there's a famous attack on these from samy kamkar, since they use a sliding window comparison it's actually super quick to build a short bit string that goes through all the values much faster than 255 broadcasts (or 4096 for 12 bit systems) by using a de bruijn sequence
I think you've missed about half of the functionality. There are two encoder chips: HT12A and HT12E. The HT12A has a 38KHz carrier for the data stream, which is intended for use with IR transmitter/receivers, and only works up to 5V. It has 8 pins that only encode addresses and 4 pins that encode only data. The HT12E only outputs the data stream and allows supply voltages up to 12V. It has 8 pins that only encode addresses and 4 pins that can encode either an address or data. The two decoder chips are the HT12D and HT12F. Both allow supplies up to 12V. The HT12D matches the first 8 bits (addresses) of the stream and latches the next four bits (data) onto its output pins when a match is found, along with setting the Valid Transmission pin high momentarily. The HT12F matches all 12 bits (addresses) of the stream and only sets the Valid Transmission pin high momentarily on a match. There are no other data bits. So, in simple terms, you can decide whether you want to transmit just a single bit of information and have 12 address bits that have to match (4096 combinations) on the HT12F. Or you can transmit 4 bits of information (16 different numbers) and have 8 address bits (256 combinations) to match with the HT12D.
My first thought was, I wonder if you could send two different sets of 4 bit data sequentially and use them as a second 8 bit address thereby giving 256x256 = lots.
Since I didn't do the kind of work where I got lots of manufacturers' data sheets for new products, I never realized how many single purpose ICs had been designed. Of course many, if not most, are obsolete, having been replaced by either more versatile programmable designs or proprietary chips that cannot be easily repurposed for any other use. Are you mining the inventory you got from that analog designer's estate?
But, the upgraded, more secure system of rolling codes is defeatable in less than 30 seconds without having to record a sample in advance. A real step up that was, right... ;)
@@matteo234321 Agreed, great video. I think these chips might even be used in my gate opener transmitter/receiver as they're the old dip switch set code models.
there's a famous attack on these from samy kamkar, since they use a sliding window comparison it's actually super quick to build a short bit string that goes through all the values much faster than 255 broadcasts (or 4096 for 12 bit systems) by using a de bruijn sequence
Useful. I’m going to pick up a few of each. Thanks.
I think you've missed about half of the functionality. There are two encoder chips: HT12A and HT12E. The HT12A has a 38KHz carrier for the data stream, which is intended for use with IR transmitter/receivers, and only works up to 5V. It has 8 pins that only encode addresses and 4 pins that encode only data.
The HT12E only outputs the data stream and allows supply voltages up to 12V. It has 8 pins that only encode addresses and 4 pins that can encode either an address or data.
The two decoder chips are the HT12D and HT12F. Both allow supplies up to 12V. The HT12D matches the first 8 bits (addresses) of the stream and latches the next four bits (data) onto its output pins when a match is found, along with setting the Valid Transmission pin high momentarily.
The HT12F matches all 12 bits (addresses) of the stream and only sets the Valid Transmission pin high momentarily on a match. There are no other data bits.
So, in simple terms, you can decide whether you want to transmit just a single bit of information and have 12 address bits that have to match (4096 combinations) on the HT12F.
Or you can transmit 4 bits of information (16 different numbers) and have 8 address bits (256 combinations) to match with the HT12D.
How cool, these will be fun just to play with !...cheers.
My first thought was, I wonder if you could send two different sets of 4 bit data sequentially and use them as a second 8 bit address thereby giving 256x256 = lots.
I have a set of 4 remote controlled sockets that use these encoders/decoders. Each socket has 8 + 4 dip switches.
Ho w cool, Thanks for demo.. Now if you could demo or recommend a single IC transmitter, That would be awesome ..!
Good to see the waveform of data string , Sri guess length is same , Manchester encoding?
cool chip.
Since I didn't do the kind of work where I got lots of manufacturers' data sheets for new products, I never realized how many single purpose ICs had been designed. Of course many, if not most, are obsolete, having been replaced by either more versatile programmable designs or proprietary chips that cannot be easily repurposed for any other use.
Are you mining the inventory you got from that analog designer's estate?
I bought these
@@IMSAIGuy I am jealous of your access to places that have "interesting" bits and pieces to sell. Not jealous enough to move, however.
@@tfrerich I bought them on eBay or Aliexpress
I need some of those to set bits for a pattern generator I’m creating. I wonder if you can cascade them together?
Can I use this encoder and decoder with my homemade transmitter (built in 555timer ic)
Can you decode more than one data bit at a time and send it thru a cd4514 4 line to 16 line decoder ?
replay attack nightmare
But, the upgraded, more secure system of rolling codes is defeatable in less than 30 seconds without having to record a sample in advance. A real step up that was, right... ;)
@@tonyfremont TOTP is pretty easy even with 8bit microcontroller.
Interesting
I have the feeling that you the Taiwanese company Princeton Technology made a copy of these chips.
0 to F on the 4 bit output? 0 to FF would be 8 bits. But I know what you meant 🙂
I thought the same, us nerds pay way too much attention to the little details! Regardless, great video as always!
@@matteo234321 Agreed, great video. I think these chips might even be used in my gate opener transmitter/receiver as they're the old dip switch set code models.