Hack Remote RF Security Locks With Arduino

Hack Remote RF Security Locks With Arduino : 10 Steps - Instructables https://www.instructables.com/Hack-Remote-RF-Security-Locks-Wit...
Hack Remote RFProjects

Security Locks With Arduino by pumudu88
Contests (/member/pumudu88/)
Teachers Follow Download Favorite w I Made It
Log In(https://www.instructables.com/account/login/?nxtPg=) Sign Up(https://www.instructables.com/account/register)
(/projects) (/contest) (/teachers) (/search)
(/)
Hack Remote RF Security Locks With

Arduino
By pumudu88 (/member/pumudu88/) in Circuits (/circuits/) > Arduino (/circuits/arduino
/projects/)
67,918 238 24
Download Favorite
Arduino RF Key Hack Final Test
Watch on
frame=1&width=1024&height=1024&fit=bounds&md=b141857605ab10e88bc88b4a28c9a4cd)
(https://content.instructables.com/FZL/EII2/IX6FRGTJ/FZLEII2IX6FRGTJ.jpg?auto=webp&
(/member
/pumudu88/)
By pumudu88
About: I'm a human, whom interested in hacking stuff.
(/member
:) More About pumudu88 » (/member/pumudu88/)
/pumudu88/)
Follow
This is my �rst instructable so please bear with me if I'm not clear
enough. And note that this is for educational purpose only. Hope this
will help someone to evaluate how secure/non-secure their so-called
secure locking mechanisms �xed in cars or home garage doors. This
hack can be used to open wide variety of security locks used in cheap
after market car security systems to almost all cheap remote garage
doors.
There are several Instructables such as " Arduino 433Mhz Wireless
Communication Rc Switch (https://www.instructables.com
/id/Arduino-433Mhz-Wireless-Communication-Rc-Switch/)" explaining
how to use generic RF remote keys. But most of them does not give
the full picture of advantages/ disadvantages of using basic RF remote
keys. My main goal of this instructable is to �ll that gap, and explain
how easy it is to hack basic remote keys.
There are two main RF remote key methods currently available. In
We use cookies to enhance your experience and personalize content. See our cookie statement (https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement/cookie-
high-level, these are active and passive entry systems.
statement) for details. Manage your cookie preferences.
Decline Accept Passive entry system is using �xed code (usually 24 bit/40 bit) every

time to authenticate a key. Therefore it's just a matter of capture the
1 de 16 21/04/2023, 14:27
signal and re-transmit it to gain access. Even with this major
Hack Remote RF Security Locks With Arduino by pumudu88 (/member/pumudu88/) Follow Download Favorite w I Made It
vulnerability, these type of security systems are still widely used. Main
reason this method still popular is that it's not practical to brute force
and break these codes (2^24 combinations to brute force with 24 bit
code).
On other hand active entry systems are much harder to hack. There are
several ways these systems implemented. Most common method is
Rolling code which dynamically change codes based on common
algorithm on both key and receiver. Currently I'm working on these
types of systems, hopefully will be able to do a instructable on these as
well.
In this instructable i'll explain how to analyse passive entry system
codes and how to repeat the codes to gain access.
I've tested this method on following security systems.
● Liftmaster/Chamberlain/Sentex 893Max Remote Control Transmitter
(https://www.amazon.com/Liftmaster-Chamberlain-Sentex-Control-
Transmitter/dp/B006OB1B98)
● Viper 350 PLUS 3105V 1-Way Car Alarm Keyless Entry
(https://www.amazon.com/Viper-3105V-1-Way-Alarm-Keyless
/dp/B00C1T8P1O)
● Steelmate 838N 1 Way Car Alarm System (https://www.amazon.com
/Steelmate-Keyless-Central-Anti-hijacking-Transmitter
/dp/B012WAKKNC)
Even though I've tested with above systems this hack will work on any
passive entry systems which uses 315MHz , 433.92MHz frequencies.
It's worth note that by convention, it's a must to restrict all commercial
Remote keyless system to use only 315MHz(In europe) and
433.92MHz (in USA and other countries) radio frequencies.
 Add Tip V Ask Question | Comment Download
Step 1: Materials
md=182e545b3464171c9ff034e72188f28e)
/FPBICXVIW6PSVPQ.jpg?auto=webp&
(https://content.instructables.com
/FPB/ICXV/IW6PSVPQ
frame=1&fit=bounds&
md=c9f1d8aa3d346a9c40f7bd2719af4965)
/F6UW1R1IW6PSVQQ.jpg?auto=webp&
/F6U/W1R1/IW6PSVQQ
frame=1&fit=bounds&
We use cookies to enhance your experience and personalize content./IW6PSVQR

See our cookie statement (https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement/cookie-
/FK056B6IW6PSVQR.jpg?auto=webp&frame=1&
md=aae98729b874bf81a1c572795d2d99a5)
(https://content.instructables.com/FK0/56B6
fit=bounds& md=8f0671efb68976727fcc6e265db71611)
/FT31SFBIW6PSVYH.jpg?auto=webp&
/FT3/1SFB/IW6PSVYH
frame=1&fit=bounds&
I usually buy from ebay where I can �nd very cheap working parts with
Decline Accept
free or almost free shipping.
2 de 16 21/04/2023, 14:27
Following are major parts I used for this project:
1. Arduino uno (http://www.ebay.com/itm/391580478077) - USD 5.17
(Please note that this is not the original Arduino. If you are using
cheap clone Arduino's just like me please goto Arduino website
(https://www.arduino.cc/en/Main/Contribute) contribute few
dollars. If they never open source these schematics we'll never have
arduino's this cheap)
2. DVB-T SDR TV Tuner Receiver Stick RTL2832U+R820T
(http://www.ebay.com/itm/USB2-0-Digital-DVB-T-SDR-DAB-FM-
HDTV-TV-Tuner-Receiver-Stick-RTL2832U-R820T-/361650690587) -
USD 7.09
(I bought this some time back where R820T was the cheapest
option available with RTL2832U which has frequency range
24-1766 MHz. There's a new version with R820T2 chipset which is
said to be less prone to rf noise compared to previous. If you can
�nd a dongle with R820T2 buy it instead of R820T.)
3. 433Mhz RF Transmitter/Receiver Module (http://www.ebay.com
/itm/262123832438) - USD 0.74
4.
315Mhz RF transmitter/receiver Module (http://www.ebay.com
/itm/181924555488) - USD 0.99
Following items are used to make this project more portable and easy
to handle:
(Note that I found these items at home, but i'll post ebay links to buy
them as well)
1. Veroboard (http://www.ebay.com/itm/5pcs-5-7CM-Single-side-
Prototype-Circuit-Board-Veroboard-Stripboard-DIY-PCB-
NEW-/112178785545) - USD 1
2. Few connector wires female (http://www.ebay.com/itm/40PCS-
Dupont-Wire-Female-to-Female-Connector-Cable-2-54mm-1P-1P-
For-Arduino-/130682956953) - USD 0.99
3. Few header pins (http://www.ebay.com/itm/2016-New-10pcs-
breakable-pin-header-40-Pin-1x40-Male-2-54-
TIAU-/262373605303) - USD 0.2
4. (Optional) USB type A male port (http://www.ebay.com/itm/5Pcs-
USB-2-0-Type-A-Male-4-Pin-DIP-Right-Angle-PCB-installation-Plug-
Connector/281694097075) - USD 0.99
5. (Optional) USB type B male port
Note: If you can just buy a " USB type B to type A male to male connec-
tor (http://www.ebay.com/itm/1-x-USB-Type-A-Male-to-USB-Type-
B-Male-Adapter-Adaptor-Converter-Printer-Scanner-/150868318396)"
from local store or ebay no need to buy usb type A, type B male ports
separately. Since I didn't have that connector at home I had to made it
with available items.
Apart from these items we need few connector wires as well as a
computer. Even though I have done this in windows 7, mac osx and
ubuntu, I'll explain step by step instructions for Mac OSX-10.9.4(64bit).
These instructions will be very similar to both other operating systems
if you have fair understanding in your operating system. Feel free to
ask any questions in comment section if you're using windows or
linux/ubuntu.
Step 2: Summary of Steps

Following are the main steps need to follow.
1. Identify the passive code:
Decline Accept
2. Install RTL-433 library on computer.
3 de 16 21/04/2023, 14:27
(this is necessary as these libraries will enable us to listen
whatever radio frequencies dongle can handle).
3. Start listening to 315MHz and 433.92MHz frequencies and
decode.
4. Transmit passive code (using Arduino):
5. Setup Arduino hardware and sketch.
6. Test Arduino setup with serial monitor.
7. Setup GUI interface to Arduino setup.
(I wrote a java swing GUI application for easily change
parameters on the go without going through hassle of using
serial monitor or uploading Arduino sketches for each parameter
change)
8. Finishing Touches to the Prototype:
9. Build simple rf transmitter shield
10.
(Optional) Build USB Type A to B Adapter
Step 3: Identify the Passive Code: Install RTL-433

Library
(https://content.instructables.com/FKH/41UX
md=bbcadd1bdd223a072c0b755faf77cb4e)
/FKH41UXIWMR1HSL.jpg?auto=webp&
frame=1&fit=bounds&
/IWMR1HSL (https://content.instructables.com/F2A/RIX5
md=f938aa435f20e4e87a077bc85f0d2a2d)
/F2ARIX5IWMR1LL5.jpg?auto=webp&
frame=1&fit=bounds&
/IWMR1LL5
RTL library will turn your Realtek RTL2832 based DVB dongle into a
generic data receiver. Since RTL2832 chipset allows to tune 24-1766
MHz range it can be used in various other projects as well. Such as
monitoring adb aircraft transponder data which broadcasts from each
and every commercial �ight.
I'll try to make this instructable as complete as possible by giving each
and every step. To install RTL libraries we have several prerequisites
ful�ll as follows.
Main goal of this step is to setup merbanan/rtl_433
(https://github.com/merbanan/rtl_433) on a computer. With some
googling and little brainstorming you'll �nd quick and dirty ways to set
it up.But I always prefer build from basics just to keep in control.
Prerequisites:
Please note that these steps are given for Mac OSX. If you need any
speci�cs or stuck in a dead-end, please let me know in comment
section. I've tested this end to end on all major operating
systems(windows 7, ubuntu 14.04 and mac osx 10.9.4) as well.
If you're on Windows just use prebuild executables for "rtl-433" on this
website (http://cognito.me.uk/computers/rtl_433-windows-binary-32-
bit/). I haven't tried it though, with some googling this is will be the
quickest way to setup "rtl-433" on windows.
Install "cmake"
1. Download CMake from the CMake website (https://cmake.org
/download/). (make sure to download dmg version)
2. Once you have successfully downloaded the .dmg �le, simply
double-click.
3. To install CMake application drag and drop CMake onto the
Applications folder.
Decline Accept
4. Launch CMake from Launchpad or Spotlight.
4 de 16 21/04/2023, 14:27
5. From the "Tools" menu select "How to Install For Command Line
Use". From the dialog (https://www.instructables.com/�les/deriv
/F2A/RIX5/IWMR1LL5/F2ARIX5IWMR1LL5.LARGE.jpg) that pops up,
note the cmake-gui path (ex: /Applications/CMake.app/Contents
/bin/cmake-gui).
6. Open a terminal by executing "cmd+Space", typing "terminal" and
execute following commands on terminal :
7.
sudo mkdir -p /usr/local/bin
sudo /Applications/CMake.app/Contents/bin/cmake-gui --install=/usr/local/bin
8. Verify that it has been correctly installed to PATH by executing:
9.
cmake --version
Install "libtool" "libusb-1.0.0-dev" libraries
1. Install libtool and libusb by executing following commands in
terminal :
2.
brew install libtool
brew install libusb
Install "rtl-sdr" library
rtl-sdr library (https://github.com/osmocom/rtl-sdr) has well-
documented documentation (http://sdr.osmocom.org/trac/wiki/rtl-
sdr#Buildingthesoftware). And steps are fairly simple. Please goahead
and install it properly.
Install RTL-433 library
Once all the prerequisites are completed, clone rtl_433 git repository
(https://github.com/merbanan/rtl_433) and follow steps bellow to
build the library using cmake. In repository main page
(https://github.com/merbanan/rtl_433) there's a comprehensive guide
to each and every command and how to use it as well.
cd rtl_433/
mkdir build
cd build
cmake ../
make
sudo make install
Once rtl-433 install on your system plug the DVB-T USB dongle and run
following command.
rtl_433
If everything worked well rtl_433 will identify the usb device and start
listening to any incoming rf transmissions. I have attached successful
Console output (https://cdn.instructables.com/FKH/41UX/IWMR1HSL
/FKH41UXIWMR1HSL.LARGE.jpg) for reference.
Step 4: Identify the Passive Code: Start Listening

to 315MHz and 433.92MHz
Decline Accept
5 de 16 21/04/2023, 14:27
/FN9LP5TIWQUZV8G.jpg?auto=webp&frame=1&fit=bounds&
(https://content.instructables.com/FN9/LP5T/IWQUZV8G
md=046b768b26b4cb2bfb9187b341001bc3)
Depending on the rf frequancy on your test security lock, you need to
listen to either 433.92MHz or 315MHz. Since all rf key fobes are
regulated to use one of these frequencies, if you don't know the exact
frequency on your key you can try both frequencies.
For 433.92 MHz RF keys
"rtl-433" by default tunes to 433.92MHz frequency. In order to listen to
all incoming transmissions under this
frequency, we need to switch to analyzer mode as follows.
1. Plugin the DVB-T tuner dongle to one of the usb ports of the
computer.
2. Open a terminal and enter following command:
rtl_433 -a
It'll start listening to any incoming tra�c and print it on the console.
press a button on the remote key and it'll register on console output.
For 315MHz RF keys
Name of the library is slightly misleading as it says "433" implying it
can only receive on 433MHz frequency. This is not true. This library can
receive any frequency if the connected hardware permits.
In order to tune into 315MHz using the tuner:
1. Plugin the DVB-T tuner dongle to one of the usb ports of the
computer.
2. Open terminal and enter following command :
rtl_433 -f 315000000 -a
press a button on the remote key and it'll register on console output.
IMPORTANT: Just like a radio, DVB-T tuner can only tune into one
frequency at a given time. You can not tune into both frequencies
simultaneously using one receiver.
If everything works as expected you'll see similar console output as
follows :
Decline Accept
6 de 16 21/04/2023, 14:27
Reading samples in async mode...
Tuned to 315000000 Hz.
*** signal_start = 90713609, signal_end = 90787588

signal_len = 73979, pulses = 125
Iteration 1. t: 185 min: 97 (80) max: 273 (45) delta 5
Iteration 2. t: 185 min: 97 (80) max: 273 (45) delta 0
Pulse coding: Short pulse length 97 - Long pulse length 273
Short distance: 81, long distance: 257, packet distance: 2720 p_limit: 185
bitbuffer:: Number of rows: 5
[00] {25} 55 24 8c 00 : 01010101 00100100 10001100 0
[01] {25} 55 24 8c 00 : 01010101 00100100 10001100 0
[02] {25} 55 24 8c 00 : 01010101 00100100 10001100 0
[03] {25} 55 24 8c 00 : 01010101 00100100 10001100 0
[04] {25} 55 24 8c 00 : 01010101 00100100 10001100 0
As you can see there's clear binary pattern "01010101 00100100
10001100 0" repeated 5 times with long pulse length around 273. If we
can simply repeat this binary pattern, receiver should identify it as a
valid key and authenticate.
Step 5: Transmit Passive Code: Setup Arduino

Hardware and Sketch
md=4efcd1eb01bae317e08a525a99897130)
(https://content.instructables.com/F77/4YF0
/F774YF0IWQV00PR.jpg?auto=webp&
frame=1&width=1024&height=1024&
/IWQV00PR
fit=bounds& (https://content.instructables.com/FHF/JR0Z
md=33693c68aff3204e480c365205ce8e80)
/FHFJR0ZIX6FRHCN.png?auto=webp&
frame=1&width=1024&fit=bounds&
/IX6FRHCN
Arduino hardware setup
Hardware setup is very simple as shown in the attached diagram
(https://www.instructables.com/�les/deriv/F77/4YF0/IWQV00PR
/F774YF0IWQV00PR.LARGE.jpg). I've included a breadboard just keep
the diagram clean. If you can connect 5v and ground wires properly to
the Arduino, there's no need to use a breadboard.
Further, data pins are con�gurable using GUI interface which will
explain later. Therefore, no need to stick to the 12 and 10 pins. you can
use any digital output pins as required.
Arduino sketch
In order to send binary codes, we need a 3rd party library for Arduino
named rc_switch (https://github.com/sui77/rc-switch) developed by
Suat Özgür.
Follow the steps bellow to properly install the rc-switch library and
upload the sketch.
1. Download rc-switch library from "sui77/rc-switch" git repository
(https://github.com/sui77/rc-switch/releases/latest).
2. Place the unzipped rc-switch library directory inside
"{USER_HOME}/Documents/Arduino/libraries/".
(There are several methods to install libraries. For more info on how
to install libraries check out Arduino o�cial guide
(https://www.arduino.cc/en/Guide/Libraries))
3. Download attached arduino sketch �le(RfProjectArduinoCode.ino)
or latest sketch from my git repository (https://github.com
/pumudu88/rc-switch-gui). Sketch is simple, well commented and
self-explanatory.
On high-level, what it do is monitor any incoming serial messages
and transmit rf codes based on serial input parameters.
I have added inline comments to make it more readable. Feel free
Decline Accept to ask any questions in comments section if need more info.
7 de 16 21/04/2023, 14:27
4. Open the sketch �le from Arduino IDE, verify and upload it to
Arduino.
Arduino Sketch Internals
I've explained all the major functions through inline comments in
sketch �le. I'll try to make it clearer for a �rst-time Arduino user by
going through important code lines.
INPUT_SIZE variable de�nes the size of the input char array.
#define INPUT_SIZE 150
Create necessary variables including RC switch instance.
RCSwitch mySwitch = RCSwitch();
char* binaryCode;
char* pulseLength;
char* rfTransmitPin;
char* rfProtocolType;
char* repeatIterations;
One time setup to initialize serial baud rate and initialize build in LED
output to notify status. This will �ush the serial input bu�er just to
make sure no garbage serial data passed to rc switch library.
void setup()
{
// Initialize serial:
Serial.begin(9600);
pinMode(13, OUTPUT);
// Flush serial buffer

serialFlush();
}
I believe rest of the code within "loop()" is self-explaining. As I have
added inline comments for each critical code line. If you have any
questions ask them in the comment section.
RfProjectArduinoCode.ino (https://content.instructables.com/FNL/YE03
Download (https://content.instructables.com/FNL/YE03/IX6FSMP2/FNLYE03IX6FSMP2.ino)
/IX6FSMP2/FNLYE03IX6FSMP2.ino)
Step 6: Transmit Passive Code: Test Arduino Setup

With Serial Monitor
md=dc1425660a89eaebe3c58e59c55d2ee9)
(https://content.instructables.com/FJP/Z4JS
/FJPZ4JSIWQV0PVI.jpg?auto=webp&
fit=bounds&
/IWQV0PVI (https://content.instructables.com/FD6/MGE1
md=48c88ef8e1f24f148fb52ae256f092ca)
/FD6MGE1IWQV0R3V.jpg?auto=webp&
/IWQV0R3V
fit=bounds&
Before proceed we need to make sure that Arduino is properly setup
and ready to transmit codes properly.
In order to verify follow the steps bellow:
1. Start receiving 433.92MHz rf signals using DVB-T usb dongle as
explained in step 4.
2. Connect Arduino to computer using usb cable.
3. Open serial monitor in Arduino IDE by navigating to "Tools -> Serial
Monitor".
4. Send following line through serial mointor input to Arduino.
binaryCode:0101011010&pulseLength:321&rfTransmitPin:10&rfType:1&repeatIterations:5
This should register binary code properly on DVB tuner as attached
console output (https://www.instructables.com/�les/deriv/FJP/Z4JS
Decline Accept /IWQV0PVI/FJPZ4JSIWQV0PVI.LARGE.jpg) screenshots.
8 de 16 21/04/2023, 14:27
Similarly, Test 315MHz transmitter by changing "rfTransmitPin" to 12
and tune into 315MHz frequency using rtl_433. Refer attached screen-
shots (https://www.instructables.com/�les/deriv/FD6/MGE1
/IWQV0R3V/FD6MGE1IWQV0R3V.LARGE.jpg) to get a clearer idea.
Now, by changing serial input parameters you can transmit binary
codes got from your rf key and mimic the key.
Step 7: Transmit Passive Code: Setup GUI Interface

to Arduino Setup
Initial Test RF Transmitter Dry Run
Watch on
(https://content.instructables.com/F8T/1Q4Y/IWQV3I0X/F8T1Q4YIWQV3I0X.jpg?auto=webp&
frame=1&fit=bounds&md=283c2dc49695304ff35c9a2ca275fc04)
This step is not mandatory as we can mimic rf keys by sending
properly formatted serial input as explained in previous step. But
interfacing arduino with GUI will make it easy to use for anyone with
basic computer literacy.
I choose java/swing to develop the RC SWITCH GUI mainly due to my
personal preference. Further, java apps are highly portable across all
platforms, which makes it easy to share/run executables.
About RXTX java library and why it's needed
Java JDK does not support serial port communication natively at the
moment. Therefore, we need to rely on external java library which can
communicate with serial ports. RXTX library (http://rxtx.qbang.org
/wiki/index.php/Main_Page) has developed to address this issue.
RXTX is an open source java library, using a native implementation (via
JNI), providing serial and parallel communication for the Java
Development Toolkit (JDK). Even though there are few other
alternatives to rxtx this is the most complete serial communication
library backed by wide community support for troubleshooting(stack
over�ow (http://stackover�ow.com/) :) ).
Rxtx library contains two parts.
Decline Accept
9 de 16 21/04/2023, 14:27
1. RXTXcomm.jar - This enables JDK/JRE to communicate with OS
speci�c serial drivers.
2. OS speci�c serial drivers (ex: librxtxSerial.jnilib for mac osx) -
This communicates with serial ports identi�ed by the operating
system.
Refer attached high-level architecture diagram (https://www.instructa-
bles.com/�les/deriv/F8T/1Q4Y/IWQV3I0X
/F8T1Q4YIWQV3I0X.LARGE.jpg) to understand how rxtx library been
used.
Java GUI program to control Arduino transmitter
I have provided all the java source codes in rc switch gui git repository
(https://github.com/pumudu88/rc-switch-gui). If you are a developer
go ahead and use these sources as required.
I'm not planning to explain all the internals of the GUI project as it will
make this instructable way O� course. Please ask any questions in the
comments section. If you're planning to build the GUI from source
make sure to import "RXTXComm.jar" library properly to the project.
Running the GUI program(using pre-build jars) on Mac osx 10.9.4
(64bit):
1. Install latest java version on your computer. (As I have compiled
these jars on java 1.8, it won't work in older java versions)
2. Download and unzip attached "rc_switch_gui.zip" �le.
3. Move into unzipped directory and execute following command.
This should open up the main window
(https://www.instructables.com/�les/deriv/FLS/YQWS/IWQV3ME9
/FLSYQWSIWQV3ME9.LARGE.jpg).
java -jar rc-switch-gui.jar
Using GUI program:
GUI interface is self-explanatory. For sake of completeness of this
instructable, I'll brie�y explain the functionality of each tab.
● Connection Tab (https://www.instructables.com/�les/deriv
/FHG/XNCU/IWQV3YU6/FHGXNCUIWQV3YU6.LARGE.jpg)
As name suggests this tab will let you select the serial port and
connect. Note that you need to click on "Refresh" button next to
drop down list in order to list down all available serial ports. There's
a "status" noti�cation indicating a successful connection or any
errors(such as "port in use" error) while connecting. Refer attached
image (https://www.instructables.com/�les/deriv/FHG/XNCU
/IWQV3YU6/FHGXNCUIWQV3YU6.LARGE.jpg) for more info.
● Transmit Tab (https://www.instructables.com/�les/deriv/FJH/SMZW
/IWQV3YU1/FJHSMZWIWQV3YU1.LARGE.jpg)
Without a successful connection, this tab won't be accessible to the
user. After a successful connection, this tab will enabled and ready
to send binary codes to Arduino. There's a progress bar indicating
progress of the send operation at bottom of this tab as well.
● Con�gurations Tab (https://www.instructables.com/�les/deriv
/FYI/XBQ4/IWQV3YU9/FYIXBQ4IWQV3YU9.LARGE.jpg)
This tab will allow user to de�ne Arduino data pins corresponding to
433MHz and 315MHz transmitters.
Arduino RF Transmitter 1.tiff (https://content.instructables.com/FLS/YQWS

Download (https://content.instructables.com/FLS/YQWS/IWQV3ME9/FLSYQWSIWQV3ME9.tif)
/IWQV3ME9/FLSYQWSIWQV3ME9.tif)
gui_connect.tiff (https://content.instructables.com/FHG/XNCU/IWQV3YU6
Download (https://content.instructables.com/FHG/XNCU/IWQV3YU6/FHGXNCUIWQV3YU6.tif)
/FHGXNCUIWQV3YU6.tif)
We use cookies to enhance your experience and personalizetransmit1.tiff

content. See our cookie statement (https://www.autodesk.com/company/legal-notices-trademarks/privacy-statement/cookie-
(https://content.instructables.com/FJH/SMZW/IWQV3YU1
Download
statement) for details. Manage your (https://content.instructables.com/FJH/SMZW/IWQV3YU1/FJHSMZWIWQV3YU1.tif)
cookie preferences.
/FJHSMZWIWQV3YU1.tif)
Decline Accept
configs.tiff (https://content.instructables.com/FYI/XBQ4/IWQV3YU9
Download (https://content.instructables.com/FYI/XBQ4/IWQV3YU9/FYIXBQ4IWQV3YU9.tif)
10 de 16 21/04/2023, 14:27
/FYIXBQ4IWQV3YU9.tif)
rc_switch_gui.zip (https://content.instructables.com/FNZ/8NKU/IWQV3Z2F
Download (https://content.instructables.com/FNZ/8NKU/IWQV3Z2F/FNZ8NKUIWQV3Z2F.zip)
/FNZ8NKUIWQV3Z2F.zip)
Step 8: Troubleshooting :)
Keep in mind that you might face some issues/errors while following
above steps. I've documented all the issues which I faced while making
this instructable. Hopefully, it'll help you to resolve any issues faced.
Common Errors/Exceptions on Mac OSX
● java.lang.Unsatis�edLink Error
If you face this error it's because architecture mismatch in serial driver
library and host computer.
java.lang.UnsatisfiedLinkError: librxtxSerial.jnilib: no suitable image found.
Did find: librxtxSerial.jnilib: no matching architecture in universal wrapper thrown while loading g
In o�cial rxtx website (http://rxtx.qbang.org/wiki/index.php
/Main_Page) they have provided Mac OSX libraries compiled for 32bit
architecture. They haven't provided libraries to support on 64bit
systems.
In the attached "rc_switch_gui.zip" it contains 64 bit compiled
library(as I'm running on 64bit system). If you need 32bit Mac OSX
libraries you can simply replace it from o�cial rxtx libraries
(http://rxtx.qbang.org/wiki/index.php/Download) from the website.
● Port already in use Error
The OS X has exclusion (locking) mechanism on the serials ports. The
MacBooks never had serial ports, but the USB ports emulate them.
When the Arduino connected, it appears in the port list as
"/dev/tty.usbmodemXX" where "XX" are some digits. When exception
thrown with port already in use, that's a standard I/O exception that
meant we could not get gain access. The current owner was unde�ned
because there was no current owner. We just did not have the required
access to the directory to take ownership.
In order to �x this open terminal and execute following:
sudo mkdir /var/lock
sudo chmod 777 /var/lock
This creates the required directory and makes it accessible. The serial
port will no longer be busy, given that something else is not really
using it! ;)
Common issues on Ubuntu 14.04 LTS
My initial plan was to cover only Mac OS through this instructable. But
as I tried to run the jar in Ubuntu I faced one of the most annoying
issues, where rxtx library failed to identify some serial ports even
though there are no errors/exceptions.
After hours of research found that on Ubuntu 14.04, Arduino's
recognized as /dev/ttyACMxx. The RXTX library only searches through
/dev/ttyXXXX.
Therefore need to make symlink to available port as follows.
sudo ln -s /dev/ttyACM0 /dev/ttyUSB0
Make sure to replace "/dev/ttyACM0" with your Arduino's port
identi�er. This should solve the issue.
Another issue was that user does not have su�cient privileges to
access serial ports. Therefore, make sure to run the GUI application as
root user if possible. If you need to run the application using current
Decline Accept user just add the current user to "dialout" user group and restart the
computer.
11 de 16 21/04/2023, 14:27
sudo usermod -a -G dialout username
Make sure to replace "username" with your user.
Step 9: Finishing Touches to the Prototype
md=c205f50a374145dd930db091c671727b)
/FGQYODYIX0PZAAW.jpg?auto=webp&
/FGQ/YODY/IX0PZAAW
fit=bounds&
5 More Images
/FUX3LGMIX0PXZZB.jpg?auto=webp&frame=1&
(https://content.instructables.com/FUX/3LGM
md=43c3eca0ad49470f1d5997f5534431df)
fit=bounds&
/IX0PXZZB (https://content.instructables.com/F87/3EDH
md=fb810da770e889f93bda12e1ee6e0bf9)
/F873EDHIX0PZAAY.jpg?auto=webp&
fit=bounds&
/IX0PZAAY
In order to �nalize this project, we need to properly pack everything in
a neat packaging. Of cause, we can't handle breadboards while wires
hanging with tiny transmitters in a car park or a garage. :)
This step focuses on making this project portable and easy to handle.
This step can be divided into two parts:
● RF Transmitter Arduino Connector Shield
(Instead of using breadboard, I needed something more portable
and ability to easily attach/detach from Arduino.)
● USB type A/ type B connector
(male to male)
(Using a USB cable is not convenient. In order to use this as a
pluggable dongle, I needed a connector without the cable part. As I
mention in "Materials" section(step 1) these connectors are available
to buy.)
RF Transmitter Arduino Connector Shield
This is a simple setup which uses only 4 pins from arduino. I've
attached the Veroboard diagram (https://www.instructables.com/�les
/deriv/FUX/3LGM/IX0PXZZB/FUX3LGMIX0PXZZB.LARGE.jpg). Solder
properly as shown in diagram and make sure to disconnect all non-
used header pins as precaution. I've used connectors to attach/detach
transmitters as well. If you don't wish to reuse transmitters in some
other project just solder it directly to the board.
Make sure to verify each and every pin connection after soldering.
Make sure opposite Arduino pins are not connected through
Veroboard as well.
My �nal adaptor looks like this (https://www.instructables.com/�les
/deriv/F87/3EDH/IX0PZAAY/F873EDHIX0PZAAY.LARGE.jpg). I'm sure
there are more nice ways to arrange it. I just made this from what's
available to me at the moment :)
USB Type A to B Connector
It's better if you can buy pre-build adapter (https://www.instructa-
bles.com/�les/deriv/F5H/ETHK/IX0Q00F0
Decline Accept
/F5HETHKIX0Q00F0.LARGE.jpg) as it's cheap and well built. But since it
12 de 16 21/04/2023, 14:27
takes long time to arrive(where I live) I decided to build my own
adapter as I got all necessary parts at home.
Soldering a USB connection is very simple as well. There are only 4
wires to connect and there are clear pinout diagrams all over the
internet as well. I used this pinout diagram (https://www.instructa-
bles.com/�les/deriv/F4S/N3HN/IX0PY07R
/F4SN3HNIX0PY07R.LARGE.jpg) which clearly identify pins by
numbering.
Final outcome looks like this (https://www.instructables.com/�les
/deriv/F5E/P5O5/IX0PZAAU/F5EP5O5IX0PZAAU.LARGE.jpg). It's not
pretty but it does the job as expected.
Important: If you decided to build your own adapter make sure
you do it right without short-circuiting wires. Double check each
and every connection and soldering before connecting it to PC.
Otherwise, in worst case your PC motherboard will pay the price.
If you don't want to risk anything best bet is to buy an adapter
instead of building it on your own.
Step 10: Conclusion
Arduino RF Key Hack Final Test
Watch on
/F46Z9OYIX0Q02OG.jpg?auto=webp&frame=1&fit=bounds&
(https://content.instructables.com/F46/Z9OY/IX0Q02OG
md=6a3e3c7578b06cfabfcb782e0fdb9a5f)
This hack can be improved in various methods. For example if this can
be implemented with arduino micro or nano, it will be easy to carry
any where just like a pen drive. It's fairly simple to do as well. Only
thing needs to be done apart from these steps, is mount RF
transmitters properly to the arduino.
Further, since RF transmission can be directly controlled through serial
inputs, there are lots of possibilities for various other projects as well.
Main goal of this instructable is to make aware how easy to hack
passive RF remote systems and gain access. Passive RF coded systems
Decline Accept are now outdated and it's high time to stop using them as
13 de 16 21/04/2023, 14:27
security/entry systems. This is fairly easy hack for anyone with average
knowledge in electronics and programming.
Hope this will help someone to evaluate their own rf security systems
Be the First to Share
and take necessary actions to prevent any mishaps.
Did you make this project? Share it with us!
I Made It!
Participated in the
Arduino Contest 2016 View Contest
Recommendations
(/contest/arduino2016/)
Participated in the
First Time Authors
View Contest
Contest 2016 (/contest
/firsttimeauthors2016/)
Participated in the
Remix Contest 2016 View Contest
(/contest/remix2016/)
(/Recycled-Spool-Smart-Lamp-With-Sound- (/ECLIPSE-the-Ring-Lamp-With-Progressive-
Reactivity-MQ/) Lighting-IR/)
Recycled Spool Smart Lamp - With ECLIPSE - the Ring Lamp With
Sound Reactivity, MQTT, Hue & Alexa Progressive Lighting, IR Controlled
(/Recycled-Spool-Smart-Lamp-With- (/ECLIPSE-the-Ring-Lamp-With-
 7 8 486  44 8 3.3K
(/contest/bigsmall23/) (/contest/home23/)
 Add Tip
V Ask Question
| Post Comment
We have a be nice policy.

Please be positive and constructive.
Add Images Post
24 Comments
(/member/maxisoblivious/) maxisoblivious (/member/maxisoblivious/) 2 years ago
Reply / Upvote
please tell me how perform these steps on windows 10.....
/ (/member/Shammy+Christopher/)
Shammy Christopher (/member/Shammy+Christopher/)
1 3 years ago on Step 10
Reply / Upvote
Very nice article..
I have a question..
Can we do this without PC?
I mean can we directly record and reply the code using Arduino and Rx TX modules with any Arduino
automatic script?
If yes plz share me the details..
I want to know thiscan be happen or not..
So plz reply me asap...
(/member/mihai.paun.395/) mihai.paun.395 (/member/mihai.paun.395/) 3 years ago
Reply / Upvote
Hello I have a problem failing to open my car. Where am I wrong ??? Thank you.
Decline Accept
14 de 16 21/04/2023, 14:27
/FAF/UFIQ/JXYYOPAM
/FAFUFIQJXYYOPAM.jpg?auto=webp&
fit=bounds&frame=1)
(/member/jamesjms/) jamesjms (/member/jamesjms/) 4 years ago

Reply / Upvote
Dear
Thanks for sharing the skill. I did all the thinks as per your guidance but while running I m not getting
the binary value please guide me
Thanks,
james
3 replies F
(/member/Giapsport/) Giapsport (/member/Giapsport/) Question 4 years ago on Step 10
Answer / Upvote
Làm và gửi cho tôi 1 cái
/ (/member/benitoca/) benitoca (/member/benitoca/) 4 years ago

Reply / Upvote
1
ever encountered a hexidecimal RF code? this is what i'm seeing with my garage door opener.
/FDI/65CV/JN4VOGA3
/FDI65CVJN4VOGA3.png?auto=webp&
fit=bounds&frame=1&height=1024)
3 replies F
(/member/lovshrm24/) lovshrm24 (/member/lovshrm24/) Question 4 years ago
Answer / Upvote
hi can i do this on respberry pi3 as i don't have mac osx? what will be the steps or commands to setup
rtl-433 on respberry pi3? do i also need to install the drivers for the tv tuner before setup the rtl-433 ?
i just want to copy the code from my car starter remote as i have only one remote and want to make a
spare remote
thanks
1 answer F
(/member/k41matt/) k41matt (/member/k41matt/) 6 years ago

Reply / Upvote
How easy do you think this would be to implement on a raspberry pi to make an all-in-one portable
system?
3 replies F
(/member/LucaR48/) LucaR48 (/member/LucaR48/) 4 years ago

Reply / Upvote
If ur having problem w/ libusb on mac os install pkg-config
(/member/alexs660/) alexs660 (/member/alexs660/) 6 years ago

Reply / Upvote
Thanks for the share. Which software do you use? Can the same done
with rolling code or PKE systems? Can you help me with instructions
for this process shown on video? alexshmidt199@GMAIL.COM is my email.
statement) for details. Manage your cookie preferences. More Comments Post Comment
Decline Accept
15 de 16 21/04/2023, 14:27
Categories About Us Resources
 Circuits  Living Who We Are Sitemap (/sitemap/)

(/circuits/) (/living/) (/about/) Help (/how-to-write-
 Workshop  Outside Why Publish? a-great-instructable/)
(/workshop/) (/outside/) (/create/) Contact (/contact/)
 Craft  Teachers
(/craft/) (/teachers/)
 Cooking
(/cooking/)
Find Us
(https://www.instagram.com (https://www.pinterest.com (https://www.facebook.com (https://www.twitter.com
/instructables/) /instructables) /instructables) /instructables)
© 2023 Autodesk, Inc.
Terms of Service (http://usa.autodesk.com/adsk/servlet Privacy Statement (http://usa.autodesk.com/adsk/servlet Privacy Legal Notices & Trademarks (http://usa.autodesk.com/legal-
/item?siteID=123112&id=21959721) /item?siteID=123112&id=21292079) settings notices-trademarks/)
| | |
(http://www.autodesk.com)
Decline Accept
16 de 16 21/04/2023, 14:27

Hack Remote RF Security Locks With Arduino

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Hack Remote RF Security Locks With Arduino

Uploaded by

Copyright:

Available Formats

Hack Remote RF Security Locks With Arduino : 10 Steps - Instructables https://www.instructables.com/Hack-Remote-RF-Security-Locks-Wit...

Hack Remote RFProjects

Hack Remote RF Security Locks With

Arduino RF Key Hack Final Test

Decline Accept Passive entry system is using �xed code (usually 24 bit/40 bit) every

 Add Tip V Ask Question | Comment Download

We use cookies to enhance your experience and personalize content./IW6PSVQR

 Add Tip V Ask Question | Comment Download

Step 2: Summary of Steps

 Add Tip V Ask Question | Comment Download

Step 3: Identify the Passive Code: Install RTL-433

brew install libusb

sudo make install

 Add Tip V Ask Question | Comment Download

Step 4: Identify the Passive Code: Start Listening

*** signal_start = 90713609, signal_end = 90787588

 Add Tip V Ask Question | Comment Download

Step 5: Transmit Passive Code: Setup Arduino

#define INPUT_SIZE 150

RCSwitch mySwitch = RCSwitch();

// Flush serial buffer

 Add Tip V Ask Question | Comment Download

Step 6: Transmit Passive Code: Test Arduino Setup

 Add Tip V Ask Question | Comment Download

Step 7: Transmit Passive Code: Setup GUI Interface

Initial Test RF Transmitter Dry Run

Arduino RF Transmitter 1.tiff (https://content.instructables.com/FLS/YQWS

We use cookies to enhance your experience and personalizetransmit1.tiff

 Add Tip V Ask Question | Comment Download

java.lang.UnsatisfiedLinkError: librxtxSerial.jnilib: no suitable image found.

sudo mkdir /var/lock

sudo chmod 777 /var/lock

sudo ln -s /dev/ttyACM0 /dev/ttyUSB0

 Add Tip V Ask Question | Comment Download

Step 9: Finishing Touches to the Prototype

 Add Tip V Ask Question | Comment Download

Step 10: Conclusion

Arduino RF Key Hack Final Test

We have a be nice policy.

Add Images Post

(/member/maxisoblivious/) maxisoblivious (/member/maxisoblivious/) 2 years ago

(/member/mihai.paun.395/) mihai.paun.395 (/member/mihai.paun.395/) 3 years ago

(/member/jamesjms/) jamesjms (/member/jamesjms/) 4 years ago

(/member/Giapsport/) Giapsport (/member/Giapsport/) Question 4 years ago on Step 10

/ (/member/benitoca/) benitoca (/member/benitoca/) 4 years ago

(/member/lovshrm24/) lovshrm24 (/member/lovshrm24/) Question 4 years ago

(/member/k41matt/) k41matt (/member/k41matt/) 6 years ago

(/member/LucaR48/) LucaR48 (/member/LucaR48/) 4 years ago

(/member/alexs660/) alexs660 (/member/alexs660/) 6 years ago

 Circuits  Living Who We Are Sitemap (/sitemap/)

(https://www.instagram.com (https://www.pinterest.com (https://www.facebook.com (https://www.twitter.com

/instructables/) /instructables) /instructables) /instructables)

© 2023 Autodesk, Inc.

You might also like