30453045 URC-7721 remote

mikelelere · Post by **mikelelere** » Thu Nov 12, 2020 5:26 am

Hi,

I have a URC-7721 remote equipped with an S3F80 MCU, which is JP1.3-compatible even though it neither has a JP1 connector nor holes or pads. After soldering the 6-pin connector directly to the MCU leads, I was able to dump the raw .ir file. I also opened the remote and was able to collect the keycodes from the PCB. Playing a bit with the remote I found that it does not support macros (995 commands), but it does support key moves (994 commands, after programming a new key move, I can see the associated data at relative address $013). I believe that the upgrade area begins at address $103, right after the checksum. With all this information I've composed a very basic RDF file that allows me to download and upload info to the remote.

However, I have failed to get a remote upgrade to work. I think that it is probably because the button map (cloned from the URC7740 RDF) is wrong. I would like to request help from JP1 experts to figure out how to fill in the [ButtonMaps], [DigitMaps], and [Protocols] sections.

I've uploaded a zip file containing the raw .ir download, a photo of the remote, a list of keycodes extracted from the PCB, and the preliminary RDF file I've created at https://www.hifi-remote.com/forums/dload ... e_id=26127

Thanks in advance

Post by **The Robman** » Fri Nov 13, 2020 10:44 am

I have started an RDF for you here:
https://www.hifi-remote.com/forums/dload ... e_id=26129

I have PM'd you for some additional information.

And just in case you need it, here is a user manual for this remote:
https://www.hifi-remote.com/forums/dload ... e_id=26128

Post by **The Robman** » Fri Nov 13, 2020 9:05 pm

The RDF is almost complete, all that is missing is the [Settings] section. I'll need you to experiment with VPT (993 command) to see which bytes change in the raw data.

mikelelere · Post by **mikelelere** » Sat Nov 14, 2020 6:36 am

Thanks very much, Rob for your help! I've been experimenting a bit with the VPT settings, and I think that we now have a complete RDF for the URC-7721. I've uploaded it here: https://www.hifi-remote.com/forums/dload ... e_id=26133. I think that the [Settings] section I've added is correct (given some tests I've conducted) but I may be wrong. I've included in the zip file a table that shows the changes in the raw dump after enabling/disabling VPT for the JP1 experts to review in case the [Settings] section I created is wrong. The upper row shows the offsets of memory positions involved in VPT settings (namely $0F, $10, and $11) and the data in the rows show the memory contents in a given state (e.g. first row shows the memory contents on 981 reset, the second row shows the state after canceling VPT, etc.). The emphasized cells point out the changes wrt the state in the previous row.

As per the tests I've conducted so far, everything seems to be working OK. I will continue testing the remote and will report any issues back here. Again, thank you very much Rob for your help!

Post by **The Robman** » Sat Nov 14, 2020 12:58 pm

This looks good Mike. I do notice that bytes $0E and $12 are unaccounted for, I'm not sure what tests you could run to see if those values ever change (they're "40" and "01" in your raw ir file), but you should keep an eye on them.

mikelelere · Post by **mikelelere** » Sat Nov 14, 2020 6:26 pm

I also noticed that these bytes won't change no matter which tests I run. I will try again with different 9XX commands and will see what happens.

Post by **The Robman** » Sat Nov 14, 2020 9:16 pm

Many of these remotes have a feature in them where, if you change the setup code too often they go into scrambled mode, where they switch around some of the buttons. This mode is intended to catch companies who are trying to steal UEI's codes by learning them to one of their remotes. So, it's quite possible one of the other of those bytes indicate that mode.