in arduino, programming, tutorial

How to hack any IR remote controller

Share Button

If you haven’t heard of Air Swimmers before, you probably had a miserable life. Air Swimmers are inflatable foil balloons made in the shape of fish. But what makes them really awesome is the fact that they can be remotely controlled to fly around in a room. One of my friends, Claudio, developed an obsession interest for them; and that’s when we decided to create our own hackuarium.

The idea was simple: buying a bunch of Air Swimmers, hacking into their controllers and running a swarm simulation to control them. If you’re interested in doing the same and you have a basic knowledge of electronics …you’re reading the right post. At the end of this article you can find the links to buy all the necessary components.

How it works…

The first step is to understand how the remote controller works. Every controller has an IR sensor and it usually works with a proprietary protocol. We wanted to use a modular approach which enables us to set up new fish with little to no work. For that reason, we decided to sniff the IR packets sent by the remote controller, so that we could then replay them at will.ir sniffer (1)

This technique is often referred as sniffing, since the device we’ll build will detects IR messages which were not originally directed to it. This particular approach works perfectly with the majority of IR remotes and devices, since there is no actual processing involved. Every time you push a button on the remote, you’re sending the same message; the receiver ignores where the message comes from and just executes it.

Step 1: Building the IR receiver

ir2_bb2

The circuit above uses a an Arduino Uno board connected to an IR receiver (in black). There are several types of IR receivers; for this tutorial is important to use a digital receiver (like the TSOP4838) and not an IR photocell . A digital receiver is sensitive to 38KHz IR signals; if it detects one, it’ll output a low voltage (0 volt), or a high one (5 volt) otherwise. A photocell, instead, acts like a variable resistor and its voltage output linearly mirrors the amount of IR light is has been exposed to. Remotes typically work on digital signals and that’s why we’ll a digital receiver.

The schematics show that I also used an IR emitter. It’s important to couple it with the right resistors; too high and it won’t turn on, too low and it will burn. IR diodes typically requires 180 Ohm resistors. Double check on your datasheets to be sure!

To decode the digital signals that the IR receiver will produce, we’ve been using a library called Arduino-IRremote, which comes with several demos and examples. Once you’ve installed the library, you can test your setup with this code.

The pin referred in line 3 must match the one you have used for your IR receiver. Line 14 decodes the raw data stored into results, either from irrecv.enableIRn() or irrecv.resume().  Once started, the program should display data when exposed to the light or a remote controller.

Step 2: Sniffing the code

So far, the setup is already able to sniff packets. irrecv.decode, in fact, shows these packets in a Human-readable format,  But if we need to re-send them, the actual raw data has to be extracted and converted in a format which is compatible with irsend. The following code, inspired by this one, converts the inputs read from the receiver into a list of integer, separated by commas.

If working correctly, it should now display something like this:

Step 3: Sending the signal back

The numbers printed are the exact values that need to be sent to irsend.sendRaw. The only thing you’ll have to do is to store them into an array.

Air Swimmers have several controls: left, right, dive up and dive down. You have to sniff all of these inputs and save them into different arrays.

It is interesting to notice that some remote controllers are sending the same code, over and over again for a certain period of time. Errors in IR signals are very common, so that might be a technique to ensure that at least one of them reaches the target. If that’s an intended behaviour you want to replicate, you can use the following code.

Line 6 is the one which actually sends the code. irsend is configured to use the pin 3.

What went wrong…

The IR sniffer works amazingly well. Adding a new Air Swimmer to the swarm is relatively easy, but it need to manually detect and configure the IR messages for each signal. We wrote a web interface to monitor and control the fish remotely, and that works as well. The only problem we experienced is the fact that Air Swimmers are incredibly challenging to control. When they are in  big space, they’re really impressive. But in a small room the precision you get is too low to have a real swarm simulation. Moving them randomly doesn’t seem different at all. The real issue with them is that they’re very sensitive to air flows and temperature changes. They can suddenly move making virtually impossible to know their position without an external monitoring system. Helium naturally leaks, so after twelve hours you need to fill the balloon again. Oh, and one of the Air Swimmers exploded. I mean, it literally exploded.

Conclusion

This post explained how to hack an unknown remote controller by sniffing its IR packets. For the vast majority of applications, there is no need to understand the protocol used; messages are often independent and have no protection or timestamp. This is perfect to control a TV, a garage door or (like we did) a bunch or Air Swimmers.

The components

Providing that you already have an Arduino, this project can be done with less than $10. If you want to experiment with IR remotes, I advise you to get these 5 pairs Infrared Diode LED IR Emission and Receiver, which comes with all that you need. Alternatively, you can get the TSOP4838 which are qualitatively better. Resistors are incredibly cheap: I have used 180 Ohm ones for this tutorial.


Other resources

📧 Stay updated

A new tutorial is released every week.

💖 Support this blog

This websites exists thanks to the contribution of patrons on Patreon. If you think these posts have either helped or inspired you, please consider supporting this blog.

Paypal
Ko-fi
Twitter_logo

Write a Comment

Comment

  1. I would to implement your code to an IR-repeater. Novice as I am, can’t get it right without error messagees. I know basic Arduino coding, but that’s all.
    My question How do I put these 3 sketches all together, so that it records and plays back in a loop ?

    • Hey!

      That’s not so trivial. Mostly because I created a first Arduino sketch to “sniff” the packets used by the remote. And then another sketch that controls the actual target.

      I’d start just by making a sketch that sniff the packets. The sketch in “Step 2” should work almost straight away. Alternatively you can start from one of the examples provided in the library and see how it works.

      Unfortunately is very hard to help on this without seeing the code directly!

  2. Hey Alan, nice work tho. My question is that when i decode my AC remote controller, i always get a raw data as:
    —————–
    DATA: 0x28 0xC6 0x0 0x8 0x8 0x3F 0x10 0xC 0x5 0x20 0x40 0x0 0x0 0x0 0x54
    DATA: 40 198 0 8 8 63 16 12 5 32 64 0 0 0 84
    —————————————————————————-
    Now, i wanna send the codes to the AC with the help of IR sender. Which of these data will i use in my arduino code? Thanks

  3. Hi Alan,

    Sniffing code works properly. However for sending the recorded data frame how do you implement your “sendCmd( )” function?

    Thank you in advance!

Webmentions

  • Build an infra-red remote control sniffer with Arduino | Electronics Infoline July 12, 2018

    whether ir receiver can replaced with phototransistor

  • Everything You Need to Know About LEDs - Alan Zucconi July 12, 2018

    whether ir receiver can replaced with phototransistor

  • How to build a distance sensor with Arduino - Alan Zucconi July 12, 2018

    whether ir receiver can replaced with phototransistor