Live data from Hacker News

Reverse engineering a car key fob signal

0x44.cc

31–40 of 85 posts

Re: Reverse engineering a car key fob signal

#31
post #7

> These keys are generated and tracked using a counter which has to stay in sync between the remote and the car. This ensures that the car doesn’t reuse an old key, and that the remote always generates fresh keys. Something I've always wondered about is, how do learning remotes defeat this? My car has a couple of built-in garage door buttons, and I'm pretty sure I programmed it by just hitting the remote button in th…

My understanding is that most garage door openers do not use rolling keys, they send the same code each time.

They have been rolling codes since the early 2000s. 80s and most 90s doors are static codes.

Re: Reverse engineering a car key fob signal

#33
post #20

Earlier quoted context omitted.

I've got a Flipper, LimeSDR (non-mini), some old-school ham equipment, a cheapo $10 RTL-SDR receiver, a few cheap HTs, some RFID tools, etc. Each has their use. The Flipper is nice for quick and lightweight checking of things. LimeSDR is incredibly capable, but also a bit of a pain in the ass to use. Not something you'll flip out to quickly check something or run an experiment.

> checking of things like what?

Door handles

Re: Reverse engineering a car key fob signal

#34
post #7

> These keys are generated and tracked using a counter which has to stay in sync between the remote and the car. This ensures that the car doesn’t reuse an old key, and that the remote always generates fresh keys. Something I've always wondered about is, how do learning remotes defeat this? My car has a couple of built-in garage door buttons, and I'm pretty sure I programmed it by just hitting the remote button in th…

My understanding is that most garage door openers do not use rolling keys, they send the same code each time.

Mine has rolling codes and a "learn button" on the head end to accept a new remote.

Re: Reverse engineering a car key fob signal

#35

Earlier quoted context omitted.

The flipper isn't really a full sdr though, it just has a very minimalist RF IC that has almost non-existent bandwidth. For $400 you can get a limeSDR mini that can read and write 30MHz of spectrum at a time, ie the entire ham 70cm band all at once. If you think a flipper is dangerous, plug in a dummy load and dump noise on L1 then watch your phones GPS stop working, or alternatively decide it's on another continent.

what benefit does being able to read the entire ham 70cm at once bring/what usecases does it unlock? interested in learning

Depends very broadly on your area of interest, but to throw out some random numbers and thoughts:

If you want to move data between two points, 30MHz of "bandwidth", depending on noise and signal, can be on the order of 30MB/s data rates or more assuming you're good at doing QAM or similar modulation. That's 50x what the CC1101 in the flipper maxes out at

If you want to search for a particular signal of interest (ie why does turning on my LED lamp open my garage door), that's more spectrum you can view at once, about 3x wider than what an RTL-SDR can receive. Similarly, you can view the entirety of a 30MHz wide emission as opposed to only seeing pieces of it.

You could monitor two different narrow bandwidth signal sources that are within ~30MHz of each other simultaneously, ie the 101.5FM broadcast channel and 121.5 airband guard channel. This provides the capabilities of something like a police radio scanner, covering the entire VHF or UHF land mobile band but without having to stop listening to find another signal and the ability to record the entire spectrum capture to disk so you can review all concurrent transmissions separately at a later time.

https://en.wikipedia.org/wiki/Waterfall_plot#/media/File:SDR...

Above is a spectrum plot of an FM broadcast station using wide FM modulation and with some digital sub carriers on either side for song info etc. Other stations will be to the left and right of it and the "bandwidth" of the receiver determines how wide the plot you can view is.

Re: Reverse engineering a car key fob signal

#36
post #7

> These keys are generated and tracked using a counter which has to stay in sync between the remote and the car. This ensures that the car doesn’t reuse an old key, and that the remote always generates fresh keys. Something I've always wondered about is, how do learning remotes defeat this? My car has a couple of built-in garage door buttons, and I'm pretty sure I programmed it by just hitting the remote button in th…

My understanding is that most garage door openers do not use rolling keys, they send the same code each time.

my 2016 gate use rolling codes.

Re: Reverse engineering a car key fob signal

#37
post #27

Earlier quoted context omitted.

My understanding is that most garage door openers do not use rolling keys, they send the same code each time.

They've been in use since the 90s, actually[0]. My understanding is that the earlier rolling code systems are easily defeated and I think this can be done (possibly with stock firmware) using a Flipper Zero. Prior to that, garage doors had a set of DIP switches (16, or 32, I can't remember). You matched the switch configuration on your opener with the switch configuration on the controller. And as you might imagine,…

There were also so-called "learning codes" that overlapped substantially with the introduction of rolling codes. Think fixed-code remotes with a random preprogrammed code instead of dip switches. Chamberlain's "billion code" is representative. They have to be paired with the opener receiver in the same way as rolling code remotes.

Re: Reverse engineering a car key fob signal

#39
post #3

>Note: Transceiver SDR devices do exist of course, but they tend to be very pricey A HackRF clone is cheaper than a Flipper, and way more capable in my opinion. I would bet most flippers either lie in drawers or are used by stupid teenager kiddies for trolling.

I have both. They both enjoy the warmth of my drawer :)

Realest comment here. I have a few drawers full of these kind of toys I used once and forgot about. Right next to my serial cables and bits of wire.

Re: Reverse engineering a car key fob signal

#40
post #12

Why bother intercepting, decoding, and encoding your own signal when you can just use a big antenna and MITM the fob and the vehicle and convince them they are closer than they really are?

what kind of consumer level antenna can forward/amplify key fobs (in the gigahertz range, no?) without causing excess “signal to noise” ratio that the car can detect?

One example: https://youtu.be/uxzm_6SYBFo?si=BSav_oEKiFBT8cf8&t=41
Post reply on HN