Reversing the Yamaha YAS-207 infrared remote protocol

Introduction

As explained in the Introductory post, I’m reversing the control interfaces of the Yamaha YAS-207 soundbar.

In this installment I’m looking at the low hanging fruit, the infrared remote.

Before I begin, a word about the format: Originally I assumed that this would be stupidly simple. And I was wrong, in a way. So let’s board the failboat together and sail on it for a while.

Problem

Figure out the infrared protocol used in YAS-207 soundbar’s remote, the FSR78 ZV28960:

in order to replicate it on another device.

First: Search the net

I did not spend that much time on this, but it proved to be a waste of time. When someone lists “codes” for the device, they usually mention proprietary codes for some multi-remote. Which is worse than useless.

Let’s call it a fail.

Second: Use IRToy

I happen to have the “USB Infrared Toy” from Dangerous Prototypes¹:

so I tried to fiddle with it to capture the protocol.

I won’t bore you with all the details, but even with the latest firmware the gadget seems basically useless (to me) for any device that doesn’t use RC5 protocol.

I tried the LIRC mode, and it kept crashing².

Even in the “SUMP” (logic analyzer) mode it outputs garbage for me. Here’s a screenshot from Sigrok’s PulseView to demonstrate:

(it doesn’t look particularly bad in this view, but it’s essentially garbage)

And before you accuse me of being a dummy for sampling at 10 kHz, there’s essentially no decode-able output at anything higher than that. Plus sigrok wiki says to sample at 10 kHz, so, there.

I’m calling this a fail.

Third: Use logic analyzer and IR receiver

The infrared protocols are essentially a bunch of modulated light. For an awesome primer you can check the IR Remote Control Theory page³.

So using an IR receiver on a logic analyzer pin should be all that’s needed.

And given that on AliExpress you can find an 8-channel logic analyzer for close to $5, there’s no excuse not to have one.

Plus an IR receiver like TSOP38238 will set you back $2 (at adafruit).

The entire tricked out setup boils down to someting like this:

I’ll cut the long story short, to say – BOOYAH!

Successful decode of the IR command; click for detailed version.

So it seems to be the NEC protocol; where power button emits command 0xCC to the address 0x78.

I’d chalk that a partial success. I have a way out, but this is just too much work (capturing the forms and re-typing it).

We need to automate this.

Fourth: Use IRMP

Being the lazybones I am, I looked for IR decoder libraries and found the Infrared Multi Protocol Decoder + Encoder which not only supports many platforms, but also an incredible amount of IR protocols (50!).

So hooking up one GPIO pin on an Arduino to that same IR receiver from the previous picture, and flashing the IRMP on it yielded the table below.

That simple!

With the greatest of fanfares, may I present to you, the IR codes emitted by Yamaha’s FSR78 remote:

Button	Code
power	P=NEC A=0x8778 C=0xCC
hdmi	P=NEC A=0x8778 C=0x4A
tv	P=NEC A=0x8778 C=0xDF
analog	P=NEC A=0x8778 C=0xD1
bluetooth	P=NEC A=0x8778 C=0x29
surround	P=NEC A=0x8778 C=0xB4
stereo	P=NEC A=0x8778 C=0x50
clear_voice	P=NEC A=0x8778 C=0x5C
bass_extension	P=NEC A=0x8778 C=0x8B
bluetooth_standby	P=NEC A=0x8778 C=0x34
dimmer	P=NEC A=0x8778 C=0xBA
subwoofer_up	P=NEC A=0x8778 C=0x4C
subwoofer_down	P=NEC A=0x8778 C=0x4D
mute	P=NEC A=0x8778 C=0x9C
volume_up	P=NEC A=0x8778 C=0x1E
volume_down	P=NEC A=0x8778 C=0x1F

Closing words

With the IR protocol decoded + recorded, I call the first part of this series “gemacht”.

In the next part I’m going to start looking into the Bluetooth remote control. Say, the next weekend?

1. Because their “Bus Pirate” seriously rocks I also bought this one some years back. And never used it (so far). ↩

2. In the end – after going through the rest of the steps written here, I managed to squeeze some reasonable output out of irrecord (despite the segmentation faults) – but it was a bit too little, bit too late. For the curious: irrecord.conf. ↩

3. And don’t stop just on that page, in the top right corner is a menu that allows you to navigate to a detailed description of individual protocols. The site is extensive and with superb content, despite the poor UI. ↩