Video Tutorial: Using Universal Radio Hacker, an RTL-SDR and a Microcontroller to Clone 433 MHz Remotes

Over on YouTube user hubmartin has uploaded a video showing how to use an RTL-SDR and the Universal Radio Hacker (URH) software to reverse engineer and clone a 433 MHz remote control. URH is used to extract the signal timing and modulation characteristics as well as the binary/hex code.

Then in order to clone the signal hubmartin uses a cheap IoT microcontroller with button and 433 MHz transmitter attachments. Some C code is then used to program the microcontroller and 433 MHz transmitter with the extracted signal information and to transmit on a press of the button. In his example hubmartin uses his cloned dongle to control a wireless power plug and a motorized projector screen.

Universal Radio Hacker SDR Tutorial on 433 MHz radio plugs

Tweet
Share138
Reddit
Vote
Email
138 Shares

Related posts:

  1. Tutorial on Performing a Replay Attack with a HackRF and Universal Radio Hacker
  2. Cloning A Garage Key with RTL-SDR, Universal Radio Hacker and an Arduino
  3. Reverse Engineering Signals with the Universal Radio Hacker Software
  4. Hacking a La Crosse Weather Station with an RTL-SDR, PlutoSDR and Universal Radio Hacker
  5. Video Tutorial on Receiving ISS Astronaut Amateur Radio Conversations with RTL-SDR
Subscribe
Notify of
guest

1 Comment
Inline Feedbacks
View all comments
Steve
#237799

Good morning, This is a great informative video and I have the exact same remote / socket set which I would like to clone for use in my smart home. Before I came across your video I bought a Sonoff Rf 433 bridge and flashed it with Tasmota and Portisch firmware to achieve the same goal, but so far I have had no luck! I am able to reliably sniff the traffic with Rfraw 177 but unable to get a response from the devices when I convert the codes from B1 > B0 and retransmit them. I can get a very consistent results learning the codes from your method with URH but the codes are in a very different format and I wondered if there is any way to send these to the RF Bridge via MQTT with just the data and pulse length parametes as used with your library?

1
Reply