Reversing the Yamaha YAS-207 infrared remote protocol
As explained in the Introductory post, I’m reversing the control interfaces of the Yamaha YAS-207 soundbar.
In this installment I’m looking at the low hanging fruit, the infrared remote.
Before I begin, a word about the format: Originally I assumed that this would be stupidly simple. And I was wrong, in a way. So let’s board the failboat together and sail on it for a while.
Figure out the infrared protocol used in YAS-207 soundbar’s remote, the FSR78 ZV28960:
in order to replicate it on another device.
First: Search the net
I did not spend that much time on this, but it proved to be a waste of time. When someone lists “codes” for the device, they usually mention proprietary codes for some multi-remote. Which is worse than useless.
Let’s call it a fail.
Second: Use IRToy
I happen to have the “USB Infrared Toy” from Dangerous Prototypes1:
so I tried to fiddle with it to capture the protocol.
I won’t bore you with all the details, but even with the latest firmware the gadget seems basically useless (to me) for any device that doesn’t use RC5 protocol.
I tried the LIRC mode, and it kept crashing2.
Even in the “SUMP” (logic analyzer) mode it outputs garbage for me. Here’s a screenshot from Sigrok’s PulseView to demonstrate:
(it doesn’t look particularly bad in this view, but it’s essentially garbage)
And before you accuse me of being a dummy for sampling at
10 kHz, there’s
essentially no decode-able output at anything higher than that. Plus sigrok
wiki says to sample at
10 kHz, so, there.
I’m calling this a fail.
Third: Use logic analyzer and IR receiver
So using an IR receiver on a logic analyzer pin should be all that’s needed.
And given that on AliExpress you can find an 8-channel logic analyzer for close to $5, there’s no excuse not to have one.
Plus an IR receiver like TSOP38238 will set you back $2 (at adafruit).
The entire tricked out setup boils down to someting like this:
I’ll cut the long story short, to say – BOOYAH!
So it seems to be the NEC
where power button emits command
0xCC to the address
I’d chalk that a partial success. I have a way out, but this is just too much work (capturing the forms and re-typing it).
We need to automate this.
Fourth: Use IRMP
Being the lazybones I am, I looked for IR decoder libraries and found the Infrared Multi Protocol Decoder + Encoder which not only supports many platforms, but also an incredible amount of IR protocols (50!).
So hooking up one GPIO pin on an Arduino to that same IR receiver from the previous picture, and flashing the IRMP on it yielded the table below.
With the greatest of fanfares, may I present to you, the IR codes emitted by Yamaha’s FSR78 remote:
|power||P=NEC A=0x8778 C=0xCC|
|hdmi||P=NEC A=0x8778 C=0x4A|
|tv||P=NEC A=0x8778 C=0xDF|
|analog||P=NEC A=0x8778 C=0xD1|
|bluetooth||P=NEC A=0x8778 C=0x29|
|surround||P=NEC A=0x8778 C=0xB4|
|stereo||P=NEC A=0x8778 C=0x50|
|clear_voice||P=NEC A=0x8778 C=0x5C|
|bass_extension||P=NEC A=0x8778 C=0x8B|
|bluetooth_standby||P=NEC A=0x8778 C=0x34|
|dimmer||P=NEC A=0x8778 C=0xBA|
|subwoofer_up||P=NEC A=0x8778 C=0x4C|
|subwoofer_down||P=NEC A=0x8778 C=0x4D|
|mute||P=NEC A=0x8778 C=0x9C|
|volume_up||P=NEC A=0x8778 C=0x1E|
|volume_down||P=NEC A=0x8778 C=0x1F|
With the IR protocol decoded + recorded, I call the first part of this series “gemacht”.
In the next part I’m going to start looking into the Bluetooth remote control. Say, the next weekend?
Because their “Bus Pirate” seriously rocks I also bought this one some years back. And never used it (so far). ↩
In the end – after going through the rest of the steps written here, I managed to squeeze some reasonable output out of
irrecord(despite the segmentation faults) – but it was a bit too little, bit too late. For the curious: irrecord.conf. ↩
And don’t stop just on that page, in the top right corner is a menu that allows you to navigate to a detailed description of individual protocols. The site is extensive and with superb content, despite the poor UI. ↩