Hacking the Sonoff RF Bridge 433

Itead Studio has been releasing interesting gadgets for the Home Automation community based on a low price tag and extreme hackability. You can google “sonoff” (the main brand for Itead Studio home automation devices) to get more than a million hits, including official pages, reviews and lots of hacks. The ubiquitous ESP8266 (or its sibling ESP8285) is the core of all those devices, using WiFi instead of the traditional RF messages, replacing a remote with mobile apps or voice commands. But also, using custom firmware like ESPurna, technologies and solutions like MQTT, Node-RED or Home Assistant. But one of the latests devices from the chinese firm tries to bridge the gap between those two technologies: the Sonoff RF Bridge 433.

Itead Studio was kind enough to send me an engineer sample before holidays but I have had very few time to work on it. I should have written this post a month ago. Anyway you can buy one from the Itead Studio webshop or in the usual online markets looking for Sonoff RF Bridge [Aliexpress].

Out of the box

If you had read me before you might know that I have critisized the eWeLink app. It’s not that I didn’t like it. I just couldn’t make it work. With every new Sonoff device I gave it a chance and the outcome was always the same. Until now. Last month I tried it with the RF Bridge and the 4CH Pro and it worked like charm. Don’t know what was wrong. Maybe an uncompatibility with some other service or app in my phone. At some point the problem has been addressed and I could finally test it.



It works, you can discover the device, force pair mode for any of the 4 available buttons and use them. it also work with Alexa and eWeLink custom skill. Nice. But I just don’t want to use it. I will not go (I have never gone) much into the app, the user experience, the use cases,… because this is about hacking it with he aim of really own the device and have the freedom to choose what 3rd party services you will use with it, if any at all.

The device


The Sonoff RF Bridge 433 is a small black box with a microUSB port for power, a recessed reset button and three LEDs for notifications (power, custom and radio). The button is connected to GPIO0 on the ESP8266 so it doubles as flash mode button. In the original firmware it sets the device into “discoverable” mode, so you can use the eWeLink app to discover it.


MicroUSB and reset button.


The three LEDs in the front of the device are used in the original firmware to notify radio usage (red), wifi connection (blue) and power (green)

Short section, right. There is really not much more about it. A sticker with a QR linking to the eWeLink user guide.


Opening the box is quite easy with the help of a couple of plastic opening tools. Inside the box there is a single PCB with all the components.


A single PCB holds all the components

On one of the corners you can spot the PCB WiFi antenna and the ESP8285 (an ESP8266 with a 1Mbyte flash memory embedded) along with the required header to flash it (3V3, RX, TX and GND). You also have access to GPIO2 (labelled SDA) on the same header.


In the center of the board you can see the EFM8BB1. An 8-bit microcontroller by SiLabs that manages the radio communication. This is the same microcontroller IteadStudio has used for the Slampher and the Sonoff RF. Moving the real-time encoding and decoding out of the ESP8285 has benefits since those are very time-picky functionalities that could interfere with the WiFi communications.


The EFM8BB1 microcontroller is responsible for encoding and decoding radio messages

But the EFM8BB1 is not alone. There is a SYN470R ASK superhet receiver decoding the messages. You might have also noticed two quarter-wavelength wire antennae, one close to the receiver and the opposite one for transmitting.


The SYN470R ASK decoder and the receiving wire antenna


You can also spot a buzzer for pairing notifications and the ASM1117 regulator.

Finally, a SPDT switch that controlls the communications between the ESP8285 and the EFM8BB1. The communication is done via serial (RX and TX) and that could be a problem when trying to flash a new firmware. Moving the switch to the OFF position you effectively disconnect the communication between both microcontrollers.


The back of the board is empty, all the components are on the front

Enough about the PCB. You can check the schematics for the Sonoff RF Bridge 433 yourself at the IteadStudio wiki.


Flashing it

As we have seen the board has all the connections to allow anyone to flash custom firmware on the ESP8285 (and on the EFM8BB1, but I will focus on the Espressif chip). All you have to do is:

  • Connect the ESP8286 header to your USB2UART programmer (RX to TX, TX to RX and GND to GND)
  • Place the switch in the OFF position
  • Press and hold the reset button
  • And power the device either via the microUSB port or via the 3V3 pin on the same programming header


At that moment the ESP8285 will boot into flash mode, ready to get a new firmware. If you are using PlatformIO (recommended), just checkouot the ESPurna repository, browse or open the Atom IDE on the code folder and build and flash the itead-sonoff-rfbridge environment. From the console it would be something like:

pio run -e itead-sonoff-rfbridge -t upload

Done. If you are using Arduino IDE instead check out the instructions from the Arduino IDE page in the ESPurna wiki to configure the environment and flash the board.

Since 1.9.0 ESPurna fully supports Sonoff RF Bridge 433 but the approach the firmware uses is quite different from that on the official app.ç

The ESPurna firmware is released as free open software and can be checked out at my Espurna repository on GitHub.

Public API

It turns out that the API between the ESP8285 and the EFM8BB1 is public under the serious name of RF Universal Transceive Module Serial Protocol. The document is spare, has one or two typos and misses some basic information, but it’s good enough to interface the EDM8BB1 from you own ESP8285 firmware.

The key points in the API is that:

  • You can set the device in “listen mode” which basically beeps the buzzer to provide some user interaction
  • Any code the SYN470R decodes the EFM8BB1 will report it to the ESP8285
  • The ESP8285 can send raw codes to the EFM8BB1 and it will forward them

So we have a good enough API to work with. The ESP8285 handles the user interaction, stores codes (there is room for more than a 100 different codes in the emulated EEPROM) and commands the 8-bit microcontroller.

From the ESPurna web UI you can manage the stored codes. By default you have 6 ON/OFF pairs but you can change that in the configuration files, anyway it way more than the 4 codes the official app can handle. Once “learnt”, you can use them from the main status page, like you would with any other switch.




Once you have the codes assigned to a certain “virtual” switch you can manage the from MQTT easily by switching the false “relay” on and off:

mosquitto_pub -t /test/rfbridge/relay/0/set -m 1

or using the REST API so you can do that from outside your home too. Check my post about secure access to your IoT devices from the intenet, also with Google Home.

MQTT power

But the firmware also exposes direct access to the Receive Key and Transmit Key Value entry points. That means you can sniff RF messages from Node-RED, for instance, and send them by simply copy paste the codes. Here you have a screenshot of a fully functional interface for the Sonoff RF Bridge 433 in Node-RED. That’s all it takes.


You can sniff and store as many codes as you want or use other apps or services to send them via MQTT. The Sonoff RF Bridge 433 as a true, transparent, MQTT-433MHz-MQTT bridge.

Will it work with any RF device?

I have a couple of old RF switches sets at home. I have used them in the past and time has come to give them a second life. These have slightly different implementations based on the Manchester encoding but since the code does not matter about the message structure itself it shouldn’t matter, right?

Well, as it turns out one of the remotes (branded Noru) works flawlessly but with the other one (Avidsen) the RF Bridge struggles to understand the messages and often requires several tries before they got learnt. So what’s the difference?

My only guess at the moment is the timing. The code structure is simple:

  • Sync time (2 bytes)
  • Low level time (2 bytes)
  • High level time (2 bytes)
  • Data (3 bytes)

So this is what a Noru message looks like: “24E0 0140 0384 D00358”. That means: 9440us sync time, 320us low time and 900us high time. Data is “D00358”, this identifies the button in the remote. The timing is not necessarily strict, but you can see the high time is 3 times longer than the low time and the sync time is 10 times longer than the high time. And the minimum pulse length is around 320us and that’s about 3KHz. The SYN470R datasheet talks about a max frequency of 5KHz when in sweeping mode. The pulses in the Avidsen look like being faster than that… but more investigation is needed here.

RF relays

But apart from the Avidesen remotes all the other devices I have tested have been a success. All the RF enabled products by IteadStudio, of course but I have also bought some extremely cheap RF relays to play with.

The ones I bought are 1 channel 433MHz enabled relays [Aliexpress]. You can buy them alone, with a remote, with an enclosure and they come also in multiple channels [Aliexpress]. They work best in interlock mode, with two different commands to switch them on and off. This way ESPurna will transmit each code several times to ensure the relay has been switched, otherwise it will only transmit it once.

20170830_174255s 20170830_174320s 20170830_174310s

Anyway it’s a really cheap solution for home automation and start controlling your assets with MQTT, Alexa, Google Home or a bunch of other solutions.

Overall this is an enabling device. If you are still using 433MHz devices at home, or if you decided to stop using them because, you know, you never find the remote when you need it, now it may be time to make them talk MQTT (somewhat).

CC BY-SA 4.0 Hacking the Sonoff RF Bridge 433 by Tinkerman is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

146 thoughts on “Hacking the Sonoff RF Bridge 433

  1. Gilbert Brault

    Thanks for this good article!

    I did the same on my side and get some issue sending RF codes out, here is my code, any idea?

    void sonoff::TransmitKey(uint16_t Tsyn, uint16_t Tlow, uint16_t Thigh,uint32_t key ){
    Serial.write(0xAA); // Start of Text
    Serial.write(‘0XA5’); // TransmitKey
    Serial.write(0x55); // End of Text

    1. Xose Pérez Post author

      Those quotes around the transmit ket code (‘0xA5’) shouldn’t be there. Maybe that’s the reason…

  2. Maarten

    Would it be possible to also read weather stations working on 433 mHz and report to eg Domoticz (or alternatives)?

    1. Xose Pérez Post author

      That would require a completely different approach. I very much doubt it would work. The weather station should be transmitting data in 24bits packets using Manchester…

  3. 0xFelix

    Hey Xose,

    I tried ESPurna with my newly acquired RF Bridge but I cannot get it to work properly.

    When trying to learn a new code the RF Bridge beeps once, then I press the button on my original 433 remote and shortly after the RF Bridge beeps twice but nothing happens in the webinterface and the code is not learned. If I press the button on my remote again the RF Bridge beeps twice again without repressing the learning button. After approximately three tries the RF Bridge stays quiet.

    Do you have any idea? I noticed my board looks a bit different than yours. Instead of two 4 pin headers in the middle of the board it has one long 8 pin header. Maybe a hardware problem?


    1. Xose Pérez Post author

      Mine is an engineering sample so it could be that they changed the design before the final release. Anyway what you describe looks like an “incompatible” code for the RFBridge. It beeps when signal is received but the signal doesn’t match the expected protocol/structure. That’s the problem I had with Avidsen remotes, only seldom they are truly “learnt”.

      1. 0xFelix

        I took a peek at the insides of my remote, it uses a HX2262 chip. This chip should be compatible with the 2262 series chips (PT2262), maybe it needs a special kind of configuration. I’ve found a good source of information, there is only one catch: it is german, so maybe not much of use for you.


        I will tinker a bit with these DIP switches and codes… will let you know if I figure something out.

        Thank you for your nice firmware, I really want to use this nice web interface. 😉

          1. 0xFelix

            Hey Xose,

            I’ve taken a different path… I tried to figure out how to calculate codes for my sockets. I have Brennenstuhl RCS 1000 N sockets that use the same protocol as sockets by Elro. There is a library called rfcontroljs which implements this protocol. rfcontroljs calls it ‘switch2’.

            I adapted a bit and had success! I am able to calculate codes for my sockets by hand!

            I put my findings into a Gist:


            I think with a further bit of work a lot of the rfcontroljs protocols could be ported to the Sonoff RF Bridge 433 / ESPurna. Possibly the web interface could also be enhanced, so codes could be calculated automatically according to the used protocol.


          2. Xose Pérez Post author

            Great job Felix!
            I’m glad to see that the choice I made to be able to paste codes was a good idea. I guess the calculations could be done on the client side (javascript), what do you think?

          3. 0xFelix

            Indeed, that was a good idea! Sure, I think a client should be easily able to calculate codes in javascript. My only concern is the limited size of the flash. Do you think several protocols would fit into it? I’d be glad to help implement this feature, if you could guide me in the right direction. Never had much to do with javascript. I suppose an extensible design similar to rfcontroljs would be the best way.

            Also, do you think it would be possible to modify the firmware of the decoder/encoder? Currently only protocols with 2 different pulse lenghts (Tlow & Thigh) and a footer (Tsyn) are supported. Some protocols use more than 3 pulse lenghts, for example KlikAanKlikUit uses 4 different pulses: header, low, high and footer. I think the hardware could support it, but the software is the limiting factor. The ability to send more than 3 different pulse lengths would be great, learning codes could stay as it is. What’s your guess on that?

          4. Xose Pérez Post author

            There is still room in the firmware, after all I don’t it will take more than 2-3K in javascript. My only concern is that, contrary to the C code, everything is included -always- in the javascript code, even thou the device does not use it. I think I will need more preprocessing to the JS and HTML files to only include required functionalities. But there is still enough room for now.

            About flashing a new firmware in the SiLabs micro, well that’s a completely different project… but it will probably allow for greater suppoprt for other remotes…

  4. Göran

    Good article, thanks.

    Any general feeling for what range can be expected?
    Both wifi and 433 MHz range of course depend on antennas, for example.

    I am thinking that maybe two bridges would be needed in a house… which could be set up nicely using mqtt messages sent to any bridge subscribing to the topic in question.

    1. Xose Pérez Post author

      Don’t expect a great range. I live in a two-story house and the signal hardly (not always) reaches 10 meters with 3 walls in between. 433 Remotes use to use a 12V battery to get more transmitting power, the RF Bridge only has a 5V input.

      About the topics, each device has its own topics, if you want them to subscribe to the same topic you will have to do some (slight) changes to the code, or send the message to two different topics…

  5. Roland

    Would be fine if RCS 1000 N with HX2262 will be supported by a new relase. I noticed that I have only Remotes with HX2262 at my home.

  6. Gamester17

    @Xose, do you know anyone with influense over Sonoff products at Itead? If so could you maybe ask them to make a new version of this Sonoff RF Bridge with a much more powerful EFM that is also reprogrammable?

    See all the comments by Stuntteam here => https://www.letscontrolit.com/forum/viewtopic.php?f=9&t=3507

    If only the Sonoff RF Bridge had a much more powerful EFM chip that was also reprogrammable then it could be made to handle many more protocols.

    Stuntteam (developers of the RFLink firmware) wrote in the attatched link that they might even be able to make the full RFLink work on it if it only had a much more powerful EFM chip.

    Perhaps you could convice someone with influense over Sonoff products at Itead to make a “Pro” version of the Sonoff RF Bridge with ESP32 and a much more powerful EFM chip?

    1. Xose Pérez Post author

      I have the contact of a tech guy there. Can ask him if there is any chance they would open the EFM code.

    1. Xose Pérez Post author

      Yes! I’ve also thought about it. Hardware-wise there is a free GPIO on the ESP header, labelled SDA it’s actually GPIO2. I would connect it to a transistor to drive the IR LED from 5V from one of the regulator legs. You won’t be able to do learning so you will need a separate device to sniff codes from your IR remote, and then copy them to the RFBridge.

      1. NameZero

        Maybe it is better to create a board with esp-12 and IR +RF (emitter + receiver ). it will be much better than the sonoff bridge.

    1. Xose Pérez Post author

      I agree with him, you are limited to what the EFM can do. Maybe it’s not a “piece of junk” but certainly it could be a plus to reprogram the EFM. Unfortunately that falls outside my skills at the moment…

        1. Xose Pérez Post author

          I can’t tell…. you better ask Itead if they have plans to release something like that.

  7. mark harding


    is it possible to use this as just a received unit without the learning that will then forward the relevant codes over to node-red for example. i have a number of 433 door switches so would like them to just be picked up by the rfbrige and then transmit the code to somewhere be it mqtt or something that i can then interpret to the door is open for example. no need to learn it just forward it!!

    1. Xose Pérez Post author

      Yes, learning helps with the user feedback but you can send or receive raw codes via MQTT to and from Node-RED without having to learn them previously.

      1. mark harding

        in which case i’m off to open it up and flash it!!! that’s the main reason i needed the unit to go in a room with a few 433mhz switches so saves running cabling everywhere for window states!!

      2. Michael

        Hello, I’m trying to get the RF bridge to forward RF messages from window sensors to the RF bridge and then via MQTT to Node-Red but I’m not sure if I’m missing something but subscribing to all topics I was not able to receive anything. Is there a way I can achieve this?

      3. Michael

        Forget my previous message I didn’t switch the switch on the board back to the original position after flashing it. thanks!

  8. mark harding

    any suggestions

    [WIFI] Connecting to BSSID FF:3F:44:04:00:00 – CH 00 – SSID **chubz**
    [RELAY] Saving mask: 0
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [RF] Disabled
    [WIFI] Could not connect to **chubz**
    [WIFI] Creating access point
    [WIFI] MODE AP ————————————–

    1. Xose Pérez Post author

      All those “[RF] Disabled” messages mean you have enabled the RF module which is not meant for the RFBridge, but for a custom RFlink module. Custom, hand-made, codes should be written in the web UI tab for the RFBridge.

    1. Xose Pérez Post author

      That would require to flash a new firmware into the EFM8 micro, the one responsible for the decoding. Not in the roadmap, sorry.

  9. sunbit

    First time ESPurner here, congrats for your work, its awesome. A quick doubt, when you refer to the “reset button” in the flashing process, it’s the button on the RF bridge that is used to pair the device, or it should be another button (cannot spot another one)

    Thank you!

      1. Carles Bruguera

        Succesfully flashed and started to play with ESPurna, but i have some issues while learning the codes. First i was never receiving the code, but i kept trying as you say on the RFBRIDGE section of the ESPURNA web ui. Then after two learnt codes, from different buttons i realized that the codes where the same, and any of the two worked when switching. Then, trying to learn another code from another button, no code appeared. I’ve logged the serial output while doing this. If you happen to find some time to take a look at it, i saved it here https://pastebin.com/60agEsYA, with some comments. Just comment that with the original rfbridge firmware i was able to learn and use the rf switches without any problem, if it helps.

        Thank you!

        1. Xose Pérez Post author

          Obviously the codes are wrong. A slight difference in the 6 first bytes is common (they are times in microseconds) but the 3 last bytes should be the same for the same button every time it is learnt (and different from other buttons, of course).
          Could you please try setting DEBUG_SERIAL_SUPPORT to 0 in the hardware.h section for the RFBRIDGE to remove any noise in the UART communication between the two microcontrollers and try again?

          #define DEBUG_SERIAL_SUPPORT 0

          1. Carles Bruguera

            It’s already set to 0. I just updated the code from bitbucket to make sure we’re using the same version https://bitbucket.org/xoseperez/espurna/src/8cda4acd37db64080c0ceebdf8492552d2943442/code/espurna/config/hardware.h?at=master&fileviewer=file-view-default#hardware.h-324

            Also i want to point that the only time i was able to learn codes (even if they are wrong) was with the serial port connected. With the FTDI cables unattached, no code ever was learnt.


          2. Xose Pérez Post author

            Could it be a power supply issue? There is nothing special about having it wired… I just checked with the RFBridge I have and it works great with 2 of the 3 remotes I own and pretty bad with the 3rd one…

          3. Carles Bruguera

            Sorry not to reply to the right place in thread, but i can’t see the reply button in the last messages 😛

            I spent some more time trying to debug why it wasn’t working with my RF outlets, and i have two things i would like to comment, just in case it gives you some clue about what can be happening:

            – I stopped trying to learn the codes and instead, sniffed them from nodered via mqtt. I can see the pattern you pointed to me, and the last three bytes are fixed for each button, while the rest changes. Anyway, sending the any of the sniffed codes trough the /rfin topic didn’t trigger the outlet (saw the debug “forward” logs on the console, so i understand that the mqtt->rfbridge works as expected)

            – I happen to have a second RFBridge from a friend with the original firmware and I tried the following: Learn the codes trough the eWeLink app while sniffiing with the one with ESPurna. Triggering the learnt button trough eWelind did work, so i captured the sniffed codes and tried to send them trough /rfin, again without any result. Altough the codes sniffed from the remote vs the ones sniffed from the RFBridge look quite different, the last three bytes remain the same.

            I saw that there is on the go the EFM8 firmware approach with support for ESPurna, and i think to give that a try, but as my remotes works on the original firmware still makes me thing that there’s something else going on, not related to the encoding or format of the comunications.

            As a final note, i also tried to change batteries in the remotes, setting a good power supply on the rfbridge and put it next to the outlet to remove any doubt of posible “phyisical” problems.

            Any ideas?

            Thank you very much for your time.

          4. Xose Pérez Post author

            Hi Carles

            The codes look perfectly normal. The first 6 bytes are time lapses so it’s normal they are not exactly the same all the time but they should be more or less the same across all buttons of the same remote. The last 3 bytes have to be the same for each button each time.

            You say you are sniffing the codes subscribing to /rfin. If you want to tell the RFBridge to send a specific code you have to send the message to /rfout/set. rfin and rfout are from the rfbridge point of view (messages coming in, messages going out). And the /set particle is always necessary when you are telling the device to do something.

          5. Carles Bruguera

            Sorry it was a writing error… i’m using the xxx/rfout/set topic to send the codes. I can see what i understand is a confirmation that the code is being sent in the serial console:

            [MQTT] Received bridge/rfout/set => 13F600AA01EA515400
            [RFBRIDGE] Sending MESSAGE ‘13F600AA01EA515400’ 1 time(s)

            [RFBRIDGE] Action 0xA0

          6. Xose Pérez Post author

            Yes, the 0xA0 is the ACK from the EFM8. And those symbols mean you are debugging it using the uart. Mind having DEBUG_SERIAL_SUPPORT to 1 introduces noise in the uart line that can impact the communications between both microcontrollers.

          7. Carles Bruguera

            Well finally i found out what was happening. You’ve already told me and i’ve succesfully checked the DEBUG_SERIAL_SUPPORT = 0 in the harware.h, in the ITEAD_SONOFF_RFBRIDGE section. I checked and reflashed again, and still had serial debug output, so i looked around in the code and disabled also the same variable in the general.h, and that did the trick 🙂

            Does that make any sense to you?

            Thank you for your time, finally i got this working:)

          8. Xose Pérez Post author

            The default value for DEBUG_SERIAL_SUPPORT is 1 (true) and is set in general.h with an #ifndef guard. Some boards (like the RFBridge) do not like that and so it is set in their section in hardware.h which is parsed first. Setting it to 0 in hardware.h should suffice…

  10. Kruu

    Great, one more time. I am just interested in Domoticz setup before I flash espurna on my rf bridge.

    Can I add door magnet sensor with open/close function and that would be one switch in domoticz? So I know when is window opened and when closed.


    1. Xose Pérez Post author

      With ESPurna you can define the door magnet sensor as a button and get the status via MQTT but you will have to translate those MQTT messages to Domoticz MQTT topics since it is not supported at the moment.

  11. RJ

    I just got the sonoff bridge, and I’m trying to make it worth my some new automatic curtains I have (by Dooya). After talking to engineers with itead (maker of the bridge) AND dooya, it seems it’s incompatible because dooya uses encrypted rolling channels, while supposedly the bridge can only pick up on fixed channels. Do you think there’s a way around this limitation?

    1. Xose Pérez Post author

      If they really use rolling channels you are out of luck. I have seen some dooya hack on the Internet thou, and they seem to work fine with fixed channel simple RF links…

  12. Kåre Rasmussen

    Hi, I just got the device home, and want to add it to my hoe automation using MQTT. The usecase is using Sonoff magnetic door switches and the motion detector. How do I setup a connection to those devices after I have flshed you FW into the bridge? also can I identifi different sensors, so I see what motiondetector that was trigered?
    thank you 🙂

    1. Xose Pérez Post author

      There is another user trying to get the messages from those devices without much success… Apparenty it should work since the decoding is done in the secondary microcontroller which ESPurna does not touch at all… I don’t own one of those sensors myself, so I can’t really tell.

      1. Portisch


        I was starting a alternative firmware for the EFM8BB1:

        Somebody is interressted to give me some help – and time!?

        Right now this is only a basic implementation – but it is working!

        First tests with a RF remote from Rohrmotor24.de:
        Learning: 0xAA 0xA1 0x55
        AKN: AA A0 55
        RF Read:
        00000000 11010000 11111001 00110010 00010001 00010001 // Up
        00000000 11010000 11100000 00000010 00010001 00110011 // Down

        Feel free to visit me at github.

        1. Xose Pérez Post author

          That’s great!!! I’d like to contribute but I’m really busy atm. One thought about the communication protocol with the “host” microcontroller (the ESP8266): I think it should be backwards compatible so it will still work with non-customized RFBridges. Maybe using different action codes for newly supported codes.

        2. azee

          Hi, i have Telldus (Proove) RF remote with three on/off button and one group on/off, initialy i tried to use the learn function of ESPurna but it never learned the code.
          i did further search on internet and came to article of “Joakim Wesslen”. These module use following pattern

          Every packet consists of a sync bit followed by 26 + 2 + 4 (total 32 logical data part bits) and is ended by a pause bit.
          S = Sync bit.
          H = The first 26 bits are transmitter unique codes, and it is this code that the reciever “learns” to recognize.
          G = Group code. Set to 0 for on, 1 for off.
          O = On/Off bit. Set to 0 for on, 1 for off.
          C = Channel bits. Proove/Anslut = 00, Nexa = 11.
          E = Unit bits. Device to be turned on or off.
          P = Pause bit.

          But The data part on the physical link is coded so that every logical bit is sent as two physical bits, where the second one is the inverse of the first one.
          ‘0’ => ’01’
          ‘1’ => ’10’

          so in this case ESPurna need to send way more bits currently supported, i did some testing on the regular RF modules and both learn and activate the socket by using the Joakim code and its all working.

          now my question is how to implement this in the EFM8BB1? i am willing to do some development as well but i need some guideline how to start?

  13. Pingback: 433 MHz Support in Node-RED - JackenHack

  14. Portisch

    I was testing the EFM8BB1 this week. It’s quite simple with Simplicity Studio, but the MC is quite limited. Especially big arrays aren’t possible. I think a UART buffer of 64 bytes are already the limit…

    I need a idea what is the better way for decoding and encoding RF signals. The RF signals I was testing do have a Duty cycle of 33% (logic 1) and a Duty cycle of 66% (logic 0). Can this be used for a lot of RF signals?
    For this timings only the frequency have to be known. For Rohrmotor24 as example it is 1kHz: Long pulse ~700us, short pulse ~300us.
    Or is it better to use a pulse timing for this?

    If this can be used encoding of byte to bits is really simple with the PCA, PWM Waveform generation.

  15. Tomislav

    After flash i can’t see wifi? Can someone help?

    Detecting chip type… ESP8266
    Chip is ESP8266
    Uploading stub…
    Running stub…
    Stub running…
    1048576 (100 %)
    1048576 (100 %)
    Read 1048576 bytes at 0x0 in 94.3 seconds (89.0 kbit/s)…
    Hard resetting…

    1. Xose Pérez Post author

      Try debugging it via serial to see the debug messages. Open a serial communication to your programmer device at 115200 bauds.

  16. Portisch

    I almost finshed the alternative firmware for the EFM8BB1.
    But I need some information about RF signals!

    The RF remote I have is simple to decode:
    SYNC: 4500µs high, 1500µs low
    Than the data is following with this timing:
    A logic 1 is a duty cylce of 30% (700µs high, 300µs low)
    A logic 0 is a duty cylce of 60% (300µs high, 700µs low)

    So the data what is needed looks like this:
    typedef struct
    // Protocol specific identifier
    uint8_t IDENTIFIER;
    // normal high signal time on sync pulse
    uint16_t SYNC_HIGH;
    // normal low signal time on sync pulse
    uint16_t SYNC_LOW;
    // time in µs for one bit. This is the sum of the high and low time of on bit
    // example bit 1: high time 700µs, low time 300µs: sum is 1000µs
    uint16_t BIT_TIME;
    // bit count for this protocol
    uint8_t BIT_COUNT;

    #define SYNC_TOLERANCE 200

    * Rohrmotor24
    * https://github.com/bjwelker/Raspi-Rollo/tree/master/Arduino/Rollo_Code_Receiver
    #define ROHRMOTOR24_IDENTIFIER 0x01
    #define ROHRMOTOR24 {ROHRMOTOR24_IDENTIFIER, 4800, 1500, 1000, 40}
    * Protocol array
    static const PROTOCOL_DATA_t PROTOCOL_DATA[1] = { ROHRMOTOR24 };

    The EFM8BB1 only needs in this way a size of 64 + 5 bytes of the UART buffer to be able to transmit 512 bits:

    With this information the EFM8BB1 will do:
    Transmit a high pulse of SYNC_HIGH of IDENTIFIER 0x01
    Transmit a low pulse of SYNC_LOW of IDENTIFIER 0x01
    Than starting the bittransfer with 1kHz (1000µs BIT_TIME) for each byte.

    The DATA_LEN is needed because of a possible value 0x55 as data what is equal to the UART SYNC_END.
    But maybe it can be skipped if the DATA_LEN is calculated by the known IDENTIFIER.
    Because of this IDENTIFIER the bit count is known.

    Is this approach usable for other RF signals?
    I took a look to the source of RFLink but there is the pulse high time measured for each pulse.
    This will need an minimum array size of 512 bytes what will not fit into the EFM8BB1.
    Also the low time of each pulse is missing – so transfer is not possible.

    1. Xose Pérez Post author

      Not an expert but I think timing is very important. But maybe it would be enough to be able to define the sync pulse and the frequency and duty cycle of the data. Minimum requirement should be to be able to reproduce what the original firmware does with your 0xA8 command.

  17. Mat Smith

    Thanks for the brilliant write-up and video. I was curious about the device but I didn’t think I’d find someone who would answer all my questions. For example: is there any way to send raw codes to the device for sending out any RF signal (i.e. not limited to a finite number of memory “slots”). Glad to see the answer is “yes”.

    I have only just received my Sonoff devices for testing (sonoff dual, single, RF, bulb, and sonoff power monitor) and I haven’t flashed them yet. After getting extremely annoyed trying to use the app to control the bulb (it’s really bad in my opinion, not bright and the app basically doesn’t work, the colours are all mixed up, waste of money

  18. Mat Smith

    Ooops, hit submit by accident! Anyway, I found the app a complete disaster and the bulb (the RGB one) is very low quality compared with Philips Hue.

    So my plan was to flash my Sonoffs with Tasmota – but seeing this, I think I’ll get it up and running with ESPurna instead. Excellent stuff – thanks again for the great write-up. Really appreciate the detail!

    1. Xose Pérez Post author

      The Sonoff B1 (the Sonoff bulb you mention I guess) is not worth it unless you want a warm white light. It’s the only bulb I have tested what has 5 channels (RGBWW) but colors are so dim they are only useful for notification and alike. There are still some issues with the RF Bridge I’m trying to sort out, hopefully soon.

  19. willcm

    Hi, great write up and superb software. I’ve got my Sonoff RF Bridge all flashed with Espurna.

    I’m having trouble getting Espurna to learn the code I need it to replicate.

    I’ve managed to sniff and replicate my RF thermostat code and can succesfull control my boiler using an ESP8266 board.

    When I try to sniff this code using Espurna’s built in learn function, nothing is picked up. Is there a way I can use the custom ino file with Espurna?

    1. Xose Pérez Post author

      There is known issue with the learning functionality that, apparently, does not happen with the engineering sample I have (I can’t see why). I’m waiting for a new unit to test it.

  20. macscr

    I bought this planning to do the same, but seems my sonoff rf bridge doesn’t have the header pins available and i would have to do some soldering just to flash it. What a pain. I think I might just scrap the idea. Their stock firmware is practically useless.

        1. Xose Pérez Post author

          Should not be hard to solder a header on J2. The button is labelled E_FW, so just connect you programmer to the J2 header, press the button and power the board to get into flash mode.

          1. macscr

            Ugh. Seems like mine has firmware 1.1.0 on it according to ewlink and I didnt have any luck flashing it. Should anything show in the serial console during startup if i have it connected correctly with a USB to TTL adapter?

        2. Jason0815

          The switch has to be pulled to the other side. Then flashing will work.
          Dont forget to switch it back.

  21. Tom

    Great WORK… Thx to you!!! With Telnet i was able to learn/store all my Remotes…. (just copy/paste the 18 characters you see in the log of the Telnet-Client)

    BUT ONE THING: The RF433 Bridge store the last state of the relay…. that works not for me. Cause i use also other Remotes. So it happen, that the bridge do not send the code !!!!

    Could it be changed in the Sketch… i do not find the releated code!


    1. Xose Pérez Post author

      Problem is that the RFBridge can only store the state if it “sees” the messages, otherwise it will go out of sync. There no easy way around it…

    1. Xose Pérez Post author

      Hard to tell. By you comment I guess it worked before you changed your router. Does it use a different ssid, password, encryption,…?

    1. Xose Pérez Post author

      Look for the ITEAD_SONOFF_RFBRIDGE definitions in the hardware.h file and change the value of the DUMMY_RELAY_COUNT setting to whatever you want.

  22. Markus

    Does it still work? Even with an Echo 2 including the new Firmware. There are some issues with the WeMo Emulation…

    1. Xose Pérez Post author

      The fauxmoESP library is not compatible with new v2 devices. There is an open issue on the bitbucket repo.

  23. Ian Addinsell

    Hi. I’ve bought the Sonoff RF 433 in the hope that it would be able to learn the codes from my ACMEDA remote control for my motorised roller blinds.
    Silence reins.
    Anyone able to suggest where I start – to work out what might need to be done to the sonoff to achieve success. It was said further up that it they needed several attempts to achieve success in reading codes. Am I in that realm or somewhere else?

    I have a RPi B gathering dust.

    It also ignores my garage remote control too, not that I want to go there.


    1. Xose Pérez Post author

      They probably use a different encoding protocol… you should first try to find out if it’s documented somewhere. But chances are they use some kind of hoping encoding, in that case you are (almost certain) out of luck.

  24. Andrew Way

    This is great! After flashing my Magic Home LED controllers and been so impressed I bought a range of Sonoff devices to play with. The flashed RF bridge is ideal for my Domoticz/RFXcom home automation software as I’ve now got the bridge in an area of the house where I was having reception problems. The bridge is acting as a repeater and has fixed my reliability issues… for £8… fantastic!

    Thank you!

  25. GearKlik

    Hi! Is there any visual signs on the RF bridge board for RX/TX while uploading firmware to it? Flashing LEDs etc. PlatformIO console reports that ESPurna has been successfully built and uploaded, but I don’t see any wifi access point to connect to the RF Bridge. When it turns on I just get a solid green LED. Stock Sonoff firmware the blue led was also flashing when the bridge was turned on

    1. Xose Pérez Post author

      The blue light should be blinking at 1Hz after flashing ESPurna the first time, otherwise the flash was not fine or the device is in an unstable status. You can also check the debug log through the UART interface (open a serial console at 115200 bauds).

  26. Rod

    Hello Xose – thanks for all of your tireless work on this firmware.

    I’m using the bridge along with the firmware 1.11.2 in the V2 Bridge (the solid gold wires antenna)

    I’ve left all fields unchanged (exactly as the brand new firmware), except my WiFi and new login password.

    I intend to operate it on my Home Assistant which is running on my Raspberry Pi 3.

    In your firmware – I enabled Home Assistant under Espurna “General” tab.

    I also own a Sonoff 4 button “ABCD” key-fob. I’ve entered 4 codes into the Espurna web interface. All operations are working outside of Home Assistant, showing in the Espurna Firmware and on the Hardware red light flash.

    Home Assistant:

    Enabling HomeAssistant in your Espurna RF Bridge webpage DOES give me a working single soft switch in the Home Assistant main page, and the operation is confirmed in the Espurna Web “Status” page. It operates a single channel (0).

    I installed MQTT Broker into HA In an attempt to control the Bridge using MQTT through Home Assistant, I then added the following into the HA config.yami using your guide, and the Above youtube video.

    mqtt: broker:

    switch: – platform: mqtt

    name: “RF Bridge”

    state_topic: “/test/ESPURNA_9EF6C9/relay/0/set”

    command_topic: “/test/switch/ESPURNA_9EF6C9/relay/0/set”

    payload_on: 1

    payload_off: 0

    optimistic: false

    qos: 0

    retain: true

    The above config produces a Switch Icon on the Home Assistant “Overview” page called “RF Bridge”.
    I can switch with a mouse, but it returns to off position (momentary -on-off) This does not translate to any operation on the Sonoff Bridge or the Espurna webpage, or nothing on a Subscribed topic in MQTT.fx

    However, using MQTT.fx, I can see the key fob device operation in the same log, but Home Assistant does not recognise ANY operation of ANY switch using the above config – even if I change the relay number to 1, or 2, etc..

    Can you review my steps to see whether I have made any errors?

    I wonder if there is some different syntax for the above config specifically this RF Bridge

    Many thanks – Happy New Year! Rod

    1. Xose Pérez Post author

      State topic should be “/test/ESPURNA_9EF6C9/relay/0” (no “set”, that’s for the command).

  27. Brian

    Hi guis, I want to my device can alert with Alarm Sensor. And I want to get signal from a pin to transfer ringtone. But I can’t code with microcontrollers. Can you help me? Thank you very much!

    1. Xose Pérez Post author

      I’m sorry but I just can’t code for anyone asking for it… I hope you understand.

  28. macscr

    Ok, got it working finally with espurna. Woo hoo. Is there a way make this simply a receiver? What my end goal is to be able to use the remote and home assistant to control my switches. I already have my broadlink setup to transmit, but wondering if i can setup the sonoff bridge then to receive any inputs from the remotes so that they know the switch has been turned on or off and can tell home assistant what has done. If not, home assistant wouldn’t know what state they are in. Thoughts? Im open to ideas.

    1. Xose Pérez Post author

      In the RFBridge you are only changing the firmware of the ESP8266, there is a second microcontroller and a decoding chip responsible for the radio communication. Without changing that too you are limited to what the protocol that microcontroller has been programmed to use. If you need something more flexible I recommend you to have direct access to a 433 receiver.

      1. macscr

        Im confused. I thought you could use it an RF receiver that would then send MQTT messages to whatever target i specify, like homeassistant. Am i wrong? Seems the OpenMQTTGateway dev is saying your solution will do it as well.

        1. Xose Pérez Post author

          You are not confused, that’s what it does, as long as the protocol of the messages is supported. 433MHz is just a transport, the way you encode the information and the protocol you use sit on top of that.

  29. Tof

    HI Xose,
    Thanks a lot for ESPurna and the Sonoff RF Bridge exploration.

    I’ve received this bridge yesterday, apparently v2 like the one macscr posted picture of it.
    Soldered header pins on J2, plugged my USB-TTL dongle and flashed it with esptool method and a compiled binary image (espurna-1.11.3-itead-sonoff-rfbridge.bin). https://bitbucket.org/xoseperez/espurna/wiki/Binaries.md

    Nice ! I’m currently playing with my old 433 plugs through MQTT 🙂

    I’ve found ESPurna to be very well made and very convenient to use. There is a lot I’ve to learn by digging into your code, specially to first-time-use and configuration that always sucks in my own ESP8266 projects.

    I’ve used the esptool.py method because it’s the easiest and quickest way to start to play with the RF bridge on ESPurna (PlatformIO I don’t get used to it yet, and ArduinoIDE too much libraries to install manually).
    But later I think I’ll study PlatformIO usage, as I’d like to control 16 switches and may be use other IO ports (J5 apparently gives access to IO4 and IO5).

    1. Xose Pérez Post author

      Great, thanks!

      I strongly recommend to try PlatformIO. I’m not saying it’s perfect but it gets close to perfect. Give it a chance and you won’t regret it.

      1. Joeyhza

        Thanks Xose for the AWESOME work.

        Changed mine to have 16 switches. Was easy enough.

        Now – to get it working with Domoticz and my door sensors and PIR’s 🙂

        Will figure that out next.

    2. pelson

      I’ve been having real problems flashing from source, but followed the binary approach with success! Thanks for sharing. I’ve got two of these devices, so will try to get the other working from source.

  30. Peer Falkenberg

    Hi, I have a sonoff RF 433 bridge I can’t setup/initial connect to at all. Followed the instructions but it seems that Bridge isn’t broadcasting any Wi-Fi (Itead…) and also tried scanning without luck. Any idea?

    1. Xose Pérez Post author

      I would try to debug the problem with the programmer connected. Open a console to it at 115200 and check the debug log.

  31. Stuart Glover

    Hi – Great software. I didn’t even bother trying what came with the device, why would you 🙂 Thanks.
    Integration with Home Assistant works extremely well, was very surprised when I found my test switches already there, looks like I might have to remove the transmitter off my PI as this can now be placed anywhere, great integration. I could see if it’s already been asked but I have a cheap RF door switch. When the door is opened I want the hub to pickup the RF and post an MQTT request which will be picked up by Home Assistant and hence reacted on e.g. Side door has been opened. So the question after all that is… Can it be done?

    1. Xose Pérez Post author

      The Sonoff RFBridge is not compatible with any RF433 out there. It talks a specific protocol/encoding. So it will depend on the kind of messages the door switch sends…

  32. Gary

    Thanks Xose

    I managed to upload pre-built bin file to V2 Sonoff RF Bridge and everything works perfect. Able to learn remotes and then switch devices on off from webpage.
    I need to add more switches so i loaded sourcetree from bitbucket into Arduino IDE, changed value of Dummy Switch Count in config file. Build and Upload this version appears successful. I can see 16 switches under Domoticz and MQTT, BUT NO Switches appear on Status page and NO RFBRIDGE tab is available on MENU. yes i did uncomment the Sonoff RF Bridge type in the Arduino.h file.
    Do you have any idea what to try next.

    Thanks again

  33. Gary H

    I was able to build from source using platformio on ubuntu linux, even though i failed using platformio-ide on windows. And able to increase the number of switches to 16 by changing DUMMY_RELAY_COUNT in config file.

    Thanks again Gary H

  34. Ashi Carmel


    Thank you for your time and efforts.

    I’m bit a newbe so if it possible to spesphic some things:

    1.may you please add a link to the direct firmware file need to be at Platformio project/src folder (to compile and upload) ?

    2.When should release the reset button?
    3.What exect board I should choose at the Platformio for the Sonoff rf 433 bridge?

    Thanks in advance 🙂

    1. Xose Pérez Post author

      If you are going to build the image using platformIO you just need to build the itead-sonoff-rfbridge environment, either from the IDE (Atom) or from the command line this way:

      pio run -e itead-sonoff-rfbridge -t upload

      The last bit will flash the board if you have it connected via a USB2UART programmer.

      You can also download the image from the “releases” section in the repository. Follow these instructions: https://github.com/xoseperez/espurna/wiki/Binaries

      1. Ashi

        Wow, thank you!

        The easiest way ware with esptool on Linux.


        I can connect my Android to the Espurna network, but i cannot browse into ,
        It say: connection error, timeout .

        May you have and suggestion ?



          1. Ashi


            It’s work now, after changing my PC ip range to suite the ESP8266.


            Dose it has only 7 devices? (i know its better than the 4, thank you!)

          2. Xose Pérez Post author

            You can set as many devices as you want, only limited by memory available. Change the DUMMY_RELAY_COUNT in the hardware.h file.

  35. Damien

    Dear all
    i got an issue even if i followed the step. I got the following prompt error in the console :
    ‘Environment itead-sonoff-rfbridge [error]’
    I’m using platformio IDE under vscode.

    1. Xose Pérez Post author

      The default URL when connected to the device AP is “”. What errors does it throw?

  36. Ashi Carmel

    Hi, thank you for your answers! Mean it!

    Where can I find the hardware.h file ?

    (Do I need to recompile and reflash ?)


  37. ashi


    Couse i havn’t found any way to contact you directly, i will leave my question here:

    I’m tryng to setup Domoticz to a Smart plug (ESPURNA_8D533C
    ESPURNA 1.12.3), that work just fine only as Espurna.
    I had followed your manual, and i do have MQTT that this device is connect to, i do have a device and IDX, but switching ON\OFF won’t work using Domoitcz.

    May you be more detail what i should setup at my Espurna and at Domoiycz in order to work together ?

    Tnx in advance,

  38. Sriram Vaidyanathana

    Hi, Thanks for the wonderful article. I would like to send the remote codes from Sonoff RF bridge to the RF relay without an remote. Is there a way to send a code from RF bridge to pair with the relay without an remote?

    1. Xose Pérez Post author

      The pairing process requires that you have the remote so the RFBridge would listen to the codes it sends or that you know the codes. Your RF relay is a receiving-only device, so it will hardly “tell” the RFbridge what codes it understands…

  39. schmurtz


    Thanks a lot for all this awesome work on espurna. One strange question :
    do you have the original stock firmware ?

    I have a test to do on the factory firmware but I forgot to save it before tried espurna 😉

    Thank you.

  40. umerfraz

    Hie, Xose, i am trying to flash R2 which came out around nov of 2017. via Arduino, it seems to successfully flash. but when i power it up it seems to have stock itead firmware and is recognised by ewelink. i cant put it into the first time config mode as is normal for espurna devices.

    any ideas why this is happening?

      1. umerfraz

        well actually, i am doing it from arduino ide. it does not give me an error. just shows that familiar 0 to 100% progress of uploading the firmware. But yes you are obviously right that its not being flashed at all.
        i am certainly putting the switch in off position and connecting the wires correctly. Arduino can see the device correctly (i am flashing many other sonoff devices fine with same setup). i will try Platform.io to see if that works.

        any suggestions would greatly help.

  41. umerfraz

    it was a silly mistake. i just realised i had misplaced the jumper for voltage selection on my FTDI. however, its strange how Arduino was still detecting and upload firmware onto the kit. i could even see thee FTDI blinking when it normally uploads.

    1. Xose Pérez Post author

      Yes, very strange, because the flashing process is bidirectional, the module must be reporting back that each sector got flashed correctly…

  42. Tony Brownlie

    I’ve carried out the Hardware Itead Sonoff RF Bridge Direct Hack
    that is I’ve flashed the rfbridge-direct.bin ,soldered two 210 ohm as shown
    and cut the traces shown for the R2 -v1 board and turned the switch back on.

    I’m now at the stage of trying to assign rf codes the switches
    using rf codes I have already cloned and used and tested on a esp32 module with
    an Arduino sketch using rc-switch which is why I though I’d use the Direct hack
    I’ve logged on and went to the RF page but when I press the learn button for one of the
    switches nothing happens I.E. the buzzer doesn’t sound and the rf led does’t flash.
    I checked the debug console and it shows the learn mode as on
    but nothing is learnt.
    I then entered a code manually and saved it, again the debug console
    shows the code has been saved and when I operate the switch in the Status page
    the debug console shows the code as been sent but the rf led doesn’t flash and no signal seems to be sent.
    So basically I not sure if I have a setup issue or a hardware fault.
    Any input would be great ,Oh and this is one of the codes I’ve tried “111000111001111111100111”

    1. Xose Pérez Post author

      Indeed. I do it using Node-RED and the node-red-contrib-blynk-ws node, but there is a pull-request to add Blynk support into ESPurna directly, for instance.


Leave a Reply (all comments are moderated, be patient)

This site uses Akismet to reduce spam. Learn how your comment data is processed.