Help decode this TPMS

[donys8]

I am currently working on reverse engineering an unbranded aftermarket TPMS sensor operating at 433.92 MHz. I am capturing raw RF data using rtl_433 with a custom decoder configuration:
rtl_433 -R 0 -f 433920000 -g 20.7 -X 'n=mytpms,m=OOK_MC_ZEROBIT,s=124,l=228,r=204,g=0,t=0,y=612,bits>=160'.
The original receiver module from the TPMS kit is based on the CMT2220LY, which further confirms the modulation scheme. I am consistently receiving frames with a fixed length of around 70 to186 bits, starting with a repeating preamble followed by a payload that appears to be encoded. Interestingly, all sensors share the same apparent ID, and the actual sensor differentiation seems to be embedded within the encoded payload. To generate controlled and repeatable data, I am using a pressure chamber setup to vary tire pressure while keeping other conditions stable, and I am logging RF frames at each pressure level. I will also include photos of the product box and the pressure chamber used for testing. Any insights into decoding strategies (such as Manchester decoding alignment, whitening/XOR encoding, or similar TPMS protocols) would be greatly appreciated.

[Front Right]
{186}4000000000000000000000002594de8ea711b3debf0ac7c [26 PSi 27degC]
{186}4000000000000000000000002594faeac375d7bf9e2ba74 [21 PSi 27degC]
{186}4000000000000000000000002594d9c9e056f492f346ca4 [20 PSi 27degC]
{186}4000000000000000000000002594dbcbe254f69233862a8 [18 PSi 27degC]
{186}4000000000000000000000002594f7a78e389af819ac204 [17 PSi 27degC]
{186}4000000000000000000000002594fcac853391f0d164c88 [15 PSi 27degC]
{186}4000000000000000000000002594ddcde452f0afce7bd78 [14 PSi 27degC]
{186}4000000000000000000000002594c191b80eacf150e54e8 [12 PSi 27degC]
{186}4000000000000000000000002594f4e4cd7bd98263d67d8 [11 PSi 27degC]
{186}4000000000000000000000002594f02009bf1d4766d35f4 [9 PSi 27degC]
{186}4000000000000000000000002594eefed761c39bfa8f238 [7 PSi 27degC]

[Front Left]
{186}4000000000000000000000002594ff6e40d6ae19fbce5bc [35 PSi 29degC]
{186}4000000000000000000000002594e3f2dc4a3284a69306c [33 PSi 29degC]
{186}4000000000000000000000002594f9280690e844a693464 [25 PSi 29degC]
{186}4000000000000000000000002594feefc1572f86e712e18 [22 PSi 28degC]
{186}4000000000000000000000002594decfe1770faa4bbe6a4 [19 PSi 28degC]
{186}4000000000000000000000002594c1507ee8903253a6558 [16 PSi 28degC]
{186}4000000000000000000000002594c5547aec94349560b34 [15 PSi 28degC]
{186}4000000000000000000000002594d0416ff9811ffe0bff8 [13 PSi 28degC]
{186}4000000000000000000000002594c697b92f57caeb1e8ac [12 PSi 28degC]
{186}4000000000000000000000002594feefc1572fb4d560d00 [10 PSi 27degC]
{186}4000000000000000000000002594cadbf5631b822396270 [9 PSi 27degC]

[Rear Right]
{186}4000000000000000000000002594f7e6c86bd47a586de74 [26 PSi]
{186}4000000000000000000000002594ea3b15b609a5c4319b8 [25 PSi]
{186}4000000000000000000000002594fe2f01a21db716e34a8 [23 PSi]
{186}4000000000000000000000002594e77658fb44ec0df8518 [22 PSi]
{186}4000000000000000000000002594c2537dde61c6e7129b4 [20 PSi]
{186}4000000000000000000000002594cd5c72d16ecbaa5fd64 [19 PSi]
{186}4000000000000000000000002594c3527cdf60c362973e8 [17 PSi]
{186}4000000000000000000000002594ffeec063dc7d9c29c40 [16 PSi]
{186}4000000000000000000000002594cd1c32912e8eaf1af70 [14 PSi]
{186}4000000000000000000000002594dc0d23803fa1c075bbc [13 PSi]
{186}4000000000000000000000002594d80927843ba706b35d0 [11 PSi]
{186}4000000000000000000000002594d2436dce71eb0abf71c [10 PSi]
{186}4000000000000000000000002594fb6a44e758c1e055bb0 [8 PSi]
{186}4000000000000000000000002594c81937942bbcdd68860 [7 PSi]

[Rear Left]
{186}4000000000000000000000002594f8476c2283ba9b6ea14 [36 PSi 28degC]
{186}4000000000000000000000002594cb341f51f0c7a6539c4 [34 PSi 28degC]
{186}4000000000000000000000002594c7f8d39d3c0e2fda154 [30 PSi 28degC]
{186}4000000000000000000000002594f6c9e2ac0d2302f7254 [26 PSi 28degC]
{186}4000000000000000000000002594ce311a54f5d9388d1bc [25 PSi 27degC]
{186}4000000000000000000000002594e31c3779d8f3d267d10 [24 PSi 27degC]
{186}4000000000000000000000002594fe81aae4456fce7b8c8 [23 PSi 27degC]
{186}4000000000000000000000002594f58aa1ef4e6706b3644 [22 PSi 27degC]
{186}4000000000000000000000002594e45b703e9fbc9d28bec [17 PSi 27degC]
{186}4000000000000000000000002594d669420cad8fae1bad0 [16 PSi 27degC]
{186}4000000000000000000000002594f9466d23829bbacf790 [8 PSi 26degC]
{186}4000000000000000000000002594d9260d43e2f01164d20 [3 PSi 26degC]

[ProfBoc75]

@donys8 , to confirm flex, can you share here , few cu8 zipped captures ?

rtl_433 -R 0 -S unknown

Except the 2 first byte 0x2594 , other values are not stable. We expect stable byte for the temp data, or all are whitened or encrypted.
Not able to find some data layout for the moment.

[ProfBoc75]

@donys8 : I have findings !

Based on your samples, with preamble = 0x00009653 we can extract 9 bytes.

[Front Right]
7a 3a 9c 46 cf 7a fc 2b 1f [26 PSi 27degC]

bitbench

Then, if each 9 byte are XOR, you get 8 byte , like that: b[0] ^ b[1], b[1] ^ b[2], b[2] ^b [3] ...

ID 40a6da89 PRESSURE 181 TEMP 134 ? d7 ? 34 [Front Right 26 PSi 27degC]

bitchench after XOR

And therefore, data layout looks like:

ID: {32}
Pressure: {8} , looks scale kPa, but not linear with little offset.
Temp: {8}, Temp °C, offset 107
Then Unknown flags.

May be the last byte should not be XOR, I will try tomorrow.

[donys8]

Wow, this has cleared things up a lot. How did you calculate the preamble as 0x00009653? Also, the byte after the temperature may be an alert for a low battery, since the default receiver has that feature.

[ProfBoc75]

Wow, this has cleared things up a lot. How did you calculate the preamble as 0x00009653? Also, the byte after the temperature may be an alert for a low battery, since the default receiver has that feature.

First, you need to play with bitbench to simplify all findings, lot of possibilities with bitbench (shift, invert, manchester decoding...), since the length of the frame is 186 bit it's not a multiple of 8 bit (one byte), therefore 2 extra bit here, then if you shift to left by 2 all the bit, you have 0x....0000002594xxxx << 2 = 0x000009653yyyy

Unfortunately, I'm not able to find the CRC or Checksum, can you share few cu8 captures, may be some byte are missing or wrong flex decoder.

Edit: Do you have ID printed directly on the sensor ? This could help confirm the assumption/data layout.
Sometime it's decimal or hexadecimal value, from you samples, you may found : Hexa 40a6da89 = Dec 1084676745
Value may be reversed too, Hexa 89daa640 = Dec 2312808000 , let me know.

[donys8]

Here are some data points I collected
tpms_signal.zip
4sensor.zip

As for the ID itself, I couldn’t find it; the housing only indicates where the sensor is mounted in the car. I even opened it up, but didn’t find any markings.

Edit: 4sensor.zip is data in 0kpa and 27degC

[ct08525]

def decode_tpms_final_stable(hex_str):
    marker = "9653"
    start = hex_str.find(marker)
    payload = bytes.fromhex(hex_str[start+4:])
    
    raw_data = [(payload[i] ^ payload[i+1])  for i in range(len(payload)-1)]
    static_id = "".join(f"{raw_data[b]:02x}" for b in range(0, 4))
    pack = " ".join(f"{raw_data[b]:02x}" for b in range(len(raw_data)))
    
    p_raw = raw_data[4]
    t_raw = raw_data[5]
    state = raw_data[6]
    crc   = payload[0] #raw_data[7]

    calc_crc = 0
    for b in raw_data[0:9]:

        calc_crc ^= b
    calc_crc = (calc_crc ^ payload[8]) & 0xFF 
    
    #pressure = round((p_raw) * 0.01, 2)
    pressure = round((p_raw)**2 * 0.00005, 2)
    temperature = t_raw - 110

    return {
        "ID": static_id,
        "Bar": pressure,
        "Temp": temperature,
        "State": state,
        "CRC": crc,
        "CRC2": calc_crc,
        "RAW": pack
    }

packets = [
  	#[Front Right]
    "00000000000000000000000096537a3a9c46cf7afc2b1f",  #[26 PSi 27degC]
    "0000000000000000000000009653ebab0dd75efe78ae9d",  #[21 PSi 27degC]
    "00000000000000000000000096536727815bd24bcd1b29",  #[20 PSi 27degC]
    "00000000000000000000000096536f2f8953da48ce18aa",  #[18 PSi 27degC]
    "0000000000000000000000009653de9e38e26be066b081",  #[17 PSi 27degC]
    "0000000000000000000000009653f2b214ce47c3459322",  #[15 PSi 27degC]
    "00000000000000000000000096537737914bc2bf39ef5e",  #[14 PSi 27degC]
    "00000000000000000000000096530646e03ab3c543953a",  #[12 PSi 27degC]
    "0000000000000000000000009653d39335ef66098f59f6",  #[11 PSi 27degC]
    "0000000000000000000000009653c08026fc751d9b4d7d",  #[9 PSi 27degC]
    "0000000000000000000000009653bbfb5d870e6fea3c8e",  #[7 PSi 27degC]

	#[Front Left]
    "0000000000000000000000009653fdb9035ab867ef396f",  #[35 PSi 29degC]
    "00000000000000000000000096538fcb7128ca129a4c1b",  #[33 PSi 29degC]
    "0000000000000000000000009653e4a01a43a1129a4d19",  #[25 PSi 29degC]
    "0000000000000000000000009653fbbf055cbe1b9c4b86",  #[22 PSi 28degC]
    "00000000000000000000000096537b3f85dc3ea92ef9a9",  #[19 PSi 28degC]
    "00000000000000000000000096530541fba240c94e9956",  #[16 PSi 28degC]
    "00000000000000000000000096531551ebb250d25582cd",  #[15 PSi 28degC]
    "00000000000000000000000096534105bfe6047ff82ffe",  #[13 PSi 28degC]
    "00000000000000000000000096531a5ee4bd5f2bac7a2b",  #[12 PSi 28degC]
    "0000000000000000000000009653fbbf055cbed3558340",  #[10 PSi 27degC]
    "00000000000000000000000096532b6fd58c6e088e589c",  #[9 PSi 27degC]

	#[Rear Right]
    "0000000000000000000000009653df9b21af51e961b79d",  #[26 PSi]
    "0000000000000000000000009653a8ec56d8269710c66e",  #[25 PSi]
    "0000000000000000000000009653f8bc068876dc5b8d2a",  #[23 PSi]
    "00000000000000000000000096539dd963ed13b037e146",  #[22 PSi]
    "0000000000000000000000009653094df779871b9c4a6d",  #[20 PSi]
    "00000000000000000000000096533571cb45bb2ea97f59",  #[19 PSi]
    "00000000000000000000000096530d49f37d830d8a5cfa",  #[17 PSi]
    "0000000000000000000000009653ffbb018f71f670a710",  #[16 PSi]
    "00000000000000000000000096533470ca44ba3abc6bdc",  #[14 PSi]
    "000000000000000000000000965370348e00fe8701d6ef",  #[13 PSi]
    "000000000000000000000000965360249e10ee9c1acd74",  #[11 PSi]
    "0000000000000000000000009653490db739c7ac2afdc7",  #[10 PSi]
    "0000000000000000000000009653eda9139d63078156ec",  #[8 PSi]
    "00000000000000000000000096532064de50aef375a218",  #[7 PSi]

	#[Rear Left]
    "0000000000000000000000009653e11db08a0eea6dba85",  #[36 PSi 28degC]
    "00000000000000000000000096532cd07d47c31e994e71",  #[34 PSi 28degC]
    "00000000000000000000000096531fe34e74f038bf6855",  #[30 PSi 28degC]
    "0000000000000000000000009653db278ab0348c0bdc95",  #[26 PSi 28degC]
    "000000000000000000000000965338c46953d764e2346f",  #[25 PSi 27degC]
    "00000000000000000000000096538c70dde763cf499f44",  #[24 PSi 27degC]
    "0000000000000000000000009653fa06ab9115bf39ee32",  #[23 PSi 27degC]
    "0000000000000000000000009653d62a87bd399c1acd91",  #[22 PSi 27degC]
    "0000000000000000000000009653916dc0fa7ef274a2fb",  #[17 PSi 27degC]
    "000000000000000000000000965359a50832b63eb86eb4",  #[16 PSi 27degC]
    "0000000000000000000000009653e519b48e0a6eeb3de4",  #[8 PSi 26degC]
    "00000000000000000000000096536498350f8bc0459348",   #[3 PSi 26degC]
    "0000000000000000000000009653e8ac29437fd1558f6a",   #1.5bar
    "0000000000000000000000009653cc880d675bc1449d40",
    "00000000000000000000000096538bcf4a201c20a53f5d"
    ]

print(f"{'Sensor ID':<10} | {'Bar':<5} | {'Temp':<2} | {'Stat'} | {'CRC'} | {'CRC2'} | {'Raw'}")
    for p in packets:
        res = decode_tpms_final_stable(p)
        print(f"{res['ID']:<10} | {res['Bar']:<5} | {res['Temp']}°C | {hex(res['State'])} | {'0x' + hex(res['CRC']).zfill(4)[2:]} | {hex(res['CRC2'])} | {res['RAW']}")

Try to pump more than 3.25 Bar. Bcoz 0xff will turn to 3.25 Bar, and the sensor can measure up to 8 Bar.

[ProfBoc75]

@ct08525 , nice code, but your CRC (XOR checksum) is not valid.

Simple test, just modify any bit into packets, and your CRC is still = CRC2 (calculated) and should not since you alter one bit, the CRC or Checksum must failed. Just because you did XOR twice the same data, A ^ B = C and C ^ A = B or C ^ B = A

raw_data is the first XOR, then you XOR again each value, so you did XOR twice, the reason why you are back to initial value.

[ct08525]

Then, there is no CRC. Reveng.exe failed to detect any. The last byte isn't it also... I'd thought that it is in the 1st byte, and i've already tried that, giving it as the last byte conjuncted to raw_data at the end... But all of this wasn't work.

[ProfBoc75]

Then, there is no CRC. Reveng.exe failed to detect any. The last byte isn't it also... I'd thought that it is in the 1st byte, and i've already tried that, giving it as the last byte conjuncted to raw_data at the end... But all of this wasn't work.

Yes, I did the same already, also using the revdgst tools, no more luck. But I have the same approach, the first value after 0x9653 could be the "seed" then XOR with the data next byte to get the frame, something to deep dive here. More samples could help, like we did on other sensors last weeks...

[ct08525]

When the pressure goes higher than 0x3c, 6th, 5th and 4th bits of the 6th byte are changing from 101 to 110. I guess the second range above 2*0x3C will result in 111 value of this bits. So, first range is 0x3c...0x3b and corresponds 0...~2,5 Bar, the second one - 2,51...~5 Bar, and the last is 5,1...~7,5 Bar.
7th byte probably is polynominal CRC-8.
Added: NO. AI answers this:
DATA: 40 D0 07 8F A2 87 DA 72
DATA: 40 D0 07 8F 56 88 DA 72
DATA: 40 D0 07 8F 4C 88 DA 72
DATA: 40 D0 07 8F 3C 88 9A 72
Why the last byte is the same?

In these four lines, the sum of the bytes varies, but the result is the same. This defeats the CRC or XOR theory.
The 8th byte is an independent information byte.

[ct08525]

Radio.zip
Project for HC-12 v2.6

[ct08525]

I finally tortured the Google AI and get this.

test.zip