433MHz TUI scanner: using a FT232H connected to a CC1101 | Hacker News Reader

433MHz TUI scanner: using a FT232H connected to a CC1101

blog.jacq.cc

37 pointsxx__yy16 comments

Neat project. A few years ago I tried and failed to get a junkyard Toyota security ECU from a ‘96 4Runner to work for remote lock/unlock in my ‘94 Land Cruiser with an eBay key fob. I might revisit it with this approach - cheap and easy RF analysis software/hardware would have eliminated a lot of guess work … though if memory serves I think the real headache was decoding wire colors in the security harness, which were not all explicitly labeled in the manual for “security” reasons.

What approach are you going to take to try and determine the cryptographic key of your device? Is there some way to hack and “root” your gate opener controller?

The “universal radio hacker” software makes it really easy to decode OOK remotes using an SDR. It figures out the parameters too.

https://github.com/jopohl/urh

I used this to decode my fan remote signals and wrote a simple python script for doing OOK transmissions with a HackRF. (I felt like doing my own).

I did something similar for my parents remote controlled blinds. I used a Flipper Zero to record the signal sent from the remote and an ESP32 + transmitter to replay the commands at sunrise and sunset.

Do you recall what frequency it was?

433.92 MHz. I think a lot of little RF remotes and even car key fobs use it.

Meh,

Get an rtl-sdr dongle that covers way more frequencies, install urh ( https://github.com/jopohl/urh ), and you get the full signal on RF, demodulated and you can do full analysis on it + you can do a lot of other stuff with RF with the dongle and other software (eg. track planes in the air with dump1090, listen to walkie talkies and ham radio operators, etc.)

If you buy a tx-capable sdr, ignoring the legallity issues, you can also replay that signal or modify it before replaying.

Thanks for sharing, I've got an rtl-sdr dongle gathering dust, I might try it out.

i initially disagreed, assuming they went with the cc1101 to transmit custom stuff. also ti launchpads for their entire cc series are more affordable and easier to use than any tx sdr. it is not hard to program RF ism band stuff, even with custom protocols there is reams of examples.

but ya after reading a bit more its the blind leading the blind

Thanks, I came here to ask what was wrong with the good ol' rtl2832.

While skimming the article the only thought I had was "this is really the hard way to do this huh"

Nice another vibe coded project and matching AI written blog. This is all getting very tiresome. There much easier ways to generally poke around RF

I get using AI to figure out things you might not otherwise have figured out but just copy/pasting the output from AI into a blog post is not interesting to me. Take 10 minutes to humanize the output. Write the blog post and tell us how you did it, including how you used AI, how you prompted it, etc. But I don't need someone's claude transcript as the only output. Ugh

Noted, I appreciate your feedback, I will do better.

If it were not for LLMs I wouldn't have the time to work through all these projects. Even before kids, it required many hours and days of failing, which is good for learning, but I simply just don't have the time otherwise.

I guess I just wanted to share some commentary about this, but I do think, what's the point? Anyone else with a LLM subscription could do the same without the post...

I'm on the downswing of AI. I no longer trust what AI tells me. Copilot gives one answer. ChatGPT gives another. Claude equivocates. Copilot flavors every new answer with the meat of previous conversations.

Reading AI generated code or blog posts you have to be extra dubious. AI will lie, and the human who prompted may or may not have vetted that information. The contents could be gold as easily as it could be sand.

For things that I need correct: I research on sources pre-2022. For things that don't really matter: I prompt AI and iterate.

I wouldn't use this vibe coded slop that will just blow up my hardware. Unlikely to work with other chips as the author tested it with the only one he has with him.

Use with caution.

Doubt about the "blow up", not sure how that will happen, unless I wire it up wrong.

As mentioned in the post, I wanted to figure out what the Ali remote outputted. It stated it could do rolling codes too, but didn't work with the Richmond remote. It was late at night and I didn't want to press gate/garage door remotes and wake up my family.

Second part of the project is recording the Richmond remote and seeing what that looks like. I have no idea what that will actually look like, I just know of the rolling code concept. After that I was going to try and to match it against known OEM keys, and if that doesn't work, do a brute force attempt for a day and see if that yields anything.

Before LLMs I had let the smoke out of my projects, all great learning experiences. Now that I'm older and have less free time, they help me rekindle my hobby, quicker. But the downside is I don't get to make as many mistakes, which is good and bad, ... The jury is still out on that one.

Reply on news.ycombinator.com