I found an old Kambrook Wireless Outlet set, which consisted of 3 wireless outlet and a wireless 433mhz remote, and wanted to 'automate' my room.
While I could have tried to reverse engineered the wireless protocol, I decided that since I am not likely to use more than 5 wireless outlet at this stage, I could simply just interface directly with the buttons itself (and ignore the channel selectors). If I was going to do the entire house, I would get a proper x10 system (or a centrally wired system if renovating)
This is not a full on tutorial, rather it is a general outline/guideline so you could have an easier time approaching similar projects. Code will be included in last page.
That being said, to do this, you are recommended to have access to these parts:
An arduino (or a microcontroller of your choice with UART)
A supply of resistors (for pulling down the mosfet)
A supply of N-Channel Mosfet 2N700
Lots of thin wires (preferably a AWG30 wire)
Note: I was lucky that I could power the remote using 5v (even though it said it required 12v). Depending on your model, you may or may not be able to do this.
Step 1: Modifications
Before you do anything. You need to first work out how to power it. I simply hooked mine straight to the USB power supply, this is since the little surface mount "transistor" near the battery terminal is actually a 5v regulator (possibly only used by the onboard microcontroller). The 433mhz transmitter on the top of the PCB seems happy with 5v for me, but yours may not like it. Just do what you need to do (e.g. get a powersupply brick that supplies the voltage), or step it up with a joule theft, boost converter, etc...
Next you need to identify the trigger mechanism. I was hoping that each button trace corresponds to a GPIO pin on the onboard remote microcontroller. If it was the case, then my life would be very easy, I can simply tap the traces directly to the arduino and pull the voltage up or down.
However if you follow the trace in this remote, you see that the interface works via 'matrix scanning', much like how your keyboard works. This means you can get smaller and cheaper microcontrollers, but have more buttons than would be possible if you had addressed each buttons individually.
I then tried to work out where each trace connects too, but was too lazy to work it out. I also tried to inspect the marking of the IC, but for some reason... there is no markings on it... (not hacker friendly!)
I studied other people's similar attempt, which often consist of using optical isolators, or relays, which I considered to be too bulky. I also tried using BJTs since I have plenty lying around (and they are dirt cheap), however it didn't work, since it is likely that the remote's microcontroller doesn't detect via current, but rather by voltage differences.
Luckly I have some 2N7000 N-Channel mosfets, which proved to be handy (and as a bonus also has 'current isolation' on the gate side). By working working out which side is the 'higher voltage' rail and the 'lower voltage' rail in respect to each buttons, I places the Drain of the 2N7000 towards the 'higher voltage' side and the Source pin to the 'Lower voltage' side.
The gate pin if left floating may swing randomly between conduct/nonconductance , you are recommended to put a pulldown resistor towards the each gates of the 2N7000 to keep the mosfet on the off state. If you don't, then you may have erratic behavior occasionally. For me, I decided to forgo it, as I cannot find space to place the resistor in the case (And I still need to solder more 2N7000.
Lastly you connect the N-Channel Mosfet 2N7000's gate to the GPIO pins of the arduino (arduino nano in my case), and make note of which GPIO pin correspond to each button of the remote.