stay logged on
   [ Main Page ][ First New  ]
What to do when you've lost your ViewSonic Projector remote
Posted by Krux on Sunday February 23, 2014 @ 09:07pm
>>reply ]

So at SYN Shop, the hackerspace I help run, the remote control for our projector went missing some time back. This is unfortunate, since to turn on the projector we had to climb on a ladder, step stool, or unsafely climb on a chair or table to reach the projector on the ceiling. And then of course since you are touching the projector, you usually end up moving it in the process, which means the image doesn't display where it should on the projector screen.

As it happens, we inherited the projector from /usr/lib, when the space closed it's doors. While not the same model, it was the same brand. So the remote from that projector just happens to also work on our projector. This was great, since it meant that we could once again power on the projector from the safety and comfort of the seats in the classroom. Well it would be, but as we were not wanting to also lose that remote, it has been locked up in the SYN Shop board of directors locker that only a few people have access to.

Now we could buy a learning remote, which would let us copy the projector remote so we have a backup. However that's not very hackerish. The better way would be to reverse engineer the codes, and if needed duplicate it. So I borrowed the spare projector and remote, so I could do exactly that.

Using a logic analyzer and the Defcon Darknet badge, which I had made as a kit at last year's Defcon, I was able to put together something to capture the IR codes. The badge has an IR transmitter and receiver, so it was a convenient device to hook up to without having to take the remote control apart.

As luck would have it, the remote used the standard NEC IR protocol which uses a 38KHz carrier that is modulated to encode a 32 bit value. Dave Jones over at the EEVBlog did a good video that explains this, as well as useful source code. So all that was left was to capture the code for each button, so we had a record of it.

And with that, a handy table of remote control codes:

power 11000001 00101111 11100001 00011110
vga1 11000001 00101111 10100110 01011001
vga2 11000001 00101111 01100110 10011001
video 11000001 00101111 11100110 00011001
source 11000001 00101111 01000000 10111111
auto 11000001 00101111 00100110 11011001
menu 11000001 00101111 00100001 11011110
up 11000001 00101111 01000001 10111110
down 11000001 00101111 10100001 01011110
left 11000001 00101111 11000001 00111110
right 11000001 00101111 10000001 01111110
volume+ 11000001 00101111 00010001 11101110
volume- 11000001 00101111 10010001 01101110
mute 11000001 00101111 11010001 00101110
mag+ 11000001 00101111 00010110 11101001
mag- 11000001 00101111 10101001 01010110
keyst+ 11000001 00101111 01100001 10011110
keyst- 11000001 00101111 01010001 10101110
color 11000001 00101111 11000110 00111001
freeze 11000001 00101111 00000001 11111110
mouse 11000001 00101111 11010110 00101001
blank 11000001 00101111 11110001 00001110

What is interesting is that the fourth byte is a bitwise XOR of the third byte.

So using the sample code I linked to above, I was able to use an Arduino with an IR LED to turn on the projector. At some point I may actually make a clone of the remote, but the point of the exercise was more to archive the information in the event we needed it in the future.
   [ Main Page ][ First New  ]