Badcaps Forums

Badcaps Forums (https://www.badcaps.net/forum/index.php)
-   General Electronics Technical Discussion (https://www.badcaps.net/forum/forumdisplay.php?f=29)
-   -   Using car key fob as generic remote control (https://www.badcaps.net/forum/showthread.php?t=105622)

Dannyx 04-18-2022 02:17 PM

Using car key fob as generic remote control
 
Good day folks. It's been a while since I've DIY-d anything, so the other day I was thinking if it's possible to use the key fob of my car as a remote for other automation stuff. I have quite a few generic 433Mhz remotes and modules I picked up on Ali for various projects, but instead of having another remote dangling off the key chain, I thought I could use the car's own fob for more than unlocking my car when I'm near it. Say I come home and wish to switch on a light at my front door.

I already tried putting one of my generic receivers in pairing mode and hitting one of the 2 buttons on the car fob and of course it didn't work, despite being the same frequency (433Mhz). As I later learned, there's the matter of fixed vs. rolling codes, so that's not going to work out of the box, at least not with these modules you find all over the web. I know for a fact my fob uses a PCF7946, but there's little info on it and how it operates. The only thing I require is some device to pick up the signal from the fob and turn on a pair of relays: one for the "unlock" button, one for the "lock" button. Sounds simple. I found some devices which claim to be able to receive "rolling codes" for garage door openers, but I'm not sure those would work either and my skills in RF stuff are a bit lacking. Any suggestions ? Thanks.

eccerr0r 04-18-2022 04:44 PM

Re: Using car key fob as generic remote control
 
probably not much in the RF you need to do, basically you'll be pulling off the shelf items. The single code non-rolling simple fobs are probably easy to decode and use the buttons, just listen for the same code sequence again and again...hence it's vulnerable to replay attacks. Need rolling code to thwart the replay attacks.

Dannyx 04-19-2022 01:41 AM

Re: Using car key fob as generic remote control
 
Forgot to link to some of the stuff I mentioned that claims to read rolling codes, so here it is...

eccerr0r 04-19-2022 01:54 PM

Re: Using car key fob as generic remote control
 
If you get a receiver that knows about your transmitter from the get go, then things are easy once again... I'm sure there are probably multiple distinct examples out there and they're pretty much clones of these so perhaps things would be easier to deal with in this case, but if you have a one off transmitter, it would be quite a challenge to use these.

Dannyx 04-19-2022 02:10 PM

Re: Using car key fob as generic remote control
 
After doing some more reading, I learned (or rather inferred) some more about this particular PCF chip, despite the info being very scarce. It's quite complex. Inside the key fob, the chip isn't actually transmitting anything itself (i.e. it doesn't drive the antenna directly): instead, it "hands off" whatever data needs transmitting to a dedicated transmitter chip, which is what actually does the transmitting.

The PCF chip also handles the immobilizer part, which prevents the car from starting if the key is turned in the barrel, but the fob is not actually IN the barrel. I actually confirmed this myself a while back when I replaced the shell of my fob and tried giving it a turn without the board in the shell: the engine started for a second, but it immediately turned off. I don't care about that part at all and I probably don't care about the encrypted part of the 433Mhz message either - all I want is to pick up the "payload" (?) and work out what button was pushed.

I found something HERE, but again, I'm not sure if it'd work with my particular fob. I need to get myself a receiver and actually try it. I imagine it should pick up SOMETHING at least (it IS 433Mhz after all), even if the info would be encrypted/incomplete. It's not an issue, because as the guy said in the end of his article, we don't care about that data anyway because we don't want to interact with the car itself...

stj 04-19-2022 02:26 PM

Re: Using car key fob as generic remote control
 
your wrong,
the "remote" and immobiliser are seperate.
the immobiliser is an RFID chip encased in epoxy that can be removed from the key and does not require a battery.

i experimented with them a while back to see if i could jam them from a reasonable distance :)

Dannyx 04-19-2022 02:33 PM

Re: Using car key fob as generic remote control
 
1 Attachment(s)
Ok, good to know - that's why I said "inferred" :D. What threw me off is the antenna coil in the datasheet for the PCF chip, connected to the "IN" pins on the left - apparently those receive something back from the car ? I thought those represented the NFC antenna for the immobilizer...or something.

Is the immobilizer the little coil here ? That's the board the fob for my Renault uses, by the way.

stj 04-19-2022 03:39 PM

Re: Using car key fob as generic remote control
 
the immobilizer looks like a little black wedge - it's not on the pcb

Dannyx 04-20-2022 02:57 AM

Re: Using car key fob as generic remote control
 
Then I think it's THIS. I ran across them when I searching for stuff for this project, but couldn't tell what it is and where it's located. I guess it's in the car then, since it's not in the fob...

petehall347 04-20-2022 04:19 AM

Re: Using car key fob as generic remote control
 
Quote:

Originally Posted by Dannyx (Post 1126817)
Then I think it's THIS. I ran across them when I searching for stuff for this project, but couldn't tell what it is and where it's located. I guess it's in the car then, since it's not in the fob...

one goes in the key .

stj 04-20-2022 08:33 AM

Re: Using car key fob as generic remote control
 
it's in the fob, it interacts with a coil around the ignition barrel.

Dannyx 04-20-2022 11:14 AM

Re: Using car key fob as generic remote control
 
There isn't anything else on the PCB, as you can see in the pic I showed (the other side only has the battery), hence why I think the PCF chip in the fob handles the immobilizer too...

That's not important anyway. I just ordered some 433Mhz receiver boards and will try this project. Obviously the fob will be different, but it should give me something I can work with...

Dannyx 06-21-2022 08:05 AM

Re: Using car key fob as generic remote control
 
Ok, I just had a go with these RXB6 modules and I get absolutely nothing out of them. The program the chap shows in his article uploaded fine, but I get no data in the serial monitor at all. I tried both my car fob which I'm most interested in and also a generic 433Mhz remote. I was expecting to see at least some garbage in the serial monitor. It could be any number of things: either the remotes don't match this module at all, or the code doesn't pick them up. It's worth noting my board is a Mega, unlike the Uno used in the article, so perhaps something else doesn't match.

I'll try some other resources to see if I get this module to pick up ANYTHING for a proof of concept test...

NiHaoMike 06-23-2022 11:13 PM

Re: Using car key fob as generic remote control
 
Rather than trying to defeat the security of the key, what about install a transmitter in the car connected to the door locks? Lock your car when it's near your house and it turns on the lights if it's dark.

stj 06-24-2022 05:05 AM

Re: Using car key fob as generic remote control
 
Quote:

Originally Posted by NiHaoMike (Post 1143608)
Rather than trying to defeat the security of the key, what about install a transmitter in the car connected to the door locks? Lock your car when it's near your house and it turns on the lights if it's dark.

if you read the first post,
it's not about the car, he wants to re-use the keyfob for other things.

Dannyx 06-24-2022 11:59 AM

Re: Using car key fob as generic remote control
 
Quote:

Originally Posted by stj (Post 1143656)
if you read the first post,
it's not about the car, he wants to re-use the keyfob for other things.

Correct.

redwire 06-24-2022 12:41 PM

Re: Using car key fob as generic remote control
 
Check the RXB6 pinout, it has an enable pin 6 which floats high to enable data, not power save.
Some of those 433MHz RX modules have extremely weak data output 10uA (!) so a low value pullup or LED there will prevent any signal from being seen.
The SYN470R/SYN480R IC is totally gutless for output and try shut off the Arduino internal pullup resistor, no pullups anywhere and see if you get data.
There is always RX noise blips to be seen.

To troubleshoot- I took a CMOS inverter CD4049 etc. and connected it to the 433MHz RX module's output, as a buffer to then drive other gates for an LED and a speaker, and Arduino.
You can listen for what the module is picking up, beeps and boops or noise.

NiHaoMike 06-24-2022 10:35 PM

Re: Using car key fob as generic remote control
 
Quote:

Originally Posted by stj (Post 1143656)
if you read the first post,
it's not about the car, he wants to re-use the keyfob for other things.

The problem is getting a receiver to interpret the encrypted communications, so the simplest solution would be to make use of the receiver in the car that's already set up for that purpose.

Using an Arduino compatible microcontroller and some sort of transmitter module, it would be quite easy for it to send packets when the doors are locked/unlocked, when a door is opened/closed, and when the car is started/stopped (to name a few events) just by connecting the GPIOs using voltage dividers to divide down the 12V to the 5V or 3.3V the Arduino uses.

Dannyx 06-25-2022 03:19 AM

Re: Using car key fob as generic remote control
 
Quote:

Originally Posted by NiHaoMike (Post 1143860)
The problem is getting a receiver to interpret the encrypted communications, so the simplest solution would be to make use of the receiver in the car that's already set up for that purpose.

Using an Arduino compatible microcontroller and some sort of transmitter module, it would be quite easy for it to send packets when the doors are locked/unlocked, when a door is opened/closed, and when the car is started/stopped (to name a few events) just by connecting the GPIOs using voltage dividers to divide down the 12V to the 5V or 3.3V the Arduino uses.

Again, it's not about using the car as a receiver, since it's too far from anything (I live in in an apartment complex, so it's down in the parking lot) - it's about using the car's fob as a remote for stuff around the house.

Anyway, I don't even know where the receiver for the fob is located in the car and it's most likely potted in epoxy anyway. I'm not going to fiddle with that. Think I'll just stick with an additional remote on the keychain after all. This PCF chip seems to be quite tricky to crack.


All times are GMT -6. The time now is 05:07 AM.

Powered by vBulletin ®
Copyright ©2000 - 2022, Jelsoft Enterprises Ltd.