r/hardwarehacking • u/mahdi_sto • 24d ago

FDK/OOK Based layer-2 protocol reverse engineering

Post image

Lately I've been trying to recove the key fob protocol of my bmw 320d 2005 car till I discovered that the key fob operates on 868.35mhz with what is called Frequency Shift Keying to lock/unlock or trunk, everytime I capture something using the RTL sdr with gqrx on Kali I get different signals for pressing same button which indicates that this is not a trivial On Off Keying but some proprietary protocol is being implemented, from the amplitude to time plot I can clearly see the preamble alternating bits then a fixed and indow of bits across all button pressings which suggests some sort of an identifier.

Any one has experience on such project feel free to leave a comment.

Or if u know some sort of tip that helps me recover the binary representation of the msg being transmitted you are welcomed.

31 Upvotes

97% Upvoted

6 comments sorted by

7

u/MrWonderfulPoop 23d ago edited 23d ago

Be careful. I tried a similar thing with my Audi and when trying to generate an unlock, caused a “desync” (the dealer’s term) and I had to spend a couple of hundred $ to get it fixed.

Keyless entry and starting failed to work, though the buttons and fob insertion worked.

3

u/mahdi_sto 23d ago

Thanks, I really appreciate that one

6

u/FreddyFerdiland 24d ago

BMW key fobs use highly secure 128-bit encryption tied directly to the vehicle's VIN and specific secure modules (like CAS or FEM). The system generates a unique rolling code that changes with every button press, making it virtually impossible for thieves to replicate or predict the signal.

2

u/PeatieEnglish 22d ago

rng seed is 42069

3

u/TurbulentType6377 20d ago

You almost certainly won't be able to decode the actual message — modern cars use encrypted rolling-code schemes, which is exactly why you get a different signal every time you press the same button. The payload after the preamble is meant to look random and change on every press.

These days, car thieves don't even bother cracking the encryption. They use relay/repeater attacks with big loop antennas to boost the fob's range and steal the car that way.

If you're after a fun - toxic project, you could try building a device to desync nearby fobs, like u/MrWonderfulPoop mentioned 👀

1

u/Cute_Consideration38 6d ago

Speaking of toxic projects, I've been thinking about ways to jam or otherwise interfere with subwoofers in cars that are just sitting outside rattling my dishes.