@r_255, BWired... Sorry, I frequently checked the first page for interest, but did not see the second page... I was about to write a progress report last week... Sorry again.
As a beginning: some part numbers are mistyped: the unit has a Samsung K4M64163PK SDRAM.
There also must be an AT25DF161 or an AT25DF321A somewhere on the board, the firmware can handle both of them.
I will try to avoid to enter the hardware details of the evotouch controller, if someone interested, let me know, I will try to gather the information I have into a readable form.
Sniffing:
The frequency ~is 868.300 [it is (factory) programmable, stored in flash E], the modulation is GFSK, the bitrate used is 38400 baud.
The exact default values @26.000MHz quartz: 868.338745117188, f_IF = 152340.0 Hz, channel spacing: 199.951 kHz
If you need the exact parameters of CC1101, I will let you know how evotouch initializes it.
If you looking for a sniffer device: I ordered busware.de CC1101-USB-Lite 868MHz (CUL).
http://www.busware.de/tiki-index.php?page=CUL
(It is also CC1101 based @26M, all registers accessible, so there will not be problems, but I have to write a custom firmware for evoTouch sniffing/communication; if someone needs it let me know)
I have chosen this unit, because it can be used not only for sniffing, but for transmission as well, so it is suitable as the RF part of a future PC-based system.
It will be shipped next week and as soon as I have the results I will let you know if it worth purchasing.
I also ordered a set of evotouch for testing purposes (as my wife will kill me if I brick my controller in the middle of the heating season
).
If I may add, simple brute-force sniffing will not result in fast success, as the protocol is using a channel coding and the communication also depends on a magic from the current device ID.
Anyway, after knowing the algorithm, sniffing logs may be used for verification and reveal not-yet-known communication.
The hardware of the evotouch controller and the protocol itself is ~90% mapped, I need to make some real tests before publishing something full of errors.
Good hunters do not drink for the skin of the bear before shot, so I will let you know my plans later, after the very first step succeed.
Hopefully I will able to control the valves and the boiler relay end of next week.
From the point of first successful control attempt I am seeking for help to double-check my results and documentation.