Cloning automatic garage door opener remote control

[Halcyon]

Hi guys. I have a remote for our apartment complex which opens the main carpark roller door. We only have the one remote and was hoping to clone it without needing to fork out a ridiculous amount to purchase a second fob.

I understand the difference between rolling code vs. non-rolling code systems, with the former being difficult/impossible to reliably clone, without access to the programming functions of the system itself (which I do not, it's all under lock and key and there is no way building management would let anyone in there).

I don't know the brand of the system or key that's in use (I've attached a photo in case anyone recognises it). There are no markings or branding anywhere on the outside or inside of the remote. There are also no dip switches or jumpers in the remote itself that seems to allow programming. The operation of the remote only opens the door (it auto-closes after a time delay).

My question is, how likely is it that this is going to be a rolling code type, given that the building complex has hundreds of apartments (and remote controls)? Would it be more sensible to install a non-rolling code type? I'm just trying to gather as much information about the system, before I start purchasing hardware. I unfortunately don't have any way I can capture and view the transmission coming from the remote itself, to see if the data changes with each key press.

[Someone]

https://misterminit.co/pages/remotes
They keep relatively up to date on this.

[dave_k]

One of these will do the job:

https://www.bunnings.com.au/ata-garage-door-remote_p3961961

[Someone]

One of these will do the job:

https://www.bunnings.com.au/ata-garage-door-remote_p3961961

Even if it is on the same frequency/coding, that still needs access to the base/receiver to synchronise the rolling code. TL;DR?

[Halcyon]

One of these will do the job:

https://www.bunnings.com.au/ata-garage-door-remote_p3961961

Even if it is on the same frequency/coding, that still needs access to the base/receiver to synchronise the rolling code. TL;DR?

That's my understanding. If it is a rolling code type, I'm basically out of options without going through the "official" channels (via building management etc... etc...).

If it's not a rolling code type, then it should be pretty easy to clone.

I'd imagine it would be far easier to install the non-rolling code type in a large apartment building, for ease of key management. i.e.: Many identical keys can be programmed quickly, there's no need to program each apartment into the system, nothing to go "out of sync" etc... But I could be wrong? Do rolling code systems exist that allow for hundreds of individual keys to be programmed?

If it's anything like their card system to get into the doors, it's probably the cheap kind (I managed to clone the large HID card onto a smaller 125kHz fob).

[Someone]

But I could be wrong? Do rolling code systems exist that allow for hundreds of individual keys to be programmed?

If it's anything like their card system to get into the doors, it's probably the cheap kind (I managed to clone the large HID card onto a smaller 125kHz fob).

Reasonably secure scaleable access systems do exist for remotes, and like RFID "fob" entries it can be hard to tell what's on the back end or how sophisticated it is (config/software only changes can radically improve RFID security but most people don't care).

[floobydust]

You'll need to know what the TX frequency is i.e. 433MHz, 315MHz, 372MHz etc. It's best to know the make/model of the opener. Or take the remote apart and read the PCB. Or recognize the remote's unique shape.

Rolling code was conquered a long time ago.
I got a replacement (rolling code) remote from Ali GATE-RC9 Store cheap and works great. You have to pair it with the opener, otherwise it is ignored.

But for a many remote apartment complex, I would think it is not rolling code.
In that case look at Linx Technologies bought out by TE Connectivity I got their stuff from DigiKey, it's better quality and more expensive.
If the remotes (all) have a simple common address, it does make it hard to manage - imagine rejecting a remote that was lost or stolen without redoing (pairing) it for everyone - because the RX typically can only "erase all" learned remotes and you have to re-pair for all of them...

Ali does have low cost remotes and receiver modules that are multi-band and do both rolling or fixed code like this RX module.

[Halcyon]

The frequency in Australia for these types of applications is almost always going to be 433 MHz. I might just buy a cheap remote from Ali or similar and try it.

I assume if it keeps working after a few presses, then it's always going to work (i.e.: The code is static).

Or take the remote apart and read the PCB. Or recognize the remote's unique shape.

I did take it apart, but didn't notice distinguishing features like a model number or anything. It's probably a mass-produced remote that works with a number of systems. I am just assuming the frequency (as I've never seen anything other than 433 MHz used here), but I did find it odd that there was a coil (not dissimilar to what you'd find in a contactless building access fob) attached to the PCB. Not sure if this was the antenna, or if the remote also doubles as an IC/ID/HID fob. When I get a chance, I might try to read it with my cheapy Chinese card copier and see if it recognises it.

If it was the antenna, I was expecting to see a small spring/spiral coil.

EDIT: Confirmed, the garage remote also doubles as a HID fob. It opens doors in the building by just holding it against the reader. Nice to know, but not really useful for the purposes of this thread.