The first step was to open it up, since the outside didn’t have any distinguishing marks.

No dip switch for setting a code, and no FCC ID. However, I did find the manufacturer’s name (Linear), and some searching got me to the ACT-31B product page, which explained that each remote was factory programmed with a unique code, and that the receiver needed to be programmed to accept individual remotes.

Some additional searching got me the FCC ID EF4 ACP00872, and I was able to look up the device in the FCC database, which provided a ton of information. Specifically, I found that the device transmits at 318 MHz and uses OOK modulation of the carrier wave and a kind of PPM for the data encoding. In addition, there was a block diagram, functional description, and even the entire schematic.

Extracting the code

Since I had a working remote and knew the schematic, I could have just used an oscilloscope to probe the signal pin for the code. Unfortunately, I don’t have a scope (though should really get one), so I went for a more indirect, but fun, approach – an RTL-SDR. This let me extract the actual RF signal the remote transmits. Demodulated:

As we can see, there is an initial sync pulse, followed by 23 data pulses. Each pulse is 1 ms, with one in each 6 ms period. This translates to the code 01001110010010110100010, if we assume that a pulse in the earlier half of the period means a 0. Of course, the actual value of the code doesn’t matter, as long as we can reproduce it.

Transmitting the code

Because the remote uses 318 MHz instead of the more common frequency 315 MHz or 433 MHz, I couldn’t just use a transmitter like this. I briefly considered building a transmitter from scratch, but it would be a little risky since I don’t have much analog experience. Eventually. I decided to ju