My Ceiling fan is controlled by a Hunter Fan Co 27185 remote control, which transmits control messages over RF at 350MHz.
Internally the device uses a HT12E encoder chip driving a 350MHz LC oscillator.
I used my RTLSDR and Gqrx to capture transmissions from the remote, which revealed the following things…
Inspectrum is a promising open source project that enables very quick and easy analysis of narrow-band signals contained in IQ-data captures.
Analysis of the transmissions captured by Gqrx revealed that the packets are sent in a PWM (pulse-width modulation) scheme over OOK.
With the modulation of the packets now known, I used GNU radio to construct a real-time version of the Inspectrum demodulator.