How_I_hacked_my_air_conditioner_controller.pdf

Transcript

1. How I hacked my air conditioner controller Nicholas Meschke
2. Agenda • How Air conditioners work? • What is IR? • Hardware used • IR Packet Reverse Engineering
3. How air conditioners work? • Controller holds the current state • Communication through IR
4. What is IR? • Transmission Protocol • Receiver/Emissor • On/Off µs pulses • IR Packet
5. Hardware used • Arduino Leonardo • IR Receiver
6. IR Packet 6112, 7364, 564, 1632, 672, 1536, 628, 1564, 568, 1628, 564, 1628, 676, 1508, 684, 1536, 564, 1624, 572, 548, 652, 496, 604, 520, 568, 556, 600, 540, 660, 468, 568, 552, 600, 520, 652, 1568, 564, 1624, 568, 1628, 644, 1548, 648, 1564, 564, 1624, 568, 1620, 652, 1568, 628, 492, 600, 524, 564, 552, 656, 492, 568, 552, 568, 552, 680, 468, 568, 556, 596, 520, 680, 468, 564, 1628, 568, 1628, 648, 1544, 648, 1560, 600, 1592, 568, 1620, 652, 1564, 604, 1588, 568, 556, 676, 440, 632, 516, 572, 552, 596, 520, 656, 492, 632, 1560, 600, 520, 680, 1536, 568, 548, 720, 1484, 644, 496, 600, 520, 568, 1624, 632, 492, 676, 1532, 604, 520, 600, 1588, 656, 492, 600, 1588, 572, 1616, 684, 464, 564, 1628, 572, 1624, 632, 1552, 656, 1564, 564, 1624, 568, 552, 660, 1552, 576, 1620, 568, 560, 632, 504, 576, 544, 572, 552, 568, 580, 596, 1592, 568, 552, 572, 576, 632, 488, 568, 1620, 572, 548, 656, 1556, 572, 556, 568, 1620, 656, 488, 568, 556, 568, 1620, 688, 460, 564, 1628, 568, 556, 680, 1512, 620, 520, 568, 1620, 572, 1616, 684, 7296, 572
7. IR Packet Reverse Engineering • Unreadable and unmeaningful • Convert it to hexadecimal • Figure out the packet
8. • Group the reading into pairs • Get the second value of the pair • Apply a threshold (empirical value) • Convert the binary sequence to Hexadecimal 6112 7364 564 1632 548 652 496 604 111111110000000011111111000000000011111111000000101010010101011011111011000001000101010010101011 0xff00ff003fc0a956fb0454ab Converting to Hexadecimal
9. • Set the temperature to 18, read the command • Set the temperature to 19, read the command • Compare both packets Comparing packets and figuring out the packet format 0xff00ff00bf40a956bb4454ab: Setting the temperature to 18 0xff00ff00bf40a9563bc454ab: Setting the temperature to 19 HEADER COMMAND PARAMETER TEMP MODE TEMP CHECKSUM FOOTER ff00ff00 bf40 a956 b b 4 45 4ab ff00ff00 bf40 a956 3 b c 45 4ab
10. Thank you!