Infrared remote controls are simple and ubiquitous. Emulating them with the aid of a microcontroller is a common project that hackers use to control equipment as diverse as televisions, cable boxes, and home stereos. Some air conditioners can be a little more complicated, however, but [Ken]’s here to help.
The root of the problem is that the air conditioner remote was using a non-obvious checksum to verify if commands received were valid. To determine the function generating the checksum, [Ken] decided to bust out the tools of differential cryptanalysis. This involves carefully varying the input to a cryptographic function and comparing it to the differences in the output.
With 35 signals collected from the remote, a program was written to find input data that varied by just one bit. The checksum outputs were then compared to eventually put together the checksum function.
[Ken] notes that the function may not be 100% accurate, as they’re only using a limited sample of data in which not all the bytes change significantly. However, it shows that a methodical approach is valuable when approaching such projects.
Thirsty for more checksum-busting action? Check out this hacked weather station.
For IR remotes you don’t usually need to know how the checksum works, as you can just capture the whole command including the sum and play it back
It seems like [Ken] says as much at the end of the original post, looks like this was more of an academic challenge than a strict requirement.
Air conditioner remotes send every command with each button press, even if you just set the temperature it also sends fan speed, mode etc so you’d have to capture a lot of different commands if you wanted to do it that way
I figured it worked like this. Settings are actually on the remote and sync with the AC.
Depends on the AC. Lower-end ones just have dumb “up/down/etc.” buttons and can easily be replayed.
Higher-end ones (like ones with remote thermostat) send everything in each command and you need to know the checksum algo.
Might be perverse to try during this season. Set the house on fire while working the A/C to compensate. :-p
It’s 35°C/95°F where I live today.
Fa la la la laaaaaa la la la la
I once did such analysis for reverse engineering a packet radio system. It was quite fun and not so difficult once you grasp what “linear” means in the context of functions that take binary string as input and give another as output.
Of course, at the end of it, it turned out to be pretty standard CRC32. It just didn’t include all the bytes in the packet so my initial check missed it.
Comfort isn’t pointless. I find needless sweating kinda offensive.
Second.
With that attitude, I can tell you don’t live in Houston, like I do. I’ve always said that Houstonians would make the perfect people for migration to a lunar colony. They are already used to never going outside unless it’s absolutely necessary, and they understand that if the HVAC/life support fails, it’s a critical life threatening emergency that has to be dealt with immediately.
I find air conditioners^H^H^H^H^H^H^H^H^H^H^H^H^H^H^H^HCentral heating offensive. Why would you waste power (essentially your money) on something so pointless.
Troll much ?
https://www.accuweather.com/en/weather-news/prolonged-exposure-to-heat-cho/26887488
“Prolonged exposure to stale heat and damp, choking humidity claims hundreds of lives each year, according to the Centers for Disease Control and Prevention.
The CDC reported a total of 7,233 heat-related deaths in the U.S. between the years of 1999-2009. In that time, an average of 658 people died of heat-related causes each year.”
So lets waste a little sun. It’s not like it has anything better to do.
https://www.treehugger.com/sustainable-product-design/affordable-solar-powered-air-conditioning-finally-here-coming-us-market-soon.html
About compare two commands there is also this application:
https://github.com/gnlcosta/daikin_emura#compare-two-commands
used to decode Daikin Emura FTXG-JW air con.
14 THOUGHTS ON “CRYPTANALYSE YOUR AIR CON” – Yet only 8 comments?
It is always better to keep some of your thoughts to yourself.
When a trolly parent comment gets deleted, it takes the whole thread with it.
a) Please don’t feed the trolls.
b) Hit the “Report comment” button so that we can delete them as fast as possible and other folks don’t waste their time replying to a comment that’s just going to go away soon anyway.