Universal Fixed and Rolling Code Remote Control Duplicator

[ozcar]

So, we all know that it is impossible or pointless to clone a rolling-code remote. But take a look at this:
 
https://www.ebay.com/itm/Universal-Fixed-Rolling-Code-Garage-Door-Remote-Control-Duplicator-Frequency-New/183502291856

For years now it has been possible to buy non-genuine but compatible remotes for many popular brands of rolling-code remote controls. The makers of the compatible remotes are not going to tell us what they are doing, but I have to think that they are making use of something like the well-publicised side-channel attack on Keeloq receivers to extract the manufacturer key (Keeloq being the only rolling code system that I am really familiar with). Such compatible remotes are often made using the same chips as the original remotes, like HCS..., and like the original remotes, are only compatible with a limited range of receivers made by a particular manufacturer.

However, the above remote is different. Although they specifically mention compatibility with a particular Liftmaster remote there, the device in question is supposed to be compatible with many different brands, working on many different frequencies. It is obvious that the makers of the compatible remotes have been able to get hold of manufacturer keys for many brands of remotes, so it would certainly be possible to make a remote that is compatible with more than one brand (but not by using a standard encoder chip).

However, they claim to be able to duplicate a working remote. I had a bit of an idea of what they might be doing, and I was sufficiently curious to purchase a couple of them to check. I'll post a bit more with what I found later, but I'm wondering if anybody else has noticed remotes like this?

I think remotes like this have only become available in the last year or so, but maybe I am wrong, because I found that are a large number of different ones for sale on Ebay and Aliexpress. There are many seemingly unrelated companies making them:

https://scimagic.com.cn/

https://www.szyet.com/

http://www.cngiant.net/

[ozcar]

I chose two different-looking remotes to purchase, but it turned out that they are both made by Yaoertai. They are models YET2114AIO and YET2130AIO, which seem to be quite similar in capabilities, but slightly different shape. Both of these are supposed to handle a range of frequencies between 280MHz to 868MHz, but I have seen others that work on just a single frequency.

Both of them are based on an STM8L151G micro, and a TI CC110L transceiver (sans any logos, maybe not made by ST or TI?). At least they made no attempt to disguise them - I've encountered CC110L before with the top ground off in a RC receiver.

There are four pads in a row, with the ends ones marked "GND" and "VCC", the other two go to the STM8 SWIM and NRST pins. I did not bother to check, but expect it to be readout-protected. It might be possible to erase it and reprogram it though.

I tried using it to clone a fixed-code remote and as expected it worked. I don't have a vast array of rolling-code remotes to try it on, but it does successfully "copy" my ATA PTX4 (Keeloq classic, HCS301). My take on what they do is use the "copy" process to establish which key from their set of manufacturer keys to use, to then generate the transmitter key.

They do not copy the Keeloq transmitter serial number, nor do they use a constant serial number. Instead, it seems they generate a random serial number (over many tests, the high order 12 bits of the 28-bit serial number were always zero though).

Having done the "copy" you then have to get the receiver to "learn" to accept the new remote, same as you would for any other new remote.

For some brands of remotes, the "copy" process is a little more complicated, if the manufacturer has chosen to use what Microchip calls the "secure learn" process, where you have to press a special button, or combination of buttons, on the remote to get it to send a "seed" value which is used when forming the transmitter key.

It is not surprising that they do not copy the transmitter serial number. Most people who would buy one of these would be likely to still want to use their original remote in addition to the new one, and trying to use two transmitters with the same serial number on the same receiver would have problems due to the transmission sequence number checking. However, a device which did copy the serial number, and added say 100 to the sequence number, would have a less honourable use. It would be able to eavesdrop when a door is opened, and then be able to open the door later - at least for systems which don't implement "secure learn", and that is more than half of all the remotes listed as being compatible for the YET2130.

Creating a device like that would require only a trivial change to the code in the device. I wonder if such devices already exist, kept under the counter for special customers. For all I know, perhaps these devices like I have can already do that, by pressing some magic sequence of buttons.

When I was testing the YET2114, I did actually once see that it had copied the serial number. I don't think I had accidentally found some hidden function though. Rather I believe all that happened was that for some reason it had mistakenly decided that it was dealing with a fixed code had just duplicated it.

In light of what they are doing, one of these devices would be an attractive target for somebody wanting to get hold of manufacturer keys. Why buy a whole array of different brands of receivers, and torturing each one of them to divulge one key, when instead you could get a whole lot of keys out of one of these devices? I have no idea whether the process is any more difficult on a STM8 than on the PIC processors typically used in Keeloq receivers, though.

[nunojpg]

Great info. Yes, getting master keys from this devices would probably be very nice to establish a database. Many projects would benefit from having them. Not sure if the  STM8L151G allows to dump the firmware for disassemble. And how my, reverse engineering the chinese 

[amyk]

https://www.st.com/resource/en/programming_manual/cd00226555-how-to-program-stm8l-and-stm8al-flash-program-memory-and-data-eeprom-stmicroelectronics.pdf

Yes, it has readout protection just like most other MCUs.
But it is a weak one: https://itooktheredpill.irgendwo.org/2020/stm8-readout-protection/