Fomotech Alpha 500
Potentially defective!
Parameter | Data |
---|---|
Source | eBay |
Modulation | Narrow Band FM |
Frequency | CH 416 -> 433.9500MHz |
ID | 38 -> 01000001 |
Hamming Distance | 6 |
Manual | Source or Local Copy |
Sniff
Electronics
- Controller: PIC16LF72
Pictures
Front | Back |
---|---|
And the PCB
PCB Back | PCB Front |
---|---|
F21-E1B TX
Parameter | Data |
---|---|
Source | Amazon |
Frequency | 319.925MHz |
Modulation | FSK / NBFM |
Address | 32Bit |
Hamming Distance | >=4 |
Sniff
Decoding
Scrolling through the sniff shows a certain pattern 1010101010101010
which seems pretty promising when analyzing sniffs by simply using the split function:
Sniff 1
1 occurence of
10101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001100
16 occurences of
1100110010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001100
1 occurence of
11001100101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110011001010
Sniff 2
1 occurence of
10101001010101101010011001101010011010100110101001100110101010100101011001010110011010100110101001011010100101100110011010101010100110100101011010011001100101010101011001011010100110011001100110011001100110010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001100
16 occurences of
1100110010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001100
1 occurence of
1100110010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110
When comparing the first blocks with eachother and adding a 0 to the second block, which can validly be added to the data from preamble on quickly finds the next parallel:
10101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011
01010100101010110101001100110101001101010011010100110011010101010010101100101011001101010011010100101101010010110011001101010101010011010010101101001100110010101010101100
The beginnings are exactly the same, just inverted, which might well be part of integrity checking.
Electronics
- Main Controller: MSP430F1101A
- Radio Head: TDK5101F
- ASKDTA is connected to GND
Header
Pin | MSP430 |
---|---|
1 | 1 TEST |
2 | 2 VCC |
3 | 7 !RST |
4 | 10 TA0 |
5 | 14 TA0 |
6 | 4 GND |
Pictures
Front | Back |
---|---|
The PCB looks as follows
PCB Bottom | PCB Top |
---|---|
The Receiver
Receiver Front | Receiver PCB | Receiver RF |
---|---|---|
Cattron TH-EC/40
Parameter | Data |
---|---|
Source | eBay |
Frequency | 170.730MHz |
Address | 10772 |
Modulation | FM with PPM |
Hammingdistance | d>=6 |
Sniff
On Left Joystick Full Forward Right Joystick Full Forward Light Button
Pictures
Remote
Top | Front | Side |
---|---|---|
The remote has a small plug on the button, which sets the address for the remote. It was sealed with a blobb of hotglue, behind which was hidden a small label with the address number. Carefully looking into the plug shows a circuit board. Due to not wanting to break it at this point, I didn’t open it any further.
Address Plug | Label | Chip |
---|---|---|
Inside
Receiver
Power | All | Relais |
---|---|---|
nbb NANO
Parameter | Data |
---|---|
Source | eBay |
Frequency | 433.475MHz |
Modulation | FSK following |
Security | Individual pair of addresses in a 16Bit range |
Manual | Manual or Local Copy |
Audio Recording
Being AFSK, here the audio recording
ITU-T V.23 describes Mode 2 AFSK as using 1300Hz and 2100Hz as symbols and 1700Hz as center frequency, which looks very similar to Audacity’s spectrum analysis. It has peaks at 2079Hz, 1780Hz and, well, one snaller one at 1310Hz. The first two are close enough and I guess the latter just shows that the symbols aren’t transmitted very balanced.
Electronics
- Receiver: ST10F168-Q3
Pictures
Remote
Top | Back | Side |
---|---|---|
Inside, sadly most of it is hidden behind shielding.
Top View | Side View |
---|---|
Receiver
Top | Inside |
---|---|
Component | Picture |
---|---|
RF Board | |
Relais Board | |
Power Board |