Flashing Sonoff Touch – No soldering

Although it is not really a big thing to solder an angled header in a SonOff Touch in order to reprogram it, one also has to solder a wire to the GPIO-0 pin of the ESP8285 chip as the SonOff Touch has no button that can be used to get it into flash mode.
I therefore wondered if it wouldn’t be possible to flash the Sonoff Touch without any soldering. Spoiler: yes it is possible, but you need some dexterity.
First open the Sonoff Touch. This is easiest done with cautiously prying a screwdriver on between the casing and the frontplate at the side.
once that is done you can see a small board that you can just pull-out.
On that board there are 4 in line holes that we need to connect an FTDI programmer to. On the bottom side of the board is also a 2×2 male header. That is the one that we just pulled out of its header in the housing. We are going to need that header a bit later as well.

indicated  the function of the 1×4 header in the image. You are going to need an FTDI to USB module  THAT YOU CAN SET TO 3.3 VOLT. You also will need a 1×4  straight pinheader and 4 female to female DuPont wires.
Now make the following connection between the 1×4 male header and the FTDI to USB connector:

header FTDI module
Ground Ground
Tx Rx
Rx Tx
Vcc Vcc

To make clear, if it already wasn’t, this is a connection to a loose, 4 pin male header.
The next thing you need is a female to male DuPont cable. Connect the female end to the ground connection on the 2×2 header.

Also, you need to identify GPIO0 on the ESP8285 chip:


For the final flashing you need a bit of dexterity but this is what you do:

  • Have your Arduino IDE available with the  required program loaded.
  • Under tools-boards choose the generic 8285 module
  • Flash size 1 Mbyte 16k SPIFFS
  • Make sure the FTDI module is not connected to the USB port of your computer.
  • Now press the 4 pin male header that is connected to your FTDI module in the proper holes. Make sure it is the right way around, so Ground connects to ground, Vcc to Vcc, Rx to Tx and Tx to Rx. If there is a bit of slack between the header and the holes. push against the pins with  the mouse of yr thumb or with your little finger, so it makes  poper connection.
  • Now take the male pin of the DuPont cable that you connected to the ground on the 2×2 pin header and push it against GPIO 0.
    Keep it in place with your thumb.
  • You still should have one hand free. Use that to push the FTDI module in the USB connection of your computer.
  • Once that is done, you can let go of the male pin pressed against GPIO0
  • In the IDE chose the right port and press ‘upload’.

That’s it.

So, what program should you upload to make the Sonof Touch work?
Of course there is Tasmota and many people are very happy with it. Truthfully, I found it cumbersome and couldn’t even compile it. Considering all we need to do is switch 1 pin, it shouldn’t be so hard to write something simple.
Given the fact that the Sonoff Touch will most likely disappear in the wall and you don’t want to have to take it out and flash it again, two things come in very handy in the program:

  • OTA (Over The Air) flashing
  • WiFiManager

The code also gives MQTT feedback about the

  • MAC
  • IP
  • Filename
  • SignalStrength

It can be downloaded here


433 MHz system for your Arduino

With ELRO AB440, SelectRemote, Powertran, EverFlourish, Eurodomest, Dimmermodule, ProMax, Kambrook, Etekcity, Sonoff/Slampher, Digoo

Elro AB440
Elro AB440
PowerAccess 288

With the price of 433MHz Receivers and Transmitters being so ridiculously low, I figured I couldn’t put of using some any more so i ordered a pair at Dealextreme for less than 2 USD. When they arrived, of course I imediately wanted to test them.
I had an old IKEA set (SELECTREMOTE No. 1728029) also sold by Blokker at one time, and an Old HEMA set (PowerAccess, originally Ewig Industries RF AC socket 288A)) . The Selectremote 1728029 is most likely Equivalent to the Powertran A0342.

As I didnt really have an idea about the codes and as the transmitter of the SelectRemote was broken and the PowerAccess set being a learning one, it seemed best to get a new set.  (Actually, the Power Access turned out work on 419MHz, so no way I could have gotten that to work with my set up)


My preferred supplier ‘Action’ didn’t have, so on to ‘Blokker’ (both local stores) that had a set: The AB440 for 15 Euro. Apparently the manufacturer was ‘ELRO’. The chip in the remote control is an HX2262, a common chip in RC systems

I loaded one Arduino with an RF sniffer (Datapin on D2) and pressed ‘A on’ and yes, a code came through. pressed again and a different code came through, pressed again and 3 or 4 codes came through. That actually happened in all channels. One code seemed very frequent and I gathered maybe the protocol required to send more than one code, or maybe one code several times.

I decided to focus on just the one ON and OFF button and with just a gentle press, I seemed to come to two codes for the ON and 2 codes for the OFF button that seemed to recur most frequent.

Then I checked if indeed each of those codes had an actual function with regard to the socket being switched on or off, so with my RF sniffer still running, I prepared one of the switches as channel ‘A’ and tested again.

Behold….. it turned out that the Socket switch -in spite of a number of codes being put out by the remote control- only reacted to one specific code and indeed that was one of the two I had opted for.

Though I could analyse the code I figured that if i would just send the code I received the Switch would react to that and that the library would take care of the timing

So, I quickly adapted the Senddemo program to send the On and Off code for Channel A and plugged it back in. and yes, there it went clicking away, On, Off, On, Off.

So now I did the same for the B and C channel, isolated 2×2 codes that seemed the most likely and actually picked the right one immediately to put into the senddemo program and there it was… the 3 socket switches happily clicking away.

Just a few more remarks. As it shows in the output from the ‘Sniffer’ program, it is a 24 bits code. Of course that doesn’t look like any 24 bits code but that is because it is a decimal value. If I calculate the binary code it looks like this. (On and OFF codes) and u just add leading zero’s to come to 24
A 1049937 000100000000010101010001
A 1049940 000100000000010101010100
B 1053009 000100000001000101010001
B 1053012 000100000001000101010100
C 1053777 000100000001010001010001
C 1053780 000100000001010001010100
separated in ‘trits’ it looks like this (the ’29’ is the set number set by the 1st 4 switches):

on off on on on A B C D na ON/ OFF
00 01 00 00 00 00 01 01 01 01 00 01 29A aan
00 01 00 00 00 00 01 01 01 01 01 00 29A uit
00 01 00 00 00 01 00 01 01 01 00 01 29B aan
00 01 00 00 00 01 00 01 01 01 01 00 29B uit
00 01 00 00 00 01 01 00 01 01 00 01 29C aan
00 01 00 00 00 01 01 00 01 01 01 00 29C uit

The first 4 ‘trits’ represent the position of the dip switches that select the group. In my case that was on-of-on-on-on. ‘on’ is ’00’  which means tied to ground. ‘off’ is ’01’ which means ‘floating’. 10111=’23’  (2⁴ +0+ 2² +2¹+2⁰) but if you see the LSB as being on the right -as the library class does- it becomes ’29’ (2⁴+2³+2²+0+2¹)
The next 4 positions determine the Switch ID. The next trits is not applicable and the last two determine ON or OFF.

For RC use there are 2 main libraries  for the Arduino: the one of fuzzilogic (Randy Simons)  and the RCSwitch from Suat Özgür. As the ELROAB440 set was working with the latter, I initially stuck to the RCSwitch library.

SendDemo - sends RF codes 
hacked from
http://code.google.com/p/rc-switch/ by @justy
 // Use whatever number you saw in the RF Sniffer Sketch
#define A_aan 1049937
#define A_uit 1049940
#define B_aan 1053009
#define B_uit 1053012
#define C_aan 1053777
#define C_uit 1053780

RCSwitch mySwitch = RCSwitch();
void setup() {

pinMode(7, OUTPUT); // use pin 7 to drive the data pin of the transmitter.

void loop() {

// Send your button's code every 5 seconds.
mySwitch.send(A_aan, 24);
mySwitch.send(A_uit, 24);
mySwitch.send(B_aan, 24);
mySwitch.send(B_uit, 24);
mySwitch.send(C_aan, 24);
mySwitch.send(C_uit, 24);

Now in hindsight I have been a bit stupid. If I had taken the time to read the documentation of the RCSwicth library, I would have found out that the library caters for 1he ’10 dip switch switches’ such as the ELRO AB440, as is shown in the program ‘TypeA_WithDIPSwitches.pde’
If I would have set the DIP Switches e.g. like “1011100100”, (for device ‘C’) I could have used the statements:




Well, let’s say ‘I learned a lot’. Just for completeness sake, it is obvious -if you compare it with the previous table- that the DIPSwitch position ‘ON’ doesnt send a ‘1’ but a zero. The code “1011100100”  is that of the  ‘C’ switch from the table above.

I still wondered why I couldn’t get the AB440 to work on the fuzzilogic library. With searching further I came upon an extension of the fuzzilogic library called RemoteSwitch (author Jeroen Meijer). That didnt work for the AB440 in first instance but Jeroen was kind enough to work through my data so it now has a separate class for the AB440. (code now on github).  (No longer on GitHub but here)


SelectRemote Nr. 1728029
SelectRemote Nr. 1728029

As I couldnt ‘sniff’ the  SELECTREMOTE No. 1728029 for lack of a functioning transmitter, and had no idea what codes it used, (Initially) I couldn’t get it to work yet with the RCSwitch library.

But I did get it to work with the Fuzzilogic RemoteSwitch library, as it was similar to the protocol of  a once popular ‘Blokker transmitter’

The code will look like this:

* Demo for RF remote switch transmitter.
* Setup:
* - Connect a 433MHz transmitter to digital pin 7.
// Instance of Blokker remote, use pin 7 
BlokkerTransmitter blokkerTransmitter(7);
void setup() {

void loop() {  
  // Switch on Blokker-device 1.
  // Wait 2 seconds
  // Switch off Blokker-device 1.
  // Wait 4 seconds

(Later on I would find the ON and OFF codes to be:
ON 1 : 0011 1111 0000 0011 0000 0000  //4129536
ON 2 : 0000 1111 0000 0011 0000 0000 //983808
ON 3 : 0011 0011 0000 0011 0000 0000 //3343104
ON 4 : 0000 0011 0000 0011 0000 0000 //197376

OFF 1 : 0011 1111 0000 0000 0000 0000 //4128768
OFF 2 : 0000 1111 0000 0000 0000 0000 //983040
OFF 3 : 0011 0011 0000 0000 0000 0000 //3342336
OFF 4 : 0000 0011 0000 0000 0000 0000 //196608
with “0” is 240us on, 740us off
and “1” is 740us on, 240us off)

It is clear that the 8 MSB determine the device address, whereas bits 8&9 determine the ON and OFF state. These codes can be used with the RCSwitch library

With the RemoteSwitch library the coding is as follows:

#include "RemoteSwitch.h"  
ElroAb440Switch ab440Switch(7); 
BlokkerSwitch3 blokkerTransmitter(7);
 void setup() { } 
void loop() 
{ //Switch on SelectRemote 1728029 device 1 
//Switch on AB440-device B on system code 29. 
// dip switch 1-5 is on-off-on-on-on = 10111... but is read as 11101='29' 
delay(2000); blokkerTransmitter.sendSignal(1,false); 

Powertran A0342


The Powertran A0342 is very akin to the the Selectremote, albeit that it has 8 channels rather than 4, divided over 2 banks that can be selected by a slideswitch on the transmitter. It works with the Blokkerprotocol in the RemoteSwitch library. If you do not want to use a library, because it  adds overhead,you can also use the program below, that will also work with the 4 channel Selectremote


#define radioPin           // IO number for radio output
void setup() {
pinMode(radioPin, OUTPUT); // set data to transmitter pin to output
void loop() {
remoteControl(1,0);                     // Turn Remote 1 off
remoteControl(2,0);                     // Turn Remote 2 off
remoteControl(3,0);                     // Turn Remote 3 off
remoteControl(4,0);                     // Turn Remote 4 off
remoteControl(5,0);                     // Turn Remote 5 off
remoteControl(6,0);                     // Turn Remote 6 off
remoteControl(7,0);                     // Turn Remote 7 off
remoteControl(8,0);                     // Turn Remote 8 off
delay(5000);                            // Delay 5 seconds
remoteControl(1,1);                     // Turn Remote 1 on
remoteControl(2,1);                     // Turn Remote 2 on
remoteControl(3,1);                     // Turn Remote 3 on
remoteControl(4,1);                     // Turn Remote 4 on
remoteControl(5,1);                     // Turn Remote 5 on
remoteControl(6,1);                     // Turn Remote 6 on
remoteControl(7,1);                     // Turn Remote 7 on
remoteControl(8,1);                     // Turn Remote 8 on
delay(5000);                            // Delay 5 seconds
void remoteControl(int channelNum, boolean remoteState) {
// Turns on or off remote channel
// channelNum  : 1 to 8 remote channel number (set on wireless plugpack
// remoteState : 0 = Off, 1 = On
// Sends same packet signal 4 times
// 13 Bit pattern in remoteOn and remoteOff arrays

int longTime              = 740;         // microseconds
int shortTime             = 240;         // microseconds
unsigned int remoteOn[8]  = {0x010E,     // 0000 0001 0000 1110
0x010C,     // 0000 0001 0000 1100
0x010A,     // 0000 0001 0000 1010
0x0108,     // 0000 0001 0000 1000
0x0106,     // 0000 0001 0000 0110
0x0104,     // 0000 0001 0000 0100
0x0102,     // 0000 0001 0000 0010
0x0100};    // 0000 0001 0000 0000
unsigned int remoteOff[8] = {0x000E,     // 0000 0000 0000 1110
0x000C,     // 0000 0000 0000 1100
0x000A,     // 0000 0000 0000 1010
0x0008,     // 0000 0000 0000 1000
0x0006,     // 0000 0000 0000 0110
0x0004,     // 0000 0000 0000 0100
0x0002,     // 0000 0000 0000 0010
0x0000};    // 0000 0000 0000 0000

// "0" is 240us on, 740us off, 240us on, 740us off
// "1" is 740us on, 240us off, 740us on, 240us off
// Send order is bit0, bit1, bit2 ... bit 12

// Now send packet four times
for (int j=0; j<=4; j++) {
if (remoteState) {                  // Turn on
for (int k=0; k<=12; k++) {       // Send 13 bits in total
if (!bitRead(remoteOn[channelNum-1],k)) {
digitalWrite(radioPin, HIGH);           // "0"
digitalWrite(radioPin, LOW);
digitalWrite(radioPin, HIGH);
digitalWrite(radioPin, LOW);
} else {
digitalWrite(radioPin, HIGH);           // "1"
digitalWrite(radioPin, LOW);
digitalWrite(radioPin, HIGH);
digitalWrite(radioPin, LOW);
} else {                            // Turn off
for (int k=0; k<=12; k++) {       // Send 13 bits in total
if (!bitRead(remoteOff[channelNum-1],k)) {
digitalWrite(radioPin, HIGH);           // "0"
digitalWrite(radioPin, LOW);
digitalWrite(radioPin, HIGH);
digitalWrite(radioPin, LOW);
} else {
digitalWrite(radioPin, HIGH);           // "1"
digitalWrite(radioPin, LOW);
digitalWrite(radioPin, HIGH);
digitalWrite(radioPin, LOW);
delay(5);              // Short delay between packets
delay(10);                // short delay after sending

EverFlourish EMW203RW

Another popular RC system is the Chinese EverFlourish EMW203RW from the German DIYMaxeda group  (Praxis, Formido, Brico, Plan-It). It is a sturdy outdoor (green) or indoor (white) switch with a transmitter for 3 switches. They can be set to 4 channels. Were sold as Cotech by Clas-Ohlsson

EMW203RW outdoor switch

EMW203RW indoor switch

The 24 bit codes (for Channels A and B) are as follows: (on-off / decimal-binary)

A1 1381719 1381716 / 000101010001010101010111 000101010001010101010100
A2 1394007 1394004 / 000101010100010101010111 000101010100010101010100
A3 1397079 1397076 / 000101010101000101010111 000101010101000101010100
B1 4527447 4527444 / 010001010001010101010111 010001010001010101010100
B2 4539735 4539732 / 010001010100010101010111 010001010100010101010100
B3 4542807 4542804 / 010001010101000101010111 010001010101000101010100

To make sense of this code, it is easiest to separate them in ‘trits’. Let’s look at the ‘on’ code for ‘A1’ :

00 01 01 01 00 01 01 01 01 01 01 11
A B C D 1 2 3 na na na na ON

The first four trits set the device_address (A-D) with a selected letter grounded (00) and the nonselected floating (01)., the next 3 the Switch id (1-3) then there are 4 non relevant trits and then one trit for on (11=High) or off (00=grounded).

‘B1-ON’, according to that logic, should then be:

01 00 01 01 00 01 01 01 01 01 01 11
A B C D 1 2 3 na na na na ON

which -as we can see in the sniffed code- is correct. This code looks very much like the one for  the ‘Blokker2’ class in the addition Jeroen Meijer made to the fuzzylogic library. It now has a separate class.

#include "RemoteSwitch.h"
EverFlourishSwitch everswitch(7);
void setup() {
void loop() {  
  everswitch.sendSignal('A', 1, true);
  //wait 2 seconds
  everswitch.sendSignal('A', 1, false);

EuroDomest 972080

‘Action’ is currently selling the EuroDomest 972080 system: 3 switches + remote control for 9.99 euro. This is a learning system that will not lose the

Eurodomest 972080

settings if taken out off the wall-socket (at least not for a while. These receivers supposedly can learn the old kaku_switch protocol. They are receptive to remotes of other systems when programmed as such, but I found that they do not always recognize the  codes sent by other remotes during programming  so you may only be able to only switch on or off a lamp when programmed with another remote.
The manual of the Eurodomest is a a bit cryptic in how to program the switches. This is how it is done:
Plug in a switch and  push the ON button on the switch until the led starts flashing slowly. Then  push the ON button on the remote: the LED on the switch now should start to flash quickly. Press the OFF button on the remote toll the LED goes off. Your switch is now programmed. (on second thought, most likely pressing the OFF button isnt even necessary)
The remote (at least in my case)  sends the following codes:
Channel 1 ON/OFF
Received 9588047 / 24bit Protocol: 1   100100100100110101001111
Received 9588046 / 24bit Protocol: 1   100100100100110101001110
Channel 2 ON/OFF
Received 9588045 / 24bit Protocol: 1   100100100100110101001101
Received 9588044 / 24bit Protocol: 1   100100100100110101001100
Channel 3 ON/OFF
Received 9588043 / 24bit Protocol: 1   100100100100110101001011
Received 9588042 / 24bit Protocol: 1   100100100100110101001010
Channel 4 ON/OFF
Received 9588039 / 24bit Protocol: 1   100100100100110101000111
Received 9588038 / 24bit Protocol: 1   100100100100110101000110
Channel ALL ON/OFF
Received 9588034 / 24bit Protocol: 1   100100100100110101000010
Received 9588033 / 24bit Protocol: 1   100100100100110101000001
It is clear to see that the signal only changes by 1 bit, though it is a bit odd that there seems to be an unlogical difference between channel 3 and 4 as one would expect “100100100100110101001001”  for ON and “100100100100110101001000” for OFF.
Also the All ON/OFF seems a bit out of order.
Sending these codes as is with the RCSwitch library works fine. It seems impossible to figure out what the  device code  for a random set would be, so you would need to first sniff the remote control, or, just send a chosen code with a 433MHz transmitter from an Arduino (or other micro controller).
The Eurodomest protocol is very akin to that of the ENER002, that in itself is akin to the Duwi/Everflourish EMW200R. It has the HS2303-PT chip rather than the PT2262. The Eurodomest might be the same as the Bauhn remote switch set. The ENER002 has its own class in the Jeroen Meijer update of the Fuzzilogic library.
If you want to use channel 4, make sure you have the most recent update of the Jeroen Meijer library
Program would look like this:

#include "RemoteSwitch.h"
Ener002Switch enerswitch(7);
void setup() {
void loop() {
enerswitch.sendSignal(823148, 1, true); //channel 1
enerswitch.sendSignal(823148, 1, false);
enerswitch.sendSignal(823148, 2, true); //channel 2
enerswitch.sendSignal(823148, 2, false);
enerswitch.sendSignal(823148, 3, true); //channel 3
enerswitch.sendSignal(823148, 3, false); 
enerswitch.sendSignal(823148, 4, true); //channel 4
enerswitch.sendSignal(823148, 4, false); 
enerswitch.sendSignal(823148, 7, true); // ALL
enerswitch.sendSignal(823148, 7, false); 

The  ‘823148’is the  decimal form of the first 20 bits that form the set address (for a particular Transmitter)

If you do not have that number… just use any 20 bits number, and  use the arduino to program your  Eurodomest. The ‘7’  means ‘All’. As per Januari 2016 the Eurodomest is phased out at the Action stores and is being replaced by the ProMax. The Eurodomest is the same one as the Efergy remote (Efergy Easy Off).

LED Dimmer

LED dimmer

The full credit of this goes to Jeroen Meijer who analysed the protocol of a popular RF Led dimmer driver available in Chinese webshops.

The code is very akin to that of the Eurodomest, albeit that it has a 19 bit address and a 5 bit command structure.

His fork of the RemoteSwitch library contains a class -CnLedDim1Switch- to control this dimmer.

The codes are also easy to snif. The left 19 bits forming the base address of the device.

So if pressing the button ‘ON’  generates the code:

on      6670849 / 0110010111001010000 00001,

then ‘0110010111001010000’ or ‘208464’ is the baseaddress and ‘00001’ the command code.
A program would be like this:

#include "RemoteSwitch.h"
CnLedDim1Switch ledDimSwitch(7);
const unsigned long dimaddress = 208464;
const byte pwr = 1;
const byte licht = 4;
const byte BrightUp = 5;
const byte BrightDown = 6;
const byte Full = 7;
const byte Half = 8;
const byte Quart = 9;
const byte Mode = 11;
const byte SpeedUp = 13;
const byte SpeedDown = 15;

void setup(){}

void loop()

ProMax 75.006.14 / Elro Flamingo F500S

Promax Intek 75.006.14

The Promax 75.006.14 is currently (early 2016) sold at Action stores (Netherlands) as a follow up for the Eurodomest. It is a sleek design, but appears to be difficult to implement. As it turns out the transmitter sends out several protocols.

Although you may find reference on internet that the transmitter of this set sends two codes per key, that is in fact not true: it sends 4 codes per key. Two of those codes can be found with the RCSwitch library sniffer and 1 can be found with the RemoteSwitch library sniffer example. The RC found  protocols are apparently  the ‘AC’ protocol and the HomeEasy EU protocol. The RemoteSwitch-found protocol seems to be a Kaku2 protocol, but sadly none of those codes work on the ProMax Switches. For that you need the 4th code (actually it is the 1st code it doesnt detect).
There are several ways to find that code. You could use the so called “Poor man’s oscilloscope” in which you connect the soundcard of your computer via a voltage divicer to a 433MHz receiver, record the keypushes with Audacity and try to work out from there what the codes of your transmitter are. There is also another way:
As device the ProMax is akin to the Elro Flamingo F500S  therefore it is the Flamingo sniffer program that could be used. This renders 28bits codes, add a zero on the end to make it fit a uint32_t bit word. The Promax is similar to the Elro Flamingo F500S, Mumbi m-FS300 and possibly the SilverCrest 91210.  As the the Promax protocol has rolling code per key, you may find 16 different codes per key. Take one, if that does not work, pick another. As during pairing with your tansmitter you only need to send the ON code, after wich the switch knows how to react to the off code and the master buttons, it is obvious there is a relation between the ON and OFF codes. In fact, the OFFcode can be calculated from the ON code. Each ProMax can be programmed with 5 codes. Be carefull to not program it with randomcodes, because you need the corresponding OFF code to remove the code.There is also another way. Find some working Flamingo codes from the internet and program your switches with those and use this program to send the codes from yr arduino. As the promax has the possibility to store 5 codes per switch, you can also program it with the Remote. That way you have switches that react to the remote as well as to the Arduino. Once you have founde the codes, having your arduino send them to the Switch is fairly easy: First send a sync signal that is HIGH for 300usecand low for 1500usec. Then send a ‘0’ (bit) as  HHHL with a periode of 300uS and the ‘1’  as HLLL. The Class Ohlson Co/Tech 51058×10 is probably similar too, albeit that its sends 4 rolling codes

Beware, the ProMax sold at action is NOT this one.

Flamingo SF-500WD/2

SF-500WD/2In the fall of 2017 Action started selling the Flamingo SF-500WD/2 remote for 9.95 euro whereas regular retail price is arond 17 euro. The SF-500WD/2 is a 2 switches-1 remote Outdoor remote set for which i have not been able to find any codes yet. Apparently it is recognized by RFlink.  A manual is available.

Kambrook RF3399


The Kambrook, made by Ningbo, is a bit of a different RF switch as the RemoteSwitch and RCswitch libraries don’t detect it as it has a 48 bit packet size. A fork of the RCSwitch library has a 4th protocol added to make it work with the Kambrook.

In the Kambrook a short pulse is constructed from a 280uS wide pulse, followed by 300uS off period. The long pulse consisted of a 675uS wide pulse, followed by a 300uS off period. The message is repeated 5 times with a gap of 9850us in between.

The signal consists of  48 bits: it starts with an 8 bit sync signal thart is typically 01010101. That is followed by 24 (3×8) address bits. Then 8 databits, followed by 8 trailing bits, typically 11111111.

The databits determine the switch and wether it is on or off

Unit Data Data (decimal)
A1 ON 00000001 1
A1 OFF 00000010  2
A2 ON 00000011  3
A2 OFF 00000100  4
A3 ON 00000101  5
A3 OFF 00000110  6
A4 ON 00000111  7
A4 OFF 00001000  8
A5 ON 00001001  9
A5 OFF 00001010  10
B1 ON 00000101  17
C1 ON  00100001 33
D1 ON  00000001 49

Arduino code for the Kambrook is here.

Nexa, Proove, Anslut

nexaDetails on how to drive these switches is described here, and here more on the Ikea Ansluta., and the Nexa.


etek4Etekcity is a popular brand that has several types. The popular 5Rx-2TX/learning code consist of 5 outlet switches and 2 transmitters. The transmitters have 5 ON and 5 OFF buttons. The coding is rather simple: it has a 24 digit code in which the last 4 bytes signal ON (0011)  or OFF (1100). The next 5 byte pairs (so bit 4 to bit 13) indicate the number of the button (both bytes in pair 1-5 high if button 1-5 is pressed.  bytes 4-7 are always ‘0’ unless the button for that position is pressed, bytes 8-13 are always ’01 unless the button for that position is pressed. The remaining bytes form the base address of the hand transmitter. The pulswidth is 190uS. The below table clarifies it:

Button On/Off address 5 4 3 2 1 Off/On
1 “on” 00 00 01 01 01 01 01 01 00 11 0011
“off” 00 00 01 01 01 01 01 01 00 11 1100
2 “on” 00 00 01 01 01 01 01 01 11 00 0011
“off” 00 00 01 01 01 01 01 01 11 00 1100
3 “on” 00 00 01 01 01 01 01 11 00 00 0011
“off” 00 00 01 01 01 01 01 11 00 00 1100
4 “on” 00 00 01 01 01 01 11 01 00 00 0011
“off” 00 00 01 01 01 01 11 01 00 00 1100
5 “on” 00 00 01 01 01 11 01 01 00 00 0011
“off” 00 00 01 01 01 11 01 01 00 00 1100

As it is a learning remote, one will have to sniff the code of the transmitter, or use the code above.

EtekcityAnother popular Etekcity model has a remote with only 5 buttons for on and off. The code here is fairly simple as well as shown in the table below

button Address 5 4 3 2 1
1. 00 01 11 01 01 01 01 00 00 00 00 11
2. 00 01 11 01 01 01 01 00 00 00 11 00
3. 00 01 11 01 01 01 01 00 00 11 00 00
4. 00 01 11 01 01 01 01 00 11 00 00 00
5. 00 01 11 01 01 01 01 11 00 00 00 00

PulseLength: 162 microseconds Protocol: 1


arc2300The PB3-230 is a remote powerswitch made by Intertechno. The are also sold under the name ARC PB3-2300 or Nexa PB3-2300. There is a library available.




sonoff-rf_06The Sonoff and Slampher are two devices sold by Itead. They come in several versions either controlled by WiFi, by RF or by both. The transmitter is a 4 button device (beware, it is often sold seprately) that sends out 24 bit codes in which the first 20 bits are the same and the last 4 just indicate binary 1, 2, 8 or 16.
These buttons can control 4 sonoffs as they are meant as toggle buttons rather than On/Off buttons. The set up is as follows: Quickly press “SET” button on Sonoff and Slampher twice, the red LED on Sonoff/Slampher will flash one time, then press one of the ABCD buttons on the controller once for a few seconds for pairing. If you pair it with A, then you can press A to turn on/off your device. The transmitter sends the following codes:

Button Decimal Binary
A 11708433 10110010101010000001 0001
B 11708434 10110010101010000001 0010
C 11708436 10110010101010000001 0100
D 11708440 10110010101010000001 1000

As the WiFi use of the sonoff and slampher is through a specific website, there are many software hacks available (it contains an ESP8266). If you reflash it with new software, there is no garantee that the RF function will be kept.

Digoo RC-13

The Digoo RC-13 Smart Home RF Wireless Remote Control Socket comes with 3 sockets and either a 3 channel or a 5 channel remote.
the remote transmits the following 24 bit codes

1 ON 10001111111000110000 1001
1 OFF 10001111111000110000 0001
2 ON 10001111111000110000 1010
2 OFF 10001111111000110000 0010
3 ON 10001111111000110000 1100
3 OFF 10001111111000110000 0100

It is clear to see that the device number is defined in the last 3 bits, whereas the ON/OFF code is defined in the 4th bit from the right. The first 20 define the ID of the set.

Some further 433 resources:
RC-Switch Downloads,
A new way to interface with remote power switches
How to operate Low Cost Outlets
askOOK decoding
433 MHz rf module with Arduino Totorial
Decoding and sending 433 MHz Rf codes with Arduino and RC switch,
433 MHz rf module with Arduino Totorial
Some usefull example codes for the Arduino on github:
ninjablocks 433Utils.
Handy RF sniffer (Datapin on D2) and  Senddemo sketch (Datapin on D7).
The Powertran Remote Control.