Hacking the Zoom H2n Remote Control

The Zoom H2n is a portable sound recorder looking like an old fashioned microphone it is a handheld device that provides an assortment of stereo and surround recording modes, it records onto an SD card in MP3 or WAV format with options for various bitrates and frequencies. The unit is powered internally by two AA batteries and can also be powered from the USB port. The recorder I am experimenting on has firmware version 2.00 installed.

A not at all contrived image of the Zoom H2n Portable Recorder

The Zoom Remote Controller RC2 is a wired four pin 2.5mm jack plug connection, this remote has three buttons: record, mark, and pause there is also an LED to show when the H2n is recording. It is purchased separately from the recorder and only appears to be available bundled in an accessory pack. It looks difficult to take apart without leaving some damage, and this may not be necessary for decoding.

Zoom Remote and breadboard for testing

In this post I am looking to see how the remote works and find what control method it employs so in Part Two I can use an Arduino style micro-controller to provide an external trigger such as for timed recordings.

Setup for Testing

For testing I have made a breakout lead, this is essentially an extension cable split in half with a couple of molex style connectors allowing me to plug it into a breadboard. With this I have found the cable has the following connections, with pin one being the tip of the 2.5mm jack plug:

  1. Remote Receive – RX
  2. Remote Transmit – TX
  3. Ground
  4. 3.1V – Power

When checking with a multimeter I found continuity from the negative of the left battery (on the Mic Gain side) to pin three, ground, of the jack, there is also a connection between the positive of the right-hand battery to pin one of the jack but on the multimeter in diode mode there looks to be a capacitor, the voltage rises until no apparent connection is indicated. With no activity on the recorder the RX and TX pins show ~2.7 volts.

Determining the RX and TX pins turned out to be straightforward. When you press the record button after a moment the recording LED lights up, on the oscilloscope I can see three different square wave patterns for the three different buttons on the TX pin and a single type of square wave on RX to light the LED. The following images show the signal for the record button then that sent in response to to light the LED.

Signal sent by the remote when Record pressed
Signal sent by the Zoom recorder to light the LED in the remote

Also when buttons are pressed on the recorder data is seen on the RX line. For a more detailed examination I will need to break out the logic analyser.

Signal Analysis

Following some research where the remote for a Zoom H4n was examined, I set both channels being used on the logic analyser to the following:

  • Protocol: UART
  • 2400 baud, 8 bits, no parity, 1 stop (8n1)
  • Bit Order: LSB first, inverted logic: No
Decoding of the first part of the stop recording command

First I decoded the buttons on the remote with the trigger on the logic analyser set to falling edge on the Remote TX line. On TX there is a pause between the two pairs of command bytes which appears to be the length of time the button was pressed, around 350-500ms, there is also a pause between bytes in the RX response, the value of the response changes depending on which recording mode you are in, those shown below are when the recorder is in XY Stereo:

Record Start
TX: 0x81 0x0 ~ 0x80 0x0
RX: 0x20 1.85s 0x20 0x21 record LED on
Record Stop
TX: 0x81 0x0 ~ 0x80 0x0
RX: 0x21 0x21 0x20 1.9s 0x20 0x20 record LED off
Pause (while recording)
TX: 0x80 0x2 ~ 0x80 0x0
RX: 0x21 51ms 0x21 0x20 then this repeats
492ms 0x20 0x21 to flash the LED
492ms 0x21 0x20 until pause is pressed again
Resume from Pause
TX: 0x80 0x2 ~ 0x80 0x0
RX: 0x21 0x21 LED on
Mark
TX: 0x80 0x1 ~ 0x80 0x0
RX: 0x21 492ms 0x20 0x21 LED on

I was also able to capture the following activity sent to the remote when various buttons were pressed on the recorder itself with the recorder in XY Stereo mode. Other models of the recorders made by Zoom have more advanced remotes, such as the RC4 as featured in this hack of the H4n. I suspect they would work on this machine too. This time I set the logic analyser to trigger with a falling edge on Remote RX. I think the 0x20 code is used to indicate the display illumination has been turned off. I saw activity on all buttons except the Mic Gain knob.

Power On – Without remote attached
TX: Lots of random activity
RX: 0x10 400ms 0x80 0x81
1.2s 0x10 0x0 0x80 0x0
140ms 0x0 0x0 0x80 0x80 0x0
~2ms 0x0 0x80 0x0 0x0 0x80 0x0
Power On – With remote attached
TX: 0x0 five pulses 30ms apart
30ms 0x0 0xA1 0x80 0x0 0xA1
RX: following pulses on TX 0x80 0x81 0x80 0x10
1.2s 0x10 0x0
148ms 0x0 0x0
~4ms 0x0 0x0 0x0
Record Start
RX: 0x20 20ms 0x20 0x21 LED on
Record Stop
RX: 0x21 0x21 0x21 0x20 ~ 0x20
~283ms 0x20 0x20  LED off
Menu \ Home – Into Menu
RX: 0x20 0x20 0x0
Exit from Menu
RX: 0x20 45ms 0x20
Play Switch: Up/Down/Press
RX: 0x20 55ms 0x20
Clipping detect (tapping the microphone with a pen)
RX: 0x10 0x2 56ms 0x2
59ms 0x10
60ms 0x10
354ms 0x10
Volume: Up and Down
RX: 0x20
Recording Mode Change: 4 channel surround
RX: 0x10 0x10 0x30 14ms 0x30 0x30
122ms 0x34
60ms 0x30
60ms 0x30
Recording Mode Change: XY Stereo
RX: 0x30 0x30 0x20 216ms 0x20
Recording Mode Change: 2 channel surround
RX: 0x20 0x20 0x30 0x30 18ms 0x30
148ms 0x30
164ms 0x30 0x6
56ms 0x14 0x30
477ms 0x30
Recording Mode Change: MS Stereo
RX: 0x30 0x30 0x10 170ms 0x10
50ms 0x12

I think these response codes are to light up various LED’s on the more advanced Zoom RC4 remote, this suggests that other remotes would work in this recorder.

The following table shows the response codes given with different microphone configurations when record is clicked to start recording:

TX: 0x81 0x0 ~100ms delay 0x80 0x0
XY Stereo: 0x20 750ms delay 0x20 0x21
2 Channel Surround: 0x30 750ms delay 0x30 0x31
MS Stereo: 0x10 750ms delay 0x10 0x11
4 Channel Surround: 0x30 750ms delay 0x30 0x31

In Part Two I will be covering the use of a Arduino style micro-controller as an alternative remote control.

Links and Sources

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.