search

samyk / opensesame

OpenSesame attacks wireless garages and can open most fixed-code garages and gates in seconds using a Mattel toy
https://samy.pl/opensesame/
GNU General Public License v2.0
846 stars 175 forks source link

Frequencies are not looped as intended in garages.h due to incorrect use of #define for g #21

Closed deweydb closed 9 months ago

deweydb commented 9 months ago

[see updated post below, this post I was confused...]

I followed your lead and used a 315MHz helix antenna. I unsoldered the white wire from this pad, and soldered one end of the helix antenna in that place:

image

Did you do more than this? It seems the signal output is extremely weak, I can pick it up with my RTL-SDR if i am touching the helix antenna onto the RTL-SDR antenna, but even then, it is almost just noise. image

Did I do the antenna part wrong?

And advice would be greatly appreciated!

deweydb commented 9 months ago

OK, I found the issue. I am using the American Girl Im-Me which has a 26Mhz crystal oscillator, I believe if I understand the CC111x datasheet correctly, this frequency is used by Fref calculations in FSCTRL1. Also it seems that my board has a slightly different revision than the one used for this project, the board used in the Radicha Girl Tech is 761-57600 Rev.F The board in the American Girl Im-Me is: 761-57600 Rev.F0

It appears the F version of the board has a 27Mhz crystal oscillator, which would mean all the calculations for frequencies are off by a factor of 27/26, which makes 310Mhz become 322Mhz. image

So I dialed around a bit with my RTL-SDR and found that I was hitting a stronger signal at 318Mhz and working from a distance not just when the antenna is touching the RTL-SDR antenna. I guess this means my math is off somewhere, I need to read the cc111x datasheet some more.

As a side note, if anyone is reading this and is playing with antennas, for some reason when I use an antenna tuned to the ~315 Mhz range my im-me crashes immediately when transmission begins. I believe this must be to do with the frequency autocalibration code, but I haven't figured out exactly what yet. If anyone has any insight about this i would REALLY appreciate it. At the moment I had to go back to a 1/4 wave monopole tuned closer to 900 MHz (same as original im-me) to prevent the crashes.

deweydb commented 9 months ago

OK, I found the source of the issue. I suck a C so I am not great at explaining this but there is a bug where g is defined in garages.h #define g garages[_garage_id] and takes on the value of the last value of the garages struct, {318000000, 2000, 9, 18, 1, 0x020100, 0x03fd00, 0x03fdfe}, even at the beginning of sending, causing the code to always jump straight to 318Mhz.

I do not believe #define should be used here, as g is dynamic in that loop. If it is desired I will make a pull request with a fix for this.

edit: there is another issue with the same problem: https://github.com/samyk/opensesame/issues/17