Reverse engineering a 27MHz RC toy communication using RTL SDR

Based on patterns ("110110110", "1010", "111011101110"), I bet bits are variable length. Long pulse for sync, medium for 1, short for 0 (or other way). So there is always the same number of bits, but the time taken is different. This makes it very easy to decode, and explains the values in the table.

I had an rc submarine that could go underwater a couple feet, but I'd take an rc car's 27MHz radio and put it underwater, it'd stop working almost immediately soon as it went underwater (waterproofed). Wonder what the difference was.

The RX2 protocol is incredibly simplistic and inefficient at the same time, something like numbers of pulses in increments of few dozens to accept one of the grand total of dozen commands. It barely allow multiple command issuance within a second and completely incapable of handling analog inputs due to that. It's truly a product of "if it works" mindset.

They take the radio input, or just digital input into the antenna pin, or photodiode for IR input, or you can just remove the chip and solder an Arduino into H bridges. The difficulties are about the same. The minor disappointment I have had with these is that the steering servo built into the chassis inthe example I had was way too roughly made that analog control was plain impossible no matter what.

It’s an amazing tool. In less than an hour I decoded my RF remotes for the fans in my house.

Whipped up a Python script (without external modules) that transmits a modulated carrier using HackRF. Now I can control fans (with lights) with scripts.

URH also really good at recognizing the pulse durations and repetitions.

All crude RG devices aren’t even ASK, it’s really OOK. The receivers don’t have an ADC!