How to hack into the TV remote control and understand the IR code

admin · September 12, 2016 at 8:07 am

Posted by: admin Category: Network Comments: 3 Post Date: December 11, 2011

How to hack into the TV remote control and understand the IR code

What you will need all is the IR receiver and sender, you can find it here.

The Receiver should connect like this,

Pin 1 is the output so we wire this to a visible LED and resistor
Pin 2 is ground
Pin 3 is VCC, connect to 5V

And now you can start to test it with a normal LED and 4 AA battery.

IR remote signals

Now we know that the sensor works, we want to figure out whats being sent right? But before we do that let’s first examine exactly how data is being sent from the IR remote (in your hand) to the IR receiving sensor (on the breadboard).

For this example we will use the Sony power on/off IR code from a Sony TV remote. Its very simple and commonly documented!

Lets pretend we have a Sony remote, and we can look at exactly what light is being blasted out of the IR LED. We’ll hookup a basic light sensor (like a basic photocell!) and listen in. We won’t use a decoder like a PNA4602 (just yet) because we want to see the undecoded signal. What we see is the following:

Basically we see pulses or IR signal. the yellow ‘blocks’ are when the IR LED is transmitting and when there is only a line, the IR LED is off. (Note that the voltage being at 3VDC is just because of the way I hooked up the sensor, if I had swapped the pullup for a pulldown it would be at ground.)

The first ‘block’ is about 2.5ms long

(see the cursors and the measurement on the side)

If you zoom into one of those blocks…

You see that they’re not really ‘blocks’ but actually very fast pulses!

If you zoom in all the way…

You can measure the frequency of the IR pulses. As you can tell by the cursors and the measurements on the side, the frequency is about 37.04KHz

OK so now we can understand how IR codes are sent. The IR transmitter LED is quickly pulsed (PWM – pulse width modulated) at a high frequency of 38KHz and then that PWM is likewise pulsed on and off much slower, at times that are about 1-3 ms long.

Why not have the LED just on and off? Why have PWM ‘carrier’ pulsing? Many reasons!

One reason is that this lets the LED cool off. IR LEDs can take up to 1 Amp (1000 milliamps!) of current. Most LEDs only take 20mA or so. This means IR LEDs are designed for high-power blasting BUT they can only take it for a few microseconds. By PWM’ing it, you let the LED cool off half the time

Another reason is that the TV will only listen to certain frequencies of PWM. So a Sony remote at 37KHz wont be able to work with a JVC DVD player that only wants say 50KHz.

Finally, the most important reason is that by pulsing a carrier wave, you reduce the affects of ambient lighting. The TV only looks for changes in light levels that clock in around 37KHz. Just like its easier for us to tell differences between audio tones than to pin down the precsise pitch of a tone (well, for most people at least)

OK so now we know the carrier frequency. Its 37KHz. Next lets find the pulse widths!

Reading out IR codes from an Arduino

The good news is that it is very easy to hook up this sensor. Just connect the output to a digital pin. The bad news is that the Arduino’s friendly digitalRead() procedure is a tad too slow to reliably read the fast signal as its coming in. Thus we use the hardware pin reading function directly from pin D2, thats what the line IRpin_PIN & (1 « IRpin)does.

And now put the code into arduino, you can download it from here.

https://github.com/adafruit/Raw-IR-decoder-for-Arduino

// you can also use codes from https://github.com/shirriff/Arduino-IRremote , the IRrecvdump could detect the IR code as well

Point your remote to the IR receiver, and just click the button once, and you will see the following display:

You have to ingore the first one as useless, and start with the second one, for example, my IR can modify like this with a pair:

19828 usec, // this is the useless one that you can ignore

7860 usec // and this is the IR pulse which goes higher and lower for 7860 microsecond certain time
3940 usec, // and this is the delay, the IR pulse will start again

500 usec // IR pluse
480 usec, // delay

500 usec
480 usec,

500 usec
1460 usec,

540 usec
460 usec,

480 usec
480 usec,

500 usec
480 usec,

520 usec
1440 usec,

520 usec
1460 usec,

480 usec
3940 usec,

520 usec
1440 usec,

520 usec
480 usec,

500 usec
1460 usec,

500 usec
480 usec,

480 usec // last one IR pulse

Send signal to your TV

now let’s wire the anode side of IR LED to digital pin 13, and cathode side of LED to GND.

First let’s take a look at following code:

[c]// This sketch will send out a Nikon D50 trigger signal (probably works with most Nikons)
// See the full tutorial at http://www.ladyada.net/learn/sensors/ir.html
// this code is public domain, please enjoy!

int IRledPin = 13; // LED connected to digital pin 13

// The setup() method runs once, when the sketch starts

void setup() {
// initialize the IR digital pin as an output:
pinMode(IRledPin, OUTPUT);

Serial.begin(9600);
}

void loop()
{
Serial.println("Sending IR signal");

SendNikonCode();

delay(60*1000); // wait one minute (60 seconds * 1000 milliseconds)
}

// This procedure sends a 38KHz pulse to the IRledPin
// for a certain # of microseconds. We’ll use this whenever we need to send codes
void pulseIR(long microsecs) {
// we’ll count down from the number of microseconds we are told to wait

cli(); // this turns off any background interrupts

while (microsecs > 0) {
// 38 kHz is about 13 microseconds high and 13 microseconds low
digitalWrite(IRledPin, HIGH); // this takes about 3 microseconds to happen
delayMicroseconds(10); // hang out for 10 microseconds
digitalWrite(IRledPin, LOW); // this also takes about 3 microseconds
delayMicroseconds(10); // hang out for 10 microseconds

// so 26 microseconds altogether
microsecs -= 26;
}

sei(); // this turns them back on
}

void SendNikonCode() {
// This is the code for my particular Nikon, for others use the tutorial
// to ‘grab’ the proper code from the remote

pulseIR(2080);
delayMicroseconds(27);
pulseIR(440);
delayMicroseconds(1500);
pulseIR(460);
delayMicroseconds(3440);
pulseIR(480);

delay(65); // wait 65 milliseconds before sending it again

pulseIR(2000);
delayMicroseconds(27);
pulseIR(440);
delayMicroseconds(1500);
pulseIR(460);
delayMicroseconds(3440);
pulseIR(480);
}
[/c]

In the above codes, void pulseIR go higher and lower for certain time, for example 7860 microseconds. now we can put all the timing we get from serial montior into pulseIR() and delaymicroseconds(); for example, it should be like:

[c]
pulseIR(7860);
delayMicroseconds(3940);

pulseIR(500);
delayMicroseconds(480);

pulseIR(500);
delayMicroseconds(3440);
….
pulseIR(500);
delayMicroseconds(480);

pulseIR(500);
delayMicroseconds(480);

pulseIR(580);
[/c]

Do all the timing in the codes and put them into arduino finally, now you can control your TV by arduino!

How to hack into the TV remote control and understand the IR code