-2
\$\begingroup\$

The signal I want to replicate is to open/close a garage door, operated by a Novoferm motor. The remote control used is a Novotron 522. The description states this is 2-channel remote control, operating at a frequency of 433 MHz. It uses "AES 128 bits, KeeLog" Tormatic Keeloq Rolling code. I'm equipped with a HackRF SDR that I could use to intercept (record) and reproduce the signal.

Do you think this would be possible?

\$\endgroup\$
2
\$\begingroup\$

Unless there is an unexpected flaw in their design, it is not possible.

Rolling codes are designed so that, even if you can intercept the data frame that has been transmitted from the genuine remote, it is useless: using the same data frame again will be ineffective (they are single-use), and it can't be analyzed to predict the next data frame that will open the door again.

What you want to do is exactly what the device is designed to prevent thiefs to do, and it effectively requires breaking AES 128.

\$\endgroup\$
  • \$\begingroup\$ On the other hand, if you do figure it out, make sure to let the information security sector know. They would be extremely interested in how you did it. \$\endgroup\$ – Hearth May 5 at 19:54
  • \$\begingroup\$ Thanks, @dim. Would this mean if I want to automate the opening/closing of my own garage door, I'd have to design a device to physically press the buttons of the given remote? \$\endgroup\$ – Stefan Doychev May 5 at 20:09
  • 2
    \$\begingroup\$ @StefanDoychev This solution is more realistic, but probably not practical. Instead of having something that mechanically presses the button, I would check the possibility to disassemble the remote, solder two wires from the button pins and put a relay there. Then you're free to trigger the relay whenever you want, and the result will be the same as a button click. \$\endgroup\$ – dim May 5 at 20:19
1
\$\begingroup\$

Johnson Controls has designed smart remotes for cars to pair the Keelog encoder sequence in an AUto-Learning mode. They in turn supply the consoles with wireless remotes for all auto OEM’s

Other’s also do it for other products. It requires you have physical access.

https://cdn.sos.sk/productdata/8b/da/3ba32979/hcs-dec-4-f.pdf

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.