Hacking the Sonoff RF Bridge 433

Itead Studio has been releasing interesting gadgets for the Home Automation community based on a low price tag and extreme hackability. You can google “sonoff” (the main brand for Itead Studio home automation devices) to get more than a million hits, including official pages, reviews and lots of hacks. The ubiquitous ESP8266 (or its sibling ESP8285) is the core of all those devices, using WiFi instead of the traditional RF messages, replacing a remote with mobile apps or voice commands. But also, using custom firmwares like ESPurna, technologies and solutions like MQTT, Node-RED or Home Assistant. But one of the latests devices from the chinese firm tries to bridge the gap between those two technologies: the Sonoff RF Bridge 433.

Itead Studio was kind enough to send me an engineer sample before holidays but I have had very few time to work on it. I should have written this post a month ago. Anyway you can buy one from the Itead Studio webshop or in the usual online markets looking for Sonoff RF Bridge [Aliexpress].

Out of the box

If you had read me before you might know that I have critisized the eWeLink app. It’s not that I didn’t like it. I just couldn’t make it work. With every new Sonoff device I gave it a chance and the outcome was always the same. Until now. Last month I tried it with the RF Bridge and the 4CH Pro and it worked like charm. Don’t know what was wrong. Maybe an uncompatibility with some other service or app in my phone. At some point the problem has been addressed and I could finally test it.



It works, you can discover the device, force pair mode for any of the 4 available buttons and use them. it also work with Alexa and eWeLink custom skill. Nice. But I just don’t want to use it. I will not go (I have never gone) much into the app, the user experience, the use cases,… because this is about hacking it with he aim of really own the device and have the freedom to choose what 3rd party services you will use with it, if any at all.

The device


The Sonoff RF Bridge 433 is a small black box with a microUSB port for power, a recessed reset button and three LEDs for notifications (power, custom and radio). The button is connected to GPIO0 on the ESP8266 so it doubles as flash mode button. In the original firmware it sets the device into “discoverable” mode, so you can use the eWeLink app to discover it.


MicroUSB and reset button.


The three LEDs in the front of the device are used in the original firmware to notify radio usage (red), wifi connection (blue) and power (green)

Short section, right. There is really not much more about it. A sticker with a QR linking to the eWeLink user guide.


Opening the box is quite easy with the help of a couple of plastic opening tools. Inside the box there is a single PCB with all the components.


A single PCB holds all the components

On one of the corners you can spot the PCB WiFi antenna and the ESP8285 (an ESP8266 with a 1Mbyte flash memory embedded) along with the required header to flash it (3V3, RX, TX and GND). You also have access to GPIO2 (labelled SDA) on the same header.


In the center of the board you can see the EFM8BB1. An 8-bit microcontroller by SiLabs that manages the radio communication. This is the same microcontroller IteadStudio has used for the Slampher and the Sonoff RF. Moving the real-time encoding and decoding out of the ESP8285 has benefits since those are very time-picky functionalities that could interfere with the WiFi communications.


The EFM8BB1 microcontroller is responsible for encoding and decoding radio messages

But the EFM8BB1 is not alone. There is a SYN470R ASK superhet receiver decoding the messages. You might have also noticed two quarter-wavelength wire antennae, one close to the receiver and the opposite one for transmitting.


The SYN470R ASK decoder and the receiving wire antenna


You can also spot a buzzer for pairing notifications and the ASM1117 regulator.

Finally, a SPDT switch that controlls the communications between the ESP8285 and the EFM8BB1. The communication is done via serial (RX and TX) and that could be a problem when trying to flash a new firmware. Moving the switch to the OFF position you effectively disconnect the communication between both microcontrollers.


The back of the board is empty, all the components are on the front

Enough about the PCB. You can check the schematics for the Sonoff RF Bridge 433 yourself at the IteadStudio wiki.


Flashing it

As we have seen the board has all the connections to allow anyone to flash a custom firmware on the ESP8285 (and on the EFM8BB1, but I will focus on the Espressif chip). All you have to do is:

  • Connect the ESP8286 header to your USB2UART programmer (RX to TX, TX to RX and GND to GND)
  • Place the switch in the OFF position
  • Press and hold the reset button
  • And power the device either via the microUSB port or via the 3V3 pin on the same programming header


At that moment the ESP8285 will boot into flash mode, ready to get a new firmware. If you are using PlatformIO (recommended), just checkouot the ESPurna repository, browse or open the Atom IDE on the code folder and build and flash the itead-sonoff-rfbridge environment. From the console it would be something like:

pio run -e itead-sonoff-rfbridge -t upload

Done. If you are using Arduino IDE instead check out the instructions from the Arduino IDE page in the ESPurna wiki to configure the environment and flash the board.

Since 1.9.0 ESPurna fully supports Sonoff RF Bridge 433 but the approach the firmware uses is quite different from that on the official app.ç

The ESPurna firmware is released as free open software and can be checked out at my Espurna repository on Bitbucket.

Public API

It turns out that the API between the ESP8285 and the EFM8BB1 is public under the serious name of RF Universal Transceive Module Serial Protocol. The document is spare, has one or two typos and misses some basic information, but it’s good enough to interface the EDM8BB1 from you own ESP8285 firmware.

The key points in the API is that:

  • You can set the device in “listen mode” which basically beeps the buzzer to provide some user interaction
  • Any code the SYN470R decodes the EFM8BB1 will report it to the ESP8285
  • The ESP8285 can send raw codes to the EFM8BB1 and it will forward them

So we have a good enough API to work with. The ESP8285 handles the user interaction, stores codes (there is room for more than a 100 different codes in the emulated EEPROM) and commands the 8-bit microcontroller.

From the ESPurna web UI you can manage the stored codes. By default you have 6 ON/OFF pairs but you can change that in the configuration files, anyway it way more than the 4 codes the official app can handle. Once “learnt”, you can use them from the main status page, like you would with any other switch.




Once you have the codes assigned to a certain “virtual” switch you can manage the from MQTT easily by switching the false “relay” on and off:

mosquitto_pub -t /test/rfbridge/relay/0/set -m 1

or using the REST API so you can do that from outside your home too. Check my post about secure access to your IoT devices from the intenet, also with Google Home.

MQTT power

But the firmware also exposes direct access to the Receive Key and Transmit Key Value entry points. That means you can sniff RF messages from Node-RED, for instance, and send them by simply copy paste the codes. Here you have a screenshot of a fully functional interface for the Sonoff RF Bridge 433 in Node-RED. That’s all it takes.


You can sniff and store as many codes as you want or use other apps or services to send them via MQTT. The Sonoff RF Bridge 433 as a true, transparent, MQTT-433MHz-MQTT bridge.

Will it work with any RF device?

I have a couple of old RF switches sets at home. I have used them in the past and time has come to give them a second life. These have slightly different implementations based on the Manchester encoding but since the code does not matter about the message structure itself it shouldn’t matter, right?

Well, as it turns out one of the remotes (branded Noru) works flawlessly but with the other one (Avidsen) the RF Bridge struggles to understand the messages and often requires several tries before they got learnt. So what’s the difference?

My only guess at the moment is the timing. The code structure is simple:

  • Sync time (2 bytes)
  • Low level time (2 bytes)
  • High level time (2 bytes)
  • Data (3 bytes)

So this is what a Noru message looks like: “24E0 0140 0384 D00358”. That means: 9440us sync time, 320us low time and 900us high time. Data is “D00358”, this identifies the button in the remote. The timing is not necessarily strict, but you can see the high time is 3 times longer than the low time and the sync time is 10 times longer than the high time. And the minimum pulse length is around 320us and that’s about 3KHz. The SYN470R datasheet talks about a max frequency of 5KHz when in sweeping mode. The pulses in the Avidsen look like being faster than that… but more investigation is needed here.

RF relays

But apart from the Avidesen remotes all the other devices I have tested have been a success. All the RF enabled products by IteadStudio, of course but I have also bought some extremely cheap RF relays to play with.

The ones I bought are 1 channel 433MHz enabled relays [Aliexpress]. You can buy them alone, with a remote, with an enclosure and they come also in multiple channels [Aliexpress]. They work best in interlock mode, with two different commands to switch them on and off. This way ESPurna will transmit each code several times to ensure the relay has been switched, otherwise it will only transmit it once.

20170830_174255s 20170830_174320s 20170830_174310s

Anyway it’s a really cheap solution for home automation and start controlling your assets with MQTT, Alexa, Google Home or a bunch of other solutions.

Overall this is an enabling device. If you are still using 433MHz devices at home, or if you decided to stop using them because, you know, you never find the remote when you need it, now it may be time to make them talk MQTT (somewhat).

CC BY-SA 4.0 Hacking the Sonoff RF Bridge 433 by Tinkerman is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

93 thoughts on “Hacking the Sonoff RF Bridge 433

  1. Gilbert Brault

    Thanks for this good article!

    I did the same on my side and get some issue sending RF codes out, here is my code, any idea?

    void sonoff::TransmitKey(uint16_t Tsyn, uint16_t Tlow, uint16_t Thigh,uint32_t key ){
    Serial.write(0xAA); // Start of Text
    Serial.write(‘0XA5’); // TransmitKey
    Serial.write(0x55); // End of Text

    1. Xose Pérez Post author

      Those quotes around the transmit ket code (‘0xA5’) shouldn’t be there. Maybe that’s the reason…

  2. Maarten

    Would it be possible to also read weather stations working on 433 mHz and report to eg Domoticz (or alternatives)?

    1. Xose Pérez Post author

      That would require a completely different approach. I very much doubt it would work. The weather station should be transmitting data in 24bits packets using Manchester…

  3. 0xFelix

    Hey Xose,

    I tried ESPurna with my newly acquired RF Bridge but I cannot get it to work properly.

    When trying to learn a new code the RF Bridge beeps once, then I press the button on my original 433 remote and shortly after the RF Bridge beeps twice but nothing happens in the webinterface and the code is not learned. If I press the button on my remote again the RF Bridge beeps twice again without repressing the learning button. After approximately three tries the RF Bridge stays quiet.

    Do you have any idea? I noticed my board looks a bit different than yours. Instead of two 4 pin headers in the middle of the board it has one long 8 pin header. Maybe a hardware problem?


    1. Xose Pérez Post author

      Mine is an engineering sample so it could be that they changed the design before the final release. Anyway what you describe looks like an “incompatible” code for the RFBridge. It beeps when signal is received but the signal doesn’t match the expected protocol/structure. That’s the problem I had with Avidsen remotes, only seldom they are truly “learnt”.

      1. 0xFelix

        I took a peek at the insides of my remote, it uses a HX2262 chip. This chip should be compatible with the 2262 series chips (PT2262), maybe it needs a special kind of configuration. I’ve found a good source of information, there is only one catch: it is german, so maybe not much of use for you.


        I will tinker a bit with these DIP switches and codes… will let you know if I figure something out.

        Thank you for your nice firmware, I really want to use this nice web interface. 😉

          1. 0xFelix

            Hey Xose,

            I’ve taken a different path… I tried to figure out how to calculate codes for my sockets. I have Brennenstuhl RCS 1000 N sockets that use the same protocol as sockets by Elro. There is a library called rfcontroljs which implements this protocol. rfcontroljs calls it ‘switch2’.

            I adapted a bit and had success! I am able to calculate codes for my sockets by hand!

            I put my findings into a Gist:


            I think with a further bit of work a lot of the rfcontroljs protocols could be ported to the Sonoff RF Bridge 433 / ESPurna. Possibly the web interface could also be enhanced, so codes could be calculated automatically according to the used protocol.


          2. Xose Pérez Post author

            Great job Felix!
            I’m glad to see that the choice I made to be able to paste codes was a good idea. I guess the calculations could be done on the client side (javascript), what do you think?

          3. 0xFelix

            Indeed, that was a good idea! Sure, I think a client should be easily able to calculate codes in javascript. My only concern is the limited size of the flash. Do you think several protocols would fit into it? I’d be glad to help implement this feature, if you could guide me in the right direction. Never had much to do with javascript. I suppose an extensible design similar to rfcontroljs would be the best way.

            Also, do you think it would be possible to modify the firmware of the decoder/encoder? Currently only protocols with 2 different pulse lenghts (Tlow & Thigh) and a footer (Tsyn) are supported. Some protocols use more than 3 pulse lenghts, for example KlikAanKlikUit uses 4 different pulses: header, low, high and footer. I think the hardware could support it, but the software is the limiting factor. The ability to send more than 3 different pulse lengths would be great, learning codes could stay as it is. What’s your guess on that?

          4. Xose Pérez Post author

            There is still room in the firmware, after all I don’t it will take more than 2-3K in javascript. My only concern is that, contrary to the C code, everything is included -always- in the javascript code, even thou the device does not use it. I think I will need more preprocessing to the JS and HTML files to only include required functionalities. But there is still enough room for now.

            About flashing a new firmware in the SiLabs micro, well that’s a completely different project… but it will probably allow for greater suppoprt for other remotes…

  4. Göran

    Good article, thanks.

    Any general feeling for what range can be expected?
    Both wifi and 433 MHz range of course depend on antennas, for example.

    I am thinking that maybe two bridges would be needed in a house… which could be set up nicely using mqtt messages sent to any bridge subscribing to the topic in question.

    1. Xose Pérez Post author

      Don’t expect a great range. I live in a two-story house and the signal hardly (not always) reaches 10 meters with 3 walls in between. 433 Remotes use to use a 12V battery to get more transmitting power, the RF Bridge only has a 5V input.

      About the topics, each device has its own topics, if you want them to subscribe to the same topic you will have to do some (slight) changes to the code, or send the message to two different topics…

  5. Roland

    Would be fine if RCS 1000 N with HX2262 will be supported by a new relase. I noticed that I have only Remotes with HX2262 at my home.

  6. Gamester17

    @Xose, do you know anyone with influense over Sonoff products at Itead? If so could you maybe ask them to make a new version of this Sonoff RF Bridge with a much more powerful EFM that is also reprogrammable?

    See all the comments by Stuntteam here => https://www.letscontrolit.com/forum/viewtopic.php?f=9&t=3507

    If only the Sonoff RF Bridge had a much more powerful EFM chip that was also reprogrammable then it could be made to handle many more protocols.

    Stuntteam (developers of the RFLink firmware) wrote in the attatched link that they might even be able to make the full RFLink work on it if it only had a much more powerful EFM chip.

    Perhaps you could convice someone with influense over Sonoff products at Itead to make a “Pro” version of the Sonoff RF Bridge with ESP32 and a much more powerful EFM chip?

    1. Xose Pérez Post author

      I have the contact of a tech guy there. Can ask him if there is any chance they would open the EFM code.

    1. Xose Pérez Post author

      Yes! I’ve also thought about it. Hardware-wise there is a free GPIO on the ESP header, labelled SDA it’s actually GPIO2. I would connect it to a transistor to drive the IR LED from 5V from one of the regulator legs. You won’t be able to do learning so you will need a separate device to sniff codes from your IR remote, and then copy them to the RFBridge.

      1. NameZero

        Maybe it is better to create a board with esp-12 and IR +RF (emitter + receiver ). it will be much better than the sonoff bridge.

    1. Xose Pérez Post author

      I agree with him, you are limited to what the EFM can do. Maybe it’s not a “piece of junk” but certainly it could be a plus to reprogram the EFM. Unfortunately that falls outside my skills at the moment…

  7. mark harding


    is it possible to use this as just a received unit without the learning that will then forward the relevant codes over to node-red for example. i have a number of 433 door switches so would like them to just be picked up by the rfbrige and then transmit the code to somewhere be it mqtt or something that i can then interpret to the door is open for example. no need to learn it just forward it!!

    1. Xose Pérez Post author

      Yes, learning helps with the user feedback but you can send or receive raw codes via MQTT to and from Node-RED without having to learn them previously.

      1. mark harding

        in which case i’m off to open it up and flash it!!! that’s the main reason i needed the unit to go in a room with a few 433mhz switches so saves running cabling everywhere for window states!!

      2. Michael

        Hello, I’m trying to get the RF bridge to forward RF messages from window sensors to the RF bridge and then via MQTT to Node-Red but I’m not sure if I’m missing something but subscribing to all topics I was not able to receive anything. Is there a way I can achieve this?

      3. Michael

        Forget my previous message I didn’t switch the switch on the board back to the original position after flashing it. thanks!

  8. mark harding

    any suggestions

    [WIFI] Connecting to BSSID FF:3F:44:04:00:00 – CH 00 – SSID **chubz**
    [RELAY] Saving mask: 0
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [WIFI] Could not connect to **chubz**
    [WIFI] Creating access point
    [WIFI] MODE AP ————————————–

    1. Xose Pérez Post author

      All those “[RF] Disabled” messages mean you have enabled the RF module which is not meant for the RFBridge, but for a custom RFlink module. Custom, hand-made, codes should be written in the web UI tab for the RFBridge.

    1. Xose Pérez Post author

      That would require to flash a new firmware into the EFM8 micro, the one responsible for the decoding. Not in the roadmap, sorry.

  9. sunbit

    First time ESPurner here, congrats for your work, its awesome. A quick doubt, when you refer to the “reset button” in the flashing process, it’s the button on the RF bridge that is used to pair the device, or it should be another button (cannot spot another one)

    Thank you!

      1. Carles Bruguera

        Succesfully flashed and started to play with ESPurna, but i have some issues while learning the codes. First i was never receiving the code, but i kept trying as you say on the RFBRIDGE section of the ESPURNA web ui. Then after two learnt codes, from different buttons i realized that the codes where the same, and any of the two worked when switching. Then, trying to learn another code from another button, no code appeared. I’ve logged the serial output while doing this. If you happen to find some time to take a look at it, i saved it here https://pastebin.com/60agEsYA, with some comments. Just comment that with the original rfbridge firmware i was able to learn and use the rf switches without any problem, if it helps.

        Thank you!

        1. Xose Pérez Post author

          Obviously the codes are wrong. A slight difference in the 6 first bytes is common (they are times in microseconds) but the 3 last bytes should be the same for the same button every time it is learnt (and different from other buttons, of course).
          Could you please try setting DEBUG_SERIAL_SUPPORT to 0 in the hardware.h section for the RFBRIDGE to remove any noise in the UART communication between the two microcontrollers and try again?

          #define DEBUG_SERIAL_SUPPORT 0

          1. Carles Bruguera

            It’s already set to 0. I just updated the code from bitbucket to make sure we’re using the same version https://bitbucket.org/xoseperez/espurna/src/8cda4acd37db64080c0ceebdf8492552d2943442/code/espurna/config/hardware.h?at=master&fileviewer=file-view-default#hardware.h-324

            Also i want to point that the only time i was able to learn codes (even if they are wrong) was with the serial port connected. With the FTDI cables unattached, no code ever was learnt.


          2. Xose Pérez Post author

            Could it be a power supply issue? There is nothing special about having it wired… I just checked with the RFBridge I have and it works great with 2 of the 3 remotes I own and pretty bad with the 3rd one…

  10. Kruu

    Great, one more time. I am just interested in Domoticz setup before I flash espurna on my rf bridge.

    Can I add door magnet sensor with open/close function and that would be one switch in domoticz? So I know when is window opened and when closed.


    1. Xose Pérez Post author

      With ESPurna you can define the door magnet sensor as a button and get the status via MQTT but you will have to translate those MQTT messages to Domoticz MQTT topics since it is not supported at the moment.

  11. RJ

    I just got the sonoff bridge, and I’m trying to make it worth my some new automatic curtains I have (by Dooya). After talking to engineers with itead (maker of the bridge) AND dooya, it seems it’s incompatible because dooya uses encrypted rolling channels, while supposedly the bridge can only pick up on fixed channels. Do you think there’s a way around this limitation?

    1. Xose Pérez Post author

      If they really use rolling channels you are out of luck. I have seen some dooya hack on the Internet thou, and they seem to work fine with fixed channel simple RF links…

  12. Kåre Rasmussen

    Hi, I just got the device home, and want to add it to my hoe automation using MQTT. The usecase is using Sonoff magnetic door switches and the motion detector. How do I setup a connection to those devices after I have flshed you FW into the bridge? also can I identifi different sensors, so I see what motiondetector that was trigered?
    thank you 🙂

    1. Xose Pérez Post author

      There is another user trying to get the messages from those devices without much success… Apparenty it should work since the decoding is done in the secondary microcontroller which ESPurna does not touch at all… I don’t own one of those sensors myself, so I can’t really tell.

      1. Portisch


        I was starting a alternative firmware for the EFM8BB1:

        Somebody is interressted to give me some help – and time!?

        Right now this is only a basic implementation – but it is working!

        First tests with a RF remote from Rohrmotor24.de:
        Learning: 0xAA 0xA1 0x55
        AKN: AA A0 55
        RF Read:
        00000000 11010000 11111001 00110010 00010001 00010001 // Up
        00000000 11010000 11100000 00000010 00010001 00110011 // Down

        Feel free to visit me at github.

        1. Xose Pérez Post author

          That’s great!!! I’d like to contribute but I’m really busy atm. One thought about the communication protocol with the “host” microcontroller (the ESP8266): I think it should be backwards compatible so it will still work with non-customized RFBridges. Maybe using different action codes for newly supported codes.

  13. Pingback: 433 MHz Support in Node-RED - JackenHack

  14. Portisch

    I was testing the EFM8BB1 this week. It’s quite simple with Simplicity Studio, but the MC is quite limited. Especially big arrays aren’t possible. I think a UART buffer of 64 bytes are already the limit…

    I need a idea what is the better way for decoding and encoding RF signals. The RF signals I was testing do have a Duty cycle of 33% (logic 1) and a Duty cycle of 66% (logic 0). Can this be used for a lot of RF signals?
    For this timings only the frequency have to be known. For Rohrmotor24 as example it is 1kHz: Long pulse ~700us, short pulse ~300us.
    Or is it better to use a pulse timing for this?

    If this can be used encoding of byte to bits is really simple with the PCA, PWM Waveform generation.

  15. Tomislav

    After flash i can’t see wifi? Can someone help?

    Detecting chip type… ESP8266
    Chip is ESP8266
    Uploading stub…
    Running stub…
    Stub running…
    1048576 (100 %)
    1048576 (100 %)
    Read 1048576 bytes at 0x0 in 94.3 seconds (89.0 kbit/s)…
    Hard resetting…

    1. Xose Pérez Post author

      Try debugging it via serial to see the debug messages. Open a serial communication to your programmer device at 115200 bauds.

  16. Portisch

    I almost finshed the alternative firmware for the EFM8BB1.
    But I need some information about RF signals!

    The RF remote I have is simple to decode:
    SYNC: 4500µs high, 1500µs low
    Than the data is following with this timing:
    A logic 1 is a duty cylce of 30% (700µs high, 300µs low)
    A logic 0 is a duty cylce of 60% (300µs high, 700µs low)

    So the data what is needed looks like this:
    typedef struct
    // Protocol specific identifier
    uint8_t IDENTIFIER;
    // normal high signal time on sync pulse
    uint16_t SYNC_HIGH;
    // normal low signal time on sync pulse
    uint16_t SYNC_LOW;
    // time in µs for one bit. This is the sum of the high and low time of on bit
    // example bit 1: high time 700µs, low time 300µs: sum is 1000µs
    uint16_t BIT_TIME;
    // bit count for this protocol
    uint8_t BIT_COUNT;

    #define SYNC_TOLERANCE 200

    * Rohrmotor24
    * https://github.com/bjwelker/Raspi-Rollo/tree/master/Arduino/Rollo_Code_Receiver
    #define ROHRMOTOR24_IDENTIFIER 0x01
    #define ROHRMOTOR24 {ROHRMOTOR24_IDENTIFIER, 4800, 1500, 1000, 40}
    * Protocol array
    static const PROTOCOL_DATA_t PROTOCOL_DATA[1] = { ROHRMOTOR24 };

    The EFM8BB1 only needs in this way a size of 64 + 5 bytes of the UART buffer to be able to transmit 512 bits:

    With this information the EFM8BB1 will do:
    Transmit a high pulse of SYNC_HIGH of IDENTIFIER 0x01
    Transmit a low pulse of SYNC_LOW of IDENTIFIER 0x01
    Than starting the bittransfer with 1kHz (1000µs BIT_TIME) for each byte.

    The DATA_LEN is needed because of a possible value 0x55 as data what is equal to the UART SYNC_END.
    But maybe it can be skipped if the DATA_LEN is calculated by the known IDENTIFIER.
    Because of this IDENTIFIER the bit count is known.

    Is this approach usable for other RF signals?
    I took a look to the source of RFLink but there is the pulse high time measured for each pulse.
    This will need an minimum array size of 512 bytes what will not fit into the EFM8BB1.
    Also the low time of each pulse is missing – so transfer is not possible.

    1. Xose Pérez Post author

      Not an expert but I think timing is very important. But maybe it would be enough to be able to define the sync pulse and the frequency and duty cycle of the data. Minimum requirement should be to be able to reproduce what the original firmware does with your 0xA8 command.

  17. Mat Smith

    Thanks for the brilliant write-up and video. I was curious about the device but I didn’t think I’d find someone who would answer all my questions. For example: is there any way to send raw codes to the device for sending out any RF signal (i.e. not limited to a finite number of memory “slots”). Glad to see the answer is “yes”.

    I have only just received my Sonoff devices for testing (sonoff dual, single, RF, bulb, and sonoff power monitor) and I haven’t flashed them yet. After getting extremely annoyed trying to use the app to control the bulb (it’s really bad in my opinion, not bright and the app basically doesn’t work, the colours are all mixed up, waste of money

  18. Mat Smith

    Ooops, hit submit by accident! Anyway, I found the app a complete disaster and the bulb (the RGB one) is very low quality compared with Philips Hue.

    So my plan was to flash my Sonoffs with Tasmota – but seeing this, I think I’ll get it up and running with ESPurna instead. Excellent stuff – thanks again for the great write-up. Really appreciate the detail!

    1. Xose Pérez Post author

      The Sonoff B1 (the Sonoff bulb you mention I guess) is not worth it unless you want a warm white light. It’s the only bulb I have tested what has 5 channels (RGBWW) but colors are so dim they are only useful for notification and alike. There are still some issues with the RF Bridge I’m trying to sort out, hopefully soon.

  19. willcm

    Hi, great write up and superb software. I’ve got my Sonoff RF Bridge all flashed with Espurna.

    I’m having trouble getting Espurna to learn the code I need it to replicate.

    I’ve managed to sniff and replicate my RF thermostat code and can succesfull control my boiler using an ESP8266 board.

    When I try to sniff this code using Espurna’s built in learn function, nothing is picked up. Is there a way I can use the custom ino file with Espurna?

    1. Xose Pérez Post author

      There is known issue with the learning functionality that, apparently, does not happen with the engineering sample I have (I can’t see why). I’m waiting for a new unit to test it.

  20. macscr

    I bought this planning to do the same, but seems my sonoff rf bridge doesn’t have the header pins available and i would have to do some soldering just to flash it. What a pain. I think I might just scrap the idea. Their stock firmware is practically useless.

        1. Xose Pérez Post author

          Should not be hard to solder a header on J2. The button is labelled E_FW, so just connect you programmer to the J2 header, press the button and power the board to get into flash mode.

          1. macscr

            Ugh. Seems like mine has firmware 1.1.0 on it according to ewlink and I didnt have any luck flashing it. Should anything show in the serial console during startup if i have it connected correctly with a USB to TTL adapter?

  21. Tom

    Great WORK… Thx to you!!! With Telnet i was able to learn/store all my Remotes…. (just copy/paste the 18 characters you see in the log of the Telnet-Client)

    BUT ONE THING: The RF433 Bridge store the last state of the relay…. that works not for me. Cause i use also other Remotes. So it happen, that the bridge do not send the code !!!!

    Could it be changed in the Sketch… i do not find the releated code!


    1. Xose Pérez Post author

      Problem is that the RFBridge can only store the state if it “sees” the messages, otherwise it will go out of sync. There no easy way around it…

    1. Xose Pérez Post author

      Hard to tell. By you comment I guess it worked before you changed your router. Does it use a different ssid, password, encryption,…?

    1. Xose Pérez Post author

      Look for the ITEAD_SONOFF_RFBRIDGE definitions in the hardware.h file and change the value of the DUMMY_RELAY_COUNT setting to whatever you want.

  22. Markus

    Does it still work? Even with an Echo 2 including the new Firmware. There are some issues with the WeMo Emulation…

    1. Xose Pérez Post author

      The fauxmoESP library is not compatible with new v2 devices. There is an open issue on the bitbucket repo.

  23. Ian Addinsell

    Hi. I’ve bought the Sonoff RF 433 in the hope that it would be able to learn the codes from my ACMEDA remote control for my motorised roller blinds.
    Silence reins.
    Anyone able to suggest where I start – to work out what might need to be done to the sonoff to achieve success. It was said further up that it they needed several attempts to achieve success in reading codes. Am I in that realm or somewhere else?

    I have a RPi B gathering dust.

    It also ignores my garage remote control too, not that I want to go there.


    1. Xose Pérez Post author

      They probably use a different encoding protocol… you should first try to find out if it’s documented somewhere. But chances are they use some kind of hoping encoding, in that case you are (almost certain) out of luck.

  24. Andrew Way

    This is great! After flashing my Magic Home LED controllers and been so impressed I bought a range of Sonoff devices to play with. The flashed RF bridge is ideal for my Domoticz/RFXcom home automation software as I’ve now got the bridge in an area of the house where I was having reception problems. The bridge is acting as a repeater and has fixed my reliability issues… for £8… fantastic!

    Thank you!

  25. GearKlik

    Hi! Is there any visual signs on the RF bridge board for RX/TX while uploading firmware to it? Flashing LEDs etc. PlatformIO console reports that ESPurna has been successfully built and uploaded, but I don’t see any wifi access point to connect to the RF Bridge. When it turns on I just get a solid green LED. Stock Sonoff firmware the blue led was also flashing when the bridge was turned on

    1. Xose Pérez Post author

      The blue light should be blinking at 1Hz after flashing ESPurna the first time, otherwise the flash was not fine or the device is in an unstable status. You can also check the debug log through the UART interface (open a serial console at 115200 bauds).

  26. Rod

    Hello Xose – thanks for all of your tireless work on this firmware.

    I’m using the bridge along with the firmware 1.11.2 in the V2 Bridge (the solid gold wires antenna)

    I’ve left all fields unchanged (exactly as the brand new firmware), except my WiFi and new login password.

    I intend to operate it on my Home Assistant which is running on my Raspberry Pi 3.

    In your firmware – I enabled Home Assistant under Espurna “General” tab.

    I also own a Sonoff 4 button “ABCD” key-fob. I’ve entered 4 codes into the Espurna web interface. All operations are working outside of Home Assistant, showing in the Espurna Firmware and on the Hardware red light flash.

    Home Assistant:

    Enabling HomeAssistant in your Espurna RF Bridge webpage DOES give me a working single soft switch in the Home Assistant main page, and the operation is confirmed in the Espurna Web “Status” page. It operates a single channel (0).

    I installed MQTT Broker into HA In an attempt to control the Bridge using MQTT through Home Assistant, I then added the following into the HA config.yami using your guide, and the Above youtube video.

    mqtt: broker:

    switch: – platform: mqtt

    name: “RF Bridge”

    state_topic: “/test/ESPURNA_9EF6C9/relay/0/set”

    command_topic: “/test/switch/ESPURNA_9EF6C9/relay/0/set”

    payload_on: 1

    payload_off: 0

    optimistic: false

    qos: 0

    retain: true

    The above config produces a Switch Icon on the Home Assistant “Overview” page called “RF Bridge”.
    I can switch with a mouse, but it returns to off position (momentary -on-off) This does not translate to any operation on the Sonoff Bridge or the Espurna webpage, or nothing on a Subscribed topic in MQTT.fx

    However, using MQTT.fx, I can see the key fob device operation in the same log, but Home Assistant does not recognise ANY operation of ANY switch using the above config – even if I change the relay number to 1, or 2, etc..

    Can you review my steps to see whether I have made any errors?

    I wonder if there is some different syntax for the above config specifically this RF Bridge

    Many thanks – Happy New Year! Rod

    1. Xose Pérez Post author

      State topic should be “/test/ESPURNA_9EF6C9/relay/0” (no “set”, that’s for the command).

  27. Brian

    Hi guis, I want to my device can alert with Alarm Sensor. And I want to get signal from a pin to transfer ringtone. But I can’t code with microcontrollers. Can you help me? Thank you very much!

    1. Xose Pérez Post author

      I’m sorry but I just can’t code for anyone asking for it… I hope you understand.

  28. macscr

    Ok, got it working finally with espurna. Woo hoo. Is there a way make this simply a receiver? What my end goal is to be able to use the remote and home assistant to control my switches. I already have my broadlink setup to transmit, but wondering if i can setup the sonoff bridge then to receive any inputs from the remotes so that they know the switch has been turned on or off and can tell home assistant what has done. If not, home assistant wouldn’t know what state they are in. Thoughts? Im open to ideas.

    1. Xose Pérez Post author

      In the RFBridge you are only changing the firmware of the ESP8266, there is a second microcontroller and a decoding chip responsible for the radio communication. Without changing that too you are limited to what the protocol that microcontroller has been programmed to use. If you need something more flexible I recommend you to have direct access to a 433 receiver.

      1. macscr

        Im confused. I thought you could use it an RF receiver that would then send MQTT messages to whatever target i specify, like homeassistant. Am i wrong? Seems the OpenMQTTGateway dev is saying your solution will do it as well.

        1. Xose Pérez Post author

          You are not confused, that’s what it does, as long as the protocol of the messages is supported. 433MHz is just a transport, the way you encode the information and the protocol you use sit on top of that.

  29. Tof

    HI Xose,
    Thanks a lot for ESPurna and the Sonoff RF Bridge exploration.

    I’ve received this bridge yesterday, apparently v2 like the one macscr posted picture of it.
    Soldered header pins on J2, plugged my USB-TTL dongle and flashed it with esptool method and a compiled binary image (espurna-1.11.3-itead-sonoff-rfbridge.bin). https://bitbucket.org/xoseperez/espurna/wiki/Binaries.md

    Nice ! I’m currently playing with my old 433 plugs through MQTT 🙂

    I’ve found ESPurna to be very well made and very convenient to use. There is a lot I’ve to learn by digging into your code, specially to first-time-use and configuration that always sucks in my own ESP8266 projects.

    I’ve used the esptool.py method because it’s the easiest and quickest way to start to play with the RF bridge on ESPurna (PlatformIO I don’t get used to it yet, and ArduinoIDE too much libraries to install manually).
    But later I think I’ll study PlatformIO usage, as I’d like to control 16 switches and may be use other IO ports (J5 apparently gives access to IO4 and IO5).

    1. Xose Pérez Post author

      Great, thanks!

      I strongly recommend to try PlatformIO. I’m not saying it’s perfect but it gets close to perfect. Give it a chance and you won’t regret it.


Leave a Reply (all comments are moderated, be patient)