Bury 9012 remote control reverse engineering

bury9012

Using Atmel ATMEGA48 driving a Nordic Semiconductor 2402 transmitter with a 16Mhz oscillator.

Programming connector (Standard Atmel):

GND  MOSI  VCC
 6    4     2

RST  SCLK  MISO
 5    3     1

Pin 1 is marked by a square pad


ATMGA48<>2402 comms:

+----------+------------+----------+-------+
|Atmel Pin | Atmel Name | 2402 Pin | Desc  |
+----------+------------+----------+-------+
|   32     |  PD2       |    2     | CS    |
|   31     |  PD1/TxD   |    4     | DIN   |
|   30     |  PD0       |    1     | CE    |
|    2     |  PD4/RxD   |    3     | CLK   |
|    7     |  PB6       |   16     | PWRUP |
+----------+------------+----------+-------+

Protocol description:
On each key press, 3 configuration are sent:
0x03, 0xe6, 0x82
This is broken down as follows:

23-20 - Not used.
19 - PLL - open loop - normal
18 - not used - 0 - (doc says should be 1 ??)
17 - Pre_EN - preamble enabled
16 - Not used - set to 1

15 - CRC_L - set to 1, 16-bit CRC
14 - CRC_EN - set to 1, on-chip CRC generation enabled
13 - Burst - set to 1 - enable ShockBurst(TM) mode.
12 - OD - set to 0 - 250kbps data rate (?? 1Mbps should be more power conservative)
11-9 - set to 3'b011 - 16MHz oscillator
8-7 - set to 2'b01 - transmit at -10dB
6-0 - RF ch# - set to 7'h02 - Transmit at 2402MHz