The Fonz is a scanner and transmiter for the TouchTunes Jukebox (Gen 2 and above) Wireless Remote. TouchTunes uses a wireless remotes that transmits at 433.92Mhz, uses ASK/OOK, and uses a pin (000-255) for addressing. This script was meant to be used with RfCat and the Yard Stick One. This research has also been ported to the GoodWatch and Portapack-Havoc projects.

The information shown in this repo is for educational use only. Please don't do anything illegal. :)

$ pip3 install future pyusb
$ git clone https://github.com/notpike/The-Fonz.git
$ cd The-Fonz
$ sudo ./The_Fonz.py

## Plug In Rard Stick One
## Select 'Scan' to listen for transmissions
## Select 'TX' to transmit
## Select 'EW' for Eletronic Warware Mode (Educational Purposes Only)
## Select 'Exit' when done

• Frequency: 433.92MHz
• Modulation: ASK/OOK
• Protocol: NEC
• Symbol Rate: 1766
• Symbol Period: 566us

• Short(0): 10

• Long (1): 1000

• Structure:

• Sync (Literal Symbols): \xff\xff\x00

• Preamble (Decoded NEC): 0x5D

• PIN 000-255 (Decoded NEC): 0x00-0xFF (LSB)

• Command (Decoded NEC):

Note: Commands are doubled with the 2nd half being reversed. For example, Pause 0x32 will translate to 0x3223 before being encoded to the literal symbols. \xA8\x8A\x8A\xA2\xA8\x80

• 0x32 // Pause
• 0x78 // On/Off
• 0x70 // P1
• 0x60 // P2
• 0x20 // F1
• 0xF2 // Up
• 0xA0 // F2
• 0x84 // Left
• 0x44 // OK
• 0xC4 // Right
• 0x30 // F3
• 0x80 // Down
• 0xB0 // F4
• 0xF0 // 1
• 0x08 // 2
• 0x88 // 3
• 0x48 // 4
• 0xC8 // 5
• 0x28 // 6
• 0xA8 // 7
• 0x68 // 8
• 0xE8 // 9
• 0x18 // Music_Karaoke
• 0x98 // 0
• 0x58 // Lock_Queue
• 0xD0 // Zone 1 Vol+
• 0x90 // Zone 2 Vol+
• 0xC0 // Zone 3 Vol+
• 0x50 // Zone 1 Vol-
• 0x10 // Zone 2 Vol-
• 0x40 // Zone 3 Vol-

• Command: Pin 000 - On/Off
• Literal Symbols HEX: ffff00 a2888a2 aaaa 8888aa2aa2220
• Literal Symbols BIN: 11111111111111110000 10 1000 10 1000 1000 1000 10 1000 10 10 10 10 10 10 10 10 10 1000 1000 1000 1000 10 10 10 1000 10 10 10 10 1000 1000 1000 100000
• Decoded Symbols: SYNC S L S L L L S L S S S S S S S S S L L L L S S S L S S S S L L L

• Now uses the proper encoding and decoding methods the for NEC protocol! :D
• Everything is better now!
• No more recursion problems!
• Check out The_Fonz.py for the new script!

• Added Electronic Warfare Mode
• Tatical Jamming inbetween transsmissions
• Stops unwanted signals from reaching the target while you still have full control over the juke box

• Can be imported threw the iPython interface with RfCat.
• import The_Fonz as f
• f.MainMenu()

• Cleaned up my code
• Grouped the commands togeather for the Brute Force atack, %50 faster but not tested.
• Plans: Add RTL-SDR and HackRF suport, Figure out Long TX's.

• Removed redundant re-transmission in the Brute Force feature, ~20sec faster now.
• Prints the TX codes during a Brute Force.

• Added Brute Force feture! You now can try every PIN posability for 1 command. Enter in 999 for the PIN and you'll be able to brute force a command.
• Improved menu, no longer bugs out when you enter the wrong choice.

• Added TX feture! You now have a 'hopfully' working remote! (Not Tested Yet, Only compaired to the origional remote)
• Improved PIN discovery so it only returns 1 answer

http://productwarranty.touchtunes.com/download/attachments/1179814/900303-001-Remote%20Control%20User%20Guide-R01.pdf?version=1&modificationDate=1373656509000&api=v2

http://www.pressonproducts.com/t1-jukebox-remote-touchtunes-compatible/

https://fccid.io/2AHXI-T1

https://pastebin.com/Ue7UYAPg

Based off of Michael Osman's code. https://greatscottgadgets.com/

rflib and vstruct pulled from https://github.com/ecc1/rfcat

Ported to Portapack-Havoc by Furrtek https://github.com/furrtek/portapack-havoc

Written by NotPike, @IfNotPike