Reverse Engineering: RGB LED Bulb With IR Remote

165,310

218

47

Published

Introduction: Reverse Engineering: RGB LED Bulb With IR Remote

About: I like microcontrollers and LEDs :D

We bought 20 of these RGB LED Light bulbs for a party at work, but I was a little disappointed with the color fading functions they provided. So I decided to take one apart, reverse engineer the IR protocol, and see if it had more functions than those available from the IR remote.


Other instructables related to reverse engineering:
If you find this instructable interesting, you should have a look at this. It also goes more in depth on the tools used in this instructable. 

https://www.instructables.com/id/USB-controlled-home-automation-hack/

Step 1: The Product and Proect Goals

This is a really cheap RGB LED bulb that fits into a regular E27 bulb socket. It has an IR remote that lets you choose between different modes and colors.

I want to use them in the color fade mode, but the color fade in these bulbs suck. For some reason they fade the LEDs to almost white color, which doesn't look that great.

I am hoping to find some hidden modes, or alternative ways of controlling this thing without too much work. 

Step 2: Sniffing the Remote

The first obvious thing to do here is to sniff the IR led on the remote control.

I soldered on some wires to the LED, and put the cover back on, so I could have easy access to the signal while pressing the buttons.

Step 3: IR Carrier Frequency

Now I have access to the data sent by the IR remote, great. However, IR remotes uses a carrier frequency to transmit their binary data. This creates a whole lot of garbage data in the logic analyzer. See the screenshot.

One important thing I can get from the IR remote, is the carrier frequency. I used the frecuency measurement in my oscilloscope to measure this.

Step 4: Getting the LED Bulb Off Mains Power

I want to poke around in the LED bulb itself to sniff the signal from the IR receiver, however, I dont want to probe this cheap china product while it is connected to 230 Volt mains power.

I measured the voltage across GND and VCC, 5 volts.

I hooked some wires up to GND and VCC. I also disconnected the VCC from the bulbs power supply.
Now I'm ready to probe around the bulb without exposing myself and my equipment to mains potential.

Step 5: Sniffing the Bulb

Now that the bulb wasn't running off mains power, but on an isolated power supply, I was able to poke around and find the data pin on the IR receiver.

I soldered a wire to it, poked my debug wires through the heatsink and put the cover back on the led bulb.

The little LED inside was too bright to work on it with the lid off.. luckily the heatsink had little slots in it for the wires to pass through.

As expected, the IR receiver on the LED bulb removes the 38KHz carrier frequency, leaving me with a much cleaner signal to probe.

On the logic analyzer screenshot, you can see both signals, one with and one without the 38KHz carrier frequency.

The signal from the IR receiver is inverse, so GND is high and VCC is low.

Now I am finally ready to get into the interesting sutff; figuring out how this thing communicates.

Step 6: The Wrong Way

I'll share with you a wrong approach that I tried before going into the correct interpretation of the data.

If you look at the second picture, you'll se one packet captured with the logic analyzer.

It starts with a pulse of 9ms, then a pause of 4.5ms, then comes the data bits.

In the voids where there are no data bits, there is room for exactly one data bit. This lead me to believe that this remote just banged out the bits in a regular serial fashion. I expected it to maybe use some sort of variable length pulses to encode each bit, but I didn't see any variable length, so I assumed (incorrectly) that a pulse was a logical 1 and a void was a logical 0.

When doing this sort of thing, I like to capture on of each type of packet, and lay them out in the Gimp (open source photoshop, kinda).

After spending some time analysing the data, it didn't really make any sense, so I figured I was decoding it incorrectly... which turned out to be the case.

Step 7: The Right Way

I googled IR remote protocols and found this document: http://www.vishay.com/docs/80071/dataform.pdf

I immediately recognised the NEC-format with its 9ms initialization pulse and 4.5ms pause followed by data.

The remote did use some sort of pulse length encoding after all..
A logical 0 is sent as a pulse of 560 microseconds, followed by a pause of 560 microseconds. (ca timing values)
A logical 1 is sent as a pulse of 560 microseconds, followed by a pause of 1650 microseconds.

The IR packet consists of a 9ms pulse, a 4.5ms pause, then an address byte and a data byte, and finally a single stop bit.
Each byte is transmitted twice.  Once normal, and once with its bits inverted. So 0b11110000 would be transmitted as 0b11110000 and 0b00001111.

As you can see in the pictures, the address byte is always 0x00. Nothing interesting going on there.

I went back to the gimp and painted the logical 0s with a red dot and the 1s with a green line. Then I typed the bits into a spreadsheet. The data looked a lot like a binary count, only in random order. So I sorted the data by the bit columns starting with MSB.

As you can see, only the 5 most significant bits are used, and also some values in the top 5 bits aren't used, leaving me with a small hope that these bits could trigger some hidden features.

Not exactly as hacking friendly as I hoped it would be, but I'll still give it a shot.

Step 8: Introducing New IR Commands

I wanted to see if the LED bulb would accept any other commands than the 24 commands corresponding to the 24 buttons on the remote.

I wrote an arduino program to send IR commands. I used a timer to generate the 38KHz carrier frequency and some functions to turn the timer on and off.

The program loops through all 256 possible command bytes (0x00 to 0xFF) and sends them as IR remote packets.

Turns out, NONE of the command bytes besides the ones from the remote control does anything :(
Bummer.

On the bright side, I was able to control the LED bulb from the arduino without any problems, But that wasn't exactly what I wanted to do :p

Also, the address byte doesn't do anything either. The bulb just ignores it. Any address i tried seemed to work.

If you want to control one of these led bulbs or any other device that uses the NEC IR protocol, you can modify my code to do so. The arduino code is attached here.

Step 9: Conclusion

This product was very hackable in the sense that I could easily get in there and reverse engineer it.

If what I wanted to do was replace the IR remote that came with the product with an Arduino, I'd call it a raging success. However, I wanted to make the LED bulb do something more or something different.

If you want to have one of these bulbs be computer controlled, you can easily modify my arduino code to make that happen.

Share

    Recommendations

    • Water Contest

      Water Contest
    • Creative Misuse Contest

      Creative Misuse Contest
    • Clocks Contest

      Clocks Contest

    47 Discussions

    0
    user
    Jaap85

    4 months ago

    I bought a couple of these lamps, and they all worked fine. But suddenly, I pressed a wrong button or something, half of the lamps are stuck in one color. I can't get them to work anymore using the remote. I tried disconnecting them from the power, bit the lamps wouldn't reset. The other lamps work fine with the remote, so the remote isn't the problem.

    So I figured: if I could reset the memory on the lamps back to factory settings, it would be perfect. Only problem is: how?

    Any of you have any idea how I can reset the memory of the lamps?

    0
    user
    PetDie

    1 year ago

    So, I'm no beta. Amazed at what you learned from the remote and the bulb. But: looking in the same rack in the shop where the RGB lightbulb is sold, (at 6,50 euro a steal), this caught my attention: A RGB light strip, (14,50 Euro) same source, other remote. With custom buttons! Might even buy this just to find out if it will work on the bulb as well.

    2016-11-06 12.29.25.jpg
    1 reply

    Did you end up buying this? If so, how did it work?

    0
    user
    sfahey

    1 year ago

    Hello All!

    I have one question dealing with these type of multi-colored LED control circuits. I bought 20 of the Crayola Multi-Colored Party Bulbs, which are basically the same thing as what is shown here. My problem is, half of the lights when turned off will keep their last mode setting, but the other half resets every time to a default setting. I open one of each to look at the circuit and even tried to draw it out to find the difference, but I didn't find anything. The LED lights that reset on power down were bought in a 2 pack, vs the single pack that saves it's setting.

    Does anyone know how I could modify the circuit to get the ones that reset to keep their last setting? I have attach a picture of the two circuits. The GREEN circuits are the problem. I've tried search the internet for answers, but to no avail.

    Any help would be appreciated.

    Sean

    20161125_093534.jpg

    There is a rather interesting article on this subject here too

    http://blog.allgaiershops.com/2012/05/10/reversing...

    Problem I have with my remote is that it sends a different code every time i press a certain button, eventhough I seem to have the same remote as you (meaning the cases look the same).
    Even if for instance the transmitter is meant to send a number of codes for different appliances, one would expect some pattern

    Nice intructible. I want to control my RGB strip whit my arduino as well but I do not have an electrical background. So I tried to make it but failed for unknown reasons.

    Can you please tell me what kind of resistor you use for your IR LED? (I can not see it on your picture) I now use a 1K resistor (see image) and an IR LED from an old contoler.

    led.JPG
    2 replies

    I know it has been a year but led me add my 2cents:

    an IR led has a forward voltage from abt 1.5volt, so if fed from 5 volt there is 3.5V left. with a 100 ohm resistor that is a curent of 35mA. As many ir leds can take up to 100mA I feed mine through 30 ohm, via a transistor) 35mA is quite ok. I was wondering if you checked if the LED was actually working. Also, did u connet it to the right pin? I saw both 6 and 7 are ceclared

    Great instructable! I have a few questions though of a process with these bulbs that you may be able to help me with. I'm looking to create/hack the ir so that I can program long series of colors and timing (i.e. blue for 3 seconds, fade to yellow for 10, blink between white and red 40 times.. etc.). In doing this project did you find that you can hijack the bulb system and just send it a programmed set of info (without constantly hitting the remote of course) for preprogrammed color shows? Any thoughts would be great!

    Hi

    I have some crystalite bulbs with a remote but I am looking to control them with a universal remote app on my phone. However Crystalite are not listed on the apps database. Would anyone happen to know what thr IR details are, so I can send them to the app developer?

    Thank you very much for your help

    Many people in north america have a tendency to add unnecessary comment on products made in China as "cheap". The fact is, you will not find cheap low quality products in China, but only in north america, Europe and most other developed countries around the world. This is because the merchants around the world are not willing to pay for good quality products, they just want the lowest possible prices so they can make the most profit for themselves. I travel to China at least twice a year and if you do too, you will notice that everything they used there are build to last and last they do, much longer than products made in other countries. Chinese manufacturers simply made products to fit what foreign merchants are willing to pay for, so as the saying goes - you get what you paid for... Westerners have no one else but themselves to blame for cheap products. Example: The wings of Boeing 767 are made entirely in China. Would you call that cheap too?

    3 replies

    The same wings that have been an unmitigated disaster? They can't even use those wings and have largely abandoned them. Besides, China is like Japan in the 80's, not an original idea in 1.6 billion heads. Everything made there has an American or European design. The only reason anything at all is made there is they will work for $75 a month.

    These LED bulbs are really cheap, and have a low build quality. I have yet to see any RGB LED bulbs in stores here in Norway in the same price/quality range. But hey, I wanted cheap and in bulk, and that's exactly what I got. So I'm happy. You can probably find "better" ones on ebay, but we're going to use these things once a year for a company party, so I couldn't care less about the quality..

    Maxhuey, I like your picture! I think you should get a different hobby though, instead of jumping on a band wagon and beating a drum about on little comment make in the articular about China " witch is the king of inexpensive stuff"! Only saying this because it will make you a biter person, life is to short, there are bigger and more important things you can do with your time and energy!

    Would this be possible to control from a USB connection from a Windows machine? If it could, you could do all sorts of awesome stuff :D (thinking of disco, ambilight, auto turning on lights in morning, auto dimming slowly at night). Congrats, great post!

    1 reply

    Of course, Arduino can accept input through serial. "Processing IDE" will do the job.

    how to control through remote and where is code .pl upload as soon as possible

    Great instructable. While I wait for my bulb to arrive in the mail... Do you have any photos of the power supply in the bulb? Any idea of how much current is provided to the LED, and if it is capable of providing more (not just to the LED, perhaps to another circuit attached to Vcc and GND)?

    Inspired by this information, I wrote a Windows console application and Arduino code to control a Magic Lighting RGB LED bulb from a PC. I use it to display the status of a build server. Code and instructions (check the Wiki) can be found at: https://github.com/robertmoro/MagicLightingRemote

    Thanks for this tutorial, it helped a lot although I ended up using a different code.

    Hoping that this comment will be useful for someone, be aware that in the extended NEC protocol, the address is not always 0x00FF, for example, my lightbulb uses 0x00F7 (0x00F720DF for red).

    It took me a while until i found it out :)