The remote control hacked and connected to the oscilloscope for decoding

This is a very easy circuit that every one could make and have fun. This project popped out of nowhere, one day that i was trying to control the TV from the serial port of the computer. It took me no more than a few minutes to understand the simple method that the remote controls work, and even less time to make a circuit to have fun with my girlfriend :)

Because this circuit is easy enough for everyone to make, i decided, instead of writing how this circuit works, to get a little bit deeper on how remote controls work.

Although there are tons of manuals, spec papers and tutorials on how those remotes work, i wanted to do it my way. I connected the oscilloscope on the IR LED of my remote control and after some key presses and range selects, voila!!! The signal revealed. Let's see for example what happens when i press the buttons 1 and 2. Then we will try to decode the signal transmitted.

Data sent when key 1 was pressed

Data sent when key 2 was pressed

It would be easier for us to decode those signals, when we place them one over the other as follows:

The signal is transmitted from left to right. A starting bit is first to be transmitted. Then, 5 aces (5x1) follows the signal. From then on, 9 bits will follow, and those bits are considered to be the data bits. The last two bits should be the end bits.

According to what key we press, the transmitter will send this pattern, and the code bits shall change. The buttons that i chose to send are not random. I run some tests and saw that when the numeric keys are pressed, the code bits will have the binary number of each button.

In the first case, the top code has from left to right the following bits sent:

In the second case, the bottom code has from left to right the following bits sent:

The first (top) code was sent when we pressed the button 1, and the second code (bottom) was sent when we pressed key 2. If you mirror the binary numbers and invert the bits, you will get the number 1 and 2:

It should be taken into account that the delay from pulse to pulse, AKA period of the signal is approximately 1mSec. This is good to know for other projects, but for this project is irrelevant.

Now you should be able to predict the whole series of code that will be sent when we press number 4 of the transmitter.

Code sent when key 4 is pressed

Back to the oscilloscope for a closer look. If you look the pulses driven to the LEDs closer, you may notice that they are not very clear rectangular pulses. That actually draw my attention and decided to press keys on the transmitter having a faster time base chosen on the oscilloscope. This would actually magnify the pulses. I chose a time division that would actually show one pulse to each screen. And here are the results!:

Each pulse when is magnified, it appears to be composed from several other pulses. Those pulses are actualy the carrier frequency of the remote control. In our case this carrier signal is about 38.5KHz. In general, remote controls have carrier waves from 25KHz to 45KHz. This carrier wave is used to distinguish pulses sent from the remote control from other random and ambient light. The receiver has a filter that will allow only frequencies near the carrier frequency to be driven to the decoder.

I hope i managed to explain in simple words how the remote control works. On with the remote signal jamming now!

If you have already read the previous section on how remote controls work, you may have already understand the trick yourself. The goal is to confuse-blind the receiver. A simple way would be to place some non transparent tape over the IR receiver...dooooh. Ok, the idea is to confuse the receiver by sending a constant IR pulse with the carrier frequency of the transmitter. When someone tries for example to change a channel with the remote, the IR pulse from the transmitter will be combined with our pulses. The result will be a non-accepted signal from the receiver and therefore no action shall be taken. That's all.

The circuit is a simple 555 astable multivibrator. You can find detailed theory of the 555 timer operation in the pcbheaven pages, as well as a 555 timer calculator for your calculations.

The circuit schematic is as follows:

There are not much to say about the circuit. The 2N2222 transistor is used for switching the IR LEDs. It would be better to use 5mm LEDs. Any kind of IR LEDs would fit but you may need to change the 150 Ohms resistor accordingly.

The output pulses will have a frequency according to the RC circuit of the 555. This RC circuit is composed by the 1K resistor, the 10nF capacitor connected in series to the previous resistor, and the 10K potentiometer with he protective 560Ohms resistor.

If you use the 555 astable multivibrator calculator provided, you can calculate the min and max frequencies that this circuit can operate at. For the minimum frequency, the R1 should be considered as the sum of the 10K poti with the protective 470 Ohms resistor:

The remote control jammer circuit assembled on a bredboard

For the maximum frequency, the potentiometer is considered to be at it's lowest resistance and that would be 0 Ohms, therefore the R1 would be 560 Ohms:

The range is approximately from 11.5KHz to 58KHz, enough for almost every remote control on the market.

You could add optionally a switch in series with the power source. The voltage can climb up to 15 volts, but resistors that polarizes the transistor needs to be re-calculated. Use the LED resistor calculator from Dr.Calculus to calculate the 40 Ohm resistor.

Now, you can sit back and relax, watching your favorite TV show, without anyone being able to zap around the channels!

Name   Email (shall not be published)   Website Notify me of new posts via email Write your comments below: BEFORE you post a comment:You are welcome to comment for corrections and suggestions on this page. But if you have questions please use the forum instead to post it. Thank you.