Hacking and opening Garagedoors using a Raspberry Pi (Rolling Code Keeloq)

I have created a program for the Raspberry Pi, to open any garagedoor, using any frequency from 0 to 1500 Mhz, and using the mudolation types AM and FM.

To control the Raspberry Pi, I have crated an Android App, which is handling all actions using a Bluetooth connection:

Quick Jump:

Hardware:
Requirements
Connecting CC1101 Module
Connecting 433 MHz Module
Supported Remotes
Software:
Android App
Setting up Raspberry Pi
Pairing Pi and Android Phone
Usage:
Cloning/Copying/Grabbing a Remote Control
Brute Forcing a Garage Door
Automatically open approaching Garage in close range 
View / Edit Remote DIP Settings

 

Bruting is possible for all fixed code remotes which are using up to 20 bits for the code, which are:

Came, Tedsen, Kaeuferle, Nice, Ruku / Ansonic, Tormatic, Cardin, Dickert, Endress, Marantec, Hoermann, Einhell, Berner, Chamberlain, Rademacher, CDS, Bosch 12 DIP, Bosch 20 DIP.

 

Following Rolling code Remotes can be detected and created:

Keeloq Remotes

Vendor Models  
ACM TX2
AERF Hydom/Medva/Otros/Sabuton/Tmp  
Ansonic SA 868 R
Aperto TX4020 TX03
Aprimatic TR
ATA PTX4
Beninca
BFT B-RCA/Mitto/TRC1
Cardin S449
Celinsa
Centurion
Dea
Dickert S8Q 868 Mhz
Doorhahn
Doormatic
DTM Neo/Tip/Victory
Ecostar RSC2/RSE2
Elmes
Elvox ET
Erreka
ET System Blue/Mix
ETDOOR Maguisa/Mimosa
FAAC SLH/RC/XT2
Fadini
Genie
Genius Amigo/Bravo/Echo
Gibidi
GSN
Jarolift
JCM Neo RC/Go Pro
Key
Mc Garcia
Merlin
MHouse
Motorline
Mutancode
Nice Smilo
Normstahl RA3433/RCU 2K/4K/Entrematic
Novoferm MHS43-02/Novotron 502
O&O TX
Pecinin
Pujol Vario
Roper
Rosh
Rossi
Ruku SA 868 R
Seav
Schellenberg 60853
Silvelox
Skymaster
Smilo
Sommer 4020 TX03
Space
Stagnoli
Starline
Steelmate
Subaru
Telcoma
Verex
Wisniowski

 

Keeloq Go Models

Vendor Models  
BALEATO
CAREN
CUBELLS
CYACSA
DMIL
EMFA
FORSA
GIBIDI
HIBRID
HYDOM
JCM
KOM
NORATEK
NORTON
NUEVA CASTILLA
ROPER
ZIBOR

 

Other Rolling Code Remotes

Aprimatic TXM
Came Atomo
Cardin S345
Chamberlain 1 8433
9433
Chamberlain 2.0 TX4RUNI
Ditec BIX
GOL4
FAAC
Kinggates
Liftmaster 8433/9433/TX4RUNI
Nice FloR-S/INTI/On xE
Prastel
Sminn
Somfy Keasy/Keytis/Telis
V2

 

Also Check out the Remote Cloner Compatibility List.

 

Requirements:

For sending only you will need a Raspberry Pi up to Version 3, or Pi Zero.
Attention: Raspberry Pi 4 does not work, because of incompatibility with RPITX.
Plug a wire on GPIO 4, means Pin 7 of the GPIO header. This acts as the antenna.
The optimal length of the wire depends on the frequency you want to transmit on.

For receiving signals, you will either need a RTL-SDR Stick, HackRF One, or a simple 433.92 MHz Module working with 3.3 Volt,
and most recently you can also use a CC1101 module with variable frequency selection.

Available on Amazon:

Available on Ebay:

Bild 1 - RXB6 433Mhz Superheterodyne Funk Empfänger Modul Arduino Receiver FHEM Arduin... Bild 1 - CC1101 Module SMA Antenna Wireless RF Transceiver Module Arduino TE298 CP06017

Connecting the CC1101 and Raspberry Pi SPI:

CC1101 moduleRaspberry PiPi Pin Nr Wiring Pi
VCC 3V3 17  
GND GND 20  
GD2 GPIO25 22 6
GD0 GPIO27 13 2
CSN SPI_CS0 24  
SI SPI_MOSI 19  
SO SPI_MISO 21  
SCK SPI_SCLK 23  

Bild 1 - CC1101 Module SMA Antenna Wireless RF Transceiver Module Arduino TE298 CP06017

Connecting a 433 MHz Module and Raspberry Pi:

TransmitterReceiverRaspberry PiPi Pin Nr Wiring Pi
VCC VCC 3V3 1  
GND GND GND 6  
DATA   GPIO17 11 0
  DATA GPIO18 12 1
Bild 1 - RXB6 433Mhz Superheterodyne Funk Empfänger Modul Arduino Receiver FHEM Arduin...

Android App RF Remote:

The Android App will be send by email on request, and the usage is limited to 10 tries for every vendor of a remote control.
If the App works to your satisfaction, you can purchase each vendor of a remote for 5.- US$ here, and you will get unlimited usage for the purchased vendor.

The App is using permissions for Bluetooth, GPS location, write to external storage and phone accounts.
The permission for phone accounts is needed to retrieve the main email address of the play store,
which is used as login to the server, so please accept if asked to allow access to phone contacts.
GPS location is used to store the current position with a garage code in your phone database.
Bluetooth is needed to connect with your Pi.
Write to external storage is needed to backup and restore your phone database.

You can also qualify for free vendors or full access in providing missing manufacturer keys or entire vendor systems.

Getting started:

Installing the Android App:

Download the zip file at the bottom of this site. Unzip the APK file inside, and transfer it somehow to your phone, either using Bluetooth or USB file transfer.

In your Phone settings you will need to enable the option: Install unknown Apps in Security settings.
or check out this web-site for more info: https://www.lifewire.com/install-apk-on-android-4177185

Now locate the APK file with a file manager, and click on it to install it.

 

Setting up Raspberry Pi:

Setting up the Raspberry Pi is explained on a separate page here.

 

Cloning/Copying/Grabbing a Remote Control into the database:

To copy your own remote, connect a RTL-SDR device or HackRF One to your Pi, and start my module on the Pi, or if the module starts automatically, reboot the Pi.
Then start the Android App, and connect with your Pi.
In the up right Menu, choose to set the listening frequency for the RTL-SDR device, and set it to the frequency of your remote.

The App will now be listening for recognized signals, so press the button of your remote control.
In my case, I am pressing button 1 of my Nice Flor 433.92 Mhz:

The App will detect the signal, end decode the encrypted values of the remote, and ask you if you want to store it to your database.

In the Database-View you can see all your stored remotes:

If you press short on a database entry, the app will send the signal of the stored remote to open the garage if your Pi is connected.

To edit/delete the database entry, press and hold the desired entry, and an action menu will appear and allow you to edit or delete an entry.

 

Brute Forcing a Garage Code:

First go the main Page "Home / Grab Signal", and connect with your Pi:

Change to the Brute page, and select the System you would like to Brute.
Came is very common and widly used:

Press the "Play Button" to start the Brute process.

The bruting will start and display the current progress and estimated time:

When the door/gate/barrier is opening hit the Pause/Stop Button:

If it's a door that's closing after a certain amount of time automatically, wait until the door has closed.
At this time you still don't have the correct code to open the door, but you are close.
Now either hit the Back button manually a few times, until the door opens again,

or use the reverse button which will brute backwards but not so fast,

and wait until the door opens again.
Wait until the door has closed, and use this button to send the same code again.
If the door does not open, adjust by using the Next and Previous Buttons until the door opens.

Due to an Android Bug, it can happen that the bluetooth connection gets lost at this point.
For this case a Reconnect Button will show up:


Use it to finished the job.
 

Once you have the right code, you can save it to your database with the menu entry "Add Code to DB":
 

My App will automatically select the current adress using GPS and street data from google and recommend its name for the database entry.

In the database Page you can edit this new garage entry as you like:

This Button will update the GPS coordinates at any time.

 

In the Map View, you will be able to see a Marker for your new added address.

If you are connected to your Pi and click on this Marker, my App will send the signal to open the garage door.

Automatically open approaching Garage in close range:

New feature added in version 1.1:

If the Map View is open, and position tracking and AutoOpenCloseGarage is enabled, Garages that you approach within a distance of 50 Meters will be opened automatically,
 without the need to press any button.
The App must be connected to the Pi using Bluetooth, and must have an internet connection.

View Edit Remote DIP Settings:

New feature added in version 1.1:

Now you can edit / view the DIP Settings of your original Remote:

You can reach this option in the Database View, by selecting an entry and choosing the action menu item: Show/Edit DIPs:

 

Version History:

Version Date Changes Download
v1.1 18 Aug 2021

 - added many new features
 - fixed a few bugs

On Request
v1.0 25 Jun 2021

 - first Release
 

On Request

Hit counter