Hacking and opening Garagedoors using a Raspberry Pi (Rolling Code Keeloq)

I have created a program for the Raspberry Pi, to open any garagedoor, using any frequency from 0 to 1500 Mhz, and using the mudolation types AM and FM.

To control the Raspberry Pi, I have crated an Android App, which is handling all actions using a Bluetooth connection:

Quick Jump:

Bruting is possible for all fixed code remotes which are using up to 20 bits for the code, which are:

Came, Tedsen, Kaeuferle, Nice, Ruku / Ansonic, Tormatic, Cardin, Dickert, Endress, Marantec, Hoermann, Einhell, Berner, Chamberlain, Rademacher, CDS, Bosch 12 DIP, Bosch 20 DIP.

Requirements:

For sending only you will need a Raspberry Pi up to Version 3, or Pi Zero.
Attention: Raspberry Pi 4 does not work, because of incompatibility with RPITX.
Plug a wire on GPIO 4, means Pin 7 of the GPIO header. This acts as the antenna.
The optimal length of the wire depends on the frequency you want to transmit on.

For receiving signals, you will either need a RTL-SDR Stick, HackRF One, or a simple 433.92 MHz Module working with 3.3 Volt,
and most recently you can also use a CC1101 module with variable frequency selection.

Available on Amazon:

Available on Ebay:

Connecting the CC1101 and Raspberry Pi SPI:

CC1101 module	Raspberry Pi	Pi Pin Nr	Wiring Pi
VCC	3V3	17
GND	GND	20
GD2	GPIO25	22	6
GD0	GPIO27	13	2
CSN	SPI_CS0	24
SI	SPI_MOSI	19
SO	SPI_MISO	21
SCK	SPI_SCLK	23

Connecting a 433 MHz Module and Raspberry Pi:

Transmitter	Receiver	Raspberry Pi	Pi Pin Nr	Wiring Pi
VCC	VCC	3V3	1
GND	GND	GND	6
DATA		GPIO17	11	0
	DATA	GPIO18	12	1

Android App RF Remote:

The Android App will be send by email on request, and the usage is limited to 10 tries for every vendor of a remote control.
If the App works to your satisfaction, you can purchase each vendor of a remote for 5.- US$ here, and you will get unlimited usage for the purchased vendor.

The App is using permissions for Bluetooth, GPS location, write to external storage and phone accounts.
The permission for phone accounts is needed to retrieve the main email address of the play store,
which is used as login to the server, so please accept if asked to allow access to phone contacts.
GPS location is used to store the current position with a garage code in your phone database.
Bluetooth is needed to connect with your Pi.
Write to external storage is needed to backup and restore your phone database.

You can also qualify for free vendors or full access in providing missing manufacturer keys or entire vendor systems.

Getting started:

Installing the Android App:

Download the zip file at the bottom of this site. Unzip the APK file inside, and transfer it somehow to your phone, either using Bluetooth or USB file transfer.

In your Phone settings you will need to enable the option: Install unknown Apps in Security settings.
or check out this web-site for more info: https://www.lifewire.com/install-apk-on-android-4177185

Now locate the APK file with a file manager, and click on it to install it.

 

Setting up Raspberry Pi:

Setting up the Raspberry Pi is explained on a separate page here.

Cloning/Copying/Grabbing a Remote Control into the database:

To copy your own remote, connect a RTL-SDR device or HackRF One to your Pi, and start my module on the Pi, or if the module starts automatically, reboot the Pi.
Then start the Android App, and connect with your Pi.
In the up right Menu, choose to set the listening frequency for the RTL-SDR device, and set it to the frequency of your remote.

The App will now be listening for recognized signals, so press the button of your remote control.
In my case, I am pressing button 1 of my Nice Flor 433.92 Mhz:

The App will detect the signal, end decode the encrypted values of the remote, and ask you if you want to store it to your database.

In the Database-View you can see all your stored remotes:

If you press short on a database entry, the app will send the signal of the stored remote to open the garage if your Pi is connected.

To edit/delete the database entry, press and hold the desired entry, and an action menu will appear and allow you to edit or delete an entry.

Brute Forcing a Garage Code:

First go the main Page "Home / Grab Signal", and connect with your Pi:

Change to the Brute page, and select the System you would like to Brute.
Came is very common and widly used:

Press the "Play Button" to start the Brute process.

The bruting will start and display the current progress and estimated time:

When the door/gate/barrier is opening hit the Pause/Stop Button:

If it's a door that's closing after a certain amount of time automatically, wait until the door has closed.
At this time you still don't have the correct code to open the door, but you are close.
Now either hit the Back button manually a few times, until the door opens again,

or use the reverse button which will brute backwards but not so fast,

and wait until the door opens again.
Wait until the door has closed, and use this button to send the same code again.
If the door does not open, adjust by using the Next and Previous Buttons until the door opens.

Due to an Android Bug, it can happen that the bluetooth connection gets lost at this point.
For this case a Reconnect Button will show up:

Use it to finished the job.
 

Once you have the right code, you can save it to your database with the menu entry "Add Code to DB":
 

My App will automatically select the current adress using GPS and street data from google and recommend its name for the database entry.

In the database Page you can edit this new garage entry as you like:

This Button will update the GPS coordinates at any time.

In the Map View, you will be able to see a Marker for your new added address.

If you are connected to your Pi and click on this Marker, my App will send the signal to open the garage door.

Automatically open approaching Garage in close range:

New feature added in version 1.1:

If the Map View is open, and position tracking and AutoOpenCloseGarage is enabled, Garages that you approach within a distance of 50 Meters will be opened automatically,
 without the need to press any button.
The App must be connected to the Pi using Bluetooth, and must have an internet connection.

View Edit Remote DIP Settings:

New feature added in version 1.1:

Now you can edit / view the DIP Settings of your original Remote:

You can reach this option in the Database View, by selecting an entry and choosing the action menu item: Show/Edit DIPs:

Version History: