10 ms·

Reversing a 2.4GHz Remote Control

159 points by ggerganov 4y ago

dijit 4y ago
This is very very cool. The only problem I have is that the author knows his stuff so well that he falls short of explaining in enough detail. But maybe that’s an excercise left to the reader.
- _Microft 4y ago
  Maybe they expected a different audience. There is no need to be overly verbose if your audience is knowledgable enough to deal with concise descriptions.
- walls 4y ago
  This blog seems to start after the hard part. A friend of mine was trying something like this recently and couldn't figure out how to isolate the signal from all the noise around him. I was hoping this would explain even a little bit, but unfortunately not.
adamdoran 4y ago
Really interesting. What sort of hardware would be needed to use this?
- _Microft 4y ago
  I know little about this but I think the device is called HackRF and costs about $350. It can act as a receiver and sender. If you want to tinker with radio stuff for less money, you could start with a receiver only and try RTL-SDR. RTL-SDR is software-defined radio (=SDR) based on a particular RealTek (=RTL) chip. Suitable devices are as cheap as the right DVB-T USB receiver (check the list in the reddit-wiki for what might work and what might not) but there are more optimized devices for approximately $40 (un)available (because supply chain) - have a look at the rtl-sdr shop for those. https://www.rtl-sdr.com/ https://www.rtl-sdr.com/ https://www.reddit.com/r/RTLSDR/ https://www.reddit.com/r/RTLSDR/
  - adamdoran 4y ago
    Thanks, that's really useful. I had always wondered about the possibility of doing something like this with my children's various RF-controlled toys.
    - _Microft 4y ago
      You might like these two posts: "Hacking My Ceiling Fan's Wireless Remote with a USB TV Tuner", https://www.riveducha.com/decode-wireless-signal-with-usb-tv-tuner https://www.riveducha.com/decode-wireless-signal-with-usb-tv... "Abusing RPi GPIO pins as a radio controller", https://www.riveducha.com/raspberry-pi-gpio-send-radio-signals https://www.riveducha.com/raspberry-pi-gpio-send-radio-signa... Have fun and if dad modding their toys gets your kids interested in hacking/tinkering then all the better.
ge96 4y ago
Funny you steal your kid's toy That's impressive reduce it to some lines of code wow
- mobilemidget 4y ago
  He stole the toy perhaps :) But it was a good idea to give to me to give my girl her first proper RC car. (got her a paw patrol RC car before, but sigh could only go straight or circle left backwards at the same time, and not easy to hack to make it behave like a normal RC car)
looperhacks 4y ago
I always wanted to try and reverse engineer the wireless communication of my wife's insulin pump (it can communicate with a glucose meter to show the current glucose level and receive a bolus). But between me not having the know-how and any hacking being potentially threatening her health, I never got around to do it. But it would be nice to send a bolus, because the newer smartphone app can't do that via bluetooth.
- Garvey 4y ago
  No idea of the costs, so forgive me if it's not reasonable, but couldn't you get a second device to experiment with? Perhaps secondhand?
  - looperhacks 4y ago
    These are generally not available to just buy. You need a prescription, and even if I could buy it myself, the price is in the upper four figures, probably more like five figures if I'd buy all necessary equipment
- omh 4y ago
  I suspect you're aware, but there is a significant community effort on communicating with various insulin pumps. The old Medtronic pumps were hacked years ago and Medtronic responded by making it impossible with newer pumps. By now there are at least 3 different apps on different platforms and they support a variety of pumps.
  - looperhacks 4y ago
    I am aware, but my wife has the current model which is sadly incompatible with all community efforts I know of
    - omh 4y ago
      I also have an unhackable pump, unfortunately. I know there were attempts on the later Medtronic pumps by some pretty smart people so it looks unlikely that they'll ever be able to be controller openly. My next pump will definitely be one that allows remote control and some sort of looping. Whether that's officially from the manufacturer or not.
quanto 4y ago
Decades ago, I did something similar but far cheaper. I hooked up a toy tank's remote to RS232 and started bit-banging through RS232. The bits correspond to the voltage of the RS232 pins, which in turn activates the toy tank's remote's buttons. The toy tank is now completely programmable through the PC. The OP's toy does not have any state so it is quite easy to reverse engineer. All you need is a simple map from a desired action to electromagnetic signal. I am thinking of reverse engineering the protocol between my customizeable mechanical keyboard and its PC software. As the mechanical keyboard has an internal state, it is much more difficult to reverse engineer.
mittermayr 4y ago
RTL SDRs are such a great way to get into this (less than $20 on Amazon). I was shocked to see how easy the garage door opened once I'd captured a packet with the RTL SDR (on 433 Mhz) and then replayed it through the Rasperry Pi bit-banging FM hack with a tiny wire on a pin. I looked at the code and converted it to 0s and 1s, only to find out that it was always the same and also that the middle part matched the 8-bit hard-coded on/off switch every garage tends to have to adjust your coding (so your neighbour doesn't open yours). I then realised it would only take about 256 attempts to open just about any garage door in my neighbourhood (most are bought from one or two vendors). All it takes is a Raspberry PI, a USB power-bank and a script that runs in a loop. Amazing. Shocking also. But fascinating.
- op00to 4y ago
  My garage door opener uses a “rolling code” to prevent these sorts of playback attacks. I would assume they’re pretty commonplace nowadays? I remember reading a text file back in the early 90s downloaded from a bbs that had plans for a master garage door opener. Seemed like magic.
  - tyingq 4y ago
    > My garage door opener uses a “rolling code” to prevent these sorts of playback attacks. I would assume they’re pretty commonplace nowadays? Samy Kamkar's Rolljam supposedly does well against those, though the owner's fob quits working, so it's not stealthy. https://archive.ph/lHHnQ https://archive.ph/lHHnQ
  - garaetjjte 4y ago
    Vulnerabilities happened in rolling code systems too, see for example https://www.iacr.org/archive/crypto2008/51570204/51570204.pdf https://www.iacr.org/archive/crypto2008/51570204/51570204.pd... (they were able to read manufacturer key and then clone any transmitter just by eavesdropping) or https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_garcia.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
- jcrawfordor 4y ago
camtarn 4y ago
Really surprising that the communication is two-way, and sends signals with such a high bit rate. I wonder why this would be so? It's not like there's any closed-loop control going on, other than the loop formed by the user's eyes and fingers ;) I wonder if the comms ICs used in the car and controller were originally designed for some far more complex use case involving bi-directional signalling, or status feedback?
CraigJPerry 4y ago
Really enjoyed reading this. When i first stumbled across https://github.com/jopohl/urh https://github.com/jopohl/urh (universal radio hacker) i couldn’t believe my luck. I’ve done stuff like this manually before (as in just collecting all the bits and then trying to ascribe meaning, e.g. https://github.com/cleanflight/cleanflight/issues/1125#issuecomment-173776093 https://github.com/cleanflight/cleanflight/issues/1125#issue... ) but i used URH to reverse my bbq temperature sensors. I have an alexa skill that shows the last 20 readings for both probes on a graph. It is stupidly over-the-top (a Pi with a cheap sdr dongle listens for packets from the bbq down the garden, it parses out the measurements and fires them into a dynamodb which is absurd but it was quick to do, then the Alexa skill just pulls from there and sends to a chart api that draws my line graphs to show on alex’s screen - totally absurd) but great fun to do.
raldi 4y ago
Maybe the two-way communication is used when there are two remotes and two cars — perhaps in that case they each pair with different codes.

159 points by ggerganov 4y ago

This is very very cool. The only problem I have is that the author knows his stuff so well that he falls short of explaining in enough detail. But maybe that’s an excercise left to the reader.

_Microft 4y ago
Maybe they expected a different audience. There is no need to be overly verbose if your audience is knowledgable enough to deal with concise descriptions.
walls 4y ago
This blog seems to start after the hard part. A friend of mine was trying something like this recently and couldn't figure out how to isolate the signal from all the noise around him. I was hoping this would explain even a little bit, but unfortunately not.

adamdoran 4y ago

Really interesting. What sort of hardware would be needed to use this?

_Microft 4y ago
I know little about this but I think the device is called HackRF and costs about $350. It can act as a receiver and sender. If you want to tinker with radio stuff for less money, you could start with a receiver only and try RTL-SDR. RTL-SDR is software-defined radio (=SDR) based on a particular RealTek (=RTL) chip. Suitable devices are as cheap as the right DVB-T USB receiver (check the list in the reddit-wiki for what might work and what might not) but there are more optimized devices for approximately $40 (un)available (because supply chain) - have a look at the rtl-sdr shop for those. https://www.rtl-sdr.com/ https://www.rtl-sdr.com/ https://www.reddit.com/r/RTLSDR/ https://www.reddit.com/r/RTLSDR/
- adamdoran 4y ago
  Thanks, that's really useful. I had always wondered about the possibility of doing something like this with my children's various RF-controlled toys.
  - _Microft 4y ago
    You might like these two posts: "Hacking My Ceiling Fan's Wireless Remote with a USB TV Tuner", https://www.riveducha.com/decode-wireless-signal-with-usb-tv-tuner https://www.riveducha.com/decode-wireless-signal-with-usb-tv... "Abusing RPi GPIO pins as a radio controller", https://www.riveducha.com/raspberry-pi-gpio-send-radio-signals https://www.riveducha.com/raspberry-pi-gpio-send-radio-signa... Have fun and if dad modding their toys gets your kids interested in hacking/tinkering then all the better.

ge96 4y ago

Funny you steal your kid's toy That's impressive reduce it to some lines of code wow

mobilemidget 4y ago
He stole the toy perhaps :) But it was a good idea to give to me to give my girl her first proper RC car. (got her a paw patrol RC car before, but sigh could only go straight or circle left backwards at the same time, and not easy to hack to make it behave like a normal RC car)

looperhacks 4y ago

I always wanted to try and reverse engineer the wireless communication of my wife's insulin pump (it can communicate with a glucose meter to show the current glucose level and receive a bolus). But between me not having the know-how and any hacking being potentially threatening her health, I never got around to do it. But it would be nice to send a bolus, because the newer smartphone app can't do that via bluetooth.

Garvey 4y ago
No idea of the costs, so forgive me if it's not reasonable, but couldn't you get a second device to experiment with? Perhaps secondhand?
- looperhacks 4y ago
  These are generally not available to just buy. You need a prescription, and even if I could buy it myself, the price is in the upper four figures, probably more like five figures if I'd buy all necessary equipment
omh 4y ago
I suspect you're aware, but there is a significant community effort on communicating with various insulin pumps. The old Medtronic pumps were hacked years ago and Medtronic responded by making it impossible with newer pumps. By now there are at least 3 different apps on different platforms and they support a variety of pumps.
- looperhacks 4y ago
  I am aware, but my wife has the current model which is sadly incompatible with all community efforts I know of
  - omh 4y ago
    I also have an unhackable pump, unfortunately. I know there were attempts on the later Medtronic pumps by some pretty smart people so it looks unlikely that they'll ever be able to be controller openly. My next pump will definitely be one that allows remote control and some sort of looping. Whether that's officially from the manufacturer or not.

quanto 4y ago

Decades ago, I did something similar but far cheaper. I hooked up a toy tank's remote to RS232 and started bit-banging through RS232. The bits correspond to the voltage of the RS232 pins, which in turn activates the toy tank's remote's buttons. The toy tank is now completely programmable through the PC. The OP's toy does not have any state so it is quite easy to reverse engineer. All you need is a simple map from a desired action to electromagnetic signal. I am thinking of reverse engineering the protocol between my customizeable mechanical keyboard and its PC software. As the mechanical keyboard has an internal state, it is much more difficult to reverse engineer.

mittermayr 4y ago

RTL SDRs are such a great way to get into this (less than $20 on Amazon). I was shocked to see how easy the garage door opened once I'd captured a packet with the RTL SDR (on 433 Mhz) and then replayed it through the Rasperry Pi bit-banging FM hack with a tiny wire on a pin. I looked at the code and converted it to 0s and 1s, only to find out that it was always the same and also that the middle part matched the 8-bit hard-coded on/off switch every garage tends to have to adjust your coding (so your neighbour doesn't open yours). I then realised it would only take about 256 attempts to open just about any garage door in my neighbourhood (most are bought from one or two vendors). All it takes is a Raspberry PI, a USB power-bank and a script that runs in a loop. Amazing. Shocking also. But fascinating.

op00to 4y ago
My garage door opener uses a “rolling code” to prevent these sorts of playback attacks. I would assume they’re pretty commonplace nowadays? I remember reading a text file back in the early 90s downloaded from a bbs that had plans for a master garage door opener. Seemed like magic.
- tyingq 4y ago
  > My garage door opener uses a “rolling code” to prevent these sorts of playback attacks. I would assume they’re pretty commonplace nowadays? Samy Kamkar's Rolljam supposedly does well against those, though the owner's fob quits working, so it's not stealthy. https://archive.ph/lHHnQ https://archive.ph/lHHnQ
- garaetjjte 4y ago
  Vulnerabilities happened in rolling code systems too, see for example https://www.iacr.org/archive/crypto2008/51570204/51570204.pdf https://www.iacr.org/archive/crypto2008/51570204/51570204.pd... (they were able to read manufacturer key and then clone any transmitter just by eavesdropping) or https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_garcia.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
jcrawfordor 4y ago

camtarn 4y ago

Really surprising that the communication is two-way, and sends signals with such a high bit rate. I wonder why this would be so? It's not like there's any closed-loop control going on, other than the loop formed by the user's eyes and fingers ;) I wonder if the comms ICs used in the car and controller were originally designed for some far more complex use case involving bi-directional signalling, or status feedback?

CraigJPerry 4y ago

Really enjoyed reading this. When i first stumbled across https://github.com/jopohl/urh https://github.com/jopohl/urh (universal radio hacker) i couldn’t believe my luck. I’ve done stuff like this manually before (as in just collecting all the bits and then trying to ascribe meaning, e.g. https://github.com/cleanflight/cleanflight/issues/1125#issuecomment-173776093 https://github.com/cleanflight/cleanflight/issues/1125#issue... ) but i used URH to reverse my bbq temperature sensors. I have an alexa skill that shows the last 20 readings for both probes on a graph. It is stupidly over-the-top (a Pi with a cheap sdr dongle listens for packets from the bbq down the garden, it parses out the measurements and fires them into a dynamodb which is absurd but it was quick to do, then the Alexa skill just pulls from there and sends to a chart api that draws my line graphs to show on alex’s screen - totally absurd) but great fun to do.

raldi 4y ago

Maybe the two-way communication is used when there are two remotes and two cars — perhaps in that case they each pair with different codes.