While I've written this for my Energenie remote-control sockets, it should work for any "Type D" socket as defined in the rc-switch wiki - i.e, 433mhz learning sockets. Many thanks to Energenie for documenting their accessories; extremely helpful.
Here's what I sniffed using rc-switch/figured out by bashing my head against IHC for iOS backups: RF HIGH BIT: 1507, RF LOW BIT: 0815, RF FOOTER: 08dc000000000000 Format: RF (b2), Repeats: 08 (8), Data: 20 pairs (remote ID), 4 pairs (socket command), 4 pairs (footer)
RF HIGH BIT: 1507, RF LOW BIT: 0815, RF FOOTER: 08dc000000000000
Format: RF (b2), Repeats: 08 (8), Data: 20 pairs (remote ID), 4 pairs (socket command), 4 pairs (footer)
I was thrown for a while looking at RF dumps as HIGH (1507) could come in as 1506 or 1508, and LOW (0816) could be 0815 or 0817. Realise now that's just the radios being vague, not actual important information. Once we had that figured out (and rounded off!), here's the steps to this generation:
HIGH
LOW
RF + REPEATS + DATA LENGTH + DATA + FOOTER
b2
08
34 00
1507 0815 (...)
08dc000000000000
1 On, 1 Off, 2 On, 2 Off, 3 On, 3 Off, 4 On, 4 Off, All On, All Off.