I got some RF remote control outlets to run the fans without having to build custom 120V stuff, and, to avoid wifi outlets where I'll havre to use some stupid API or bounce it through some "cloud" service.  Spent most of today reverse engineering the remote for the outlets to get it to connected to wifi. 

After opening the remote, I figured there were three "easy" vectors to get at it.  Inside the remote there's an 8-pin SOIC package (probably a uC) hooked up to the buttons through a weird diode matrix.  One pin goes through about a dozen passives and a transistor, to a 3-pin metal can, to the antenna.  Option one is to probe the "data" pin of the mcu, figure out the data encoding, and inject my own serial stream between the mcu and radio.  Another is to bypass the remote altogether and use an SDR to intercept and decode the RF directly, then buy a radio that can reproduce that frequency/modulation.  Finally I could figure out how button presses are detected (with the weird diode matrix) and  inject button presses.    

Scoping what I thought was the data line revealed something weird, the "mcu" created a sawtooth wave at a couple hundred KHz, from about 2-3V whenever a button was pushed.  

Odd

No apparent modulation or anything either, just a sawtooth as long ad the button is pressed. 

I think this is something that feeds into the RF section, but still haven't really figured it out exactly. Turns out there was another pin though, which had normal digital data on it, which ran to the RF section through a path on the pcb I didn't see.   

This was pretty easy to figure out, it's a 1.08HKz RTZ code with a 700uS high pulse for "1", and a ~230uS pulse for "0" (or the reverse, doesn't really matter.  Ultimately I didn't go much further than this, figured the  weird sawtooth thing would be a pain to generate and I wanted this working as fast as possible.  

So, I turned to the buttons.  

Originally I'd figured they'd have an mcu with enough gpio to read each pin, surely any other solution would cost more right? 

Wrong apparently, there's an mcu with 4 pins for 10 buttons, and about a dozen diodes on the board.  

I expected there was some clever use of mixed I/O on the pins, sort of like charlieplexing, some "active" system where the mcu puts pins high and low and can telll what's been pushed by the responses of other pins.  Poking around a little though, showed nothing coming out if the uC at all.

Huh.

Probing the four pins showed that actually, the diodes just pulled them high in a really simple pattern depending on what button was pushed.  Bingo, that's an easy way in.  

I assigned each pin an (arbitrary) bit index, recorded what 4-bit number shows up (on the 4 pins) for each button on the remote, 

Save those in an array, wire an ESP8266 to those pins write some simple logic to toggle those pins for half a second, and boom, wifi interface for the remote.

There wasn't quite enough space in the existing case, so I soldered a DB9 to the back of the remote, and made a tiny box for the ESP with the mating connector.  

What's passed through is just power for the remote and 4 GPIO lines.  

So I hooked it all up, connected to the esp, toggled an outlet aaaaand... nothing

Pretty quickly guessed that it was the power going to the remote - by default it runs on 12V, I'd been running it off a 5V bench supply while testing, which worked fine.  Running it on my computers USB port through the ESP though, wasn't working.  I know my computer puts out a little less than 5V for USB (it's old) so ai suspect the remote just couldn't run on <5V.  

So, up the supply to 12V and add a regulator to run the esp, problem solved! 

Wait crap still now working. 

What? 

Turns out the "mcu" on the remote doesn't run at 3v3, or 5v or anything, it runs directly off the supply voltage!  So my puny 3V3 ESP digital outputs weren't registering!  It was expecting about 12V digital inputs! 

So... why did it work earlier?  

Turns out there's a sweet spot right between 5V and 5.5V where the radio still works, but, its digital inputs still register 3V3 inputs.  So, finally, I used one of those cheap ebay adjustable buck regulators to dial in  5.3V supply, and pass that to both the ESP (since it's got an onboard 3V3 reg), and the remote control.  Finally, everything worked.  Button it up, test again, and it all checked out! Got me some super cheap, locally hosted, network wifi controlled outlets now.