HACK AND CLONE CAR KEY FOB, MY EPIC FAILURE...!!

In this blog post i'm sharing my experience on cloning the my car key fob signal and how to do it properly.

first things frist the cars now a days comes with a wireless remote key where u get atleast 2 or 3 options like lock,unlocking ,trunk(we call it as dickey!!!).....these options let your car access wirelessly and some cars are completly keyless for even driving.

the keys of the cars are actually communicating with certain frequency like 433.xxxMHz or some countries uses 315.xxxMHz...the car companies uses an algorithm called "ROLLING CODES"...these are not that esay to crack cause they change every time u press key and once the key transmitted it cannot be used again...

but a hacker named "samy kamakar" demonstrated an attack called REPLAY ATTACK where u simply transmitt the signal by recording the key fob away from car or blocking the signal and then recording.

so this is how i've tried it..frist i needed to listen to the signals as possible in 10KHz bandwidth...the car reciver also have wide range of reciving capablity for reciption cause of key fob holds different battery levels through time.here is some link on sdr based contents

I've the RTL_SDR for this job for reciving and analyse the RF signal...i had old 2GHz transiciver antennas lying around so i've used them cause they have balun connectors.....or u can buy a telescope antenna for the job..

i found a program called SDR_SHARP works like a charm for spectrum analysing...and to decode the signal recived i've used universal radio hacker for recording and analysing the rf signal...

these key fobs uses a modulation technique called "ASK" or "OOK"......unfortunatly my sdr can only listen to signals and can't transmit them....

so next thing i've brought a 433MHz transcivier which are used with arduino to transmit the signal..

after some analysing the signal using rtl_sdr i've learned my key sending the following code

here is te code i wrote using Dpin 2 with "BITBANGING"

code:

#include<stdint.h>

#include <avr/io.h>

#include <util/delay.h>

#define  FS1000A_DATA_PIN    2

void setup() {                

  pinMode(FS1000A_DATA_PIN, OUTPUT);

      delay(1021);
    
}

void loop() {

    
    digitalWrite(FS1000A_DATA_PIN,HIGH);

    delay(124);

    digitalWrite(FS1000A_DATA_PIN,LOW);

    delay(80);

    digitalWrite(FS1000A_DATA_PIN,HIGH);

    delay(124);

     digitalWrite(FS1000A_DATA_PIN,LOW);

    delay(80);

     digitalWrite(FS1000A_DATA_PIN,HIGH);

    delay(123);

    digitalWrite(FS1000A_DATA_PIN,LOW);

    delay(124);

    digitalWrite(FS1000A_DATA_PIN,LOW);

    delay(124);

    digitalWrite(FS1000A_DATA_PIN,LOW);

    delay(124);
 
}  // endo of main loop

       
 

so far the code mimics the actual code but with different pluse timing....so it doesn't worked but i'm planing to send the signal using RPI with some RPITX tricks...