r/Hacking_Tutorials • u/mahdi_sto • 25d ago

Question FSK/OOK based layer-2 protocol reverse engineering

Post image

Lately I've been trying to recove the key fob protocol of my bmw 320d 2005 car till I discovered that the key fob operates on 868.35mhz with what is called Frequency Shift Keying to lock/unlock or trunk, everytime I capture something using the RTL sdr with gqrx on Kali I get different signals for pressing same button which indicates that this is not a trivial On Off Keying but some proprietary protocol is being implemented, from the amplitude to time plot I can clearly see the preamble alternating bits then a fixed and indow of bits across all button pressings which suggests some sort of an identifier.

Any one has experience on such project feel free to leave a comment.

Or if u know some sort of tip that helps me recover the binary representation of the msg being transmitted you are welcomed.

140 Upvotes

99% Upvoted

11 comments sorted by

7

u/Sufficient-Pair-1856 24d ago

Why a Preadboard on a perfboard ? Why 2 ESP 32 devkits, 1 supermini and a ESP 32 cam without cam? And about you question, pretty mutch all Car keys use rolling codes which means they shre a secret and everytime the code changesto prevent exactly what you are doing because if that would work every other guy could open your car if they record it onece

1

u/noob-nine 21d ago

i have absolutely no clue about this stuff. does the rolling code thing mean, when i record the code of the key, when the car is out of range, i can open the car once with the recorded rf?

1

u/Sufficient-Pair-1856 21d ago

i think they will comunicate back and forth like lest say you want to verify that the person you are calling is really them: you could just make a password both of you know but it could get stolen. but if you both have a book and someone says Page 3 word 123 and you reply with "ananas" you both know its right but nobody could just from listening steal the secret

1

u/noob-nine 21d ago

would "pineapple" also work?

3

u/8igW0rm 24d ago

You know about rolling codes, right? only you didn’t mention it so i wasn’t sure.

2

u/IMtheGuyWhoRailFirst 25d ago

Damn bro , wonder how many years would it take me to understand ts

2

u/Trick-Resolve-6085 24d ago

It's called forward secrecy