Tag Archives: SDR

Garage Door Hack

One field of communication and DSP that has always intrigued me is signal intelligence, the attempt to receive and decode an unknown signal. It’s an interesting puzzle that requires a wide variety of hardware, software, and analytical skills. I like to think that my research is, at least tangentially, a form of signal intelligence in that I’m attempting to use ultrasound signatures to determine what is happening inside the body. While receiving and interpreting ultrasound signals is interesting, I had a desire to look at more artificial, data bearing signals. I decided I would try to receive and decode the signal my garage door remote transmits to the base unit to open and close the door. In addition, I also wanted to create a device that would mimic my remote and be able to open the garage door on my command. This post will detail that attempt.

Remote Signal

The first task in this project required determining at what frequency my garage door remote operated. This was actually quite simple since the FCC ID# was easily visible. With a quick check of the FCC website, I was able to determine that the remote operated at 390 MHz. While not a super high frequency signal, it was beyond the bandwidth of my previous SDR. That SDR used an ADC with an integrated analog front end which limited its bandwidth to a few dozen MHz. So, partly driven by this project as well as a few other projects I am working on, I decided to design a new SDR with a wide bandwidth front end, and a high-resolution, high-speed ADC to allow for the reception of just these types of signals.

I plan to detail the design and construction of this new ADC board (along with a companion high-speed DAC board) in a later post. For now, I’ll just give a few of the critical details. In the image shown below, you can see the ADC on the left. This is a 14-Bit, 125 MSPS Analog Devices, AD9445 ADC with LVDS outputs. The low-jitter clock can be seen just below the ADC. To the right of the ADC is a Xilinx Spartan 3E chip. This is a big step down from the Virtex5 used in the previous post but given the costs associated with the Virtex5 (both the chip itself and the required PCB and assembly fees) I think it was well worth it. In addition, the Spartan3E can be programmed with the Xilinx ISE WebPACK without an additional license. As a student at the University of Minnesota, I currently have access to a full version of the ISE Design Suite, but at some point in the future I may not have this luxury so this was a big issue for me. Below the Spartan3E board there is the JTAG programming port, some LEDs, and a few inputs for clocks and triggers. Along the far right is the same USB module used in the 3D magnet localization project and allows me to quickly stream the data back to the computer.

Software Defined Radio SDR ADC Board

The analog front end on this board consists only of a single RF transformer. This allows the passage of signals with frequency content well into the hundreds of MHz. I’m able to use the ADC in an under-sampling mode to still digitize these high frequency signals. For the purposes of this project, I created an IQ demodulator that looked at a ~250 KHz swath of bandwidth and streamed the complex baseband signal back to the computer. I hooked up a small whip antenna to collect the RF transmissions from the remote and then monitored at 15 MHz (the 390 MHz signal is in the 7th Nyquist zone of the ADC and, with aliasing, would appear at 15 MHz).

The plot below shows the envelope of the signal I received when I pressed the open/close button on the remote. The remote was positioned very close to the whip antenna to ensure reception.

Garage Door Remote Signal

I had been worried that perhaps the remote signal would have a very low SNR and make it difficult to decode, but that was not the case. The plot below focuses on the first burst of data.

Garage Door Remote Signal

It’s clear that the remote is using simply On-Off Keying to transmit 83 bits of data. In fact, while the open/close button is depressed, the remote continuously transmits two frames of data 83 bits long, separated by 100 ms. These two frames of data are labeled A and B in the first plot above. Closer inspection revealed that the bits are transmitted at an approximate data rate of 2000 bits per second.

To get an idea of how the codes change with each button press, I recorded a long data set where I repeatedly pressed the open/close button. The hexadecimal representation of those received codes is shown below with each row representing the full code received for that button press.

Consecutive Remote CodesA few things are immediately obvious when looking at the above codes. The first frame appears to only use the numbers 8, 9, and 11 for each nibble. The second frame appears to only use the 2, 6, and 14 for each nibble.  While the codes don’t appear to be completely random (e.g. the last byte of the first frame is always 128, and the first nibble of the second frame is always 14), to my eyes, there isn’t an easily discernible pattern in this small code sample. This makes sense since most modern garage door openers use a rolling code system that transmits a new random number with each button press. The main garage door unit and the remote are synchronized so the main unit knows which codes to expect. The main unit will not only look for the current code, but also the next hundred or so codes to ensure the remote and main unit do not fall out of alignment due to the remote being pressed while out of range.

I was happy with these results and the overall performance of the SDR in receiving and decoding the remote signal, however my final goal remained using these results to create a device capable of mimicking my remote and fooling the main unit into opening and closing. The garage system’s use of the rolling code made it impossible for me to predict codes into the future. I decided the best thing (only thing) I could do would be to take the remote out of range of the main unit and record the next dozen or so codes, creating a code library that I could then replay to the main unit to open and close the door. Before doing this, however, I needed to design a transmission module that could generate a OOK data stream with a 390 MHz carrier.

Transmission Module

The graphic below shows the board I ended up making to generate the needed RF signal. The signal generation starts with a voltage controlled oscillator (VCO) whose frequency can be tuned between approximately 350 MHz and 410 MHz (shown on the far left of the board with a potentiometer to control the frequency). The output of the VCO is fed to an RF switch whose output is connected to a whip antenna. The digital logic input of the RF switch is used to generate the on-off keying. In addition to the whip antenna output, I also included an SMA output to help with the debugging.

OOK Transmission ModuleThe first thing I needed to do with this board was set the potentiometer controlling the frequency to the right voltage to ensure the carrier is at 390 MHz. I used the debug output on the far right of the board to connect the VCO directly to my ADC board. I measured both the control voltage and the VCO frequency as recorded by the ADC to generate the plot shown below. This data was collected at the full sampling rate for a bandwidth of 62.5 MHz.

Voltage Controlled Oscillator VCO

This plot demonstrates the aliasing present in under-sampling. What was in reality a monotonic increase in frequency, appears to first decrease then increase. Since I know what is happening I can correct for this aliasing and generate the correct frequency vs. voltage plot, as shown below.

Voltage Controlled Oscillator VCO

We can see the VCO has an approximate 14 MHz/Volt sensitivity, meaning the potentiometer should be set to give a control voltage of about 3.5 volts.

One VCO related thing I found interesting was the sensitivity to temperature. I ran a quick experiment where I monitored the VCO frequency as I placed my finger on the case. The spectrogram below shows how quickly the frequency changes with just that small thermal influence.

Frequency Shift

The final step in the transmission module was generating the logic signal to control the RF switch. I felt the easiest method to create this signal would be with an FPGA. I essentially needed an SPI port which can handle a very large data word, the flexibility of an FPGA made this a breeze. The only issue I ran into was that the data rate of the remote is slightly slower than the 2k baud I initially thought. Upon closer inspection, the bit periods were about 504 us and the time between frames was more like 100.4 ms. With this small correction I was able to accurately mimic the pass band signal generated from the garage remote. The data below shows the remote data signal overlain with my synthesized signal as recorded by the SDR board.

Remote Code vs. FPGA Code

The above graphic shows the first frame with the remote signal in blue and the synthesized signal in red. Over the 40 ms they stay nicely aligned. The graphic below shows the second frame comparison.

Remote Code vs. FPGA Code

By the end of this frame there is a slight misalignment between the FPGA and the remote, but it does not appear to be significant.

So with all the components up and running and the library of codes built up, it was just a matter of connecting everything together in my garage and hoping for the best. I’ve posted a video of me testing out the system below. The FPGA is connected to the transmission module with a BNC cable. The red wire running off the transmission module is the whip antenna used to transmit the signal to the garage door opener above. The slide switches located along the right side of the FPGA control which code from the library is played out.

Thoughts on Garage Remote Security

Working through this project has caused me to reconsider how secure my garage is to potential intruders. There seem to be some very serious flaws with how the rolling codes are implemented. The rolling codes are meant to do two things; one, they should prevent someone from recording the transmitted signal and being able to replay that signal at will to open or close the garage door. Two, they should prevent someone from using a recorded code to predict future codes. I don’t know enough about the algorithms used to create the rolling codes to have an opinion on the latter issue, but from this brief look at how the remote behaves there appear to be some serious flaws with the former.

The original garage remotes had a series of dip switches that could be toggled to create a unique ID number that would identify each remote to its base unit. This would allow neighbors to have the same make and model of garage door opener without interfering with each other. The downside to this implementation is that an intruder only needs to know your dip switch settings to craft a signal capable of opening your garage. If the intruder didn’t have physical access to the remote, he or she could just record the remote transmission and replay this to gain access. To counter this weakness, rolling codes were introduced. With rolling codes, by the time you record the transmission, the code is already out of date and useless. Or at least it should be…

Look at how this remote behaves when the open/close button is pressed. As long as the button is depressed, both code frames are transmitted continuously, resulting in multiple transmissions of the current code for even brief button presses. Now imagine you’re an intruder with the capability to record and transmit codes in real-time (a system that could easily be constructed for less than $300…) and you want to break into my garage. You could wait for me to come home and activate my garage door opener. The moment I press the button my remote begins transmitting the first frame of the current code (let’s call this code number 100). Now your device detects the transmission at the same moment my main unit does and you both begin decoding the frame. After 50 ms both your device and the main unit have decoded and stored the first frame of code 100, now instead of just passively waiting for the second frame, your device begins actively transmitting random bits. Your device continues this transmission for the next 100 ms thereby disrupting the ability of the main unit to receive the second code and open the garage door. If the remote only transmitted a code one time, this would be the end of the story, the intruder would have managed to record frame 1 of code 100 and disrupted the proper operation of the overall system, but the security of the garage hasn’t been compromised. The intruder would just be able to create a nuisance and force me to get out and manually activate my garage door. However, this isn’t the case.

After the intruder disrupts the second frame of code 100, the remote will retransmit the entire code. On the remote’s second transmission of code 100, the intruder could reverse what he did previously. He could disrupt frame 1 while recording frame 2. The intruder now has the entirety of code 100, but the main garage door unit has been prevented from receiving the correct code. The intruder can continue to transmit random bits as long as it detects the remote is actively transmitting code 100.

As the person pressing the remote button, all I would notice is that the garage door did not respond to my remote. This happens to me all the time so I would not think too much of it, I would simply press the remote button again. Pressing the remote again would cause the transmission of the next code, code 101. And here is where the intruder would be able to cover his tracks. The intruder’s system could go through the exact same steps as before, recording frame 1, then frame 2 of code 101. At the end of the transmissions, the intruder would have both codes 100 and 101 and the main unit would still be waiting for code 100. Instead of just staying silent after the transmission of code 101, the intruder could immediately play out code 100 causing the garage door to open. I would think nothing of this whole experience and continue on as if nothing happened. The problem is that now the intruder’s system knows code 101 and the main garage unit is expecting code 101.

I can’t say I’m going to lose any sleep over the prospect of someone spoofing my garage door opener, but I’m also not going to store something valuable in my garage and expect the rolling code security to protect it.

Moving forward, I would like to spend some time looking into the algorithms used to generate the rolling codes to see how secure they are and if they have any vulnerabilities. I would imagine that encryption for garage doors has its own set of unique constraints if only because of the long time the system will be in use. I think most people have the same garage door opener for many years, possibly decades. So even a brute force attack that took three years to search through all the possible keys would be too weak. Once you cracked the code, the opener would most likely still be in use and vulnerable.





My SDR – Results

I’ve had the SDR system up and running for a few days and I’ve been very pleased with the overall performance. I used a piece of half inch PVC pipe to construct a very rudimentary dipole about 4 ft tall. I don’t have the ability to mount this antenna any place so it is just leaning up against the wall. The dipole is connected directly to the ADC without any preamp or even a balun.

I created a basic QT program to help facilitate data collection. The figure below shows the main program screen. This program allows me to quickly manipulate many of the ADC and analog front end parameters as well as parameters in the data processing (e.g. IQ frequency, bit selection, etc…).

QT Main Screen

Once the data has been streamed to the computer, it is then pushed into a Matlab workspace, and a configurable script is evoked. The figure below shows a screen shot of this script. In general I prefer to do as much as I can in C++ with either my own coding or something like Intel’s Math Kernel Library, however, the script gives me the ability to dynamically reconfigure my signal processing as well as take advantage of Matlab’s routines and displays.

QT Matlab Script

I’ll detail two of the more interesting signals I was able to receive. The first is a local AM radio station with both an audio band and an HD Radio band. The second is the NIST time signal station, WWV at 10 MHz.

AM Radio Station

The spectrogram below shows the signal received from a local AM radio station at 830 KHz.

You can clearly make out the voiceprint between +-5KHz of the carrier. You can also see the HD Radio spectrum between 10 to 15 KHz and 34 to 39 KHz. HD, in this case, refers to Hybrid Digital not High Definition, and transmits digital information along with the analog signal. I was hopeful I’d be able to decode this OFDM modulated bitstream but it appears the details of this encoding and modulation are proprietary. A company Ibiquity requires you to license their IP to build any sort of a demodulator. This seems a little sleazy since these signals are being transmitted on public airwaves. There is an alternative data transmission scheme used in some parts of the world called DRM. This is an open source transmission scheme that claims to be just as effective as HD Radio. It would be nice to see something like this gain more acceptance.

I used a an envelope detector to recover the voice signal from this data. The time series from a few seconds worth of data is shown below.

Voice SignalThe audio of the demodulation can be heard here. One thing I’d like to do is look at the gain in the overall SNR when I demodulate with envelope detection vs. coherent detection.

WWV Atomic Clock

The second interesting source I looked at was the NIST time signal from Colorado. This signal is transmitted at a number of frequencies, I listened to the signal transmitted at 10 MHz. The plot below shows the normalized spectrum of the received signal. You can see not only the signal of interest but also the nice uniformity of the compensation filter.
WWV Spectrum
Not only was I happy to be able to receive such a distant signal, this particular signal has some data modulated on the carrier. On a 100 Hz subcarrier is a low rate (1 bit/second) data stream detailing the timing information. The figure below of the baseband data stream.

100 Hz Bit StreamThere is some VERY low frequency modulation present on the envelope but it’s still possible to recover the data. The length of the 100 Hz carrier determines the value of each bit. If the carrier is present for 200 ms the bit is a zero, 500 ms the bit is a 1, and 800 ms the bit is a marker bit. You can see a marker bit at the 7 second mark in the closeup plot below. This marker corresponds to the 39th second after the previous minute mark.

Bit Stream Closeup

This station transmits quite a bit more information in addition to the 1 bit/second data stream. Each minute there is some sort of audible announcement. Usually it is just a man telling you the current time at the mark, but sometimes there are updates on the GPS constellation of satellites, weather warnings, etc… You can listen to the audible announcement, collected at the same time as the above bit stream, here.


There are a number of free programs available for interfacing to SDR systems. Many of these systems rely on the sound card to get the baseband signal onto the computer. A few systems allow for control over an external system such as this. One of these programs is Winrad. Winrad offers the ability to load a DLL which contains a set of standard functions for interfacing with your own custom hardware. These functions allow Winrad to communicate that the user wants to change certain parameters and also allows the hardware to stream data to Winrad for processing. Once in Winrad, you can listen to different frequencies with various modulation schemes. It’s a really convenient tool and would recommend it to anyone playing around with a software defined radio.
Below I show a screen grab from the same AM radio station as above.
Winrad Screen GrabAt the top you can see a waterfall plot of the signal. You can again see the audio signal around the carrier with the digital information in the bands +-10 KHz from the carrier. The light blue region in the middle plot shows the band which is being demodulated and played out the speakers. This can be dragged and dropped to various locations within the band to inspect different signals. The passband of this filter can also be dynamically adjusted for the best audio signal.

Something interesting I noticed while playing around with this system was the effect of the earth ground. The signals above have all been collected while attaching the system ground to the earth ground. If I remove the earth ground connection, I’m still able to receive signals but they are significantly degraded. The screen shot below shows the same station as above but with the earth ground removed.

No Earth Ground Connection

Future Work

There are a couple of things I would like to do with this system. The first would be to make a basic preamp to help buffer and amplify the signal from the antenna. I’m able to receive local stations and powerful distant stations, but I’d like to see what this system could do with an appropriate analog front end. I’d also like to make the decimation software selectable. This is an almost trivial change since I have more than enough transmission bandwidth with the GbE. I’ll just need to modify the CIC core and be sure I select the appropriate range of bits at its output.

The other thing I’d like to do is to take advantage of the other 7 channels on the AFE5801 and create a basic phased array receiver. At the range of frequencies available right now, it would be difficult to spread the antennas far enough to have any sort of meaningful effect as a phased array. Because of the analog front end built into this chip I can’t undersample a signal, but if I could build a simple mixer with a DDS chip I could begin to look at higher frequency signals. I wouldn’t need to move too high before I could construct an array with a sufficiently spaced baseline to do some meaningful array processing.