Decode frequency for controller Naterial DC1600

[gruchasdz]

How to decode the frequency of the roller blind remote control Naterial DC1600? I have information that it works in the range of 433.05 - 434.79 MHz, but unfortunately it doesn't find any frames. Is it possible to set the listening to the declared range?

[gdt]

I would suggest using gqrx, and setting to whatever part of that range you can, and watching the waterfall while you push buttons. Perhaps try 433.92 first as that is the usual place. You will need to understand how sample rate and center frequency lead to coverage. For 250 kHz sample rate, set center to 433.15 and that will cover 433.05 to 433.25 well and sort of cover another 25 kHz above and below.

You can also do this with -S unknown using rtl_433, but I suspect that's harder for searching for the frequency.

If you don't find comments in the sources about Naterial, then there's no real reason to expect it to be decoded. But it might, if it's the same as something else that is decoded, just relabeled.

[AkaBoing]

looks like Dooya DC1600 RF433
asin B0DBVM593B
also seen at Kaufland # DC1600 1 channel Up/Down, Frequency: 434,79 MHz +/- 100 KHz (mistake ??)
GQRX with 433.85 or 434.8M should find the EV1527 based PWM switch.

reinsert the CR2430 cell before.

a neighbor has a similar device (DC1600)
a good cu is zipped..
DC1600.zip

a possible decoder should handle this codes for UP/DOWN/STOP, but what is what ?
{34}dbbaf390c
{34}dbbaf092c
{34}dbbaf193c
next step is invert..

not really "ev1527", so perhaps a CHS and a unknown flag is added. (or is it rolling code ?)
we need some more cus (zipped) with info about UP/DOWN/STOP

[AkaBoing]

got 2 fresh messages from my neighbors device
one is {34}dbbaf092c
the other {34}dbbaf193c
DC1600-2.zip

Christian: could need some help.
its not the usual 24/25 bit ev1527 message, some bits to shift?, invert ? im stuck here.

gruchasdz:
do you need any help with capturing a few messages from your device?
try rtl_433 -f 433.85M -s 1024k -g 6 -M level -S unknown
then ZIP the cus and post it here..
i have only one in my neighborhood, so we need your help..

[zuckschwerdt]

Yes, -X 'n=name,m=OOK_PWM,s=270,l=800,r=1200' is the right (PWM 270/800 µs) decoding.
It's these codes so far, right?

{34}dbbaf390c
{34}dbbaf193c
{34}dbbaf092c

Could be ID, data, checksum then. Is is really just up/down and then one broken code?

[gruchasdz]

Hello guys,

Thanks a lot for your help, I managed to get samples for each signal via rtl_433 -f 433.85M -s 1024k -g 6 -M level -S unknown

samples.zip

I do not know how to obtain the codes for each signal. (UP/DOWN/STOP)

[zuckschwerdt]

These codes reliably seem to be longer and only differ in the last byte:

g001_433.85M_1024k.cu8:
{40}5bea1dfae1
g002_433.85M_1024k.cu8:
{40}5bea1dfaee
{40}5bea1dfae1
g003_433.85M_1024k.cu8:
{40}5bea1dfaaa
g004_433.85M_1024k.cu8:
{40}5bea1dfacc
{40}5bea1dfac3
g005_433.85M_1024k.cu8:
{40}5bea1dfac3

[AkaBoing]

thx for the codes.
and oops.. none of them make sense to me.
g002 comes near {40}5bea1dfaee
are you sure, its a DC1600 device ?
if Christian has no brilliant idea .. sorry but no clue..
im studying all of them.. dont give up..

two more codes please.. one for "UP" button and one for "DOWN" button.
rename the CU g001..cu8 >UP...cu8
g002... cu8 > DOWN....cu8

is there a "STOP" button or maybe a "Pairing" button then please also a code for this.
thx for your help.

[AkaBoing]

my false flag -R156 decoder for this:
now i need more input..

one live with g002:

look at the code change {40}5bea1dfaee > {40}5bea1dfae1
this is m.b a button status change..
and no CHS at all !

the decoder: , feel free to change and test whatever u want.
Naterial_DC1600.zip

edit:
the Pairing button is inside the battery case called P2
please capture this by pressing it 2 times for 1secs
see PDF

DC1600.pdf