Superrollo GW60 BLE RF Bridge

Project to replace the original KeeLoq RF add-on for a Superrollo GW60 roller shutter controller.

This repository contains the complete project stack:

• nRF52 firmware for BLE-to-KeeLoq RF control
• ESPHome bridge for Home Assistant integration
• a 3D-printable case
• a custom PCB design including Gerbers

Background

I built a replacement for the original RF add-on hardware. The goal of this project is to integrate my own roller shutters into a local, self-hosted automation setup without relying on the vendor accessory.

Features

• BLE peripheral running on nRF52
• simple GATT write interface for shutter actions
• actions supported:
  • UP
  • DOWN
  • STOP
• static BLE PIN with MITM-protected encrypted access
• persistent KeeLoq sync counter stored in internal flash
• serial debug interface for local testing
• ESPHome bridge for automation integration
• hardware design files for a dedicated PCB
• 3D-printable enclosure
• documentation and presentation material for the reverse engineering process

Repository layout

.
├── espHomeBridge/
│   ├── bridge.yaml
│   └── secrets.yaml
├── hardware/
│   ├── case/
│   │   └── GW60.3mf
│   └── pcb/
│       └── GW60BLE/
│           ├── Gerber.zip
├── fs.h
├── GW60BLE.ino
├── keeloq.cpp
├── keeloq.h
├── README.md
└── secrets.h

Components

Firmware

The firmware is implemented in:

• GW60BLE.ino
• keeloq.cpp
• keeloq.h
• fs.h

It runs on an nRF52-based board and exposes a BLE GATT API to trigger RF transmissions for the GW60 shutter.

Responsibilities:

• provide a BLE service for actions
• validate incoming commands
• send KeeLoq RF frames
• maintain the rolling/sync counter in internal flash
• provide a serial interface for debugging and manual control

ESPHome bridge

Located in:

• espHomeBridge/bridge.yaml

This acts as the BLE client side and integrates the device into ESPHome / Home Assistant.

Responsibilities:

• discover and connect to the BLE peripheral
• authenticate/pair if required
• write action bytes to the custom GATT characteristic
• expose the shutter as a cover-like automation endpoint

espHomeBridge/secrets.yaml contains local configuration and should remain private.

Hardware

3D-printable case

Located in:

• hardware/case/GW60.3mf

This contains the printable enclosure for the hardware build.

PCB design

Located in:

• hardware/pcb/GW60BLE/

Included files:

• Gerber export for manufacturing

This allows the project to be reproduced as dedicated hardware instead of loose prototyping components.

Architecture

Home Assistant / ESPHome
        |
        v
   ESPHome bridge
        |
      BLE
        |
        v
   nRF52 firmware
        |
    KeeLoq RF TX
        |
        v
 Superrollo GW60

BLE API

The firmware exposes a custom BLE service and characteristic:

• Service UUID: 0xBC10
• Characteristic UUID: 0xBC11

The characteristic is:

• readable
• writable
• writable without response

Action values

Action	Value
UP	0x03
DOWN	0x05
STOP	0x07

Writing one byte with one of the values above causes the firmware to:

1. update the last characteristic value
2. transmit the corresponding KeeLoq RF signal
3. increment and persist the sync counter

Security

BLE access is protected with:

• a static PIN
• encrypted connection with MITM protection

From the firmware:

• read permission: SECMODE_ENC_WITH_MITM
• write permission: SECMODE_ENC_WITH_MITM

This is not meant to be an internet-facing device. It should only be used inside a trusted local environment.

Firmware behavior

On boot, the device:

1. initializes internal flash storage
2. loads the persisted 16-bit sync counter
3. initializes Bluefruit / BLE
4. configures security
5. starts advertising the custom action service

On command reception, the device:

1. validates the action byte
2. sends the RF frame via sendSignal(...)
3. increments the sync counter
4. stores the new counter value in flash

Serial test interface

The firmware also supports direct testing over the serial console.

Serial commands

Key	Action
w	send UP
s	send DOWN
space	send STOP
m	print local BLE MAC address

Serial output

The firmware prints useful debug information such as:

• current sync counter
• BLE service/characteristic UUIDs
• configured device PIN
• connection / disconnection events

Main firmware flow

Relevant top-level behavior:

• setup()
  • starts serial
  • initializes internal flash
  • restores sync counter
  • initializes BLE stack
  • configures security and GATT
  • starts advertising
• gw60ActionWriteCallback(...)
  • validates incoming BLE writes
  • dispatches valid action bytes
• applyGw60Action(...)
  • updates characteristic value
  • sends RF signal
  • increments sync counter
• loop()
  • listens for serial test commands

Building the firmware

This firmware is written in Arduino-style C++ for nRF52 using the Adafruit Bluefruit stack.

Typical requirements:

• PlatformIO or Arduino-compatible nRF52 toolchain
• Adafruit nRF52 / Bluefruit support
• required local header files for secrets and KeeLoq implementation

Example high-level build flow:

1. create your local secrets.h
2. provide the KeeLoq implementation and RF transmit code
3. build for your target nRF52 board
4. flash the firmware
5. open serial monitor at 115200

Configuration

Sensitive values are intentionally separated from the main code.

Expected local configuration includes things such as:

• BLE device name
• BLE PIN
• RF / KeeLoq secrets
• manufacturer key material
• device-specific identifiers

Relevant private files include:

• secrets.h
• espHomeBridge/secrets.yaml

Example local secrets header

This is only illustrative; keep the real values private.

#pragma once

static const char* gw60BleDeviceName = "GW60-Bridge";
static const char* gw60BleDevicePin  = "123456";

Pairing and use

1. Power the nRF52 device.
2. Pair over BLE using the configured PIN.
3. Connect from the ESPHome bridge or another BLE client.
4. Write one byte to characteristic 0xBC11:
   • 0x03 for up
   • 0x05 for down
   • 0x07 for stop

Hardware build notes

The repository includes everything needed to reproduce the dedicated hardware build:

• enclosure model in hardware/case/
• Gerbers for fabrication in hardware/pcb/GW60BLE/Gerber.zip

This makes it possible to rebuild the project as a clean standalone device rather than as a breadboard or dev-board-only prototype.

Obtaining the Key

Dump the firmware. See https://dirb.me/doku.php?id=de:tech:gw60 for how to connect and a nice read :D In the firmware look for a contiguous run of movlw / movwf, repeated eight times, writing eight bytes into consecutive RAM registers. I did something like this on the disassembled firmware:

grep -C8 "movwf" factory.asm | grep -C8 "movlw"

Limitations

• device-specific implementation for Superrollo GW60
• uses a rolling/sync counter and therefore depends on keeping transmitter state consistent
• static BLE PIN is simple but not ideal for high-security environments
• internal flash wear should be considered if commands are sent extremely frequently

Safety, legal, and ethical note

This project is intended only for hardware I own or am explicitly authorized to control. Reverse engineering and RF transmission may be restricted by law, contract, or radio regulations depending on jurisdiction.