Dumped the UEM using BDM, there was an stadard HC12 chio with a ready unpopulated footprint just beside the cpu itself.
No locks, just readout with no problems.
Used Claude a lot to reverse how it works and how the remote is received and decoded. It is "standard" KeeLoq encryption. No extra layers.
To be able to decrypt the radio frame there is needed two pieces, the serial and the key. The serial is in clear text in both eeprom and on the air. The key is also in plain text in eeprom, but not in air.
After some struggle we, Claude and I, managed to build an air sniffer using an sdr (software radio). In my case a Adalm-pluto. Only reason using this is that I had it since before when I worked on GPS and needed something that could simulate GPS in an controlled environment.
So with this and the key from eeprom we had an sniffer that I can decrypt messages from my remote. This was just for me to verify that I had all pieces correct.
Next step from this was to build an new application into a Flipper so it can act as my missing fob. This was also successful.
After all this I was not near my goal to have one more working fob.
I took one side step and bought one cheap china fob. It was no use. Looks like all of this fobs have same serial and same key. So if I manage to learn this key into my car, everyone with same key can open my car. Not good. One other problem was that with the fob you get two numbers. One short and one long key. The short is the serial in KeeLoq. The long is done some unknown transformation into the KeeLoq key. I wasn't able to find how this transform is done. So this is a dead end for DIY. I also looked into how this cheap key mas made. They have a 1MByte big flash and a small cpu. The cpu is locked. During bootup on each button press it reads the first part of the flash. Then it reads a small block of data. Next press is take a jump and reads some data little higher in memory. So this memory is a prerecorded set of frames. Every keypress jumps one block forward. Each block contains all buttons. When it reaches end it sends only zero. No way to restart. It have limited number of presses it can use.
So I looked more into the original fob, it have a HCS412 chip. It is not possible to read out the key from this chip, but it is possible to write! And from my experiment I know exact how the radio frame shall look and how the key is saved in the eeprom. So I (read Claude) write an arduino sketch that programs the chip. I have just tested and can program it. My sniffer can read it correctly.
I haven't tested on the car yet, I don't have it at home just now so it can take a couple of weeks before I can test.
As usual here is some information
- eeprom.png (50.72 KiB) Viewed 220 times
There is space for 6 keys, yellow and green is the first two.
The 4 bytes is serial, 8bytes KeeLoq key
Code: Select all
./run.sh rx --seconds 4 --save capture.npy --key xxxxxxxxxxxxxxxx
# /home/de/projects/Volvo BiFuel/keys/share/sniffer/.venv/bin/python /home/de/projects/Volvo BiFuel/keys/share/sniffer/pluto_recorder.py --uri ip:192.168.2.1 --freq 433920000 --fs 3000000 --save capture.npy rx --seconds 4.0
# capturing ~4s (45 buffers) at 433.9200 MHz - PRESS THE FOB NOW ...
# strongest burst: spread 2837, SNR ~65.7 vs noise floor
# carrier peak = LO +5.6 kHz -> true carrier ~ 433.9256 MHz
# pulse widths (us): 39 pulses, min 504 median 902 -> Te ~ 902 us (config default 780)
# 504 us | # (1)
# 721 us | ### (3)
# 829 us | ############################# (29)
# 1263 us | # (1)
# 1696 us | ##### (5)
# saved raw I/Q (11796480 samples) -> capture.npy
# capture.npy: 11796480 samples @ 3 MSPS
# 1 distinct frame(s) from 1 decoded window(s)
# frame seen in window(s) 1784-2284 ms Te~870us
-------------------------------------------------------------
polarity : 1 repeats seen : 1
checksum : PASS
raw bytes (0..8): C6 34 7F E6 56 34 12 00 24
on-air bits : 011000110010110011111110011001111110110100111000101000100000000000100100
HOP : 0xE67F34C6 (KeeLoq — bytes 0-3 LSB-first) [raw MSB-first 0xC6347FE6]
SERIAL : 0x00123456 (LE) 24-bit 0x123456 MSB 0x00
CHECK byte : 0x24 -> data(b0)=0 chk0(b1)=0 chk1(b2)=1 stop(b5)=1 [valid]
KeeLoq decrypt : plaintext 0x80B70018
button : 0x8 (UNLOCK)
overflow : 00
disc (25:16) : 0x056 (== serial&0x3FF)
counter (15:0): 0x0018 (24)
If not correct it looks like
Code: Select all
KeeLoq decrypt : plaintext 0xE1C5707F
button : 0xE (?)
overflow : 00
disc (25:16) : 0x1C5 (!= serial&0x3FF (0x0B7))
counter (15:0): 0x707F (28799)The key and serial from eeprom goes right into the arduino sketch
Just remember, use at own risk. I have used it and was able to do something but it don't mean it works for you.
My cars are all unlocked. Volvo even has the only key glued to the immobilizer antenna, can start it with a screwdriver.