Light remote control (Leroy Merlin GDANSK / Shining)

Hardware
1

Hello,

Does anyone know how to intercept RF Code 2.4GHz for this light.
It’s a 2.4GHz remote. It is dimmable and I can change the color temp from cold to warm.
The power supply that integrate the receiver is a shinlight electronic.
It’s a CCT dimmable.
I have tried MiLightv1 protocol without success.

Does anyone know how to control this kind of light ?

Thanks.

1200×550 32.5 KB

=> EXTRA SLIM SURFACE MOUTED PANEL LIGHT - Shining

=> https://www.leroymerlin.fr/produits/decoration-eclairage/luminaire-interieur/plafonnier/panneau-led-gdansk-ip20-l-120-x-30-cm-cct-dimmable-82857170.html

2

I’m back to this model. If someone have an idea of the protocol used

The remote is really simple.

FCC ID : 2ANO4-25W2R4G
Remote : RG12KW1

Operating Frequency: 2450
Type of Modulation: GFSK
Number of Channels: 1
Channel Separation: None
Antenna Type: Onboard radio frequency antenna
Antenna Gain: 0 dBi
Power Supply: 3Vdc

https://fccid.io/2ANO4-25W2R4G/Test-Report/2ANO4-25W2R4G-170830008GZU-003-Report-2-4G-3650762.pdf

3650716-0
3650716-0631×1025 54.1 KB

3

I have looked a the PSU. The chip is a CS-MRF-MS02
https://detail.1688.com/offer/621315479611.html?spm=a261b.2187593.0.0.7d8b119dfC7Mdq

It’s provide by ColaSmart. It seems they provide lot a device over 2.4Ghz too

1 Like
4

I am interested in this aswell

5

I have not found a solution on my side. I can’t find what protocol is used for this kind of devices :confused:

6

The FCC website gives some additional information: https://fccid.io/2ANO4-25W2R4G

7

I have already found this on FCC, but it still don’t know if it used a know protocol that we can intercept / reproduce with a NRF24L01 or CC2500 for example.

It doesn’t seems to be Bluetooth.
So it might be something like Milight / LivingColor /Ansulata protocol like. I don’t know if there is some other.

8

There might be a possibility with the RFLink (on 2.4 GHz band) : https://www.rflink.nl/

I will try to see what kind of signal gets out of the microcontroller (before the RF stage) using an oscilloscope.

9

I have not this electronic knowledge, but I have the rflink and spare NRF24L01 and CC2500.
I have not detected any signal.
But I cannot confirm my wiring is OK for 2.4ghz as I have not other device on this frequency on my RFLink.

10

this kind a remote seems to control GDANSK on Spanish site :

https://www.leroymerlin.es/productos/iluminacion/iluminacion-interior/paneles-led/mando-a-distancia-gdansk-19300442.html

11

Seems similar to : https://www.aliexpress.com/item/32343232531.html?spm=a2g0o.productlist.main.5.5c24ao3Wao3W5F&algo_pvid=a1464a95-6b96-4855-820b-ee1857874981&algo_exp_id=a1464a95-6b96-4855-820b-ee1857874981-2&pdp_ext_f={"sku_id"%3A"12000026289343105"}&pdp_npi=3%40dis!USD!57.0!25.65!!!!!%402100baf316774190397817734d071a!12000026289343105!sea!FR!810130419&curPageLogUid=n1WxnaAr4fJ3

Don’t know if it help to find the protocol

12

A frame I captured :

image

Bitrate seems to be around 33 kbps. (don’t mind the date on my oscilloscope :slight_smile: )

I have several Gdansk LED lamps, one remote control works only with one LED lamp, so there must be some sort of unique ID per remote/ LED lamp pair.

13

Are you sure , I was thinking one remote can be paired on many light.
Power on light and push A, B or C in the first 3 sec, then remote must be paired to the light.

14

Nice, I didn’t know they were programmable.

Does it mean communication has to be bidirectional between remote and lamp ?

15

Is it similar to. Project | Reverse-Engineering the milight on-air protocol | Hackaday.io ?

16

Not sure, I assume it’s in register mode. If it received x time the same frame at boot, it save the remote id or something like that. like basic 433Mhz remote

17

Nice infos !

18

I have been playing with remote control programming according to the user manual to try to understand the system.

Setup :

  • L1 : one LED lamp
  • R1 : remote control paired from factory
  • R2 : remote from another LED lamp

Convention :

  • R1-A means key A of remote control R1
  • R2-B means key B of remote control R2
  • etc.

Observations :

  • Pairing L1 with R1-B : L1 cannot be controlled anymore with R1-A.
  • Pairing L1 with R1-A : L1 cannot be controlled anymore with R1-B (back to initial setup).
  • Pairing L1 with R2-B : L1 cannot be controlled anymore with R1-A.
  • Pairing L1 with R1-A : L1 cannot be controlled anymore with R2-B (back to initial setup).

Next steps :
It makes me believe that communication is unidirectional. My next steps will be to capture more oscilloscope traces to try to understand the frame format.

I believe an intermediate common remote control solution would be use one original remote control together with an ESP8266 or ESP32 to generate the correct IDs for each lamp to be controlled.

The ESP8266 o ESP32 could drive the RF stage in place of the logic stage in the electronic board.

Example illustration (proper wire remains to be identified) :

image
image1240×423 62.4 KB

1 Like
19

I think we can replace the RF block once your a re able to replace the logic block with an ESP.
RF Specification of the remote seems handle by NRF24L01 or CC2500.

20

Doing some (tiny) progress : I have been making an approach by the other end, ie. the RF signal itself.

All my Gdansk remote controllers emit on 2.407 GHz (Channel 7 on nRF24L01 ?), this has been observed with HackRF One device :

image
image838×1205 416 KB

Now I am trying to get familiar with GNU Radio to have a closer look at the RF signal and try to demodulate it (GFSK).

2023-04-02 : added baseband signal :

image
image2958×531 158 KB

It looks like there are two frequencies (FSK), now I have to transform this into bits.
I have found the signal on 2.427 GHz as well, a little stronger and “cleaner”.

1 Like