Reverse Engineering IR Protocols: Building a Custom Web-UI Remote with ESP8266

I lost my TV remote, so I built one with an Arduino

Ankit Agrawal bypassed a lost remote by building a custom IR blaster using a D1 Mini. The project successfully decoded a non-standard quaternary protocol using 38 kHz timings.

Why This Matters

Standard smart TV applications often fail when network credentials change or Bluetooth is unavailable, leaving IR as the primary control vector. This case study demonstrates that modern IR protocols frequently deviate from standard NEC or Sony formats, requiring raw timing analysis and custom firmware to achieve hardware control when standard libraries fail.

Key Insights

• Mi TV 4A 43 inch utilizes a non-standard quaternary protocol featuring four distinct space lengths of 578, 867, 1147, and 1428 microseconds at 38 kHz.
• IR code sets for brand 153 and model 5122 were decrypted via Python exporters in Flipper Zero format as of 2026.
• The D1 Mini (ESP8266) was utilized to host a local web server, providing a persistent Web-UI for remote access.
• Brute-forcing common IR code sets failed, proving the necessity of protocol-specific decryption and raw mark/space microsecond timing extraction.
• The mi_remote_database on GitHub served as a critical resource for identifying proprietary Xiaomi IR timings.

Practical Applications

• Use Case: Implementing ESP8266-based IR bridges for controlling non-Bluetooth TVs via Serial Monitor or Web-UI. Pitfall: Relying on standard IR libraries that do not support proprietary quaternary pulse lengths, resulting in command failure.
• Use Case: Decrypting proprietary hardware signals using community databases like mi_remote_database for automation. Pitfall: Hardcoding WiFi credentials instead of using a captive portal, necessitating hardware reflashing when network configurations change.

References:

• https://github.com/ysard/mi_remote_database
• https://drive.google.com/file/d/1INZLRXr2k0VmKKlSUtJZjiqaEJE04-5M/view?usp=sharing