Reverse engineering an ancient wireless security keypad using RTL-SDR • Hacker News Board

Re: Reverse engineering an ancient wireless security keypad using RTL-SDR

#21

Post by drzaiusapelord » Mon, Sep 14, 2015, 3:41 PM UTC

flashman wrote: post #6

You can use a similar technique to clone a garage door remote control. You simply have to record the transmission using the techniques mentioned in this post, then rebroadcast it on the same frequency. Broadcasting FM is as simple as loading a Raspberry Pi up with PiFM[0]. Or, if you don't have the original remote (but are a bit more technical), you can just brute force the combination; most remotes only use a 12-bit…

Unless I'm reading this wrong, GPIO4 is being used as a radio transmitter, but it can only do between 100.025Mhz and 99.975Mhz frequencies. Garage openers work mostly on 315 and, older ones, on 390 MHz.

I don't think the pi ships with a proper software defined radio.

Re: Reverse engineering an ancient wireless security keypad using RTL-SDR

#22

Post by flashman » Mon, Sep 14, 2015, 11:10 PM UTC

jbergknoff wrote: post #20

flashman wrote: post #6

You can use a similar technique to clone a garage door remote control. You simply have to record the transmission using the techniques mentioned in this post, then rebroadcast it on the same frequency. Broadcasting FM is as simple as loading a Raspberry Pi up with PiFM[0]. Or, if you don't have the original remote (but are a bit more technical), you can just brute force the combination; most remotes only use a 12-bit…

Nice. I have a 30 year old garage opener but I don't have a remote. I know the combination because I set the DIP switches, and I think I even dug up the trasmission frequency when I looked into it a few months ago. I don't know what sort of transmission the opener wants to receive, though. Any resources you can point me to on that topic?

One thing I don't know how to do is encode information in pulses. That's why I use the record/replay method. There is probably a program that will convert a binary string to pulsed data (I believe 2ms chirps with 2ms gap between them?) but I don't know of it.

There is a little more information on the opening signal here: http://andrewmohawk.com/2012/09/06/hacking-fixed-key-remotes...

Re: Reverse engineering an ancient wireless security keypad using RTL-SDR

#23

Post by makomk » Tue, Sep 15, 2015, 4:06 PM UTC

drzaiusapelord wrote: post #21

flashman wrote: post #6

You can use a similar technique to clone a garage door remote control. You simply have to record the transmission using the techniques mentioned in this post, then rebroadcast it on the same frequency. Broadcasting FM is as simple as loading a Raspberry Pi up with PiFM[0]. Or, if you don't have the original remote (but are a bit more technical), you can just brute force the combination; most remotes only use a 12-bit…

Unless I'm reading this wrong, GPIO4 is being used as a radio transmitter, but it can only do between 100.025Mhz and 99.975Mhz frequencies. Garage openers work mostly on 315 and, older ones, on 390 MHz. I don't think the pi ships with a proper software defined radio.

The GPIOs generate (approximate) square waves with harmonics at 3 times the fundamental frequency, then 5 times, 7 times, etc. You can apparently use a filter to select only the third harmonic and transmit on 315 MHz that way.