Broadlink device while in AP Mode a 136 byte packet needs to be sent to the device as follows:

| Offset  | Contents |
|---------|----------|

This file has been truncated. show original

In the RawData from Broadlink Manager, the 0,1,2 and 3 are not shown. It start with byte 4 of the website above, which is always 0x26 for IR. Starting at byte 8, the even numbered bytes represent the ON time of the IR carrier. The odd numbered bytes represent the OFF time of the IR carrier. This hold true as long as neither ON or OFF time is larger than 1 byte or 7.7mS. If it is longer than that, then three bytes are used, a leading 0x00 and then two bytes holding the time for the ON or OFF.
In my Sony compatible case, the OFF time between bytes is about 25mS. This gets lumped into the OFF time of the MSB bit, so when decoding, if you do not take this into account, you will get framing errors in your data.
For Sony, it is easy. The OFF time is fixed. For a ‘0’ bit, the ON time is roughly the same as this fixed OFF time. For a ‘1’ bit, the ON time is roughly twice as long as this fixed OFF time.
When capturing with the Broadlink Manager, hold the button down for a second or two to get a decent number of repeats. Most protocols have dead time between repeats, so you can see these in the data by the 0x00 that precede the large time delays. That allows you to snip the data from between the repeats and decode it manually.

Emphyrio · January 4, 2019, 7:28am

Thanks for letting us know. I don’t think I could have thought of that. Home Assistant is a time consuming hobby isn’t it?