Reverse Engineering Smart TV Remote with Logic Analyzer

In this video, I show how I analyzed an unknown digital signal on a remote control for a Google Smart TV with a logic analyzer. I used the PCBite probe kit to connect to the test points without solder.

PCBite kits:

saleae-logic2 program:

IoT Hackers Hangout Community Discord Invite:

🛠️ Stuff I Use 🛠️

🪛 Tools:

🫠 Soldering & Hot Air Rework Tools:

🔬 Microscope Setup:

About Me:
My name is Matt Brown and I'm an Hardware Security Researcher and Bug Bounty Hunter. This channel is a place where I share my knowledge and experience finding vulnerabilities in IoT systems.

- Soli Deo Gloria

💻 Social:

#iot #hacking #embedded_systems #microscope #tools

[Packmanman]

A video on the process of decoding would be incredibly interesting! What tools you use, common patterns you know, etc etc. Really enjoying all of your videos, keep it up :)

[rd.Eye.Saw.Destruction]

I have always wondered about these pads, especially on the old Vizio double sided remotes with the keyboard attached to the bottom, it’s made of two motherboards with two IR lights pointed in different directions. I remember I would spend hours as a kid testing out all kinds of stuff with the remote and they even have weird little games you could play on these early smart TV’s. (BTW I’m talking about the big one with the A B X Y buttons, not the slim newer one and not the one where the keyboard slides down)

[SlinkyD]

This explains why I gotta wait between button presses on these "smart" remotes. Channel surfing is dead now.

[AustinHypes]

wow you are a gizmo i stg i watched your whole channel today, addicting seeing what you can do 🙈

[simmosideways]

It would be cool to see how you approach CANbus

[iamsleepyhollow]

2F seems to be transmit, 5F might be receive? (Not sure) I noticed additional patterns in each of the messages as well. It seems each message has three messages in it. I've broken them apart before. As you noted, the same byte is sent in position 3 for each of the three parts, which is always followed up be 48.

Perhaps the 3rd byte is a sort of message id for the current packet?

2F 8A7D 48 0A08
2F 9A7D 48 0A08
5F FA7D 48 690D1828F8

2F 3FA8 48 0A08
2F 2FA8 48 0A08
5F 4FA8 48 690D1828F8

2F F9AC 48 0A08
2F E9AC 48 0A08
5F 89AC 48 690D1828F8

[jayfowler]

Cool but you should be able to solder to those points with no issues, those pogo pins just cause more problems than there worth...

[martinkuliza]

7:43
1 Million (Translated to BAUD) is Sym/s SYMBOLS PER SECOND
Not Samples
and 1MHz is Frequency not BAUD, 1MHz doesn't have to mean 1 Million symbol changes per second,
you could have 9600 Symbols in that time, it depends on the BAUD RATE in use in the protocol

but.. you were looking for BAUD RATE... in SYMBOLS per second Sym/s or Sym/sec or even Bd

[neon_Nomad]

Bought one of these off ebay it never arrived:/ first experience of this but could you recommend a reseller

[yankovalsky]

Hi. Thank you for the video. I have a question. The blue LED in the logic analyzer is on all the time, and Logic2 shows that the device is starting from a high state. Is it damaged or is it supposed to be like that?

[martinkuliza]

8:35 it's not Binary Protocol. it's likely NEC Protocol
Binary isn't a protocol. it's a Numbering system and a Language, it's not a Protocol
also you just said it was HEX so....

[jstro-hobbytech]

Ive been wanting the pcbite kit for so long but the kit i want is like 700cad haha

[Sockheadrps]

I like the video but I hate that fuckin hat lol. Good video though, liked and commented for your algo