Tag Archives: FPGA

Garage Door Hack

One field of communication and DSP that has always intrigued me is signal intelligence, the attempt to receive and decode an unknown signal. It’s an interesting puzzle that requires a wide variety of hardware, software, and analytical skills. I like to think that my research is, at least tangentially, a form of signal intelligence in that I’m attempting to use ultrasound signatures to determine what is happening inside the body. While receiving and interpreting ultrasound signals is interesting, I had a desire to look at more artificial, data bearing signals. I decided I would try to receive and decode the signal my garage door remote transmits to the base unit to open and close the door. In addition, I also wanted to create a device that would mimic my remote and be able to open the garage door on my command. This post will detail that attempt.

Remote Signal

The first task in this project required determining at what frequency my garage door remote operated. This was actually quite simple since the FCC ID# was easily visible. With a quick check of the FCC website, I was able to determine that the remote operated at 390 MHz. While not a super high frequency signal, it was beyond the bandwidth of my previous SDR. That SDR used an ADC with an integrated analog front end which limited its bandwidth to a few dozen MHz. So, partly driven by this project as well as a few other projects I am working on, I decided to design a new SDR with a wide bandwidth front end, and a high-resolution, high-speed ADC to allow for the reception of just these types of signals.

I plan to detail the design and construction of this new ADC board (along with a companion high-speed DAC board) in a later post. For now, I’ll just give a few of the critical details. In the image shown below, you can see the ADC on the left. This is a 14-Bit, 125 MSPS Analog Devices, AD9445 ADC with LVDS outputs. The low-jitter clock can be seen just below the ADC. To the right of the ADC is a Xilinx Spartan 3E chip. This is a big step down from the Virtex5 used in the previous post but given the costs associated with the Virtex5 (both the chip itself and the required PCB and assembly fees) I think it was well worth it. In addition, the Spartan3E can be programmed with the Xilinx ISE WebPACK without an additional license. As a student at the University of Minnesota, I currently have access to a full version of the ISE Design Suite, but at some point in the future I may not have this luxury so this was a big issue for me. Below the Spartan3E board there is the JTAG programming port, some LEDs, and a few inputs for clocks and triggers. Along the far right is the same USB module used in the 3D magnet localization project and allows me to quickly stream the data back to the computer.

Software Defined Radio SDR ADC Board

The analog front end on this board consists only of a single RF transformer. This allows the passage of signals with frequency content well into the hundreds of MHz. I’m able to use the ADC in an under-sampling mode to still digitize these high frequency signals. For the purposes of this project, I created an IQ demodulator that looked at a ~250 KHz swath of bandwidth and streamed the complex baseband signal back to the computer. I hooked up a small whip antenna to collect the RF transmissions from the remote and then monitored at 15 MHz (the 390 MHz signal is in the 7th Nyquist zone of the ADC and, with aliasing, would appear at 15 MHz).

The plot below shows the envelope of the signal I received when I pressed the open/close button on the remote. The remote was positioned very close to the whip antenna to ensure reception.

Garage Door Remote Signal

I had been worried that perhaps the remote signal would have a very low SNR and make it difficult to decode, but that was not the case. The plot below focuses on the first burst of data.

Garage Door Remote Signal

It’s clear that the remote is using simply On-Off Keying to transmit 83 bits of data. In fact, while the open/close button is depressed, the remote continuously transmits two frames of data 83 bits long, separated by 100 ms. These two frames of data are labeled A and B in the first plot above. Closer inspection revealed that the bits are transmitted at an approximate data rate of 2000 bits per second.

To get an idea of how the codes change with each button press, I recorded a long data set where I repeatedly pressed the open/close button. The hexadecimal representation of those received codes is shown below with each row representing the full code received for that button press.

Consecutive Remote CodesA few things are immediately obvious when looking at the above codes. The first frame appears to only use the numbers 8, 9, and 11 for each nibble. The second frame appears to only use the 2, 6, and 14 for each nibble.  While the codes don’t appear to be completely random (e.g. the last byte of the first frame is always 128, and the first nibble of the second frame is always 14), to my eyes, there isn’t an easily discernible pattern in this small code sample. This makes sense since most modern garage door openers use a rolling code system that transmits a new random number with each button press. The main garage door unit and the remote are synchronized so the main unit knows which codes to expect. The main unit will not only look for the current code, but also the next hundred or so codes to ensure the remote and main unit do not fall out of alignment due to the remote being pressed while out of range.

I was happy with these results and the overall performance of the SDR in receiving and decoding the remote signal, however my final goal remained using these results to create a device capable of mimicking my remote and fooling the main unit into opening and closing. The garage system’s use of the rolling code made it impossible for me to predict codes into the future. I decided the best thing (only thing) I could do would be to take the remote out of range of the main unit and record the next dozen or so codes, creating a code library that I could then replay to the main unit to open and close the door. Before doing this, however, I needed to design a transmission module that could generate a OOK data stream with a 390 MHz carrier.

Transmission Module

The graphic below shows the board I ended up making to generate the needed RF signal. The signal generation starts with a voltage controlled oscillator (VCO) whose frequency can be tuned between approximately 350 MHz and 410 MHz (shown on the far left of the board with a potentiometer to control the frequency). The output of the VCO is fed to an RF switch whose output is connected to a whip antenna. The digital logic input of the RF switch is used to generate the on-off keying. In addition to the whip antenna output, I also included an SMA output to help with the debugging.

OOK Transmission ModuleThe first thing I needed to do with this board was set the potentiometer controlling the frequency to the right voltage to ensure the carrier is at 390 MHz. I used the debug output on the far right of the board to connect the VCO directly to my ADC board. I measured both the control voltage and the VCO frequency as recorded by the ADC to generate the plot shown below. This data was collected at the full sampling rate for a bandwidth of 62.5 MHz.

Voltage Controlled Oscillator VCO

This plot demonstrates the aliasing present in under-sampling. What was in reality a monotonic increase in frequency, appears to first decrease then increase. Since I know what is happening I can correct for this aliasing and generate the correct frequency vs. voltage plot, as shown below.

Voltage Controlled Oscillator VCO

We can see the VCO has an approximate 14 MHz/Volt sensitivity, meaning the potentiometer should be set to give a control voltage of about 3.5 volts.

One VCO related thing I found interesting was the sensitivity to temperature. I ran a quick experiment where I monitored the VCO frequency as I placed my finger on the case. The spectrogram below shows how quickly the frequency changes with just that small thermal influence.

Frequency Shift

The final step in the transmission module was generating the logic signal to control the RF switch. I felt the easiest method to create this signal would be with an FPGA. I essentially needed an SPI port which can handle a very large data word, the flexibility of an FPGA made this a breeze. The only issue I ran into was that the data rate of the remote is slightly slower than the 2k baud I initially thought. Upon closer inspection, the bit periods were about 504 us and the time between frames was more like 100.4 ms. With this small correction I was able to accurately mimic the pass band signal generated from the garage remote. The data below shows the remote data signal overlain with my synthesized signal as recorded by the SDR board.

Remote Code vs. FPGA Code

The above graphic shows the first frame with the remote signal in blue and the synthesized signal in red. Over the 40 ms they stay nicely aligned. The graphic below shows the second frame comparison.

Remote Code vs. FPGA Code

By the end of this frame there is a slight misalignment between the FPGA and the remote, but it does not appear to be significant.

So with all the components up and running and the library of codes built up, it was just a matter of connecting everything together in my garage and hoping for the best. I’ve posted a video of me testing out the system below. The FPGA is connected to the transmission module with a BNC cable. The red wire running off the transmission module is the whip antenna used to transmit the signal to the garage door opener above. The slide switches located along the right side of the FPGA control which code from the library is played out.

Thoughts on Garage Remote Security

Working through this project has caused me to reconsider how secure my garage is to potential intruders. There seem to be some very serious flaws with how the rolling codes are implemented. The rolling codes are meant to do two things; one, they should prevent someone from recording the transmitted signal and being able to replay that signal at will to open or close the garage door. Two, they should prevent someone from using a recorded code to predict future codes. I don’t know enough about the algorithms used to create the rolling codes to have an opinion on the latter issue, but from this brief look at how the remote behaves there appear to be some serious flaws with the former.

The original garage remotes had a series of dip switches that could be toggled to create a unique ID number that would identify each remote to its base unit. This would allow neighbors to have the same make and model of garage door opener without interfering with each other. The downside to this implementation is that an intruder only needs to know your dip switch settings to craft a signal capable of opening your garage. If the intruder didn’t have physical access to the remote, he or she could just record the remote transmission and replay this to gain access. To counter this weakness, rolling codes were introduced. With rolling codes, by the time you record the transmission, the code is already out of date and useless. Or at least it should be…

Look at how this remote behaves when the open/close button is pressed. As long as the button is depressed, both code frames are transmitted continuously, resulting in multiple transmissions of the current code for even brief button presses. Now imagine you’re an intruder with the capability to record and transmit codes in real-time (a system that could easily be constructed for less than $300…) and you want to break into my garage. You could wait for me to come home and activate my garage door opener. The moment I press the button my remote begins transmitting the first frame of the current code (let’s call this code number 100). Now your device detects the transmission at the same moment my main unit does and you both begin decoding the frame. After 50 ms both your device and the main unit have decoded and stored the first frame of code 100, now instead of just passively waiting for the second frame, your device begins actively transmitting random bits. Your device continues this transmission for the next 100 ms thereby disrupting the ability of the main unit to receive the second code and open the garage door. If the remote only transmitted a code one time, this would be the end of the story, the intruder would have managed to record frame 1 of code 100 and disrupted the proper operation of the overall system, but the security of the garage hasn’t been compromised. The intruder would just be able to create a nuisance and force me to get out and manually activate my garage door. However, this isn’t the case.

After the intruder disrupts the second frame of code 100, the remote will retransmit the entire code. On the remote’s second transmission of code 100, the intruder could reverse what he did previously. He could disrupt frame 1 while recording frame 2. The intruder now has the entirety of code 100, but the main garage door unit has been prevented from receiving the correct code. The intruder can continue to transmit random bits as long as it detects the remote is actively transmitting code 100.

As the person pressing the remote button, all I would notice is that the garage door did not respond to my remote. This happens to me all the time so I would not think too much of it, I would simply press the remote button again. Pressing the remote again would cause the transmission of the next code, code 101. And here is where the intruder would be able to cover his tracks. The intruder’s system could go through the exact same steps as before, recording frame 1, then frame 2 of code 101. At the end of the transmissions, the intruder would have both codes 100 and 101 and the main unit would still be waiting for code 100. Instead of just staying silent after the transmission of code 101, the intruder could immediately play out code 100 causing the garage door to open. I would think nothing of this whole experience and continue on as if nothing happened. The problem is that now the intruder’s system knows code 101 and the main garage unit is expecting code 101.

I can’t say I’m going to lose any sleep over the prospect of someone spoofing my garage door opener, but I’m also not going to store something valuable in my garage and expect the rolling code security to protect it.

Moving forward, I would like to spend some time looking into the algorithms used to generate the rolling codes to see how secure they are and if they have any vulnerabilities. I would imagine that encryption for garage doors has its own set of unique constraints if only because of the long time the system will be in use. I think most people have the same garage door opener for many years, possibly decades. So even a brute force attack that took three years to search through all the possible keys would be too weak. Once you cracked the code, the opener would most likely still be in use and vulnerable.





SSTV Through Water Communication Link

I read a series of posts (first post is here) on a very interesting blog the other day about transmitting pictures over the radio with Slow Scan Television (SSTV). The blog gives a nice description of the SSTV format which uses a frequency modulated signal to encode line brightness data. This modulation is very easy to implement with the FM modulator described previously, so I decided to implement this transmission scheme across the underwater communications link and see what sort of performance I could achieve.

SSTV Signal Generation

SSTV signal generation is not terribly difficult. The first step is to resize the image to 120 rows. Next the brightness values in each row must be mapped into the correct instantaneous frequency. I did this by normalizing the black and white image to values between 0 and 1, where 1 represented white and 0 represented black. I then interpolated each row to cover the entire transmit line interval. SSTV uses 15 lines per second, this gives each line a duration of 66.67 ms. 5 ms of this time is consumed by the line sync pulse, so each row must be interpolated to cover 61.67 ms at the chosen sampling frequency. Once this interpolation is finished, the values can simply be scaled by 800 and offset by 1500 to produce the desired frequency.

I created one long vector defining the frequency at each moment in time at the desired sampling frequency. This is sufficient for download onto the FPGA, but if you’re interested in forming a wav file you need to perform a few final steps. One, you need to recognize that the instantaneous phase of a sinusoid is equal to the derivative of the phase divided by 2 pi. So to turn the frequency vector into a phase vector, you need to integrate the vector (e.g. perform a cumulative summation), and then multiply this value by 2*pi/sF where sF is the sampling frequency. You can then feed this phase into a sinusoid to get the desired modulation.

I’ve included the Matlab code I used to generate the SSTV wav file in the zip file at the end of the post. If you’d like to try decoding the SSTV signal I used for these experiments you can download the wav file here.

I did not actually download the wav file above to the FPGA, instead I downloaded the frequencies scaled to fit into a 16 bit signed number. I used a modulation scaling of 10 allowing me enough range to implement the needed frequencies.

Signal Decoding

The setup used to transmit the signal was essentially the same as the previous post. I used the SDR to receive and store the IQ signal, and then performed the analysis offline in Matlab.

The signal I received through this setup was very nice. Below you can see a spectrogram from one of the received signals.

SSTV Spectrum SpectrogramYou can clearly make out the line sync signal at 1200 Hz and the variable frequency content between those pulses corresponding to the picture amplitude.

I decoded the signal in three steps, first find the vertical sync signal, second, find the horizontal sync signal to isolate each line, three, use a short-time fourier transform to create each line.

I used a matched filter to find the vertical and horizontal sync signals. Since these signals are just pure tones, the matched filter is a sinusoid. The variation between the vertical sync and the horizontal sync is simply the duration. The longer vertical sync pulse means that its maximum output should be larger than the horizontal sync’s output, this can be used to identify it. Below you see the output of the matched filter for a signal containing multiple SSTV transmissions back-to-back.

SSTV Matched Filter Vertical SyncThe vertical pulse sync 30 ms while the horizontal sync lasts only 5 ms, so the matched filter output for the vertical sync should be 6 times larger when it encounters a vertical sync as compared to the horizontal syncs. You can see this difference in the low level signal between the large spikes above. Below shows a close up of the above signal.

SSTV Matched Filter Vertical SyncThe peak of this signal allows the start of the image to be identified. The next step is to find the individual line syncs. We again use the same idea, below you can see the output of the line sync matched filter on the same segment of data as above.

SSTV Matched Filter Horizontal SyncWith a close up of the first line sync pulse shown below.

SSTV Matched Filter Horizontal SyncYou can see that this matched filter forms a nice peak when matched with the line sync. I used the peak of each of these sync pulses to keep the decoder aligned along each line. I then sliced off the part of the signal between these pulses for the STFT decoding.

I tried out a number of different window and FFT sizes for the decoding. The smaller the window the less frequency resolution you have, but the larger the window the more smearing, so there needs to be a balance. I typically used window sizes around 32 to 64 samples and zero padded the FFT to 512 or 1024. I should note, the blog I mentioned above uses a different method to estimate the instantaneous frequency. For comparison, here is his SSTV wav file decoded using the stft method. My picture transmitted and decoded is shown below.

Andrew Casper SSTV ReceivedI was very happy with the overall quality. I actually tried to make things a little more challenging by inserting some air filled cavities and bubbles into the propagation path to disrupt the signal. The figure below shows the received signal during this experiment. Clearly the signal becomes highly attenuated part way through transmission.

Low SNR SSTV Signal

Even with this poor signal quality, the overall image turned out fairly nice.

Low SNR SSTV Picture
Where the signal amplitude is low, the quality of the image is rather poor, but you can still clearly make out the image.

Overall, I was really impressed by the quality of image that could be transmitted with such a simple scheme and so little bandwidth. I’m really tempted to build a little device I could drop into a lake that would beam back images through a transducer. I have a UART camera, I’d just need to get an inexpensive FPGA (I think there would be a fair chance this would be a one way voyage…) and a lower frequency ultrasound transducer. Now that I think of it, I actually have an old fish finder that I believe operates around 100 KHz. I think I’ll explore a few more data transmission schemes before designing something like this. If I were to make something like this, I’d like to be able to transmit data down to the device so I could perhaps scan the camera, or tell the device to surface, etc… It’s definitely something to think about.

If you’re interested in the Matlab code I used to do the encoding and decoding you can download those files here. They are commented fairly well, so even if you aren’t familiar with Matlab you can probably follow what’s going on. I’ve also upload the received signals, basic SSTV through water at 3.5 MHz, and the disrupted SSTV transmission.