Rick's b.log - 2022/08/17
It is the 21st of November 2024 You are 52.14.88.137, pleased to meet you!

Simple remote controller hack

Car radio remote controller.

Sadly, the remote's user interface is every bit the mess as the radio's user interface. There is, for example, no button to pause/play.
Because of this, pretty much the only things I tend to make use of as the Volume Up/Down and the Prev/Next which, when listening to streaming radio using the CustomRadioPlayer app, can be used to switch stations.

From time to time, like when stopping to talk to somebody, it can be useful to hit the Mute button.
Unfortunately this is right next to the answer call (green) button and that, when there is no phone call happening, does something really annoyingly idiotic.
It makes a phone call. To whomever was last called. It doesn't matter if that was the doctor's surgery two weeks ago, if it's the last item in the call log, it'll happily dial it and put the audio through the car radio.
And when you're driving in a noisy car, trying to explain what's going on to a somewhat startled secretary is... not a great thing to do.
(I hung up, pulled over, then called her back to apologise)

So, time for a little hardware hack to sort this out.

Inside the board is pretty much unpopulated. There are two IR LEDs, and one single eight pin chip marked "PRT008A". I guess it's one of those generic Chinese things, as I wasn't able to dig up any info on it.

All handled by one little chip.

The PRT008A is interesting in that by using only five pins, it is able to detect eleven buttons, with four of them by way of being grounded to 0v.

Here is a side by side picture of both sides of the board. Note that the chip side has been flipped in order that the tracks and vias on both sides match up. I have annotated, in red (though a little hard to see) where the tracks going under the chip connect.

Both sides of the board (chip side flipped).

Pointing the phone's camera at the LEDs clearly shows a pulsing pattern when a button is pressed.

IR pulses made visible.

Hooking this up to a scope, we can see a wobbly pattern that is messy and doesn't appear to be sending the same thing each time.

Oscilloscope, 2ms timebase.

The truth is, we need to crank this scope up as fast as it can go in order to see something happen.

Oscilloscope, 10µs timebase.

The trace is 'backwards' because the +v pin of the LEDs is always connected. The signal is sent by switching the 0v pin.
And, as you can see, it's a rather messy signal that swings from about 0.8v (LED off) to just under 2v (LED on).
You can see one of the limitations of a dinky little scope such as this. The controller actually output a lot of data, but it took over half of the storage memory (look at the blue bar in the middle of the top of the screen) simply to detect this transition and respond to it. As such, a complete waveform wasn't captured.

What we can tell by looking at this is that each square across the screen represents 10 microseconds. That's ten millionths of a second.
Peak to peak looks to be mildly more than two and a half squares, so, let's say about 26 microseconds. One million divided by 26 gives us one thirty eigth thousand and four hundred and sixty oneth of a second.
Which, let's face it, is probably actually one thirty eight thousandth of a second (or 26.32 microseconds, but we lack the accuracy to spot the extra third).

In far simpler terms, it's 38kHz which is a very common frequency for infra-red remote signalling.

As for the data itself, the 2ms view showed us having data for around 9ms. 9ms is 9000µs. If we divide 9000 by 26.32, we get "about 340 bits of data".

Now, 340 bits for specifying a device type (so the controller controls the car radio and not a TV, for example) and which of the buttons is pressed, is a bit ridiculous. After all, you could probably manage that fairly well with around 32-64 bits.

But, something we can notice is that all of the waveform is the same. There's no actual data transmission here, just a series of pulses. And if we go back and look at the low quality waveform, we can see there's period of silence for about 2-3ms followed by a much shorter blip.
This should clue us in to the actual protocol in use being a modified version of the NEC code. This uses, indeed, a 9ms burst (intended to "wake up" older slower equipment), followed by what should be a 4.5ms pause but it looks to be closer to 2ms here. And, finally, the actual data being sent. This probably does drop to the same levels as the leader burst, but it modulates with a zero bit being half on and half off (a half pulse is something like 22 cycles at 38kHz) and a one bit being quarter on and three quarters off; so my scope was likely just not sensitive enough to make sense of this.

But, enough of the interesting distraction. Here's the hack. Cheap and easy.

Painfully simple hardware mod. ☺

I could have cut the tracks to disable the buttons, or used some sort of tape. However since the thing is held together tightly, just putting a piece of paper in there will block the action of the buttons and is completely reversible should I ever be in a situation where people actually want to call me.
It could happen. Unlikely, but not impossible. ☺

Bing stupidity

The legislation, directive 2009/136/EC talks about cookies in section 66 of a very lengthy and verbose set of rules.

It says:

(66) Third parties may wish to store information on the equipment of a user, or gain access to information already stored, for a number of purposes, ranging from the legitimate (such as certain types of cookies) to those involving unwarranted intrusion into the private sphere (such as spyware or viruses). It is therefore of paramount importance that users be provided with clear and comprehensive information when engaging in any activity which could result in such storage or gaining of access. The methods of providing information and offering the right to refuse should be as user-friendly as possible. Exceptions to the obligation to provide information and offer the right to refuse should be limited to those situations where the technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user. Where it is technically possible and effective, in accordance with the relevant provisions of Directive 95/46/EC, the user's consent to processing may be expressed by using the appropriate settings of a browser or other application. The enforcement of these requirements should be made more effective by way of enhanced powers granted to the relevant national authorities.

Thus, it seems Bing is simply putting the question to you over and over and over until you yell "eff off" and click the "Let us gleefully be rapacious bastards!" button instead.
Well, that's not what it says. But that is what it means.

Or, in my case, yell "eff off" and close the tab. At least Google only asks you once per private session.

It was also interesting to note the numerous times that Bing froze up on Chrome, but worked perfectly fine with Firefox. Google getting pissy about the competition? ☺

Drain blockage

Once the rain had passed, I took a quick walk around to check everything, and found a big pool of water by the back of the house.
There's a small concrete pipe that goes under the tarmac. The outflow from the kitchen/bathroom/washing machine goes through here, as does the run-off from the gutters. And it's clogged. Leaves, dirt, tribbles, alsorts.

Where the drain runs.

It drains with normal rain, and can even cope with normal rain and the washing machine puking up twenty litres in a heartbeat... so it isn't entirely blocked. However, a deluge is more than it can handle.

I tried poking a long plastic rod (part of a chimney sweep) down it, and also digging out the other side. Alas, somewhere along the way I grazed off a piece of skin and... it's quite sore.
As I have to be back at work (oh my god...) in five days, I don't fancy injuring myself any further. I hope this will be healed enough that wearing latex gloves doesn't cause any problems. Just washing my hands stings...

So, I found a company nearby (nearby as in halfway to Rennes) that cleans out drains. I think what I need is to have a high pressure water pipe shoved down it to blow the crap out by force. Beyond my abilities. I would imagine a drain cleaning place... will probably find this a comical five minute job, but hey, if they're willing to do it, I'm willing to pay them.
I left a description, and linked to photos, in their website's Contact form. Let's see if they get back in touch...

Your comments:

J.G.Harston, 17th August 2022, 17:25

When I came here from Hong Kong, when I first ran the washing machine I discovered the previous occupants of the house had a habit of flushing left-over rice down the drain. The pool of washing suds in the yard told me the drain was blocked solid.    It took a couple of hours lying flat on the ground with the whole length of my arm down the drain wielding a chisel to break through the ersatz concrete.

Rick, 17th August 2022, 18:22

I've discovered why the pause is shorter.    It turns out that the key code is actually only transmitted once.    If the key is held down, then periodically (every 110ms) a repeat code is sent. This consists of the 9ms burst, a 2.5ms pause, and then the 560µs stop burst. In other words, an empty frame (no address, no command) to mean "repeat previous".

ANTHONY , 11th November 2023, 17:13

I only came here to find out how to put this remote in pairing mode for Bluetooth

Rick, 13th November 2023, 08:49

The remote doesn't pair, it's a simple infrared device.    To pair the car radio, simply press Mode (Mod on the remote) until the radio is in Bluetooth mode, then on your phone, connect to "CAR-BT".