Using an SDR I read out the transmitted message of a key fob for my old car. The car is a 98 Mercury Grand Marquis. It's quite old so I dought it's very sophisticated.
55549d1748c2aa11d2044f 55549d1748c2aa12b70132 55549d1748c2aa139c081f 55549d1748c2aa148102ff 55549d1748c2aa156604e7 55549d1748c2aa164b01ca 55549d1748c2aa173008b7 55549d1748c2aa18150297 55549d1748c2aa19fa047f 55549d1748c2aa1adf0162 55549d1748c2aa1bc4084f 55549d1748c2aa1ca9022f 55549d1748c2aa1d8e0417 55549d1748c2aa1e7301fa 55549d1748c2aa1f5808e7 55549d1748c2aa203d02c7 55549d1748c2aa212204af 55549d1748c2aa22070192 55549d1748c2aa23ec087f 55549d1748c2aa24d1025f 55549d1748c2aa25b60447 55549d1748c2aa269b012a 55549d1748c2aa27800817 55549d1748c2aa286502f7 55549d1748c2aa294a04df
Here is some of the data I've captured. What I have so far is as follows.
Bytes 1-6 never change. I assume they are like a signature or serial number or ID of some sorts.
Bytes 7 and 8 count up. I'm guessing this is the number only used once. When byte 8 rolls over, byte 7 increments.
Byte 9 seems random. It might be the rolling code.
Byte 10 is the button being pressed. The fob has 4 buttons and there are four numbers that show up here: 0x04, 0x08, 0x01, and 0x02.
Byte 11 also seems random. I assume this is the CRC just because it shows up at the end of the message.
I've tried using reveng with no success. I fed it all of the listed data and more and it always comes back with "no model found". I'm not at all familiar with using reveng so just in case I'm an idiot here are the commands I've tried. each command was followed by the data through a batch file.
reveng -w 8 -s reveng -w 8 -l -s reveng -w 8 -F -s reveng -w 8 -l -F -s
Any thoughts or ideas would be appreciated.
It seems that I may have cracked the checksum. It is a simple sum of the message. The catch is that the first 2 bytes are not included. Also, the sum is truncated to just the least significant byte. I have not exhaustively checked the whole data set but spot checking seems to work 100% of the time.
9d1748c2aa11d2044f 34f 9d1748c2aa12b70132 332 9d1748c2aa139c081f 31f 9d1748c2aa164b01ca 2ca 9d1748c2aa173008b7 2b7 9d1748c2aa19fa047f 37f 9d1748c2aa1adf0162 362 9d1748c2aa1d8e0417 317 9d1748c2aa1e7301fa 2fa