Close

4. Comparing Nexa and Klik aan Klik uit

A project log for Reverse engineering wireless plugs

Attempt to control Nexa MYCR-1000 wireless plugs with Raspberry Pi

suikalesuikale 02/17/2022 at 17:480 Comments

Recently the project got a comment about similar looking plugs from a dutch company called Klik aan Klik uit. The plugs could be controlled with this Arduino library. So I did a comparison between my findings for Nexa and the KaKu Arduino code.

First, these are my latest notes on Nexa plugs. I changed the payload structure a little bit based on this comparison. The timings are also rounded a bit more.

payload structure: 
    [init] 1001 [7 bytes] 0101 [3 bytes] 1001 [state byte] 0101 [id byte] # first quess
    [init] 1001 [11 bytes for remote id] 1001 [state byte] [group bits] [id byte] # refined quess

bytes: 0101, 0110,    1001,   1010
state:  off,   on, all off, all on
   id:    0,    1,       2,      3
group:    0,    1,       2,      3

bits:
 init: 250 µs ON, 2500 µs OFF 
    1: 250 µs ON, 1250 µs OFF
    0: 250 µs ON,  250 µs OFF

 After analysing the KaKu code I was able to extract this information

kaku payload structure (without dimmer):
    [syc] [32 bits]
    where:
        syc is roughly the same as nexa init 
        32 bits are ((id<<6|dev)|state<<4)|(group)<<2
        
        0000iiii iiiiiiii iiiiiiii ii000000 | between 0 and 4194303
                                   00e000dd | e = 1, dd = 00 for every device, else dd = 00 - 11
                              0000 000s0000 | 1 or 0
                              0000 0000gg00 | 00 - 11
    ->  0000iiii iiiiiiii iiiiiiii iiesggdd | full payload

->  payload: [syc] [0000iiii iiiiiiii iiiiiiii iiesggdd]

kaku bits:
  syc: 10810 µs OFF, 230 µs ON, 2760 µs OFF 
    1: 230 µs ON, 1380 µs OFF, 230 µs ON, 322 µs OFF
    0: 230 µs ON, 322 µs OFF, 230 µs ON, 1380 µs OFF
   -1: 230 µs ON, 322 µs OFF, 230 µs ON, 322 µs OFF # used in dimmer payload only

kaku states:
     0: off
     1: on
100000: control group instead of single device

kaku id and group:
    00: 0
    01: 1
    10: 2
    11: 3

The bits  and timings look surprisingly similar. To make the comparations easier I had to do some translations

kaku bits to nexa bits:
    kaku | nexa
     syc | init
      1  |   10
      0  |   01

comparing: 
kaku payload translated to nexa bits:
    [init] 0101 0101 [44 id bits] [2 whole group bits] [2 state bits] [4 group bits] [4 device bits]
nexa payload:
    [init] 1001 [44 id bits] 1001 [4 state bits] [4 group bits] [4 device bits]

kaku payload: 
    [syc] 0000iiii iiiiiiii iiiiiiii iiesggdd
nexa payload translated to kaku bits:
    [syc] 10iiiiii iiiiiiii iiiiiiii 10ssggdd

So there are some subtle differences in timings and payload structures. I will test this more when I get some working hardware to send these payloads.

Discussions