opensesame VS rtl_433

Samy Kumar did a project about 10 years back, where he worked out how to brute force a 12 bit garage door code in under 10 seconds, using a childs toy: http://samy.pl/opensesame/

My garage door opener uses a 12 but dip switch config (and my last place used an 8 dip switch config, and I'm pretty sure still does).

Re reading that OpenSesame post was fun. It reminded me of a few names I need to go find out what they're up to these days (Travis Goodspeed and Michael Ossmann are names I remember seeing doing/writing-up some really cool stuff), and that the Mattel IM-ME toy he was using uses that same CC1110 "sub gHz"

At this point let's just cite his site http://samy.pl/opensesame/

Yes, there are only 512 combinations for a 9 bit receiver like this. More switches adds more combinations, but all of these style openers are susceptible to a "replay attack" where you record the signal from the opener and play it back later. They are also at risk of more sophisticated brute force attacks (https://samy.pl/opensesame/) Modern openers use a "rolling code" system that is safer, but the truth of the matter is that it is very very rare for anyone to exploit these old openers.

Functionally anything that can be attacked by OpenSesame can be programmed in, but that list is pretty small these days.

Perhaps someone could create a flipper compatible file using this existing opensesame source code

Hey all! Well, my flipper has finally arrived, and I'm delighted. I'm interested in exploring some minor development on it, and in particular was looking at trying to get samyk's opensesame attack working. As the code is all there on github, and his device used the same RF chipset. I presume it should be a relatively simple matter to get it going on the flipper, but not quite sure how to start with it, as I guess the dev docs are still only in Russian...

And there's a multiformat receiver block too: https://github.com/merbanan/rtl_433

pi@pi4b8:/etc/systemd/system $ cat rtl_433.service # based on https://github.com/merbanan/rtl_433/issues/1651 [Unit] Description=RTL_433 service script StartLimitIntervalSec=5 Documentation=https://github.com/merbanan/rtl_433/README.md After=syslog.target network.target [Service] Type=exec ExecStart=/usr/bin/rtl_433 -C si -F mqtt # Restart script if stopped Restart=always # Wait 30s before restart RestartSec=30s # Tag things in the log # View with: sudo journalctl -f -u rtl_433 -o cat SyslogIdentifier=rtl_433 StandardOutput=syslog StandardError=syslog [Install] WantedBy=multi-user.target

For example, rtl_433 has the spec for an X10 sensor say I know what data I want to put where, is there some tool/site I could enter in what the "specifications" of the signal waveform are and the data I want to send as a byte-string or binary-string and it would create a playable .sub file for me?

For "outdoor distances" I'd probably stick to something LoRa or 433MHz based. YoLink has quite a few options using the LoRa protocol. I use basic 433Mhz based AcuRite sensors paired with an RTL-SDR dongle connected to a machine running RTL_433, and use Home Assistant to trigger automations and alerts.

866-868MHz is SRD/ISM band (in UK/EU). Can be things like energy meters, TPMS, medical devices etc. Try rtl_433 on it.

I'm trying to add a Honeywell doorbell to Home Assistant by using the RTL-433 GitHub project/program. When I run the program the SDR dongle is detected but it doesn't display anything when I press the doorbell (the image shows what I see after running the program and pressing the doorbell). I have also tried Honeywell Activelink (FSK) aka [116], so I have tried both 115 and 116 decode protocols.

rtf_433 IoT & embedded device signal receiving https://github.com/merbanan/rtl_433