hacking car keys / hacking garage keys with Raspberry PI + RTL SDR dongle + RPITX in 5 minutes !
HTML-код
- Опубликовано: 12 сен 2024
- [ENABLE CAPTIONS!] In the video I am showing how to clone any radio signal of car keys / garage keys with cheap Raspberry PI and RTL SDR dongle with RPITX application. This is the same method as used for relay attack / car rolljam attack to unlock a car.
The point is that it is not required anymore to have expensive YardStick ONE or HackRF equipment to perform such activities as RF signal replication ... I am using second hand Raspberry PI 3B that I bought for only 30$ with software defined radio application and dongle. This video has only educational purposes so you could be aware of current hacking techniques. I am not trying here to teach you how to hack into a car. I am just showing how easy it is nowadays to perform radio targetted attacks so you could have some basic knowledge how to protect yourself and your assets...
Remember to protect your car by not using RF communication where unnecessary (open door rather by turning the key instead of using remote openning) f.ex. in shopping malls and other places where potential hacker may wait for you.
The RPITX project is available here :
github.com/F5O...
What do you need :
1. Raspberry PI device ( I have used Raspberry 3B )
2. Short antenna applicable for frequency you want to replay ( 433MHz : 17.3cm / 6.8' inch , 315MHz : 23.81 cm / 9.37 inch , 868MHz : 10.6cm ) - antenna has to be connected to GPIO4 pin of Raspberry Pi ( look here for info : www.raspberryp... )
3. RTL SDR dongle for 15$ - I am using shielded RTLSDR v2. Ensure you have quality built device
4. An application on Raspberry Pi : RPITX from Evariste Courjaud (thanks Evariste !!!)
a) First Step - you need to have your Raspberry Pi with Raspbian SD card - prepared to work with RTL-SDR dongle - look here for some tutorials : hamprojects.wo... ,
here on github : gist.github.co...
or here drwxr.org/2017...
b) Second Step - Install the RPITX app on Raspberry Pi :
sudo apt-get update
sudo apt-get install git
git clone github.com/F5O...
cd rpitx
./install.sh
RUN rtlmenu & Enjoy :
sudo ./rtlmenu.sh
installation tutorial from the scratch • Radio hacking - setup...
If you liked it is please leave a LIKE and SUBCRIBE for more amazing videos !
Thanks !
#ALCHNL #RTLSDR #JAMMER
Tags :
car hacking
hacking remote
hack a car
car key jammer
car relay attack
433 MHz
315 MHz
rf jammer
car theft protection
key fob jamming
car remote jammer
car key signal blocker
key jammer
key blocker
remote control jammer
jamming technology
security key hacking
car remote control system
Man-in-the-middle attack
eavesdropping
wireless key attack
wireless keyfob attack
car replay attack
unlocking a car
car unlock
unlock car
cloning car key signal
rf signal cloning
key cloning
clone vehicle remote
clone vehicle key
car key cloner
car key clone machine
unlock vehicle
hacking into a car
hack into a car
steal a car
software defined radio
Jest 4:16 niedawno wróciłem z pracy po 13h i przypadkiem wpadłem na ten film i podjaralem sie tematem na maxa. Czas wygrzebać antenę i malinę z szafy wiedziałem ze mi się przyda 🎉
Car keys from more than 10 years already is use rolling codes , so the codes is generated once only then the next time you press it will generate new code , so if you copy the code then try to use it it wont work , unless the car is very old ,
but still can be useful for other basic devices , thanks for sharing
Yes this is true, but you can also do reverse engineering like I am showing in my other video
ruclips.net/video/jziWQA8Wvp4/видео.html
with Universal Radio Hacker tool and simple arduino board with FS1000A transmitter
@@justanengineer5599 will check that. Am actually searching for this to control somfy, fujikawa and other curtain motors by RF. For home automation purposes. Thanks bro
@@zeyadsulaiman1597 What you can do to avoid code rolling?
@@nicolasperezmolina491 still didn't find a way yet. I guess this would be done by some programing by copying the rolling code generater. Wont be easy 😅
@@zeyadsulaiman1597 what do you think about keyless go ( passive keyless entry ) ?
Thanks for the educational information. Learning something NEW everyday! Very much appreciated.
Haha this is so much fun. There's a LOT and even cooler stuff that can be done with rpi and SDR 😎. Thanks for sharing dude. 👏👍
For example?
It's working ?
Of course it is working. Try it !
@@justanengineer5599 where I get all the parts ?
Very interesting video, thanks! How would you do a rolljam attack with this setup? As simple replay does not work on modern cars.. For educational purposes only :)
for roljam you need a jammer and while jamming you have to record the latest keycode. You jam nearby the car door's knob (car sends challenge signal), you record nearby the key holder (car key sends response signal). At least two persons are needed to perform this type of attack. See my latest video for CC1101 ruclips.net/video/vZcGP-O2GvQ/видео.html and this description github.com/trishmapow/rf-jam-replay
@@justanengineer5599 Thanks a lot, I already know the github repo, but the video is nice :) I thought more of a rolljam setup with the RPITX / RTL-SDR..
merci je vais essayer maintenant. J'ai programmer un attiny 13a avec USBASP comme tu l'a montrer dans une autre video et sa fonctionne trés bien. une fois fini mon essai je reviendrai poster un commantaire.
c'est cool que ça marche. N'oubliez pas de ne rien faire que vous pourriez regretter :-)
Łoł naprawdę bardzo dobrze wytłumaczony film szacun za to !!!!
Greetings!
I love watching your videos and thank you for all of your hard work. I'm curious if this method will also allow you to start the vehicle as well as unlock?
Also curious if you know how to extract the "key code" through the OBD port. Essentially building a device that plugs into the ODB port to extract and save the "key code" needed to program a transponder key without needing the existing transponder key? There is a machine called the Xhores that allows you to program a blank transponder key however the "key code" is needed from each vehicle.
the radio openers work the way that 'key code' is used as a seed for the algorythm that generates single use radio code. Without having this seed you can still record and play back the one time sequence. The receiver in the car has a tolerance for +/- 10 last sequences. That is why jaming and replaing recorded sequence is succesfull even with such device
For keyless cars opening the car also means ability to start the engine
Thank you.
When i try and use the record function in the rtlmenu, it doesn’t record anything when i play it back. Do you know how to fix this?
are you sure you have connected and properly working RTLSDR Usb dongle to your Raspberry PI? did you use the command rtl_test to check if the dongle is working?
quick question, i have been working with rpiTX lately. The only problem i have is that the poweroutput with the RPI400 of mine is very low. Do you have any idea how i can boost this frequentie? especially for 433 MHZ. I thought about putting the gpio directly onto a 433MHZ transmitter but this does not work
connect a power RF output amplifier. There is a lot of them based on Quorvo 4 pin chips and they cost around 10-20 usd. Check on www.aliexpress.com
Great info@@justanengineer5599
My car and key got out of sync💀, anyidea
Any idea how to fix
depends on a car model. Sometimes you can sync it inside a car by special key presses. You need to search some info.
@@justanengineer5599 tried not working,car is vw polo 2017
www.vwpolo.net/synchronising_the_vehicle_key-48.html
@@justanengineer5599 unfortunately this also not working
Do you have a discord server where people who are interested in these kind of stuff can communicate and teach each other their own methods? This would be very useful and grow this community.
nope, but you may always drop me an email. BTW new jammer video is going to be posted soon
Hello I have connected cable to TX PIN on RPi4 but problem is RPi4 cant transmit any freq. I dont know whats wrong. Please help me.
Only showing Running but nothing is received on RTL-SDR module.
I think on RPi4 it is only the beta version available and probably TX pin can be different. You need to consult developer pages on Github as well as some blogs of the people who tried to launch this program like this one here
www.hydrogen18.com/blog/rpi4-rpitx-test.html
@@justanengineer5599 How can I setup it and fix please help.
But MAYBE I NEED TO CANGE CPU FREQ to higher ?
sorry, but i do not have rpi4 to check it myself. As I mentioned try to ask the rpitx developer
I have two more questions about this project, the first is whether Raspberry will work with other receivers? Because I also bought a newer version of V3 but unfortunately the phone does not want to work and the second or will it be necessary to have a case with a display for Raspberry?
case and display is not necessary for RPI. You need to configure it the way you could attach remotely over WiFi with SSH.
Are you mentioning V3 version of RTLSDR USB? connect it the laptop first to see if it is working.
Thankssss man
😂😂😂
how can i make an antenna to emit frequency on the rasp pi?
Use 'whip antenna calculator' ( here www.csgnetwork.com/antennagenericfreqlencalc.html ) to calculate length of the wire and connect this wire to GPIO port 4 on Raspberry pi connector
I don't have resbery pi can I use it without resbery pi
check my cc1101 tool videos, the latest
Hey, we were able to assemble a project from your video. I need another raspberry now and I just have a question if I could use an older raspberry as a second device and if it will work with the one that is now (3b)?
in theory RPITX also works with older version of Raspberry Pi. Check hardware support table here : github.com/F5OEO/rpitx
@@justanengineer5599 Thanks a lot. I saved an equal half by ordering a slightly older model
Please give me the RTL sdr dongle link that you used in this video
Try here m.banggood.com/buy/sdr-rtl-sdr.html
@@justanengineer5599 www.amazon.in/dp/B07H8V7K75/ref=cm_sw_r_cp_apa_i_svBcGb78SNPW2 is this capable for doing this
Yes, but this one is poor quality. Look for something in alloy case with TXCO (temperature compensated frequency)
@@justanengineer5599 sure... Iam subscribed i like you behavior 🙌
@@justanengineer5599 can you suggest any standard budget product
My garage keys have rolling code… is this still doable ?
watch my other videos with cc1101 tool
Yes but it will desync the key, so I wouldn’t do it. Rolling keys mean that the code can be used once and then it’s changed, when using a different remote it will desync.
Hello tell me please why are your using two antenna?i mean you only need the one connected by usb to raspberry to show us the demonstration, but what’s the purpose of the one connected to the laptop?
Hi I am using second antenna in RTLUSB dongle connected to the PC to show you what Raspberry is transmitting over the radio frequency. Raspberry has 2 antennas - first connected to transmitting Pin GPIO4 and second to RTLSDR dongle connected to USB port (this dongle is radio receiver to get the radio message and record it in Raspberry)
We were able to execute the transponder option despite the rolling code. I still have to work on strengthening the antenna between the key and the raspberry, but overall I managed
great. tell us what was the range between two raspberry pi
@@justanengineer5599 +-20 meters but I think it would be more if not for the fact that the second device is weaker because raspberry Pi 2b
what is radio app do you use ? :D
On PC there is SDRsharp, on Raspberry RPITX.
@@justanengineer5599 Any alternative for SDRsharp?
@@staskertube sdrconsole or hdsdr
hi followed the guideline but when I do the tune or chip I get a small signal would this require a larger wire for a bigger frequency to be transmitted and when I transmit it only transmits once and stops straight away
Whip antenna has to be tuned to particular frequency. The output radio power of rpitx is rather small so for better effect a RF amplifier has to be used. If you want longer transmission time you have to record longer period of time. There is possibility to use RPITX from command line and loop broadcasting but there is no point to do that for car keys.
Hey there @justanengineer what antenna do you recommend for American key fobs?
Hi for 315MHz US band the length would be 24 cm
Czy to jakiś specjalny model Raspberry Pi 3 B powinien być czy też każdy inny można użyć do testów?
wszystkie za wyjatkiem RPi 4 bo na tym tylko wersja beta działa
Dzięki za info. W takim razie szukam Raspberry Pi3 i zaczynam zabawę. A swoją drogą to aż dziwne iż 4 już nie spełnia standardów do realizacji tskich testów.
Pełną listę co jest wspierane masz na stronie dewelopera
Raspberry Model Status
Pizero OK
PizeroW OK
PiA+ OK
PiB Partial
PiB+ OK
P2B OK
Pi3B OK
Pi3B+ OK
Pi4 In beta mode
github.com/F5OEO/rpitx
Jeśli będę miał problem z uruchomieniem projektu to mogę zwrócić się z pytaniami? Istnieje również możliwość zapłaty za przeszkolenie mnie w tym zakresie.
jak zadasz pytanie to chętnie odpowiem
Saut si j'ai bien compris le sdr connecter au pc reçois et enregistre le signal et celui du raspberry pi il sert a quoi ?
Raspberry Pi est un émetteur radio sur la broche GPIO et a rtlsdr connecté pour l'enregistrement du signal
@@justanengineer5599 je comprend donc il faut enregistré le signal emis par la clé sur la raspberry pi pour l'utiliser plus tard
exactement, vous avez besoin d'un appareil d'enregistrement et c'est à cela que sert le dongle rtlsdr
@@justanengineer5599 ce que j'ai pas compris c'est pourquoi tu a 2 dongle
Le premier dongle permet au Raspberry Pi d'enregistrer la transmission radio, le second dongle est destiné au PC pour vous montrer ce qui est transmis par radiofréquence dans le logiciel SDRSharp. Le PC est utilisé pour se connecter à Raspberry Pi (sur Putty) et pour afficher les signaux radio. Vous pouvez vous connecter à Raspberry même avec un smartphone et un terminal SSH. Vous n'avez pas besoin de PC pour cela. Le PC a été utilisé uniquement à des fins vidéo.
Bonjour sa ne fonctionne pas avec le raspberry pi4 pourtant j'ai bien installé rpitx dans Readme ils disent que avec pi4 sa marche mais avec pi4 c'est version d'essai je vais essayer avec mon pi3B+ . Encore merci pour tes video.
J'ai oublié d'écrire que l'application RPITX ne fonctionne qu'avec raspberry pi3/pi2 , désolé
If I wanted another device to trigger the playback, could I wire a relay output from the device to the GPI of the RPi and then map the GPI to the GPO the antenna is connected to?
hmm you would have to draw me a picture of this to make me understand what you are trying to acomplish
Hi everyone,
I would like to show the code on an LCD screen or on the "serial monitor" of the data that is received in an RF module, has anyone done something similar?
Either with an ARDUINO or with a PIC
Thanks in advance.
For this script, it's merely copying the signal; I don't believe it decodes the received data. If it does, it would need to interface with a python-type script that can interface with the LCD controller or Serial Port and display the decoded data.
do i need an antenna connected to the RTL SDR receiver in order to see the signals on sdrsharp?
Yes, you need some antenna
Hello, which spectrum analyzer is this?
RTL Sharp ad far as I recall
Jaką antenę używasz ta która jest w tym filmie jaki typ/model?
na rtlsdr dongle jest to składana antena teleskopowa z wtykiem SMA, najtańszy sprzęt z aliexpress
na samym raspberry to zwykły kabelek do wtykania na piny takie jak w Arduino
Hi I have a question whether on a laptop with Windows and the program hdsdr I am able to play the signal that I previously recorded with the phone using the sdr key? Because so far I have not succeeded and I wanted to check if it actually works
in general yes, but you need some supported SDR transmitter like HackRF
The phone SDR app only records audio signal so it has to be modulated first
@@justanengineer5599 Ok thank you. And if I recorded the same signal but using an rtl receiver like on. Movie and laptop and not a phone I would be able to play it? I have already bought a Raspberry Pi 3b exactly as in the video but I have not yet started this project
if you check RPITX on github here : github.com/F5OEO/rpitx/blob/master/src/pifmrds/README.md
there is an info how to use this tool to replay peeviously recorded WAV audio file with FM or AM modulation
sudo ./pi_fm_rds -audio sound.wav
And here you have the tutorial to replay any of WAV signal with RPITX
www.rtl-sdr.com/tutorial-replay-attacks-with-an-rtl-sdr-raspberry-pi-and-rpitx/
@@justanengineer5599 Great, thank you very much :)
Can use this in ss7 protocol sms sniffing?
RTLSDR is used to sniff GSM
Hi everyone,
I would like to be able to receive the signal from a controller with an HCS301 (MICROCHIP KeeLoq) in the transmitter and with a PICxxx or an ATMELxxx in the receiver.
There is a library for ARDUINO about receiving
il faut mettre quoi sur le gpio 4 un bout de metal ?
vous devez connecter un fil de 17 cm au GPIO numéro 4
www.raspberrypi.org/documentation/usage/gpio/
@@justanengineer5599 wtf pourquoi 17, si c'est 15 cm ça fonctionne pas ?
Use 'whip antenna calculator' to determine antenna length
www.csgnetwork.com/antennagenericfreqlencalc.html
Klucze samochodowe przypadkiem nie wysyłają zmiennego kodu ? Walizka służy do wzmacniania sygnału. Sam zamówiłem Hackrf bo strasznie ciekawi mnie temat jak te "walizki" działają.
Owszem klucze maja zmienny kod ale czesto sie powtarza w tym samym kluczyku. Jesli maja zas kod generowany algorytmem (hash) to wtedy stosowany jest tzw car relay attack. Czyli zagluszanie, łapanie sygnału oryginalnego klucza i odtwarzanie w niedługim okresie czasu. System ma tolerancje +/- kilka kodów wstecz lub do przodu. Wiadomo że w rzeczywistych warunkach nie każdy sygnał dotrze więc musi być tolerancja
@@justanengineer5599 A jest możliwość zagłuszania sygnału i w tym samym czasie przechwycenia ?
Oczywiscie ze tak ale musza to robic 2 osoby w danym momencie czasu. Osoba 1 siedzi z zagłuszczem obok pojjazdu , zaś osoba 2 podąża za osobą z kluczykami
@@justanengineer5599 Przy samochodach z bezkluczykowym dostępem sygnał wyzwala się przez pociągniecie klamki to jeśli w tym momencie będziemy zagłuszać sygnał nie wyjdzie ?
Jeśli jest tak jak mówiisz to wystarczy zagłuszyć sygnał kluczyka przy samym samochodzie a nagrać go w miejscu gdzie jest kluczyk.
Is there any method to get automatically record any 433mhz Freq
You simply put 433MHz frequency and it will record anything until you press stop button. But then you would need to post process the file to extract necesary fragments
@@justanengineer5599 plz give some details abt gpio pin used for attaching antenna..also specify the wire thikness used for antenna
Wire diameter should be at least 1mm, length 15cm. GPIO port #4 is used to attach this wire to raspberry
Wszystko spoko ale co jeśli kod pilota zmienia się za każdym razem?
Zazwyczaj ma jakis zestaw kodów w sekwencji en.m.wikipedia.org/wiki/Rolling_code Wystarczy zrobić reverse engineering i odtworzyć w odpowiedniej kolejności, najlepiej na arduino. Sprawdz mój inny film gdzie pokazuję jak to robić przy pomocy Universal Radio Hacker z przystawką RTLSDR na USB i kawałka programu na arduino z nadajnikiem FS1000A : ruclips.net/video/jziWQA8Wvp4/видео.html
Hey, I already have a second device and everything works great during recording and playback but when I select the transponder option by typing on the first device A () then B and on the second device in the reverse order, i.e. B and then A. But unfortunately then it does not work.
I will only add that I am testing it on the remote control, which I have to press myself, because my car with the keyless function, on which I have tested so far, has been in an accident :(
maybe it has a rolling code and the code changes every time you press it? For the transponder option you need different frequenncies between A and B device. But the final frequency on B has to be the same as on the keyfob. I must admit that I havent tested transponder option yet because I do not have 2 raspberry boxes
@@justanengineer5599 Yes, there is Rolling code for sure, because the signal I record can only be used once, but I think the problem lies elsewhere. So far, I have set the same frequency between devices, and the initial one on device a and the final one on device b, such as the signal from the remote control
@@justanengineer5599 I set it like this Device A. (Key)>(380.000000) Device B (380.00000)>(key)
in general it should work with such setting, but the problem may be with the communication between raspberries, maybe it is too far or this intermediate frequency is used by other devices and noisy
Siemka, No dobra ale idzie zrobić żeby jeden odbierał sygnał wzmacniał go i automatycznie przesyłał do drugiego a drugi go nadawał wzmocniony?
Oczywiscie - wystarczy ze zrobisz funkcje 'transponder' i masz 2 raspberrypi + 2 dongle sdr. To proste jak budowa cepa. Pierwszy raspberry odbiera klucz na czestotliwosci A i przekazuje go na czestotliwosci B. Drugi Raspberry odbiera ten sygnał na czestotliwosci B i ponownie nadaje go na czestotliwosci A. Oczywiscie to robi juz blizej odbiornika sygnału klucza. Proste co?
@@justanengineer5599 dla takiego mistrza jak ty to tak haha:)
@@justanengineer5599 czyli sygnał A łapie raspberry które jest bliżej klucza - jeśli dobrze zrozumiałem
Dokładnie tak, dobrze zrozumiałeś. Jeśli dodasz jeszcze raspberry nr 3 i częstotliwość C to mozesz dodatkowo przedłużać zasięg
@@justanengineer5599 a można zastosować inne anteny lub jakieś mocniejsze?
Can you please make full tutorial?
Which part you are interested in? RPITX installation on Raspberry?
@@justanengineer5599 on the whole thing actually
That would include installation of Raspbian Linux on Raspberry Pi. I'll see what I can do
Here is complete tutorial for You : ruclips.net/video/hoSlkv-9a2I/видео.html
Enjoy ! :-)
suggest me a software that does this and is compatible to other OS
Currently there is no such software for other OSes. Only appliances are available - search for YardstickOne and HackRF. The RPITX is poorman's HackRF version
@@justanengineer5599 ty
Work on kali linux?
Will work only on Raspberry Pi linux / Raspbian. It is connected to raspberry hardware
It works for keyless go ( passive keyless entry?
Yes, it can receive wireless key signal that is generated when someone pulls the car doors handle. But keep in mind that the code of wireless key is constantly changing so this door opening signal could be used only one time. Also you would need to jamm it first so the signal from the wireless key in someone;s pocket couldn't reach car receiving module (but could reach Raspberry and record it with RPITX).
@@justanengineer5599 so If the pi is close to the target pocket , it will capture signal as the keyless is continuely sending signal
@@justanengineer5599 can I use pi 4 ?
That is correct
There is only beta version of RPITX for Raspberry 4 so I am not sure if it's fully working. I have used RPI 3B
POLSKA
Tylko po co po angielsku?
Dorobię tłumaczenie w wolnej chwili
@@justanengineer5599 polska
Get a evil crow rf for under $40 and do all this.
that is correct. Evil crow is upgraded YardstickOne and can do all of this.
Rób filmy po POLSKU..........
wystarczy polskie napisy włączyć. dorobiłem napisy pod każdym filmem
@@justanengineer5599 Czy twój sygnał może odbierać za pomocą rtl-sdr, ale bez metalowej anteny, czy nie, ponieważ jeszcze go nie otrzymałem i jest to niezbędne, czy po prostu pomaga lepiej uchwycić transfer?
You have WhatsApp
You can find me on LinkedIn
I would like to chat with you in private, how can I contact you?
If you have questions regarding RPITX and Raspberry PI please watch my video tutorial ruclips.net/video/hoSlkv-9a2I/видео.html You will find there all clarifications. Just buy Raspberry, RTLSDR USB dongle and proceed with instructions from this second video
@@justanengineer5599 Can I change the GPIO pin for the antenna ? Because I use a touchscreen which is already connected to GPIO4 pin of Raspberry Pi
You would have to consult this with an author of the RPITX. There is some answer to your question here github.com/F5OEO/rpitx/issues/62 it is possible to use other pin 32 - GPIO 12
@@justanengineer5599 Thank you
Hey nice job … is there a way i can contact you in private
mail is on my github in the source code and in the channel description after clicking contact button
Hi Adam, thanks a lot for your effort and great work, I am new to this but very much like , I followed your steps but when it comes to use command $ ./easytest.sh to transmit the received frequency got a blank screen and have to start raspberry pi4 again, not sure how to ensure that raspberry pi receives the 433.028 Mhz and what stopping sending it - thanks a lot
Hello, there is only beta version of RPITX for Raspberry Pi 4. You have to check on github. It may reside in some separated repository that works only on Raspberry Pi 4
www.rtl-sdr.com/rpitx-beta-for-raspberry-pi-4-released/