3

Considering a key fob for RKE (remote keyless entry, automotive) its signal has been captured: It sends at 433,92MHz simple on/off.

Following I regard the deltas (time differences between on-off or off-on). The greatest common divisor of these deltas is 500µs.

The signal is the following (*500µs each, starting LOW):

50,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,10,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,1,1,1,1,1,2,
1,1,1,1,1,1,1,1,1,2,1,2,1,1,1,3,1,1,1,1,1,3,
1,2,1,1,1,1,1,2,1,3,1,1,1,1,1,2,1,2,1,3,1,3,
1,2,1,2,1,2,1,1,1,1,1,2,1,3,1,1,1

other samples:

52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 
1 1 1 1 1 1 1 1 1 2 1 2 1 1 1 1 1 2 1 2 1 1 
1 2 1 2 1 1 1 1 1 2 1 1 1 2 1 3 1 2 1 2 1 1 
1 1 1 2 1 1 1 1 1 1 1 2 1 3 1 1 1 1 1 2 1 1 
1 2 1 3 1 2 1 1 1 1 1 2 1 1 1 1 1 1 1

52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 
1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 2 1 1 1 1 
1 1 1 2 1 1 1 2 1 1 1 2 1 1 1 3 1 1 1 1 1 1 
1 1 1 1 1 3 1 1 1 2 1 2 1 1 1 1 1 1 1 1 1 3 
1 3 1 3 1 1 1 1 1 2 1 1 1 2 1 2 1 2 1 1 1

52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 
1 1 1 1 1 1 1 1 1 3 1 3 1 3 1 2 1 2 1 1 1 3 
1 1 1 1 1 2 1 2 1 1 1 1 1 3 1 2 1 2 1 2 1 1 
1 2 1 2 1 2 1 2 1 1 1 2 1 1 1 1 1 1 1 1 1 3 
1 2 1 1 1 1 1 1 1 1 1 2 1 1 1

52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 
1 1 1 1 1 1 1 1 1 2 1 2 1 1 1 1 1 1 1 3 1 1 
1 1 1 1 1 3 1 1 1 3 1 3 1 1 1 3 1 1 1 1 1 2 
1 1 1 1 1 1 1 1 1 2 1 3 1 1 1 1 1 2 1 1 1 1 
1 1 1 1 1 2 1 2 1 1 1 1 1 2 1 2 1 2 1

(50 might be 50~52, 10 might be 11, however this is not important), the receiver is sensitive enough to seperate 500,1000,1500µs -- these are the important datas.

It does NOT seem to be Manchester because there is only 1 and 2 times the "main delta", not 3*500. Some sort of PWM? So what is the main width and duty cycle?

I ask for the name of this encoding. 50 and 10 (x500µs) seems special, interesting is the part beginning after the 10*500µs=5000µs.

Update I did a simple replay attack: Captured a signal like the samples above (enough distance to car, so that it doesn't hear it), then replayed the signal with my 433MHz Transmitter and car opened successfully! That proves data is accurate enough and things are working properly. However now comes the hard part... Addition: I spotted two things: The duration of every signal is the same, if you want to further analyze it, write it like this (just example, no captured signal):

1 1 1 2   1 3     1
1 1 1 1 1 1 1 1 1 1

In addition: There is always this prefix

50 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1

Then it is maybe helpful to spot that between two non-1 (2 or 3), there is an odd amount of 1 always. Conclusion: The longer times (2 or 3) are always LOW because first 50*500µs is LOW, short pulses (1*500µs) can be both hi/lo.

I guess no one knows the encryption, but someone knows the encoding? Some sort of "line code" ?

Update2

Concerning request by @JimmyB I am adding binary representation, whereby a single 0 or 1 represents a 500µs pulse with the corresponding amplitude (0 or 1).

The prefix becomes this:

000000000000000000000000000000000000000000000000000101010101010101010100000000000101010101

Many samples following (sample hereby refers to the data after prefix, so the complete data is simply prefix+data), one sample per line:

00100101010010010100100101010010100100010010010101001010101001000101010010100100010010101001010101
01010101001010101001010010100101000101010101010001010010010101010100010001000101010010100100100101
00010001000100100101000101010010010101000100100100101001001001001010010101010100010010101010100101
00100101010100010101010001010001000101000101010010101010100100010101001010101010010010101001001001
01010100101010010101010100100101000101010001001010100100010101001001000100010010010010101001000101
01001001010100010001001010010101000101010001010101001001000101000101010100100101010010100101001001
00010101001010100100101001010101000100101010010101000100100101001001010101010010010010100100101001
01000101001010100100101010101010100100101001001010100100010101010001000100100101000100100101001001
01000100101001010101001010010001010101001001010010010100101010010101001001010100100100100100100101
01010010100101010010010100010101001001001001000101001010100101010001001001000100010010101010100101
00100101001010100101000101001001010010100101000100010010100101000100101010010001000100100100100101
01010001010101010100010100101001010001001001001001010100100101001001000100101001010010101010010001
00010100100100101010010100101010101010101010100101001010010010100100100101000100100100101001010101

Using this representation, it is clearly visible that all samples have same duration (might or might not be important for further analysis). Now looking for patterns? This is all I can provide, I guess. Due to the fact that this is in Germany, something like FCC-ID doesn't exist, so there would be chance of getting more information even though the interesting parts normally are non-public...

14
  • Are you sure about the modulation? If you're right, the message would have really low entropy for anything remotely secure (no pun intended). – JimmyB Aug 30 '16 at 19:40
  • The data is definitely correctly captured. I did a simple replay attack, see my edit in original question. Can you specify bad/low entropy, where can you see this, does this mean you can steal my car ;) ? – pas-calc Aug 31 '16 at 12:11
  • I'd expect a message to be at least between 24 and 40 bits in length, of which at least 16 to 32 bits should look like random (PRNG) "noise". – JimmyB Aug 31 '16 at 12:47
  • I think your question would benefit from adding the actual signal, i.e. the sequence of lows and highs, as a diagram or at least as binary (like 10111010110...) because, as you figured out, high and low phases may carry separate meanings, in addition to their respective duration. – JimmyB Aug 31 '16 at 12:53
  • The preamble of 50, 1, 1, ... probably is only there to allow the receiver's hf frontend to adapt and "lock in" to the sender's signal strength and timing. – JimmyB Aug 31 '16 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.