2

I'm trying to reverse engineer my garage door remote (we're having robbery problems here, so I check if it's a weak point), here's what I found, listening on 868MHz:

There's a "preamble" composed of an alternance of ones and zeros.

Then, data bits are transmitted using 3 bits, using the form "10x", I mean, a one, followed by a zero, following by a data bit, I do not recognize this encoding.

It looks to transmit 52 or 53 bits per button press (the last bit is always 0 so I don't really know if I have to count it or not).

Here's what I identified, I labelled the columns as far as I understand them, there's 4 lines for 4 distinct records (4 button press):

Constant     Remote specific  b    ?    rolling code ?   
000011110100 1010101000000100 1000 0000 0011101001011011 0
000011110100 1010101000000100 0100 0000 1111010101001100 0
000011110100 1010101000000100 0010 0000 1011000111001010 0
000011110100 1010101000000100 0001 0000 1000010111011001 0

with:

  • Constant: ... a 12 bits constant, not identified, could be the door id, the vendor ID, a protocol constant, don't know.
  • Remote specific: a 16 bits value, it change when I test another remote so it may be something like the serial number of my remote.
  • b is 4 bits showing the pressed buttons, one bit per button, (4 buttons == 4 bitS), here I pressed successively button 1, 2, 3 and 4 to demo it.
  • the 2nd 4-bits column is always filled of zeros
  • 16 bits of maybe a rolling code
  • last bit is always 0, as far as I measured (like 25 records).

A long press emits the same message in a loop (the "rolling code" does not change"), but a release followed by another press make the rolling code change.

The remote is a "v2 phoenix", which looks compatible with the "v2 phox".

Do you have any idea about which protocol it is? (if it's named a "protocol")

  • I propose you migrate this to the reverse engineering stackexchange. This has nothing to do with amateur radio, and is not about the technology and theory of radio in general. Your problem isn't RF – it's identifying the function that generates your rolling codes. – Marcus Müller Jun 15 at 13:13
  • While this is radio related, it is not amateur radio related. Most garage doors use the KeeLoq protocol which is 66 bytes of data, 28 byte serial number, 4 bytes of button information, 2 bytes status, and 32 bytes of actual rolling code. – Jim Jun 15 at 13:14
  • 1
    by the way, no need to reverse engineer anything here: if the garage door opens no matter how many wrong attempts you've made before (which it probably does), then these are ridiculously only 16 bits of things you need to try out, so 2¹⁶ possibilites. You should be through trying every possibility in a minute or two, over the air. So, if you are wondering whether this is a safe system against someone who has an SDR: no, it's not. No further investigation needed. Is that really relevant as a threat model? Probably not. How many robbers are technologically more advanced than a crowbar? – Marcus Müller Jun 15 at 14:24
  • Thanks someone to migrate my question to the right stackexchange. It does not looks like KeeLoq as it does not match the message length nor the message format. – Julien Palard Jun 15 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.