As it happens, I've been working on exactly that this week. I've recently acquired a TSU9600 and want to route all of the commands and have any rules defined in another system (currently looking at OpenHAB) so that I'm not tied to always using the Pronto. I got the Pronto because I want the hard buttons, but sometimes it'll be nice to be able to use a phone/tablet.

I was going to hook up some IR LEDs to a Raspberry Pi and have that act as my IR extender, but my TSU9600 came bundled with an RFX9400 so I decided to see if there was any way to reuse that first. So pretty much the opposite of what you're doing, but I still need to understand the communications protocol and at least some of the IR payload format to be able to convert to it.

So far I've worked out
- How to gain telnet access to the RFX9400 and run the diagnostic software on there and dump packets
- The communications protocol used to send IR payloads to the RFX9400. Probably much the same as you've already worked out for serial on the RFX9600 except for the commands to continue and stop sending the code for long presses
- The format for the IR payload sent when a code is defined using the old Pronto HEX format in PEP. I understand this and the conversion process enough that I have a Java app that will take Sony Pronto HEX commands and successfuly send them to my TV via the RFX9400
- Today I've taken a code form my Sony remote learnt in PEP (so, starting with FFFF and very long) and have managed work out how this is encoded based on a modified understanding of the format of the converted codes.

Everything is documented, but given it's in the form of a log of the investigation process which is still ongoing it's not very concise.

This document, [Link: gist.github.com], describes

- telnet access
- diagnostic software
- an out of date description of the ECF format (this seems to be Philips' term for the codes starting with FFFF)
- process for converting Pronto HEX to ECF that is slightly wrong, but is close enough to work

A second document, [Link: gist.github.com]

- shows how to decode a learned code in ECF/FFFF format
- updates my description of the ECF format to be more generalised. I'm pretty confident this is more correct than the previous version but I haven't implemented and tested it yet

It's still a work in progress so I'd be interested in any corrections. I've only looked at 2 brands of remote so far so there is bound to be variations I have not seen. Hopefully it's enough for anyone else wanting to do something like this to get started though.

As others have noted there are also the protected database codes which start with EECF in the payload. I've really not paid much attention to them as I don't have any need for them myself. There are references to encryption keys in various binaries on the RFX9400 but I don't know how you might go about actually extracting them. Without those you won't be able to support protected database codes. I'm not sure if those are what you're wanting to re-use, or if they're codes you've added to the database yourself.


Pete