2
\$\begingroup\$

I'm having a 433.92 MHz standard remote control which uses "rolling code" encoding.

Are other "rolling code" encoding standard remote controls interoperable, or do I need a more detailed description of the "rolling code" (like a chip modal number, for ex. HCS301 / HCS300 / HCS200) and perhaps some other things?

So the question is: "Does having both remotes with the same chip (for example HSC301) working on the same 433.92MHz frequency, make them compatible with respect to copying (duplicating)?"


After some research my guess would be no, because I guess that different remotes might have different encoding algorithms (algorithms of rolling code progression), which might be proprietary.

\$\endgroup\$
15
  • \$\begingroup\$ what do you mean by interoperable? \$\endgroup\$
    – jsotola
    Commented Sep 12, 2021 at 17:02
  • \$\begingroup\$ basically that you can copy the code from the original remote to them \$\endgroup\$
    – croraf
    Commented Sep 12, 2021 at 19:24
  • 3
    \$\begingroup\$ there's no such thing as a "standard remote control". \$\endgroup\$ Commented Sep 12, 2021 at 19:50
  • 1
    \$\begingroup\$ copying of what? The eeprom containing all the secrets is unreadable externally, that's even said within the product description on microchip.org . \$\endgroup\$ Commented Sep 12, 2021 at 20:43
  • 2
    \$\begingroup\$ Some remotes (especially security related ones) don't have a copy feature. Instead, a new remote is added to the receiver. And yet others have no such features so that you're supposed to replace both at once. \$\endgroup\$
    – Abel
    Commented Sep 12, 2021 at 21:21

2 Answers 2

6
\$\begingroup\$

Here's a quick overview of why you cannot copy a rolling code, even if they have the same algorithm:

As noted in the comments, a rolling code is designed to prevent someone from breaking in by recording and later replaying a transmit code. The system does this by employing:

  • A transmitter that transmits an ever-changing sequence of codes, and
  • A receiver that identifies a valid transmitter and only responds to new codes from that transmitter.

In practice (in Keeloq and similar systems, which to my knowlege means all rolling code systems in existence) the code gets changed each time the transmitter is activated, and the receiver keeps track of the last code it received from the transmitter.

For example imagine a rolling code transmitter with code sequence "ABC" -- in other words on the first five activations the transmitter would transmit codes ABC01, ABC02, ABC03, ABC04, ABC05. After that fifth transmission (assuming it was received by the receiver!) then the receiver would only accept code ABC06 or later. That's what makes the rolling code resistant to the record-and-replay hack.

Now let's copy our first transmitter (TX1) over to a second transmitter (TX2). We pair them up using the next transmission, code ABC06 and all seems well. On their next activation each transmitter will transmit code ABC07.

Hopefully you already see the problem. If activate TX1, it transmits code ABC07 and the receiver responds. But the next time I try to activate TX2, it also transmits code ABC07 and so the receiver rejects it as an old code. Maybe if TX2 were activated a few times it would get ahead of TX1 and activate the receiver... but then later on TX1 would need to "catch up" to TX2, and the whole system is... less than good.

So you cannot copy rolling code transmitters because copying a rolling code transmitter would only work well if you could somehow keep the two transmitters in sync with one another, and there is no practical way to do this. It is far easier to simply pair a second, new rolling code transmitter with the receiver, as Abel mentioned in the comments.

\$\endgroup\$
7
  • \$\begingroup\$ Thanks. I see. Do you perhaps know how is the pairing of the transmitter with the receiver done. Is this usually done by physically connecting the two? \$\endgroup\$
    – croraf
    Commented Sep 14, 2021 at 9:58
  • 1
    \$\begingroup\$ This basically also means that all rolling code remote device sellers that advertise the copying capability are fake advertises? \$\endgroup\$
    – croraf
    Commented Sep 14, 2021 at 10:03
  • 1
    \$\begingroup\$ 1. Typically the pairing is done by activating a "learn mode" on the receiver. This basically tells the receiver "the next transmitter you hear, add that to your list of valid transmitters". \$\endgroup\$
    – Mr. Snrub
    Commented Sep 14, 2021 at 17:50
  • \$\begingroup\$ 2. I have never heard of a rolling code remote that can copy. Because of the reasons described in my answer, I'd say it's not really possible. Because "learn mode" exists, it's not really necessary either. I haven't seen the literature you describe, but I'll wager that it's not actually a rolling code transmitter; its probably a fixed code transmitter that can inter-operate with a rolling code system. (Yes, that totally defeats the purpose of rolling code in the first place.) \$\endgroup\$
    – Mr. Snrub
    Commented Sep 14, 2021 at 17:52
  • \$\begingroup\$ @Mr. Snrub There are rolling codes...and craptographically secure rolling codes. Most remotes don't use SHA256...and if they did, they'd probably used for bitcoin mining instead of opening garage doors. -- For a ballpark figure: the TV-B-Gone took up to 69 seconds to brute-force all TVs in range. A rolling code garage door receiver using De Bruijn Codes can be brute-forced in 8 seconds (actually transmitting all codes; it would obviously be much faster if only done it in software). -- The question refers to a "rolling code standard", but there is none. The answer above refers to HCS301. \$\endgroup\$
    – Klaws
    Commented Mar 5 at 20:52
1
\$\begingroup\$

Yes it is possible. In fact I have consistently used 433.92 rolling code clone remotes to copy other remotes. Works fine as long as all those cloning are rolling code. I copy the transmitter used to open the gate but do so out of range of the receiver. Please don't be telling people it doesn't work because I have cloned dozens of rolling code remotes.

\$\endgroup\$
2
  • \$\begingroup\$ Yes, this is possible, with a lot of rolling code implmentations. Only very few implmentation you'll encounter "in the wild" are cryptographically secure (and the most popular cryptographically secure rolling code has successfully been broken via a side-channel attack, but we're not talking about that here). Some devices can "learn" a (not cryptographically secure) rolling code by just "listening" to two consecutive transmissions. Others require to select the type of rolling code via dip switches before learning the code via a transimssion. -- I agree that the answer could elaborate more. \$\endgroup\$
    – Klaws
    Commented Mar 5 at 20:28
  • \$\begingroup\$ @user354424 make and model please? I am aware of only one "rolling code" transmitter that allows cloning (Chamberlain / LiftMaster / Sears). That remote has two buttons. One button is intended for a shared community gate. That button can be cloned but is not a rolling code. The other button is intended for an individual's garage. That button is a rolling code and cannot be cloned. Is this maybe the remote you're using? \$\endgroup\$
    – Mr. Snrub
    Commented Mar 7 at 5:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.