Decoding Weather Station Radio
I love taking things apart, not with a screwdriver this time, but with an antenna.
In this post I decode and “hack” a consumer weather station’s radio chatter using rtl_433 and Universal Radio Hacker. I’ll show how raw RF bursts captured from the air are transformed into readable temperature, humidity, and wind readings.
This project is my first step toward understanding the binary formats and little protocols that live on common consumer devices.
Instead of treating the radio as a black box, I capture a real signal using rtl_433, then inspect the waveform and packets in Universal Radio Hacker, and walk through how bits map to meaningful sensor values.
The Signal
It wasn’t long ago that I picked up an Ambient Weather station and set it up in the backyard, I even started tracking historic data in Grafana:
I however had no idea at the time that this small piece of hardware was broadcasting weather data over a 915 MHz radio, but after watching other IoT devices using rtl_433 I discovered my little guy doing just that.
The rtl_433 software pairs nicely with Universal Radio Hacker as its .cu8 signal files can easily be opened.
Within URH Interpretation view I right click and crop to the radio selection:
I then switch from Analog view to Demodulated:
And then measure the width of a signal burst, to determine sample/symbol width:
It’s at this point I’m ready to move to the Analysis view and view the bits as hex:
Of course at this point it doesn’t mean too much, and as I’m still a noob I have no chance of piecing the data into weather data.
That when I jumped over to the rtl_433 source code and looked up the device model (Fineoffset-WH65B).
The rtl_433](https://github.com/merbanan/rtl_433) author/s are fantastic and documenting the protocol, thanks y’all!
And after reading the comments it looks like after a preamble of hex aa aa aa aa we should be getting a sync work in hex 24 d4, which we are!
All that was left was to mark each of this bits/nibbles/bytes according to the code’s comments.
It was at this point the sensor id, wind direction, and humidity matched my rtl_433 results:
However the temp, wind, and rain were no where near the results being reported, further reading in the comments and I learned in order to get their values we need to do a bit of math:
And like that everything seemed to come together:
Hope you enjoyed this quick brain dump, happy hacking!