samyk / opensesame

OpenSesame attacks wireless garages and can open most fixed-code garages and gates in seconds using a Mattel toy
https://samy.pl/opensesame/
GNU General Public License v2.0
845 stars 175 forks source link

I havent found anything wrong #6

Closed kalirenegade closed 3 years ago

kalirenegade commented 5 years ago

At least that i can tell ive been stearing at this code for months im not even sure where to look i just ordered the device and programmer ive been wanting to try this thing for years not to much to open garages doors but to control simple home automation things like rf power outlits is the code bricked on multible files or should i focus on a specific file this is really out of my scope but i dont want to give up im going to have to look up more about regesters as i only know the verry basics and dont completely understand yet

The only thing i can think of is in the rftx() function it checks if the previous transmission is done, but doesnt do anything after do i have to implement the tx function to send somthing

KonradLinkowski commented 3 years ago

How is it going @michael040990 ?

kalirenegade commented 3 years ago

i had to shelve the project till i could learn more or have some one help explain things this is what boosted my interest in rf now i have a hackrf and a yard stick one it would still be nice to get this running

CourteousCoder commented 3 years ago

I am also having the same problem as @michael040990 . I added a line to the void rftx() function, which I believe causes the radio to transmit. However, I am not sure it is actually transmitting. I see a solid red LED and the Nyan Cat animation. So this leads me to believe that the interrupt handled by void rf_isr_orig() __interrupt (RF_VECTOR) is not actually happening... If that's the case, then I'm stumped. I am going to try adding a debug line into the interrupt service routine to see if it's actually called, namely: printl(1, "INT Transmitting ");. If I see the letters INT on the line that says "Transmitting" then that means it's being called. I'd love to compare research with you, @michael040990 . Perhaps two heads are better than one. Feel free to email me at the primary email address on my GitHub profile.

CourteousCoder commented 3 years ago

Update. I don't see INT so that means the interrupt isn't happening. I think page 65 of the data sheet might be relevant

blysmth commented 3 years ago

I hope someone could throw me a bone here, I'm a novice and I feel like I'm following some red herrings!

Would I be right in saying there aren't any chunks of code missing, rather, the functions required to transmit are present but have been disabled or bypassed?

KonradLinkowski commented 3 years ago

image

blysmth commented 3 years ago

I had some ideas, hoped to talk with someone about them by email. Anyone else stumbling through this, email the address on my profile please.

blysmth commented 3 years ago

Ok, I got it sending the payload but I'm clearly doing something wrong because it just sends in a loop and I haven't captured the transmission to check yet but I think it's sending the same thing each time instead of sequential chunks of de_bruin! So I've found probably the most important part of the solution but it's still only part of it.

lame-turtlez commented 3 years ago

Hey man any update on this ?

RChadwick7 commented 3 years ago

Ok, I got it sending the payload but I'm clearly doing something wrong because it just sends in a loop and I haven't captured the transmission to check yet but I think it's sending the same thing each time instead of sequential chunks of de_bruin! So I've found probably the most important part of the solution but it's still only part of it.

Can you share how you got it transmitting?

Ivan275g4 commented 3 years ago

Can you share how you got it transmitting?

Here is a 1 preset garage code transmission example that this is based on https://github.com/mossmann/im-me/tree/master/garage/opensesame

kalirenegade commented 3 years ago

so i have added to the rftx() https://pastebin.com/41R9M1NN also noticed there were two instances one in rf.c and one in opensesame.c i removed the rf.c one and added the code to opensesame.c and it compiled fine i am at the cat animation with the red led as well i don't see anything in the 300-400mhz frequency's when running it

Ivan275g4 commented 3 years ago

michael040990,

  1. Are you using an unmodified garage.h? if so I suggest you remove all things out of garages[] = { except for one until your code starts to work. And don't use the last 318000000 one. That way you can focus on just 1 frequency. PS the program doesn't always go in the correct order of those garages, sometimes it will go top to bottom others it will go bottom to top for me.

  2. Lets look at last line of your function txdone = 0;. Once your code executes rtfx() function txdone will be 0, if your code hits a waitForTx(); or while (!txdone) before you set txdone=1 your code will get suck in a loop.

  3. I got sidetracked, and don't remember 3 now. I'm sure it wasn't too important.

kalirenegade commented 3 years ago

i got it all working that was fun i want to try and make a programable ook transmitter not nothing fancy something like define how long a low and high signal is the frequency what data to transmit that will be my next project maybe a morse code transmitter too oh wouldn't it be cool to have it send and receive morse code and display ascii i would need to get a second one or find someone local that has one that we can work on give the device somewhat original intentions just cut out the computer part and go device to device.

kalirenegade commented 3 years ago

one of the things that had me confused is the number of led flash's and length of transitions for each code in garage.h Stanley finished in 7 led blinks Chamberlain finished in 4 blinks Chamberlain Canada finished in 4 blinks however NSCD had over 200+ blinks so i thought it was just in a loop till i commented out that code and it finished pretty quickly is there a reason NSCD takes so long to transmit?

something else I ran into not sure if related but when powered by a goodfet everything works fine but when powered by 3x 1.5volt battery's it freezes with the red light on and never makes it to the animation. i might take it apart and measure the voltages to see if the regulator is powering it correctly i suppose that since the goodfet is powering the device directly there is no problem so there must be a problem in the battery power circuitry

Ivan275g4 commented 3 years ago

make a programable ook transmitter...send and receive...

Take a look at https://github.com/henryhallam/puellaardens or what that was forked from. I know nothing about it. I looked at it once for a sec and promptly lost the link to it for over a year. Fount it in my phone's bookmarks about 2 weeks ago. Enjoy.

A transition code for Stanley is 10 digits, each one can be 0 or 1 and is 4 bits long each. With proper de bruijn sequence that will be about 4096 bits. Chamberlain is about 2048 bits. NSCD is 9 digit, each has 3 states and each state is 18 bits long so that's about 354294 bits total. Also the way the code is now, it doesn't actually handle the 3rd state properly but I think it will still outputs 350K bits that's why it takes a long time and why I said don't use the last one 318MHz NSCD.

kalirenegade commented 3 years ago

That makes more sense I noticed that the order it loads is last to first in the garage array so I reordered the large one to transmit last now I just need to figure out the power issue why it transmits fine when powered by the GoodFET but freezes powered by batteries they are band new batteries

Ivan275g4 commented 3 years ago

Did you rip the battery wire when you took it apart? Looking at your pastbin name, are you from California, and do you play C&C Renegade? PS. I added something to my earlier post.

Also if you change

        for (key = 0; key < sizeof(garages)/sizeof(garages[0]); key++)
        {
            _garage_id = key;
            db_send();
        }

to

        for (key = 0; key < sizeof(garages)/sizeof(garages[0]); key++)
        {
            _garage_id = key;
            printf("Garage %i of %i and Key%i", _garage_id + 1, sizeof(garages) / sizeof(garages[0]), key);  //Quantum observation, if I dont look here, it doesnt work right.
            db_send();
        }

it does it in the right order, top to bottom.

kalirenegade commented 3 years ago

Ahh I did break the ground connection at one point when my setup fell so you think it could be from a bad solder joint I’ll try to resolver it when I get home I’ll comment out the NSCD one for now.

I wish I lived in California it’s so beautiful. I haven’t heard of a game called C&C Renegade. That name is the Hindu goddess of death abandoning her post

kalirenegade commented 3 years ago

Re soldered the battery connector and it all works out great

RChadwick7 commented 3 years ago

Did you rip the battery wire when you took it apart? Looking at your pastbin name, are you from California, and do you play C&C Renegade? PS. I added something to my earlier post.

Also if you change

      for (key = 0; key < sizeof(garages)/sizeof(garages[0]); key++)
      {
          _garage_id = key;
          db_send();
      }

to

      for (key = 0; key < sizeof(garages)/sizeof(garages[0]); key++)
      {
          _garage_id = key;
          printf("Garage %i of %i and Key%i", _garage_id + 1, sizeof(garages) / sizeof(garages[0]), key);  //Quantum observation, if I dont look here, it doesnt work right.
          db_send();
      }

it does it in the right order, top to bottom.

I tried adding this, but I got an error with the printf command. Changing it to printl, printrl, or printrlc, I get this error: Error 78 incompatible types from type 'cons-char [26] code' to type 'unsigned-char fixed'

Ivan275g4 commented 3 years ago
  1. Try adding #include to opensesame.c that should let you printf. I could not get printl, printrl, printrlc to output variables, only printf worked for me.
  2. Right after that printf command I quickly display other text and to be honest I'm not sure if printf will actually displays anything without SSN = LOW; setCursor(0, 0); and SSN = HIGH; after it. So you may have unwanted text on the screen or it may not show anything at all. All my printfs are wraped with SSN LOW/HIGH and a cursor position command.
  3. Email me? My email is listed in my profile for now. I'd like to talk about a blue "SMART" device.
HankFordham commented 1 year ago

Probably a bit late to the party but could someone email me to help me get this working? - contact@hankfordham.com

HankFordham commented 1 year ago

one of the things that had me confused is the number of led flash's and length of transitions for each code in garage.h Stanley finished in 7 led blinks Chamberlain finished in 4 blinks Chamberlain Canada finished in 4 blinks however NSCD had over 200+ blinks so i thought it was just in a loop till i commented out that code and it finished pretty quickly is there a reason NSCD takes so long to transmit?

something else I ran into not sure if related but when powered by a goodfet everything works fine but when powered by 3x 1.5volt battery's it freezes with the red light on and never makes it to the animation. i might take it apart and measure the voltages to see if the regulator is powering it correctly i suppose that since the goodfet is powering the device directly there is no problem so there must be a problem in the battery power circuitry

Would you be able to help me get mine running?

Ivan275g4 commented 1 year ago

Would you be able to help me get mine running?

1st, if you have the money to burn check out flipperzero, add brute force to your search and you will find... 2nd, this wont work for all garage gates, I spent way more time than I should trying to figure out why it wasn't working for me. After giving up many many many times, coming back to give it another try sometimes I would start from scratch, sometimes I picked up where I left off over and over the darn 20 year old garage gate would not open, then I figured out why. That gate requires 2 correct codes be transmitted with a 20 or 40ms pause between them before it will open.

HankFordham commented 1 year ago

Would you be able to help me get mine running?

1st, if you have the money to burn check out flipperzero, add brute force to your search and you will find... 2nd, this wont work for all garage gates, I spent way more time than I should trying to figure out why it wasn't working for me. After giving up many many many times, coming back to give it another try sometimes I would start from scratch, sometimes I picked up where I left off over and over the darn 20 year old garage gate would not open, then I figured out why. That gate requires 2 correct codes be transmitted with a 20 or 40ms pause between them before it will open.

Could I email you to talk about how to get it working? I have the Im-Me as well as smart response XE. I just want to have the functioning im me in my demo kit.. Was thinking about keeping one in the box and using one to actually show it sending the signals using an SDR