Garage Door Hack

One field of communication and DSP that has always intrigued me is signal intelligence, the attempt to receive and decode an unknown signal. It’s an interesting puzzle that requires a wide variety of hardware, software, and analytical skills. I like to think that my research is, at least tangentially, a form of signal intelligence in that I’m attempting to use ultrasound signatures to determine what is happening inside the body. While receiving and interpreting ultrasound signals is interesting, I had a desire to look at more artificial, data bearing signals. I decided I would try to receive and decode the signal my garage door remote transmits to the base unit to open and close the door. In addition, I also wanted to create a device that would mimic my remote and be able to open the garage door on my command. This post will detail that attempt.

Remote Signal

The first task in this project required determining at what frequency my garage door remote operated. This was actually quite simple since the FCC ID# was easily visible. With a quick check of the FCC website, I was able to determine that the remote operated at 390 MHz. While not a super high frequency signal, it was beyond the bandwidth of my previous SDR. That SDR used an ADC with an integrated analog front end which limited its bandwidth to a few dozen MHz. So, partly driven by this project as well as a few other projects I am working on, I decided to design a new SDR with a wide bandwidth front end, and a high-resolution, high-speed ADC to allow for the reception of just these types of signals.

I plan to detail the design and construction of this new ADC board (along with a companion high-speed DAC board) in a later post. For now, I’ll just give a few of the critical details. In the image shown below, you can see the ADC on the left. This is a 14-Bit, 125 MSPS Analog Devices, AD9445 ADC with LVDS outputs. The low-jitter clock can be seen just below the ADC. To the right of the ADC is a Xilinx Spartan 3E chip. This is a big step down from the Virtex5 used in the previous post but given the costs associated with the Virtex5 (both the chip itself and the required PCB and assembly fees) I think it was well worth it. In addition, the Spartan3E can be programmed with the Xilinx ISE WebPACK without an additional license. As a student at the University of Minnesota, I currently have access to a full version of the ISE Design Suite, but at some point in the future I may not have this luxury so this was a big issue for me. Below the Spartan3E board there is the JTAG programming port, some LEDs, and a few inputs for clocks and triggers. Along the far right is the same USB module used in the 3D magnet localization project and allows me to quickly stream the data back to the computer.

Software Defined Radio SDR ADC Board

The analog front end on this board consists only of a single RF transformer. This allows the passage of signals with frequency content well into the hundreds of MHz. I’m able to use the ADC in an under-sampling mode to still digitize these high frequency signals. For the purposes of this project, I created an IQ demodulator that looked at a ~250 KHz swath of bandwidth and streamed the complex baseband signal back to the computer. I hooked up a small whip antenna to collect the RF transmissions from the remote and then monitored at 15 MHz (the 390 MHz signal is in the 7th Nyquist zone of the ADC and, with aliasing, would appear at 15 MHz).

The plot below shows the envelope of the signal I received when I pressed the open/close button on the remote. The remote was positioned very close to the whip antenna to ensure reception.

Garage Door Remote Signal

I had been worried that perhaps the remote signal would have a very low SNR and make it difficult to decode, but that was not the case. The plot below focuses on the first burst of data.

Garage Door Remote Signal

It’s clear that the remote is using simply On-Off Keying to transmit 83 bits of data. In fact, while the open/close button is depressed, the remote continuously transmits two frames of data 83 bits long, separated by 100 ms. These two frames of data are labeled A and B in the first plot above. Closer inspection revealed that the bits are transmitted at an approximate data rate of 2000 bits per second.

To get an idea of how the codes change with each button press, I recorded a long data set where I repeatedly pressed the open/close button. The hexadecimal representation of those received codes is shown below with each row representing the full code received for that button press.

Consecutive Remote CodesA few things are immediately obvious when looking at the above codes. The first frame appears to only use the numbers 8, 9, and 11 for each nibble. The second frame appears to only use the 2, 6, and 14 for each nibble.  While the codes don’t appear to be completely random (e.g. the last byte of the first frame is always 128, and the first nibble of the second frame is always 14), to my eyes, there isn’t an easily discernible pattern in this small code sample. This makes sense since most modern garage door openers use a rolling code system that transmits a new random number with each button press. The main garage door unit and the remote are synchronized so the main unit knows which codes to expect. The main unit will not only look for the current code, but also the next hundred or so codes to ensure the remote and main unit do not fall out of alignment due to the remote being pressed while out of range.

I was happy with these results and the overall performance of the SDR in receiving and decoding the remote signal, however my final goal remained using these results to create a device capable of mimicking my remote and fooling the main unit into opening and closing. The garage system’s use of the rolling code made it impossible for me to predict codes into the future. I decided the best thing (only thing) I could do would be to take the remote out of range of the main unit and record the next dozen or so codes, creating a code library that I could then replay to the main unit to open and close the door. Before doing this, however, I needed to design a transmission module that could generate a OOK data stream with a 390 MHz carrier.

Transmission Module

The graphic below shows the board I ended up making to generate the needed RF signal. The signal generation starts with a voltage controlled oscillator (VCO) whose frequency can be tuned between approximately 350 MHz and 410 MHz (shown on the far left of the board with a potentiometer to control the frequency). The output of the VCO is fed to an RF switch whose output is connected to a whip antenna. The digital logic input of the RF switch is used to generate the on-off keying. In addition to the whip antenna output, I also included an SMA output to help with the debugging.

OOK Transmission ModuleThe first thing I needed to do with this board was set the potentiometer controlling the frequency to the right voltage to ensure the carrier is at 390 MHz. I used the debug output on the far right of the board to connect the VCO directly to my ADC board. I measured both the control voltage and the VCO frequency as recorded by the ADC to generate the plot shown below. This data was collected at the full sampling rate for a bandwidth of 62.5 MHz.

Voltage Controlled Oscillator VCO

This plot demonstrates the aliasing present in under-sampling. What was in reality a monotonic increase in frequency, appears to first decrease then increase. Since I know what is happening I can correct for this aliasing and generate the correct frequency vs. voltage plot, as shown below.

Voltage Controlled Oscillator VCO

We can see the VCO has an approximate 14 MHz/Volt sensitivity, meaning the potentiometer should be set to give a control voltage of about 3.5 volts.

One VCO related thing I found interesting was the sensitivity to temperature. I ran a quick experiment where I monitored the VCO frequency as I placed my finger on the case. The spectrogram below shows how quickly the frequency changes with just that small thermal influence.

Frequency Shift

The final step in the transmission module was generating the logic signal to control the RF switch. I felt the easiest method to create this signal would be with an FPGA. I essentially needed an SPI port which can handle a very large data word, the flexibility of an FPGA made this a breeze. The only issue I ran into was that the data rate of the remote is slightly slower than the 2k baud I initially thought. Upon closer inspection, the bit periods were about 504 us and the time between frames was more like 100.4 ms. With this small correction I was able to accurately mimic the pass band signal generated from the garage remote. The data below shows the remote data signal overlain with my synthesized signal as recorded by the SDR board.

Remote Code vs. FPGA Code

The above graphic shows the first frame with the remote signal in blue and the synthesized signal in red. Over the 40 ms they stay nicely aligned. The graphic below shows the second frame comparison.

Remote Code vs. FPGA Code

By the end of this frame there is a slight misalignment between the FPGA and the remote, but it does not appear to be significant.

So with all the components up and running and the library of codes built up, it was just a matter of connecting everything together in my garage and hoping for the best. I’ve posted a video of me testing out the system below. The FPGA is connected to the transmission module with a BNC cable. The red wire running off the transmission module is the whip antenna used to transmit the signal to the garage door opener above. The slide switches located along the right side of the FPGA control which code from the library is played out.

Thoughts on Garage Remote Security

Working through this project has caused me to reconsider how secure my garage is to potential intruders. There seem to be some very serious flaws with how the rolling codes are implemented. The rolling codes are meant to do two things; one, they should prevent someone from recording the transmitted signal and being able to replay that signal at will to open or close the garage door. Two, they should prevent someone from using a recorded code to predict future codes. I don’t know enough about the algorithms used to create the rolling codes to have an opinion on the latter issue, but from this brief look at how the remote behaves there appear to be some serious flaws with the former.

The original garage remotes had a series of dip switches that could be toggled to create a unique ID number that would identify each remote to its base unit. This would allow neighbors to have the same make and model of garage door opener without interfering with each other. The downside to this implementation is that an intruder only needs to know your dip switch settings to craft a signal capable of opening your garage. If the intruder didn’t have physical access to the remote, he or she could just record the remote transmission and replay this to gain access. To counter this weakness, rolling codes were introduced. With rolling codes, by the time you record the transmission, the code is already out of date and useless. Or at least it should be…

Look at how this remote behaves when the open/close button is pressed. As long as the button is depressed, both code frames are transmitted continuously, resulting in multiple transmissions of the current code for even brief button presses. Now imagine you’re an intruder with the capability to record and transmit codes in real-time (a system that could easily be constructed for less than $300…) and you want to break into my garage. You could wait for me to come home and activate my garage door opener. The moment I press the button my remote begins transmitting the first frame of the current code (let’s call this code number 100). Now your device detects the transmission at the same moment my main unit does and you both begin decoding the frame. After 50 ms both your device and the main unit have decoded and stored the first frame of code 100, now instead of just passively waiting for the second frame, your device begins actively transmitting random bits. Your device continues this transmission for the next 100 ms thereby disrupting the ability of the main unit to receive the second code and open the garage door. If the remote only transmitted a code one time, this would be the end of the story, the intruder would have managed to record frame 1 of code 100 and disrupted the proper operation of the overall system, but the security of the garage hasn’t been compromised. The intruder would just be able to create a nuisance and force me to get out and manually activate my garage door. However, this isn’t the case.

After the intruder disrupts the second frame of code 100, the remote will retransmit the entire code. On the remote’s second transmission of code 100, the intruder could reverse what he did previously. He could disrupt frame 1 while recording frame 2. The intruder now has the entirety of code 100, but the main garage door unit has been prevented from receiving the correct code. The intruder can continue to transmit random bits as long as it detects the remote is actively transmitting code 100.

As the person pressing the remote button, all I would notice is that the garage door did not respond to my remote. This happens to me all the time so I would not think too much of it, I would simply press the remote button again. Pressing the remote again would cause the transmission of the next code, code 101. And here is where the intruder would be able to cover his tracks. The intruder’s system could go through the exact same steps as before, recording frame 1, then frame 2 of code 101. At the end of the transmissions, the intruder would have both codes 100 and 101 and the main unit would still be waiting for code 100. Instead of just staying silent after the transmission of code 101, the intruder could immediately play out code 100 causing the garage door to open. I would think nothing of this whole experience and continue on as if nothing happened. The problem is that now the intruder’s system knows code 101 and the main garage unit is expecting code 101.

I can’t say I’m going to lose any sleep over the prospect of someone spoofing my garage door opener, but I’m also not going to store something valuable in my garage and expect the rolling code security to protect it.

Moving forward, I would like to spend some time looking into the algorithms used to generate the rolling codes to see how secure they are and if they have any vulnerabilities. I would imagine that encryption for garage doors has its own set of unique constraints if only because of the long time the system will be in use. I think most people have the same garage door opener for many years, possibly decades. So even a brute force attack that took three years to search through all the possible keys would be too weak. Once you cracked the code, the opener would most likely still be in use and vulnerable.





Modelling a Spinning Fan

I came across a really interesting post yesterday about predicting when a spinning fan would come to rest. This post was very much inline with my previous Kalman filtering post (i.e. estimating and modelling a dynamic system) so I decided to give it a quick try. Instead of using the Kalman or Extended Kalman filter approach of the last post, I decided to use a least squares parameter fitting technique and try to fit a model to the data. I chose to look at two relatively simple models, one where the drag on the fan is proportional to the angular velocity and a second where the drag is proportional to the velocity squared.

In order to fit these models, I first needed to collect the tracking data. Dan provided a 30 second video of the fan spinning at what I believe is 60 frames a second. Such a long video kind of precludes manual tracking (I was not up for clicking on the screen 1500 times in a row), so I had to automate the process. As you can see in the still below, the fan blades have a few colored patches on them which help the tracking process. I chose to use the greenish colored patch closets to the light as the marker I would track.

The green marker is fixed to the blade which means the trajectory it traces through one fan revolution should maintain a constant distance from the center of the light. I used this fact to reduce the area of the image over which I tracked the object. The image below shows how I cropped the movie to help ease the tracking problem.

To actually track the green patch, I needed a way to identify green pixels and ignore non-green pixels. The normal RGB color space used in this video is not great for identifying colors. For instance, a pixel value of [0, 256, 0] is a pure green pixel, but a pixel value of [256, 256, 256] represents a pure white pixel even though the G value is identical in both pixels. A color space that allows for easier color extraction is the HSV (Hue-Saturation-Value) color space. In the HSV color space, the color (Hue) is more isolated from various lighting conditions, making color extraction more straightforward. The Hue component of the HSV representation of the above image is shown below.

The final step in identifying the green patch is determining which hue values to identify as green. This was really just a trial and error process, I tried to keep the range of Hue values as small as possible to eliminate false alarms, but large enough so that I never failed to identify the patch. In the end, I settled on using Hue values between 0.28 and 0.4 (values normalized to 1.0). The graphic below shows which pixels from the above images fall into this range.

For each green pixel, I calculated the angle about the center of the fan. Instead of taking the mean of these angles as the estimated angular displacement, I instead took the median. The rationale behind this, is that even though I tried to keep the Hue range small enough to minimize false positives, I was unable to completely eliminate them. These false positives could lead to inaccurate angular displacement estimates. If I used the mean value of the estimated angles, the false alarms would distort the estimate, by using the median angle I was able to (hopefully) exclude the one or two bad estimates. As you can see in the plot below, there do not appear to be any wildly erroneous angle estimates so the median filtering appears to have worked well.

For those that are interested, I’ve collected the displacement estimates into a text file available here.


The equations for the models I used are shown below. The first equation represents a linear ODE where the drag force is proportional to the angular velocity. C is a coefficient representing the drag, where a larger value indicates greater drag. The second equations represents a non-linear ODE where the drag is proportional to the square of the angular velocity. Here again, C represents the drag.

The one nice thing about the system we’re modeling is that it’s free of external inputs, that is, we are observing the free response of the system. We should be able to determine a closed form solution to the free response, determine the parameters of the solution which most closely match the observed data, and then project the data into the future to determine when the fan stops. The trickiest part of the problem is determining what qualifies as a stopped fan. The equations above will never reach an angular velocity of zero by themselves. As the fan slows to a stop, it will at some point, deviate from these models and grind to a halt. I chose to classify a rotational speed of 1 revolution every 4 seconds as the speed at which the fan will most likely stop. I projected the fan’s motion into the future until the speed dropped below this threshold and marked this time as the stopping time. As a quick check of the sensitivity of the final guess to this threshold, I also looked at what time the fan would stop if the threshold had been 1 rotation every 5 seconds. I really have no idea if these thresholds are realistic but they seem reasonable.

Linear Model

I used an ersatz solution shown below as the general form solution to the linear drag ODE. The displacement is modeled as a decaying exponential with an initial offset.

There are three unknown parameters which must be solved for to represent this equation. I used Matlab’s lsqcurvefit algorithm to help identify these parameters. This algorithm works by searching for the parameters which will minimizes the sum of the squared data and model displacement differences. This process yielded the following values for the coefficients.

These parameters, along with the equation above, allowed me to plot the simulated displacement along with the measured displacement. I was also able to extend the data beyond the final observation to see how the model evolved.

There is a nice alignment between the data and the model within the observation period. The displacement beyond the final observed point also seems well behaved. This model can also be used to look at the angular velocity of the fan by taking the temporal derivative of the solution above. Doing this gives the graph shown below. The horizontal green line corresponds to the fan rotating at 4 seconds per turn and the blue represents a speed of 5 seconds per turn.

Using the established thresholds results in the fan coming to a stop at 38 and 43 seconds respectively.

Velocity Squared Model

The second model is a little more difficult than the first since it is a non-linear ODE. Luckily, the form of this non-linear ODE is well known and falls under the class of Bernoulli equations. To see this a little clearer, we can look at the original ODE in terms of the velocity instead of the displacement, this yields the following equation.

The trick to solving Bernoulli ODEs is to use a variable substitution. The following shows this substitution which yields a linear ODE that can be solved very easily.

So the ODE is now solved for in terms of the substituted variable w, we just need to use the original relationship between phi and w to get the equation in terms of phi.

One thing to note is that this phi represents velocity, not angular displacement. We need an equation in displacement to enable the data fitting. The displacement equation can be found by integrating phi with respect to time. This results in the final equation which is a solution to the original non-linear ODE above.

So here again we have three parameters that must be solved for by some means. I used the same technique as before to estimate the following parameters.

Using these parameters allowed me to again carry the fan’s motion beyond the observed data as shown below.

Qualitatively, the projected motion of the fan seems similar to the linear case, though the displacement does not seem to slow down as quickly. I sued the same velocity threshold as before to estimate the stopping time, this plot is shown below.

In this case the stopping times were approximately 61 and 79 seconds respectively. So indeed, by this model, the fan does take longer to slow down.

The graphic below compares the fit of the two methods within the data observation window. It’s difficult to make out, but the measured data is shown in black with the modeled data overlaid in dot-dashed lines. Both methods appear to fit nicely and the sum of the residuals were nearly identical, so based on this data along it’s difficult to say which method is more accurate.


Since reading the original post on Dan’s site yesterday, several commenters have posted guesses in the 70 second range. I believe the full video of the fan rotating to a stop has also been posted but I haven’t had a chance to look at it yet. It would be interesting to see how the fan behaves immediately before it stops.

As for my guess of when the fan would grind to a halt? I would tend to believe the second model where drag is proportional to velocity squared and place my bet somewhere around 70 seconds. If you look at the the displacement plot for the linear drag case, the plot seems to level off too quickly after the final observation point. There is a relatively large deceleration that takes place between 25 and 60 seconds, but this is not driven by the data, it is driven by the model. To me this seems indicative of a the model being over-constrained during the observation period leading to unrealistic behavior as we try to extrapolate the state. Take a look at the following plot of the acceleration for both models.

The acceleration of the fan changes dramatically during the first 25 seconds in the case of the second model, but in the case of the first there is not nearly as large a change. By the time the observation period has ended, the acceleration in the second model has largely leveled off, the acceleration in the first model continues to change at essentially the same rate. I don’t think this observation by itself invalidates the first model, but I am much more tempted to believe a model where the large changes happen while observing the data than a model which predicts the changes to happen after the observation period.