Crane Remotes


Fomotech Alpha 500

Potentially defective!

Parameter Data
Source eBay
Modulation Narrow Band FM
Frequency CH 416 -> 433.9500MHz
ID 38 -> 01000001
Hamming Distance 6
Manual Source or Local Copy

Sniff

Alpha Sniff

The raw file is here

Electronics

  • Controller: PIC16LF72

Pictures

Front Back
Alpha Front Alpha Back

And the PCB

PCB Back PCB Front
Alpha PCB Back Alpha PCB Front

F21-E1B TX

Parameter Data
Source Amazon
Frequency 319.925MHz
Modulation FSK / NBFM
Address 32Bit
Hamming Distance >=4

Sniff

F21 RF Sniff

The raw file is here

Decoding

Scrolling through the sniff shows a certain pattern 1010101010101010 which seems pretty promising when analyzing sniffs by simply using the split function:

Sniff 1

1 occurence of

10101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001100

16 occurences of

1100110010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001100

1 occurence of

11001100101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110011001010

Sniff 2

1 occurence of

10101001010101101010011001101010011010100110101001100110101010100101011001010110011010100110101001011010100101100110011010101010100110100101011010011001100101010101011001011010100110011001100110011001100110010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001010101011001010110011001010101010110101010010101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011001100110010101010110010101100110010101010101101010100101010110101010010101100110010101100101011001010110011001010101011010100110101001100101011001010110100101011010011001100101010101011001011010100110011001100110011001100110011001100101010101100101011001100101010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001100

16 occurences of

1100110010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110010110101001100110011001100110011001100110011001100

1 occurence of

1100110010101011010101001010101101010100101011001100101011001010110010101100110010101010110101001101010011001010110010101101001010110100110011001010101010110

When comparing the first blocks with eachother and adding a 0 to the second block, which can validly be added to the data from preamble on quickly finds the next parallel:

10101011010101001010110011001010110010101100101011001100101010101101010011010100110010101100101011010010101101001100110010101010101100101101010011001100110011001100110011
01010100101010110101001100110101001101010011010100110011010101010010101100101011001101010011010100101101010010110011001101010101010011010010101101001100110010101010101100

The beginnings are exactly the same, just inverted, which might well be part of integrity checking.

Electronics

  • Main Controller: MSP430F1101A
  • Radio Head: TDK5101F
    • ASKDTA is connected to GND
Pin MSP430
1 1 TEST
2 2 VCC
3 7 !RST
4 10 TA0
5 14 TA0
6 4 GND

Pictures

Front Back
F21 Front F21 Back

The PCB looks as follows

PCB Bottom PCB Top
F21 PCB Bottom F21 PCB Top

The Receiver

Receiver Front Receiver PCB Receiver RF
F21 Receiver Front F21 Receiver PCB F21 Receiver RF

Cattron TH-EC/40

Parameter Data
Source eBay
Frequency 170.730MHz
Address 10772
Modulation FM with PPM
Hammingdistance d>=6

Sniff

On TH-EC/40 On Left Joystick Full Forward TH-EC/40 L Forward Right Joystick Full Forward TH-EC/40 R Forward Light Button TH-EC/40 Light

Pictures

Remote

Top Front Side
TH-EC/40 Remote Top TH-EC/40 Remote Front TH-EC/40 Remote Side

The remote has a small plug on the button, which sets the address for the remote. It was sealed with a blobb of hotglue, behind which was hidden a small label with the address number. Carefully looking into the plug shows a circuit board. Due to not wanting to break it at this point, I didn’t open it any further.

Address Plug Label Chip
TH-EC/40 Address Plug TH-EC/40 Address Label TH-EC/40 Address Chip

Inside

TH-EC/40 Inside

Receiver

Power All Relais
TH-EC/40 Receiver TH-EC/40 Receiver TH-EC/40 Receiver

nbb NANO

Parameter Data
Source eBay
Frequency 433.475MHz
Modulation FSK following
Security Individual pair of addresses in a 16Bit range
Manual Manual or Local Copy

Audio Recording

Being AFSK, here the audio recording

nbb nano Audacity

ITU-T V.23 describes Mode 2 AFSK as using 1300Hz and 2100Hz as symbols and 1700Hz as center frequency, which looks very similar to Audacity’s spectrum analysis. nbb nano Audacity Spectrum It has peaks at 2079Hz, 1780Hz and, well, one snaller one at 1310Hz. The first two are close enough and I guess the latter just shows that the symbols aren’t transmitted very balanced.

Electronics

  • Receiver: ST10F168-Q3

Pictures

Remote

Top Back Side
nbb Top nbb Back nbb Side

Inside, sadly most of it is hidden behind shielding.

Top View Side View
nbb PCB Top nbb PCB Side

Receiver

Top Inside
nbb Receiver Top nbb Receiver Inside
Component Picture
RF Board nbb Receiver RF Board
Relais Board nbb Receiver Relais Board
Power Board nbb Receiver Relais Board