A short delay since the last post...

I went ahead and disconnected the buzzer from the remote, and wired hookups to the switches I need (Up, Down, Tick and Back)

Measuring the voltages while pressing buttons indicated that the inputs were active high, but weren't being pulled up to 5v like the rest of the board. Voltages read to ~3v. Excellent news, I thought, I can drive these direct from the esp!

Needless to say, this didn't work. Each 'button press' was registered by the remote as multiple buttons being pressed. Further investigation revealed that the buttons were being multiplexed by switching their commons at ~250Hz, with three 'groups' of buttons sharing three 'commons'. Each of the commons is switched at ~250Hz with approx 30% duty cycle, phase shifted so as not to overlap. The μc in the remote can then work out which button is pressed.

My first thought was to have the esp listen to the clocked common, and bring the switch lines high and low in time, but I couldn't get this to work reliably (perhaps easier with a 'duino rather than the non-real-time esp). Next, I tried using AND gates across the switches, but this was even worse. I suspect this was an implementation problem.

Next, I used a 4-way relay board across the switches. This worked! But the clicking was frustrating... and the resulting mess was bulky. It did, however, provide working hardware to develop some software on.