A garage door that can be opened by a 433Mhz remote. **You need it to be a fixed code**. I don't know how to check this, but rolling code will not work since we will be using the replay attack here.
Many controllers are using rolling codes.
However it seems that it is possible to program another controller when you already have one controller, so it should be possible to program a Raspberry Pi to also do the same.
Looks like it's not always possible either though.
The easier way is instead of figuring out the secret value, to clone the rolling code and replay.
Jam+Listen(1), Jam+Listen(2), Replay (1)
2nd rolling code is still unused and can be replayed later. This is called a roll-jam attack.
It would be annoying, but you could brute force it by say pressing the garage controller 1000 times, having software that confirms each press was recorded successfully, storing the codes, and assuming an average of 1 press per day, which could give you enough codes for nearly 3 years.
Still, assuming 2 seconds per push, that's almost 35 minutes of manual configuration.
Another option would be to try to build an interface to directly control the remote controller from the raspberry pi, but that would be complicated by the several different types of controllers in existence and might not work with a new one, etc.
Perhaps there is a way to physically extract the seed that is on the remote controller? You may break it, but it would also be a permanent solution.
From README:
A garage door that can be opened by a 433Mhz remote. **You need it to be a fixed code**. I don't know how to check this, but rolling code will not work since we will be using the replay attack here.
Many controllers are using rolling codes. However it seems that it is possible to program another controller when you already have one controller, so it should be possible to program a Raspberry Pi to also do the same.
Looks like it's not always possible either though.
It seems rolljam attacks could work though
It would be annoying, but you could brute force it by say pressing the garage controller 1000 times, having software that confirms each press was recorded successfully, storing the codes, and assuming an average of 1 press per day, which could give you enough codes for nearly 3 years.
Still, assuming 2 seconds per push, that's almost 35 minutes of manual configuration.
Another option would be to try to build an interface to directly control the remote controller from the raspberry pi, but that would be complicated by the several different types of controllers in existence and might not work with a new one, etc.
Perhaps there is a way to physically extract the seed that is on the remote controller? You may break it, but it would also be a permanent solution.