SubGhz: Сreating and delivering Security+ 2.0

[Skorpionm]

What's new

• SubGhz: Сreating and delivering Security+ 2.0
• SubGhz: fix message error
• Unit_test: add Security+ 2.0 encoder

Verification

• Сompile and download, create a new remote control with the Security+ 2.0 protocol and test the emulation by linking it to the garage door operator

Checklist (For Reviewer)

• PR has description of feature/bug or link to Confluence/Jira task
• Description contains actions to verify feature/bugfix
• I've built this code, uploaded it to the device and verified feature/bugfix

[github-actions]

Click here for the DFU file to flash the 465f64ae version of this branch with the Install from file option in qFlipper.

[drewbaumann]

@Skorpionm I used make to produce the latest firmware with the Security+ 1 & 2 emulation features. I am just curious what the extent of this ticket is.

In the verification step you stated,

Сompile and download, create a new remote control with the Security+ 2.0 protocol and test the emulation by linking it to the garage door operator

I did just that and was able to create a new remote through the "Add Manually" option and linked it to my garage door in both 315 and 390. However, I was unable to send commands to open the garage after the pairing process. Is the intention of this PR simply to link, or also to transmit the commands to open/close?

[neoxfx]

I tried to add flipper as a remote to a lift master garage, I see a note in garage unit that says supports sec 2.0. So here is what I did to program but still doesn’t work any idea?

1. in flipper, subghz, add manually -> select sec 2.0 (added 310, 315 and one for 390)
2. climbed ladder to garage unit, press yellow learn button, led next to it glows indicating it’s ready to add remote
3. in flipper, tried to emulate and hold all three 310, 315, & 390 separately. And each time garage unit did flash light indicating it learnt remote.

With above done, now I tried to emulate each hoping at least one will work, but still garage door won’t open at all on all three sec 2.0 frequencies

Any idea, what am i missing ?

[evilpete]

nice..

if you have any questions about rtl_433's secplus_v1.c or secplus_v2.c code just ask.

I did the rtl_433 port in C using Clayton Smith secplus python code as a reference.

[drewbaumann]

nice..

if you have any questions about rtl_433's secplus_v1.c or secplus_v2.c code just ask.

I did the rtl_433 port in C using Clayton Smith secplus python code as a reference.

Is this a suggestion to reference your code for a fix or an alternative implementation suggestion?

[evilpete]

nice..
if you have any questions about rtl_433's secplus_v1.c or secplus_v2.c code just ask.
I did the rtl_433 port in C using Clayton Smith secplus python code as a reference.

Is this a suggestion to reference your code for a fix or an alternative implementation suggestion?

just offering to help, I noted that the flipper code referenced rtl_433's and Clayton Smith secplus is the comments and I figured it would be polite speak up and offer assistance if / when it was needed.

[drewbaumann]

nice..

if you have any questions about rtl_433's secplus_v1.c or secplus_v2.c code just ask.

I did the rtl_433 port in C using Clayton Smith secplus python code as a reference.

Is this a suggestion to reference your code for a fix or an alternative implementation suggestion?

just offering to help, I noted that the flipper code referenced rtl_433's and Clayton Smith secplus is the comments and I figured it would be polite speak up and offer assistance if / when it was needed.

That's awesome. It sounds like you are uniquely qualified to help! It's been over a decade since I've touched C so I'm not a ton of help.

[evilpete]

Is this a suggestion to reference your code for a fix or an alternative implementation suggestion?

just offering to help, I noted that the flipper code referenced rtl_433's and Clayton Smith secplus is the comments and I figured it would be polite speak up and offer assistance if / when it was needed.

That's awesome. It sounds like you are uniquely qualified to help! It's been over a decade since I've touched C so I'm not a ton of help.

the only suggestion I would add it having a way to add or edit of the Rolling Code (aka Cnt) field in the 'Add Manually' option to make it a bit more useful.

[Side note: If interested, I can look it I can add the insteon home automation protocol ]

[drewbaumann]

Is this a suggestion to reference your code for a fix or an alternative implementation suggestion?

just offering to help, I noted that the flipper code referenced rtl_433's and Clayton Smith secplus is the comments and I figured it would be polite speak up and offer assistance if / when it was needed.

That's awesome. It sounds like you are uniquely qualified to help! It's been over a decade since I've touched C so I'm not a ton of help.

the only suggestion I would add it having a way to add or edit of the Rolling Code (aka Cnt) field in the 'Add Manually' option to make it a bit more useful.

[Side note: If interested, I can look it I can add the insteon home automation protocol ]

Ah. Well it seems like something is sadly broken, or not clear to the user regarding this feature. Once it works I think those are interesting suggestions for sure.

[skotopes]

We don't have test equipment for this protocol.
If you have this system and know what's wrong with current implementation then please open new issue.

[drewbaumann]

We don't have test equipment for this protocol. If you have this system and know what's wrong with current implementation then please open new issue.

Thanks for touching base! This is good to know. Given that info it sounds like maybe @evilpete might have some thoughts.

[Skorpionm]

I have such an assumption that it is possible for a garage door to hear all 3 frequencies. although people wrote that everything works. I propose to check as an option or install the firmware with security + 2 saving enabled, or write down the data of your key fob on a piece of paper and correct it in the file created by adding manually. i.e. clone your remote, and try to open it with a flipper, if it works, then I am not generating the remote data correctly, if not, then it will be necessary to transmit on all 3 frequencies

[drewbaumann]

@Skorpionm I read your response and tried my best to follow the instructions. I apologize if I missed something.

I propose to check as an option or install the firmware with security + 2 saving enabled, or write down the data of your key fob on a piece of paper and correct it in the file created by adding manually. i.e. clone your remote, and try to open it with a flipper, if it works, then I am not generating the remote data correctly

So I took an unused remote and paired it to the Sec+ 2 garage opener. I then confirmed that the remote worked as intended. After, I read the signal at 390 from the Flipper Zero with sec+ 2 saving enabled. I have tested the saved signal and it was opening and closing the garage door correctly.

[Skorpionm]

Raw?

[drewbaumann]

Raw?

@Skorpionm no. I read it by clicking "read" and tuning to 390. It read it as a sec+ 2 signal and I saved it. When I emulated it afterwards it worked repeatedly.

[Skorpionm]

so this means that the algorithm is correct, something is wrong when generating a new remote control. I then need you to record different (preferably at least a couple of new ones) remotes and all its buttons. You can RAW, you can save data from the screen. to analyze the generation of the console, I beg you to throw the files on the forum, the more of them the topics will be easier

[drewbaumann]

so this means that the algorithm is correct, something is wrong when generating a new remote control. I then need you to record different (preferably at least a couple of new ones) remotes and all its buttons. You can RAW, you can save data from the screen. to analyze the generation of the console, I beg you to throw the files on the forum, the more of them the topics will be easier

Do I need my garage door to learn the code or are you okay with me just hitting the buttons on a spare remote that isn't paired?

[drewbaumann]

@Skorpionm https://forum.flipperzero.one/t/lift-master-security-2/3503/4

[lanrat]

Is there a way to change the button that the secplus2 remote uses when manually creating a new remote?

I think some garages will only accept certain values for the button, and the default 0x68 does not seem to work.
I verified with a few of my other garage door openers and they all seem to use 0x80, 0x81, or 0xE2.

[lanrat]

It seems it can be as simple as allowing the button value to be changed here: https://github.com/flipperdevices/flipperzero-firmware/blob/dev/applications/main/subghz/scenes/subghz_scene_set_type.c#L330

[mumixam]

I think some garages will only accept certain values for the button, and the default 0x68 does not seem to work. I verified with a few of my other garage door openers and they all seem to use 0x80, 0x81, or 0xE2.

I've been playing with this some and i think this is incorrect. I believe the reason 'Add Manually' is unable to pair to the opener is because of the serial number.

I have done the following. Clone a Liftmaster Sec2+ remote via flipper. Go to a location miles away from my opener and pair the .sub stored on the flipper to a new Sec2+ opener that the original remote was never paired to. The result is the newly paired opener works fine and opens and closes the door via the flipper

I have also changed the key in https://github.com/flipperdevices/flipperzero-firmware/blob/dev/applications/main/subghz/scenes/subghz_scene_set_type.c#L329 to my Liftmaster remotes serial number (in hex) and this allows me to use "Add Manually" and pair to openers that have never been paired to my remote.

Also worth noting I have 2 liftmaster sec2+ remotes and both of them have serial numbers that start with 0x6 so im starting to think using a random 32bit int for the serial number is the issue.

One uses 315mhz (opener build year 2020)
One uses 390mhz (opener build year 2016) actually branded Chamberlain
NOTE: info above seems pointless. appears these remote/transmitters tx on both 315 and 390 at the same time

Will test some more and report back.

If anyone still watching this thread wants to post the SN# of their liftmaster/chamberlain sec2+ remotes please do (or atleast the 1st few digits)

UPDATE @ 2023-04-09T14:42:26Z :
i tried using the 1st 3 hex digits of my "legit" SN (0x668) followed by random hex digits and the pairing process failed in the same manner as "Add Manually" does (light blinks on opener but fails to open and/or close the door)

UPDATE @ 2023-04-09T15:06:35Z :
i tried taking my "legit" SN and increasing the hex value by 1 and it fails to properly pair with the opener

UPDATE @ 2023-04-09T22:36:13Z :
Ok i managed to collect the SN's from 2 other remotes so I'm at 4 in total
when the hex is converted to INT all 4 start with '1' and end with a even number

UPDATE @ 2023-04-09T22:52:23Z :
Ok in very limited testing I hard coded the SN in my flippers firmware to 0x668B1040
this is 1720389696 when expressed as a INT and this paired flawlessly with my opener
So for right now I'm assuming the SN has to start when 1 and end with a even number as a INT
^^ incorrect. 1784938418 fails to pair

UPDATE @ 2023-04-011T00:15:45Z :
was able to grab a SN from a homelink transmitter. it is a even number but it starts with a 2

UPDATE @ 2023-04-012T00:50:42Z :
was able to capture 6 SN's today. nothing new learned.
all 6 started with 1 and ended with a even number when SN is viewed as a INT

[Skorpionm]

I had only 2 records of remotes at my disposal, if we collect statistics from at least 50 (their serial numbers) it will be possible to see if there is any pattern in them

[lanrat]

@mumixam Thanks for investigating and interesting work!

With the 6 Liftmaster doors I tested, I was able to keep the default random SN and changing the button to match any existing button code from a real remote worked for me.

Maybe there is some relation between the SN and BTN that needs to match up?

[mumixam]

@lanrat I don't believe that to be the case. I have 4 legit and 1 made up SN's and they all work with 0x68 button.
NOTE: the captured data from the transmitters none of the buttons are captured as 0x68.

0xD0
0xDA
0xD8
0xC2 (homelink)
are what my remote/transmitters seem to be

what is the value of your button press? If you take your actual SN and convert it to a INT is it even? does it start with 1 or 2?

[lanrat]

I just tested all of the remotes I have saved.

Most of their SNs, converted from HEX->base10, start with a 1. I had one that starts with a 2 and one that starts with a 3. All work.

[mumixam]

Just wanted to update this thread. 9d6352e seems to have fixed the pairing issue. I've only tested on 2 openers but its worked 1st try on both. I'll try to test on more and update my comment

EDIT: update
I've found a few openers that refuse to pair when using add manually but if i use the serial number from a legit liftmaster transmitter it pairs fine (this is not the transmitter serial # that came with the opener)

EDIT2: So i figured out how to pair with the opener mentioned in the above edit. The opener is question is a Liftmaster 84505R. Steps to program/pair. Press learn button. Wait for Beep. Wait a few seconds Press learn again then Send the code from the flipper. No idea why but you have to press the learn button twice on this unit (only when using the flipper as a remote). I cloned a legit liftmaster transmitter and paired it with the 84505R and it pairs successfully with only 1 learn button press using F0.