Cloning automatic garage door opener remote control

[Halcyon]

Hi guys. I have a remote for our apartment complex which opens the main carpark roller door. We only have the one remote and was hoping to clone it without needing to fork out a ridiculous amount to purchase a second fob.

I understand the difference between rolling code vs. non-rolling code systems, with the former being difficult/impossible to reliably clone, without access to the programming functions of the system itself (which I do not, it's all under lock and key and there is no way building management would let anyone in there).

I don't know the brand of the system or key that's in use (I've attached a photo in case anyone recognises it). There are no markings or branding anywhere on the outside or inside of the remote. There are also no dip switches or jumpers in the remote itself that seems to allow programming. The operation of the remote only opens the door (it auto-closes after a time delay).

My question is, how likely is it that this is going to be a rolling code type, given that the building complex has hundreds of apartments (and remote controls)? Would it be more sensible to install a non-rolling code type? I'm just trying to gather as much information about the system, before I start purchasing hardware. I unfortunately don't have any way I can capture and view the transmission coming from the remote itself, to see if the data changes with each key press.

[Someone]

https://misterminit.co/pages/remotes
They keep relatively up to date on this.

[dave_k]

One of these will do the job:

https://www.bunnings.com.au/ata-garage-door-remote_p3961961

[Someone]

One of these will do the job:

https://www.bunnings.com.au/ata-garage-door-remote_p3961961

Even if it is on the same frequency/coding, that still needs access to the base/receiver to synchronise the rolling code. TL;DR?

[Halcyon]

One of these will do the job:

https://www.bunnings.com.au/ata-garage-door-remote_p3961961

Even if it is on the same frequency/coding, that still needs access to the base/receiver to synchronise the rolling code. TL;DR?

That's my understanding. If it is a rolling code type, I'm basically out of options without going through the "official" channels (via building management etc... etc...).

If it's not a rolling code type, then it should be pretty easy to clone.

I'd imagine it would be far easier to install the non-rolling code type in a large apartment building, for ease of key management. i.e.: Many identical keys can be programmed quickly, there's no need to program each apartment into the system, nothing to go "out of sync" etc... But I could be wrong? Do rolling code systems exist that allow for hundreds of individual keys to be programmed?

If it's anything like their card system to get into the doors, it's probably the cheap kind (I managed to clone the large HID card onto a smaller 125kHz fob).

[Someone]

But I could be wrong? Do rolling code systems exist that allow for hundreds of individual keys to be programmed?

If it's anything like their card system to get into the doors, it's probably the cheap kind (I managed to clone the large HID card onto a smaller 125kHz fob).

Reasonably secure scaleable access systems do exist for remotes, and like RFID "fob" entries it can be hard to tell what's on the back end or how sophisticated it is (config/software only changes can radically improve RFID security but most people don't care).

[floobydust]

You'll need to know what the TX frequency is i.e. 433MHz, 315MHz, 372MHz etc. It's best to know the make/model of the opener. Or take the remote apart and read the PCB. Or recognize the remote's unique shape.

Rolling code was conquered a long time ago.
I got a replacement (rolling code) remote from Ali GATE-RC9 Store cheap and works great. You have to pair it with the opener, otherwise it is ignored.

But for a many remote apartment complex, I would think it is not rolling code.
In that case look at Linx Technologies bought out by TE Connectivity I got their stuff from DigiKey, it's better quality and more expensive.
If the remotes (all) have a simple common address, it does make it hard to manage - imagine rejecting a remote that was lost or stolen without redoing (pairing) it for everyone - because the RX typically can only "erase all" learned remotes and you have to re-pair for all of them...

Ali does have low cost remotes and receiver modules that are multi-band and do both rolling or fixed code like this RX module.

[Halcyon]

The frequency in Australia for these types of applications is almost always going to be 433 MHz. I might just buy a cheap remote from Ali or similar and try it.

I assume if it keeps working after a few presses, then it's always going to work (i.e.: The code is static).

Or take the remote apart and read the PCB. Or recognize the remote's unique shape.

I did take it apart, but didn't notice distinguishing features like a model number or anything. It's probably a mass-produced remote that works with a number of systems. I am just assuming the frequency (as I've never seen anything other than 433 MHz used here), but I did find it odd that there was a coil (not dissimilar to what you'd find in a contactless building access fob) attached to the PCB. Not sure if this was the antenna, or if the remote also doubles as an IC/ID/HID fob. When I get a chance, I might try to read it with my cheapy Chinese card copier and see if it recognises it.

If it was the antenna, I was expecting to see a small spring/spiral coil.

EDIT: Confirmed, the garage remote also doubles as a HID fob. It opens doors in the building by just holding it against the reader. Nice to know, but not really useful for the purposes of this thread.

[mendip_discovery]

First off did you try a Google "circle to search"? The adverts are driving me up the wall.

I assume the Financial Controller has said no to Hack RF or FlipperZero?

You could old skool it and use a Baofeng Uv-5R use it to listen for a signal then just record the sound and play it back via the radio. Even an RTL-SDR will allow you to at least look at the signal.

[voltsandjolts]

My garage door opener failed a few years back. Turns out the PIC MCU in the garage unit had failed, so I wrote new firmware for it's replacement and used the Microchip Keeloq system. But you have a communal / shared system so different scenario I suppose.

https://www.eevblog.com/forum/microcontrollers/microchip-keeloq-classic-new-firmware-for-garage-door-receiver-new-fobs/

[bw2341]

I don't know if the feature is offered in Australia, but many North American vehicles have Homelink which is effectively a built in garage door opener remote cloning system.

If someone in your apartment complex managed to set their vehicle's Homelink to open the door, you will know that it is possible to use a cloned remote.

[Geoff-AU]

That's my understanding. If it is a rolling code type, I'm basically out of options without going through the "official" channels (via building management etc... etc...).

If it's not a rolling code type, then it should be pretty easy to clone.

Spot on.

I'd imagine it would be far easier to install the non-rolling code type in a large apartment building, for ease of key management. i.e.: Many identical keys can be programmed quickly, there's no need to program each apartment into the system, nothing to go "out of sync" etc... But I could be wrong? Do rolling code systems exist that allow for hundreds of individual keys to be programmed?

Absolutely.  Rolling code transmitters have a rolling code (security feature, to prevent replay attack) and a fixed, "unique" (to the system) code.  The transmitter and receiver handle the rolling code bit, the unique code gets sent to another controller if the rolling code security check passes.  The other controller only cares about the unique code and whether that unique code is allowed to open the door or not.  Building management just maintain the access controls for unique codes, they never see the rolling code bit because that's handled between the transmitter and receiver.

If it's anything like their card system to get into the doors, it's probably the cheap kind (I managed to clone the large HID card onto a smaller 125kHz fob).

The old 125kHz HID cards are just like the DIP-switch garage remotes.  Not very high-tech.

[Halcyon]

Thanks Geoff.

I have a couple of cheap "cloners" on the way from Amazon. I'll report back when they arrive and I get a chance to get back down to the apartment.

[Psi]

Here's a bad idea.

Put the current working remote in a box and wire its button inputs to outputs on the 4 channel inputs on a remote receiver you purchased.
Hide said box near the door with power feed from somewhere.
Pair as many remotes as you want to the new receiver.
 

Yes, i know, it's a bad idea
It would work though.

[Halcyon]

Here's a bad idea.

Put the current working remote in a box and wire its button inputs to outputs on the 4 channel inputs on a remote receiver you purchased.
Hide said box near the door with power feed from somewhere.
Pair as many remotes as you want to the new receiver.
 

Yes, i know, it's a bad idea
It would work though.

You know what? That's actually not a terrible idea. With something like LoRa, you'd get some pretty decent range. The original key could just sit indoors with a small external antenna/low power amplifier. It would definitely reach.

[Psi]

just don't accidently blow up the only working transmitter you have while building the system 

[Andy Chee]

just don't accidently blow up the only working transmitter you have while building the system 

Rather than dismantle and solder wires, I suppose you could build a mechanical repeater with motorised or solenoid 3D-printed "fingers" to actuate the fob buttons.  May not be as easy to conceal the contraption though.

[ozcar]

...
EDIT: Confirmed, the garage remote also doubles as a HID fob. It opens doors in the building by just holding it against the reader. Nice to know, but not really useful for the purposes of this thread.

Why is that not useful? Don't you need to open those doors too?

Are there no markings on the PCB in the thing, or any identifiable encoder chips?

A photo or two of the inside might help.

[Halcyon]

...
EDIT: Confirmed, the garage remote also doubles as a HID fob. It opens doors in the building by just holding it against the reader. Nice to know, but not really useful for the purposes of this thread.

Why is that not useful? Don't you need to open those doors too?

Are there no markings on the PCB in the thing, or any identifiable encoder chips?

A photo or two of the inside might help.

We already have a bunch of HID fobs/cards to get into the building. Those are easily copied.

I'd have to have a closer look at the board. Will do next time I get my hands on it. Unfortunately, since we only have the one remote, it's shared between two people and I don't spend a lot of time at this place.

[Halcyon]

Well, the Chinese remote I ordered didn't work. I mean it worked, but it didn't seem to recognise the code coming from the original remote. I suspect perhaps the frequency was wrong.

Today I ordered another model, which claims to work with anything from 280-868 MHz. We'll see what happens when that arrives.

[Brumby]

Here's a bad idea.

Put the current working remote in a box and wire its button inputs to outputs on the 4 channel inputs on a remote receiver you purchased.
Hide said box near the door with power feed from somewhere.
Pair as many remotes as you want to the new receiver.
 

Yes, i know, it's a bad idea
It would work though.

Why am I smiling ....