![]() |
|
|
Thread Tools | Display Modes |
|
![]() |
#1 |
CertifiedAxhole
Join Date: Aug 2016
City & State: Constanta
My Country: Romania
Line Voltage: 230VAC 50Hz
I'm a: Hardcore Geek
Posts: 3,277
|
![]() Good day folks. It's been a while since I've DIY-d anything, so the other day I was thinking if it's possible to use the key fob of my car as a remote for other automation stuff. I have quite a few generic 433Mhz remotes and modules I picked up on Ali for various projects, but instead of having another remote dangling off the key chain, I thought I could use the car's own fob for more than unlocking my car when I'm near it. Say I come home and wish to switch on a light at my front door.
I already tried putting one of my generic receivers in pairing mode and hitting one of the 2 buttons on the car fob and of course it didn't work, despite being the same frequency (433Mhz). As I later learned, there's the matter of fixed vs. rolling codes, so that's not going to work out of the box, at least not with these modules you find all over the web. I know for a fact my fob uses a PCF7946, but there's little info on it and how it operates. The only thing I require is some device to pick up the signal from the fob and turn on a pair of relays: one for the "unlock" button, one for the "lock" button. Sounds simple. I found some devices which claim to be able to receive "rolling codes" for garage door openers, but I'm not sure those would work either and my skills in RF stuff are a bit lacking. Any suggestions ? Thanks.
__________________
Wattevah... |
![]() |
![]() |
![]() |
#2 |
Solder Sloth
Join Date: Nov 2012
City & State: CO
My Country: USA
Line Voltage: 120VAC 60Hz
I'm a: Hobbyist Tech
Posts: 7,195
|
![]() probably not much in the RF you need to do, basically you'll be pulling off the shelf items. The single code non-rolling simple fobs are probably easy to decode and use the buttons, just listen for the same code sequence again and again...hence it's vulnerable to replay attacks. Need rolling code to thwart the replay attacks.
|
![]() |
![]() |
![]() |
#3 |
CertifiedAxhole
Join Date: Aug 2016
City & State: Constanta
My Country: Romania
Line Voltage: 230VAC 50Hz
I'm a: Hardcore Geek
Posts: 3,277
|
![]() Forgot to link to some of the stuff I mentioned that claims to read rolling codes, so here it is...
|
![]() |
![]() |
![]() |
#4 |
Solder Sloth
Join Date: Nov 2012
City & State: CO
My Country: USA
Line Voltage: 120VAC 60Hz
I'm a: Hobbyist Tech
Posts: 7,195
|
![]() If you get a receiver that knows about your transmitter from the get go, then things are easy once again... I'm sure there are probably multiple distinct examples out there and they're pretty much clones of these so perhaps things would be easier to deal with in this case, but if you have a one off transmitter, it would be quite a challenge to use these.
|
![]() |
![]() |
![]() |
#5 |
CertifiedAxhole
Join Date: Aug 2016
City & State: Constanta
My Country: Romania
Line Voltage: 230VAC 50Hz
I'm a: Hardcore Geek
Posts: 3,277
|
![]() After doing some more reading, I learned (or rather inferred) some more about this particular PCF chip, despite the info being very scarce. It's quite complex. Inside the key fob, the chip isn't actually transmitting anything itself (i.e. it doesn't drive the antenna directly): instead, it "hands off" whatever data needs transmitting to a dedicated transmitter chip, which is what actually does the transmitting.
The PCF chip also handles the immobilizer part, which prevents the car from starting if the key is turned in the barrel, but the fob is not actually IN the barrel. I actually confirmed this myself a while back when I replaced the shell of my fob and tried giving it a turn without the board in the shell: the engine started for a second, but it immediately turned off. I don't care about that part at all and I probably don't care about the encrypted part of the 433Mhz message either - all I want is to pick up the "payload" (?) and work out what button was pushed. I found something HERE, but again, I'm not sure if it'd work with my particular fob. I need to get myself a receiver and actually try it. I imagine it should pick up SOMETHING at least (it IS 433Mhz after all), even if the info would be encrypted/incomplete. It's not an issue, because as the guy said in the end of his article, we don't care about that data anyway because we don't want to interact with the car itself... |
![]() |
![]() |
![]() |
#6 |
Great Sage 齊天大聖
Join Date: Dec 2009
City & State: Europe
My Country: some shithole run by Israeli agents
I'm a: Professional Tech
Posts: 26,789
|
![]() your wrong,
the "remote" and immobiliser are seperate. the immobiliser is an RFID chip encased in epoxy that can be removed from the key and does not require a battery. i experimented with them a while back to see if i could jam them from a reasonable distance ![]() |
![]() |
![]() |
![]() |
#7 |
CertifiedAxhole
Join Date: Aug 2016
City & State: Constanta
My Country: Romania
Line Voltage: 230VAC 50Hz
I'm a: Hardcore Geek
Posts: 3,277
|
![]() Ok, good to know - that's why I said "inferred"
![]() Is the immobilizer the little coil here ? That's the board the fob for my Renault uses, by the way. |
![]() |
![]() |
![]() |
#8 |
Great Sage 齊天大聖
Join Date: Dec 2009
City & State: Europe
My Country: some shithole run by Israeli agents
I'm a: Professional Tech
Posts: 26,789
|
![]() the immobilizer looks like a little black wedge - it's not on the pcb
|
![]() |
![]() |
![]() |
#9 |
CertifiedAxhole
Join Date: Aug 2016
City & State: Constanta
My Country: Romania
Line Voltage: 230VAC 50Hz
I'm a: Hardcore Geek
Posts: 3,277
|
![]() Then I think it's THIS. I ran across them when I searching for stuff for this project, but couldn't tell what it is and where it's located. I guess it's in the car then, since it's not in the fob...
|
![]() |
![]() |
![]() |
#10 | |
Badcaps Veteran
Join Date: Jan 2015
City & State: worcester
My Country: United Kingdom
I'm a: Knowledge Seeker
Posts: 3,271
|
![]() Quote:
|
|
![]() |
![]() |
![]() |
#11 |
CertifiedAxhole
Join Date: Aug 2016
City & State: Constanta
My Country: Romania
Line Voltage: 230VAC 50Hz
I'm a: Hardcore Geek
Posts: 3,277
|
![]() Ok, I just had a go with these RXB6 modules and I get absolutely nothing out of them. The program the chap shows in his article uploaded fine, but I get no data in the serial monitor at all. I tried both my car fob which I'm most interested in and also a generic 433Mhz remote. I was expecting to see at least some garbage in the serial monitor. It could be any number of things: either the remotes don't match this module at all, or the code doesn't pick them up. It's worth noting my board is a Mega, unlike the Uno used in the article, so perhaps something else doesn't match.
I'll try some other resources to see if I get this module to pick up ANYTHING for a proof of concept test... |
![]() |
![]() |
![]() |
#12 |
Great Sage 齊天大聖
Join Date: Dec 2009
City & State: Europe
My Country: some shithole run by Israeli agents
I'm a: Professional Tech
Posts: 26,789
|
![]() it's in the fob, it interacts with a coil around the ignition barrel.
|
![]() |
![]() |
![]() |
#13 |
CertifiedAxhole
Join Date: Aug 2016
City & State: Constanta
My Country: Romania
Line Voltage: 230VAC 50Hz
I'm a: Hardcore Geek
Posts: 3,277
|
![]() There isn't anything else on the PCB, as you can see in the pic I showed (the other side only has the battery), hence why I think the PCF chip in the fob handles the immobilizer too...
That's not important anyway. I just ordered some 433Mhz receiver boards and will try this project. Obviously the fob will be different, but it should give me something I can work with... |
![]() |
![]() |
![]() |
#14 |
New Member
Join Date: Jun 2022
City & State: Austin, TX
My Country: USA
Line Voltage: 120VAC 60Hz
I'm a: Hardcore Geek
Posts: 3
|
![]() Rather than trying to defeat the security of the key, what about install a transmitter in the car connected to the door locks? Lock your car when it's near your house and it turns on the lights if it's dark.
__________________
We believe in the right to repair. |
![]() |
![]() |
![]() |
#15 | |
Great Sage 齊天大聖
Join Date: Dec 2009
City & State: Europe
My Country: some shithole run by Israeli agents
I'm a: Professional Tech
Posts: 26,789
|
![]() Quote:
it's not about the car, he wants to re-use the keyfob for other things. |
|
![]() |
![]() |
![]() |
#16 |
CertifiedAxhole
Join Date: Aug 2016
City & State: Constanta
My Country: Romania
Line Voltage: 230VAC 50Hz
I'm a: Hardcore Geek
Posts: 3,277
|
![]() |
![]() |
![]() |
![]() |
#17 | |
New Member
Join Date: Jun 2022
City & State: Austin, TX
My Country: USA
Line Voltage: 120VAC 60Hz
I'm a: Hardcore Geek
Posts: 3
|
![]() Quote:
Using an Arduino compatible microcontroller and some sort of transmitter module, it would be quite easy for it to send packets when the doors are locked/unlocked, when a door is opened/closed, and when the car is started/stopped (to name a few events) just by connecting the GPIOs using voltage dividers to divide down the 12V to the 5V or 3.3V the Arduino uses. |
|
![]() |
![]() |
![]() |
#18 | |
CertifiedAxhole
Join Date: Aug 2016
City & State: Constanta
My Country: Romania
Line Voltage: 230VAC 50Hz
I'm a: Hardcore Geek
Posts: 3,277
|
![]() Quote:
Anyway, I don't even know where the receiver for the fob is located in the car and it's most likely potted in epoxy anyway. I'm not going to fiddle with that. Think I'll just stick with an additional remote on the keychain after all. This PCF chip seems to be quite tricky to crack. |
|
![]() |
![]() |
![]() |
#19 |
Badcaps Veteran
Join Date: Dec 2010
City & State: Alberta
My Country: Canada
Posts: 2,609
|
![]() Check the RXB6 pinout, it has an enable pin 6 which floats high to enable data, not power save.
Some of those 433MHz RX modules have extremely weak data output 10uA (!) so a low value pullup or LED there will prevent any signal from being seen. The SYN470R/SYN480R IC is totally gutless for output and try shut off the Arduino internal pullup resistor, no pullups anywhere and see if you get data. There is always RX noise blips to be seen. To troubleshoot- I took a CMOS inverter CD4049 etc. and connected it to the 433MHz RX module's output, as a buffer to then drive other gates for an LED and a speaker, and Arduino. You can listen for what the module is picking up, beeps and boops or noise. |
![]() |
![]() |
![]() |
Thread Tools | |
Display Modes | |
|
|