Identification of the wireless protocol of a car key fob

As a continuation of my previous post, I will use HackRF One with Universal Radio Hacker (URH) software for the quick identification of the wireless protocol used in my car remote key fob. 

Since I didn't know the transmission frequency of the fob, I first used HackRF Spectrum analyzer software to identify its frequency. Here in Europe the more probable frequencies should be in the range of 433 MHz, 868 MHz or 915 MHz ISM frequencies, so I configured a frequency span from 400 MHz to 1 GHz. 

I let the analyzer start the scan and pressed the buttons of the key fob to transmit the data. The transmission appeared very clear at the frequency of 434 MHz. I noted this frequency to be used with URH software. 


Then, I launched URH software and started with its Spectrum Analyzer to the fine identification of the transmission frequency; in this case 434,408 MHz. 


After that, I captured a couple of transmissions for each of the three buttons of the fob using the "Record signal" function of URH. These signals are added automatically to the "Interpretation" tab of the URH program.



URH automatic detects the parameters of the signal, which in this case has OOK modulation (ASK modulation in URH), and with 600 Samples/Symbol, etc.


Now it is interesting to change the "Signal View" mode to "Demodulated", in order to see the signal translated as bits. 

 
Looking to the demodulated signal, it is easy to identify that it is encoded using differential Manchester, also called biphase mark code. A lack of transition at the clock tick means a '1' and a transition at the clock tick means a '0'. 

E.g. the captures below show the demodulation of the latest bits for the three buttons (two traces for each button). Apparently, the latest six bits identify the pressed button.


Using the "Analysis" tab of URH, the signals are automatically decoded. I selected "Differential Manchester" as Decoding mode and "Hex" as "View data as". From these results, it appears that there is a common preamble, changed data that it is likely the pseudo-random rolling code, and the latest bits are the identification of the button as explained above. 

Conclusion

This post shows a basic usage of URH and how it facilitates the identification of a simple wireless protocol.

Comments

Post a Comment

Popular posts from this blog

Software arsenal for the HackRF One

Image
HackRF One , from Great Scott Gadgets, is a Software Defined Radio (SDR) capable of transmission or reception of radio signals from 1 MHz to 6 GHz, supporting sample rates up to 20 Msamples per second. This is a powerful tool for radio experimentation, it is cheap, and compared to cheap RTL SDR dongles, it has the capability of transmit. There are tons of information in the web about this device and SDR in general and I suggest to start with the wiki , but it is not that easy to identify what software would be the more adequate to the particular needs and the specific issues for installing on Windows platform. I expect that this post would help you on this. Note that you are responsible for using your HackRF One legally! Zadig The first step for using HackRF One on a Windows computer, will be installing the required USB drivers using Zadig application. Downlad Zadig (note that SDR# Community Installer already includes it) and follow the instructions below: (1) Connect th...
Read more

Simple impedance meter project with STM32F4 Discovery board

Image
This post describes an experimental software-based impedance meter project that uses the STM32F4 Discovery board with very few additional components. The meter operates at a fixed exciting sinusoidal frequency of 59659 Hz, and it is capable to measure the impedance vector of a load, i.e. its resistance and reactance. A measurement is initiated by the user by pressing the blue button of the board and the readings are output to a terminal emulator program through the USB interface. The measurement principles are based on the article "An LMS Impedance Bridge – QEX Sept/Oct 2015" from Dr. George R. Steber. The project and source code is available at the following link . It is assumed that the reader has background in the STM32 environment. Overall operation The block diagram of the illustration below shows the basic building blocks of the meter. The capacitor and resistor in addition to the interconnection elements, are the only external components required. Howeve...
Read more

Python notebooks and the SARK-110 Antenna Analyzer

Image
The SARK-110 can be controlled from a computer using scripts written in Python programming language . For this purpose, there is an open source library and examples written in Python that facilitates this task and can be used from Windows, Linux or Mac OS. The library includes some basic examples that are normal Python scripts, and also some examples written as Jupyter Notebooks . As described in the Jupyter website , "the Jupyter Notebook is an open-source web application that allows you to create and share documents that contain live code, equations, visualizations and narrative text. Uses include: data cleaning and transformation, numerical simulation, statistical modeling, data visualization, machine learning, and much more" . The provided notebook examples, such as   https://github.com/EA4FRB/sark110-python/blob/master/src/plot_example.ipynb , illustrate how to use the libray or more properly stated, the Python Sark110 class, and plot the acquired data.  There...
Read more