How to control your home’s infrared enabled devices using your smart phone

Keith Tay
8 min readAug 10, 2020

TL;DR. If you have used a remote control to change your television’s channel, to power on or off your air conditioner or even your fan, you would have been a user of infrared radiation (also known as IR) technology. IR technology was made available to consumers as early as the mid-1950s. Over the past 70 years, its technology has vastly improved to match modern day digital requirements, which is to accommodate more features and controls for consumers. However, the lack of standardisation of IR technology has forced consumers to consider purchasing a universal remote because the original cannot control related functions or interconnected devices. Thus, in a typical home set up today, it is common to find at least 4 IR remote control lying around.

Today, most smart phones have IR capabilities (also known as IR Blaster) installed. IR Blaster is a device that emulates an infrared remote control to autonomously control a device. What this means is that consumers are able to use their own smart phone as a universal remote controller to control all the IR enabled devices at home.

Video 1: Universal remote controller using a smart phone to control IR enabled devices

In this article, I will be sharing some Proof-of-Concepts (PoCs) to send and decode digitally-coded pulses of infrared radiation using Arduino. With that knowledge, you will understand how mobile applications like ‘Smart Remote’ decodes the IR and programs it to a digital button on your phone for the control of any IR enabled devices.

What is Infrared Radiation?

Infrared radiation is a form of light similar to the light we see all around us. The only difference between IR light and visible light is the frequency and wavelength. Infrared radiation lies outside the range of visible light, so humans can’t see it:

Figure 1: Frequency Spectrum

Because IR is a type of light, IR communication requires a direct line of sight from the receiver to the transmitter. It can’t transmit through walls or other materials like WiFi or Bluetooth. — from https://www.circuitbasics.com/arduino-ir-remote-receiver-tutorial/

Typical remote controls use infrared lasers for communication. These lasers can go up to approximately 10 meters. The remote control shoots out pulses of IR energy from a light-emitting diode (LED) to an IR receiver. The receiver converts the light pulses to electrical signals that instruct a microprocessor to carry out the programmed command.

Figure 2: Typical IR transmitter indicators (LED) on remote controls

Learn about IR using Arduino

To follow along, you will need an Arduino (I’m using Uno), an IR Transmitter and Receiver (approximately 2 dollars), a breadboard and any IR remote controller you can find. For me, I picked an IR remote control used for controlling a LED bulb.

If this is the first time you are working on IRRemotes on Arduino, you will need to download the IRRemote library. To do so, head to the Arduino IDE -> Tools -> Manage Libraries -> Search for ‘IRRemote’ -> click on the ‘Install’ button.

Codes to receive and decode IR

In this exercise, we will see the difference in the output of different button press on any IR remote control. As mentioned earlier, the key problem with consumer IR is the lack of synchronisation standards that results in different (de) encoding means. This means that a Sony and a Panasonic device differs in its implementation. Thus, identifying the encoding method is essential in creating a perfect ‘replay’ using the IR transmitter.

Upload the following code to the Uno and activate your serial monitor.

Figure 3: IR Receiver —5v (Orange), Gnd (Green), Pin 7 (Yellow) on the Uno
#include <IRremote.h>
int RECV_PIN = 7; // the pin where you connect the output pin of IR sensor
IRrecv irrecv(RECV_PIN);
decode_results results;
void setup()
{
Serial.begin(9600);
irrecv.enableIRIn();
}
void loop()
{
if (irrecv.decode(&results))// Returns 0 if no data ready, 1 if data ready.
{
int value = results.value;// Results of decoding are stored in result.value
Serial.print(“Code: “);
Serial.println(results.value, HEX);
switch (results.decode_type){
case NEC: Serial.println(“NEC”); break ;
case SONY: Serial.println(“SONY”); break ;
case RC5: Serial.println(“RC5”); break ;
case RC6: Serial.println(“RC6”); break ;
case DISH: Serial.println(“DISH”); break ;
case SHARP: Serial.println(“SHARP”); break ;
case JVC: Serial.println(“JVC”); break ;
case SANYO: Serial.println(“SANYO”); break ;
case MITSUBISHI: Serial.println(“MITSUBISHI”); break ;
case SAMSUNG: Serial.println(“SAMSUNG”); break ;
case LG: Serial.println(“LG”); break ;
case WHYNTER: Serial.println(“WHYNTER”); break ;
case AIWA_RC_T501: Serial.println(“AIWA_RC_T501”); break ;
case PANASONIC: Serial.println(“PANASONIC”); break ;
case DENON: Serial.println(“DENON”); break ;
default:
case UNKNOWN: Serial.println(“UNKNOWN”); break ;
}
Serial.println(“”);
irrecv.resume(); // Restart the ISR state machine and Receive the next value
}
}

By pressing any buttons on your IR remote control, you should be able to see output on the serial monitor. For illustration purposes, Figure 4 shows the on and off operations of the LED bulb and Figure 5 shows the output from my Sharp TV remote. You will notice that different vendors use different bit size and (de) encoding method. Even though the NEC output shows 24 bits, to successfully send an NEC command, we will need to define it to 32 bits (standard).

Figure 4: Output from LED bulb remote control
Figure 5: Output from Sharp TV remote control

Codes to send IR to your home devices

To validate the commands we received from the IR receiver, we will send the same codes that were received and blast it using the respective method. If you are using other devices, instead of using the ‘.sendNEC’ method, you have to modify the method name and the bits accordingly. When you have successfully uploaded the codes, you should see a red LED light blinking on the IR Transmitter (may differ if you are using other models). Another tip is that the IR has to be directly pointing to the device, and do note that it has a smaller line of sight radius compared to the parent device.

Figure 6: IR Transmitter — 5v (Orange), Gnd (Green), Pin 3 (Yellow) on the Uno
#include <IRremote.h>
// Referring to the IRRemote function library, the header file defined PIN 3 as the signal output, so it can only connect to PIN 3. Do check if it out if you’re not using the UNO or wish to change the PIN out.
IRsend irsend;
void setup()
{
}
void loop()
{
delay(1000);
irsend.sendNEC(0xFFE01F, 32);
delay(1000);
irsend.sendNEC(0xFF609F, 32);
}

Now with some knowledge on how IR transmitter and receiver communicates, we will look at using an IR blaster, a smart phone, coupled with a mobile application to control any IR enabled devices.

Build a universal remote controller using a smart phone

Do note that you can only do this if your smart phone has IR built into it. Simply do a google search online or check the surrounding of your phone, if you see a small rounded hole, that could be an indicator that IR is built into the phone. If your phone supports it, what that means is that it has both a IR transmitter and a receiver in place. With an IR receiver, it is able to decode and save the commands. By associating the decoded command to a digital button on an IR mobile application, we can then ‘replay’ commands to the IR enabled device and control it using our phones.

The Smart Remote mobile application is pre-installed on my mobile phone (Huawei). Do note that you can find other similar mobile applications on the appstore. For the Smart Remote application, there are already custom built in templates where if you are attempting to control commonly used devices, simply select it and indicate the brand of the device. Otherwise, if you want to custom design your own remote control, click on the customise icon. For me, I paired everything into one panel to control my LED light bulb, air-conditioner and television. This is really convenient for me as I do not have to move around much to control my devices, worry about finding the remote control or even changing flat batteries.

Figure 7: Options when creating a new panel

When programming a digital key button, the tip is to have the IR remote control be really close to the IR Blaster, preferably a couple of centimetres apart. Anything too far apart will result in an inaccuracy and the likelihood of you reprogramming the key is really high. By placing them a couple of centimetres apart, I get most keys paired right by the third attempt.

Figure 8: Programming digital key on the panel
Figure 9: Recommended distance between the IR remote control and the mobile phone

Conclusion on using IR

All in all, we have seen a couple of IR remote control using different payload size and de (encoding) method. There is not much security mechanism baked into IR as it requires a good line of sight between the transmitter and receiver to communicate. For an attacker to be able to conduct something malicious, he/she has to be within the vicinity with a good line of sight between the devices. Furthermore, consumer IR are mainly used to control simple devices and most of the time, are not used in time sensitive or life critical events.

As a smart home and security enthusiast, I see IR as a standalone technology. From my own perspective, it is difficult and too time consuming to integrate them together with your other smart home technologies (e.g. ZigBee, Wi-Fi, BLE etc.).

If setting up a smart home is too complicated for you, and you are worried that smart devices connecting to the internet have some form of security threats that you could be unaware of, then procuring IR enabled devices and controlling them with a universal remote control may be the best option for you. Lastly, you can say goodbye to all the IR remote controllers lying at home!

--

--

Keith Tay

Cyber-Enthusiast | IoT Specialist | Penetration Testing | Red Teaming