RF hacking a cloud-controlled ceiling fan
Article excerpt
Sam Wilkinson bought a the DreoCLF513S ceiling fan and wanted to add Home Assistant control, bypassing the manufacturer’s cloud app. Some reverse engineering with a radio sniffer and some electronics to repeat the sniffed signals. The fan’s only local control mechanism was its remote, so I wanted to try the “universal remote” path: decode the […]
Sam Wilkinson bought a the DreoCLF513S ceiling fan and wanted to add Home Assistant control, bypassing the manufacturer’s cloud app. Some reverse engineering with a radio sniffer and some electronics to repeat the sniffed signals.
The fan’s only local control mechanism was its remote, so I wanted to try the “universal remote” path: decode the remote’s commands and replay them. Universal remotes are famously reliable products, so clearly I was on the right track.
To decode a (simple) RF control scheme, you need to figure out three things:
The carrier frequency · The base frequency used to communicate.
The modulation method · How 1s and 0s are being conveyed through that carrier frequency.
The payload(s) · The actual 1s and 0s being sent by the remote.
To replay these commands, I wired a Xiao ESP32-C6 board to an RFM69HCW 433 MHz RF transceiver.
See how it was done in the project post here and see the code on GitHub.