Reverse Engineering Wireless Weather Stations

lacrosse_wireless_temp_sensor

[Fred] got a La Crosse wireless weather station as a gift and thought the LCD display was great, but he was dismayed that there was no means of extracting the temperature data for use on a computer. He thought that the modular design of the system would make it great for use in his home automation project if he could only get his hands on the data.

He tore into the base station and started looking around for easy places to get at the data he was looking for. He thought about tapping into the bus that controls the LCD in hopes of finding an easy to decode signal, but the weather station used a proprietary chip with an integrated LCD controller, making it all but impossible. Instead, he started sniffing the data coming across the wireless link, and while he didn’t quite yet know what he was seeing, it was a start.

He sniffed the signals using Audacity, and eventually found that the base station received 40-bit data bursts from each sensor. He dug further, and with the help of some data he found online, he was able to decode the data packets. The last hurdle he ran into was figuring out how the system’s CRC encoding worked. It took a bit of work but he eventually got it, and can now record data packets knowing that the data has come over the air intact.

So far, it looks like his temperature monitoring system is working quite well, though he has several improvements planned for the near future. If you have a similar unit and are interested in extending its capabilities, [Fred] has posted plenty of code on his site.

26 thoughts on “Reverse Engineering Wireless Weather Stations

  1. Nice work reversing that CRC. It might be interesting to try the reverse hack – build/repurpose a transmitter to send arbitrary temp readings to the base station. You could use it to, say, monitor the temps of a distant server room, or temperature readings for some other part of the world (sourced from the Web, of course).

  2. nice hack!

    what do you guess?
    do other stations work with the same protocol?

    few weeks ago, i wanted to change the barometric sensor of a WS against a CO2 sensor.

    my intention was to provide a analog signal and faking the barometric sensor, but it didnt work since it was all proprietery.

  3. I’ve done something similar with the Davis weather stations. My blog shows how to interface a PC to the console for about $15 rather than using the $150 dongle from Davis. I’ve also sniffed the console’s wireless receiver chip configuration so that I’ll be able to (eventually) receive the data on an IM-ME.

    http://madscientistlabs.blogspot.com/search/label/Davis%20VP2

    I also expect that I could add data logger capabilities to my DIY interface for around $1. Haven’t gotten to this yet because, unfortunately, my time for hacking this thing in the summertime is almost non-existent.
    http://www.wxforum.net/index.php?topic=11675.25

  4. There seems to be a bit of confusion regarding the use of Audacity in this project.

    As he mentions in his writeup, Fred tapped in to the data and clock lines of the wireless chip on the receiver. This gives him full access to all of the same signals the receiver is getting from the remote unit. Audacity can be used as a “poor man’s spectrum analyzer” to look more closely at the data as demonstrated in several projects we have featured in the past.

  5. Audacity can be used to measure the low frequency signals. However be aware that the sound card is supposed to work with low frequencies (audio) so this will of course not work with high frequency signals because the sample rate is too low.

  6. thank you for the nice comments and the suggestions. !

    I used Audacity and my PC soundcard as a low cost oscilloscope.
    It works for low frequency signals that are less than a few kHz.
    I sniffed what the receiver sub-module outputs to the controller, that is after demodulation.
    There the clock and the data seem at 19.2 kHz, which the soundcard can easily record.
    I used 96kHz as a sampling rate to record the data.

    Thank you also for sharing links to similar projects, they are a useful source of information !

  7. Is there a way to track for a stolen temp sending unit? I live in South Florida and continue to get readings. Think a neighbor took it. It must be in someones house since the readings a consistent arournd 78 degrees , 12 below the outside temp
    I have a 432 mc ham handi- talke but am not aaaable to pick up a data burst Any ideas
    Thanks
    Bill

    1. You need to know what frequency you weather unit is listening to in case it’s a different frequency. You might be able to get that from the company. Another option is an RTL/SDR dongle for about $10 that can cover a huge frequency band. But really once you know the frequency you need a directional antenna to do some rf hunting and triangulate where the signal is coming from. If you can repeatedly show that it points to a particular house then you might be able to convince law enforcement to approach them about it. But is it worth it to you to go through all that? Might be quite interesting to see the neighbors face when what they stole was traceable.

  8. Very awesome indeed.
    Nicework FBB.
    Just got one of these “weather stations”.
    I might be really easy to take some of your work and apply it to a software defined radio app.
    The USB radio dongles are dirt cheap ~ $8 US and have excellent sensitivity and performance around 430MHz.

  9. I’m curious about hacking a Taylor Digital Projection Thermometer (about 20 yrs old).
    I want to be able to pick up the outdoor temp transmission on my computer, without interfering with the base unit
    or the transmit unit.
    The Specs list the “Transmission: max. 100ft. (30 m) open area, RF434 MHz.
    The FCC ID is TG3SS-5000TX with an output frequency of 434 MHz.
    What would I need on my computer to detect that frequency, read it, and display the outdoor temp
    on my computer?
    I’ve read some previous discussions re: Audacity (which I use on both Linux & Windows OS for editing mp3 files);
    but I’ve never used Audacity’s spectrum analyzer, etc. for the purposes discussed.

  10. I didn’t see any responses to amigadragon post on January 25, 2018 at 2:11 pm about grabbing the signal with RFM69HCW. I had also thought I could just grab the signal from my router as it tries to forward to the La Crosse View App. I was encouraged when I took apart the C82929 and found an 8266 chip in the circuit board. My spectrum analyzer shows a signal from a 915 MHz temperature sensor that is so infrequent as to defy analysis. However, my RFM69HCW picked it up and I was able to decode it as raw data which didn’t make too much sense. I would love to either pick up the 915 MHz sensor signals and decode them with an RFM69HCW or hack the station or hack the Wi-Fi router. The signal does seem to be quite robust to travel 400m and quite energy efficient to only emit every few minutes, so I’d rather do this than deploy my energy hog solution with a Wi-Fi based 8266 sensor controller. I.e., I love the idea of low energy sensor communications coalesced by a central hub with a Wi-Fi transmitter.
    I just haven’t found anything useful on the internet, so far.

    Thanks,
    Psi

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.