Add new SubGhz protocol for Clemsa MasterCode MV12

[flipperzelebro]

Description of the feature you're suggesting.

I have a Clemsa Mastercode MV12 garage remote that its not supported now in flipper zero. Its a fixed code 433.92 MHz remote with modulation AM270.

Testing with flipperzero i have found that its very similar to Clemsa protocol already implemented, but with some changes:

• Time of the On, Off, pause.
• Length of the key.
• Order of the bits for switches.

I attach the SUB files for te button 1 and button 2. The DIP configuration is :

(+): ---*--- (o): -------- (-): ***--**\

I have already implemented the new protocol and could create a MR

Mv12_B1.zip

Anything else?

I have already implemented the new protocol and could create a MR

[skotopes]

Yes please, we are waiting for your PR.

[UrSuLa360]

Looking forward to try it with my clemsa remote.

[racdamico]

Sure. Yes please. I'm interested too.

[UrSuLa360]

Flipper detects the signal from the remote and save it correctly.

But emulation does not open the door.

I have attached 4 files: Button 1 raw and Button 1 parsed. And same for button 2.

stuff.zip

[Skorpionm]

@UrSuLa360 check plz https://github.com/flipperdevices/flipperzero-firmware/pull/3244

[UrSuLa360]

Thanks for the reply, the emulation doesn't work either with the fix.

Aside this, the replay attack doesn't work. My raw recording doesn't open the door. I tried all modulations.

I found this topic related: https://forum.flipper.net/t/clemsa-gatefob/5255/22

Any help you need let me know.

[UrSuLa360]

@flipperzelebro first of all thanks for your contribution. I was looking forward for this since long ago.

May i ask you if you have tested your code with flipper on a garage door successfully?

Maybe im doing something wrong.

[flipperzelebro]

Hello @UrSuLa360 , you are wellcome. Yes I tested it on my own garage. I was reviewing the SUBs you shared and I realised yours are sligtly diferent form mine. Your Signal durations are about 5% shorter than mine. I am going to modify the program and check if with new durations the Flipper Zero emulates yours. Hope it wont takes me long

[flipperzelebro]

In fact the PR @Skorpionm did #3244 is almost the one I was testing.

I have tested with static const SubGhzBlockConst subghz_protocol_mastercode_const = { //.te_short = 1072, //.te_long = 2145, //.te_delta = 150, .te_short = 1020, .te_long = 2050, .te_delta = 200, .min_count_bit_for_found = 36, }; and the signal played is almost identical to yours. Could yo try it?

[UrSuLa360]

No luck, the door doesn't respond.

I also have another remote, it is not from clemsa brand, but it opens the same doors.

I have attached some pictures and another raw recordings.

The recording newremote.sub contains:

long press button 1 new remote long press button 1 new remote long press button 2 new remote long press button 2 new remote

2remotes.sub contains:

long press button clemsa long press button clemsa long press button new remote long press button new remote (i think the signals from cleamsa open door 1 and signals from newremote open door 2)

Both remotes open the same doors.

Hope this helps you.

PD: The newremote is not detected in flipper. Only the clemsa one is detected.

2ndremote.zip

[Skorpionm]

some kind of mysticism. should have worked as in the first option. since a 5% difference in durations is very small for such systems. But are you sure that the remote control is not 2-band? and tried to bring the flipper close to the receiver

[UrSuLa360]

There are only 2 remotes from clemsa with 2 buttons and this protocol. Old one(deprecated) http://www.remote-control-esma.com/clemsa-mastercode-mv-12-remote-control/ Updated version. http://www.remote-control-esma.com/clemsa-mastercode-mv-12-d-remote-control/

They both work with the same garage doors.

I attach a photo from mine without the battery.

I have a question @flipperzelebro , can you open your garage door from a raw recording?

Today im going to test emulating the code very close to the receiver. I was trying from 2 meters before.

[Skorpionm]

Can you take a photo of the insides of the board of this key fob, so that you can see the tracks and markings of the parts, it is unlikely that they are fsk, but still

[UrSuLa360]

https://github.com/flipperdevices/flipperzero-firmware/assets/125646802/4b42077c-d341-4e61-b470-61e8ae9f7f87

Here it is a video of the test, as you can see only the real remote works. After the video i tried very very close to the receiver with no luck. Also the replay attack(raw recording) did not work (this is extremely weird imo).

I have just read your last message, i will prepare the photos soon.

[flipperzelebro]

I have been studying the signals from the SUB files and what I can see is that the durations of the new remote are longer than the original clemsa, aprox. 15% longer. Clemsa : short 1022 / long 2044 / stop 15300 New Remote : short 1200 / long 2350 / stop 20300 Also what I see is that the new remote is sending 48 bits (B7E08AAC8B7E) versus the 36 bits (B7E08AAC4) of the original. It looks like the new one has saved part of the start of the next frame as the end of the current one. It is surprising that it works with such different signals.

I have double checked with the values: .te_short = 1022, .te_long = 2044, .te_delta = 200, and the signal generated is 100% identical to yours. Somethig is mising I am sure.

I Tried reply signal with Raw and it work for me.

[UrSuLa360]

I think the problem is if my raw recordings don't open the door, any generated signal from them won't work too. I need to achieve a working raw recording. If flipper can't find a way to mimic a signal from a static code sent from that remote im afraid this gonna be hard...

[flipperzelebro]

Have you tried recording the raw data with RSSI Threshold? I usually set RSSI Threshold to -70 dBm and signal is much clearer

[UrSuLa360]

I tried with RSSI threshold -70dBm and ALL modulation built in flipper (AM270, AM650, FM238, FM 476) no success :( I combined all available options to record the raw signal, even with other frequencies. No luck.

I have bought a RTL-SDR dongle. I read an old comment from @Skorpionm in other threads that using this device the signal can be recorded and analyzed much better with SDLSharp software. So i just need time to figure out and research how achieve this task. I will do my best to help to solve this mystery, just give me time.

And again thank you all for your work in this project.

PD: i know @Skorpionm you asked for some photos from the clemsa remote board. In order to access the board i need to break the case, so i will try to exhaust all possible options before breaking it. Anyway you can check the photos from the board of the "2nd remote" in this comment

[aluvare]

I have done tests with my garage, the message decoding works perfectly, but the garage does not open when you use what has been captured, not even in RAW on AM270.

[cristofer1989]

Hello. Same problem here. Flipper decodes the message but it did't work. Its weird because I can copy the remote even with a "universal" one from Aliexpress but not with the Flipper.

[njoythegame]

Any news regarding this topic? Has anyone managed to use the flipper zero to open Clemsa doors?

[UrSuLa360]

RTL-SDR-clemsa-3signals-433_92MHz-1MSps-1MHz.zip

A promise is a promise. Here there are the samples recorded with rdl-sdr dongle and URH. (3 times pressed the button)

I saved them in WAV and c16complexsigned. Let me know if you need in another format.

Here there is a signal preview.

@Skorpionm

[UrSuLa360]

Any update on this issue? Is there anything i can do to help?

[skotopes]

@UrSuLa360 other than creating PR with fix, only wait for @Skorpionm to get some free time

[Skorpionm]

Even so, I assume that these are different protocols under the same name. If the issue is resolved I will close the issues

[UrSuLa360]

@Skorpionm You are the expert on the subject, do as you see fit. If i can help, let me know.

[skotopes]

@UrSuLa360 was this issue resolved? Can I close it?