Hey everyone,

I've been working on a little project that I think might benefit a lot of people, but I'm stuck and could use some help.

For anyone that does not know what it is yet, google "WizMote" and check it out.

It's a remote to control Phillips Wiz lights and it runs on an ESP8266.

I've figured out all the button connections and how the power circuits work, so I've got it to the point that you can use the remote for something else if needed, but now I'm trying to figure out the factory signal that it sends out to maybe duplicate it with other devices (such as ttgo t-watch).

This is what I have so far.

The remote sends out a signal using ESP-Now and according to what I've received with another Espressif programmed with ESP-Now, it sends out a 13-byte message. Here's the structure I've got so far.

typedef struct wizstructure {                                             // Data to send by ESP-Now
  byte program;  // Seems to always be set to 145 when power button is pressed and 129
                 // for any other button which suggests it might be used in the programming
                 // sequence for bulbs which make you press the power button.
  byte seq[4];   // Incremental number sent each time a button is pressed. This is done in
                 // order to prevent cloning the signal and and making sure each button press
                 // is uniquely identified. the 4 bytes need to be reverse and combined to make a long.
  byte byte6 = 32;  // Unknown, but this seems to always have a value of 32
  byte button;      // Identifies which button is being pressed
  byte byte8 = 1;   // Unknown, but this seems to always have a value of 1
  byte byte9 = 100; // Unnkown, but this seems to always have a value of 100
  byte byte10;
  byte byte11;
  byte byte12;
  byte byte13;
} wizstructure;

Byte 1 (labeled as program): This only has two values, 145 (10010001) when the power button is pressed and 129 (10000001) for all other buttons. My guess is that this is used in the programming sequence as the programming sequence has you press the power button three times near the bulb(s) being programmed to use the remote.

Byte 2-5: 2 and 3 seem to change incrementally as you press any button while 4 and 5 stay zero. My guess was that these four bits combined make a long, but the order has to be reversed when put together. The order in the structure is least significant byte (not bit) first.

Byte 6: I don't know what this is, but no matter what button is pressed, it never seems to change. It's always 32 (00100000).

Byte 7: This byte determines which button is pressed
On: 1 (00000001)
Off: 2 (00000010)
Sleep: 3 (00000011)
1: 16 (00010000)
2: 17 (00010001)
3: 18 (00010010)
4: 19 (00010011)
Dim: 8 (00001000)
Bright: 9 (00001001)

Byte 8: Seems to always be 1 (00000001)
Byte 9: Seems to always be 100 (01100100)

Bytes 10-13 seem to always be random values.

I have three different remotes and all of them send the same information, so I've verified the known bytes for sure.

When I try to program a device to send out the same signal, I'm able to get through the programming the bulb for the remote, but none of the commands work when I send random values for the last 4 bytes. So, these bytes have to be something, but I'm not sure what.

Does anybody have any experience with ESP-Now and have any idea what those bytes could be? Or does anybody have experience in decoding things like this that might be able to help figure it out?

If there is anything needed to help with this let me know.


This topic was automatically closed 120 days after the last reply. New replies are no longer allowed.