[Reza’s] methodical investigation of this remote controlled outlet let him patch in with an Arduino using a 433 MHz transmitter. This is a single-device unit, but the techniques used here should allow you to take control of wireless rigs that have multiple modules to control many devices.
We’ve seen some folks at our local hackerspace try to patch into the remote control itself. That used some type of weird button scanning (not just connecting a pin to ground or voltage) and didn’t pan out. [Reza] doesn’t even crack open the case of either of the units seen above. Instead, he goes straight for a wireless receiver he had on hand, using a logic analyzer to capture the signals coming from the remote.
Once he had a good snapshot of the signals sent when pressing the on or off button of the remote he set out to replicate it in his Arduino code. His function called setStateWithDelay takes three parameters: the transmit pin, the level (high or low), and a number of milliseconds to delay. Each signal calls this function many times, but working the bugs out is pretty easy; just capture the signal with the logic sniffer and compare to the stock remote.