I'm trying to reverse engineer my garage door remote (we're having robbery problems here, so I check if it's a weak point), here's what I found, listening on 868MHz:
There's a "preamble" composed of an alternance of ones and zeros.
Then, data bits are transmitted using 3 bits, using the form "10x", I mean, a one, followed by a zero, following by a data bit, I do not recognize this encoding.
It looks to transmit 52 or 53 bits per button press (the last bit is always 0 so I don't really know if I have to count it or not).
Here's what I identified, I labelled the columns as far as I understand them, there's 4 lines for 4 distinct records (4 button press):
Constant Remote specific b ? rolling code ? 000011110100 1010101000000100 1000 0000 0011101001011011 0 000011110100 1010101000000100 0100 0000 1111010101001100 0 000011110100 1010101000000100 0010 0000 1011000111001010 0 000011110100 1010101000000100 0001 0000 1000010111011001 0
- Constant: ... a 12 bits constant, not identified, could be the door id, the vendor ID, a protocol constant, don't know.
- Remote specific: a 16 bits value, it change when I test another remote so it may be something like the serial number of my remote.
- b is 4 bits showing the pressed buttons, one bit per button, (4 buttons == 4 bitS), here I pressed successively button 1, 2, 3 and 4 to demo it.
- the 2nd 4-bits column is always filled of zeros
- 16 bits of maybe a rolling code
- last bit is always 0, as far as I measured (like 25 records).
A long press emits the same message in a loop (the "rolling code" does not change"), but a release followed by another press make the rolling code change.
The remote is a "v2 phoenix", which looks compatible with the "v2 phox".
Do you have any idea about which protocol it is? (if it's named a "protocol")