Clemsa GateFOB

[Solilord]

Hey there,

I have another Keyfob, but thats a bit harder (than the Marantec)

Its a Clemsa MASTERCODE VM1
Its a Spanish Manufacturer.
The Keyfob sneds at 433.92MHz and semms to be a fixed Code (Dip Switches) but with a manufacturer code.
Replay Attack DIDNT work.

More infos are very hard to get.
I found a spanish compliance document and a scanned Manual in Spanish. (I do not know spanish… :D)

Apparently you can copy Key FOBs directly ( → Mando garaje clemsa MV 12 mastercode nuevo modelo - YouTube)

I have attached 4 Photos, 2 Captures from flipper (I can do SDR as well but only if needed, we dont have enough of the key FOBs at my work to take them home) and the Documents i have found online.
Its not for a high security Gate but for a simple Car barrier to our Carpark.

The Capures are a) 10x pressed, and b) one Long/hold Press, Idk if this makes a difference or sends the mastercode, but maybe it helps.

Zschr_nr2_10.sub (92.2 KB)
Mastercode_I_dont_know.sub (21.6 KB)

manual_mando_mastercode_1_canal_mv_1_clemsa_8.pdf (89.6 KB)
MT.0107.20.pdf (5.4 MB)

Thank you SO much guys!

[SkorP]

records with different switch positions are also needed. and calculate from the description how the master code is transmitted. if the recording repetition attack is not reproduced, then either the modulation is wrong or the code is dynamic

[Solilord]

Okay, no Problem. i can capture them on Saturday.

Maybe, i didnt try much, cause this may looks suspicios ( iam allowed to be there, but standing around the gate doent make sense)

From many websites i know, that this sould be static.

I try to figure out, IF there is a possibility to trigger the mastercode.
But at least from the Copy Manual you only hold buttons on the NEW remote (seems to set the new one in capturing mode) and normal press one button on the original fob.
(Maybe there isnt a mastercode; and “MASTERCODE” is only the Marketing name.)

[SkorP]

Multicode

[Solilord]

Okay. I found some useful information:

„ The CLEMSA Mastercode hand-held transmitters have dealer coding (personalization) and additional coding via DIP switches.
The CLEMSA MV12D hand transmitter can learn this dealer code (personalization) from a working CLEMSA MV1 or MV12 hand transmitter. The coding of the DIP switches must then be adopted from the old MV hand-held transmitter.
The old hand-held transmitter can be electronically coded, in which case it is not possible for the customer to code the new hand-held transmitter.
You can determine whether your hand-held transmitter is electronically coded by changing a DIP switch. If the gate or barrier still opens, the hand-held transmitter is electronically encoded.“

(MV12D is the 2 Button FOB. But it seems the same one as mine, mine isn’t produced anymore so the description is always linked to the MV12D one)

Seems like the manufacturer code gets learned automatically. Without extra sending function.

I will try the last thing as well

The Multicode thing is mentioned cause the receivers can be used in multiple Modes, like MutanCode and so on.
The FOB is an older one, so that this should use only Manufacturer code and dipSw. (Or the „electronically encoded“(?)

[SkorP]

many letters, little sense. record a transmission with different switch positions and see what is there and how, how the turn will reach this protocol

[SkorP]

it seems that there is not AM modulation but FM. you can see the prealbula and the bits of the useful signal

you need to record with 2 SDRSharp programs (to see what the signal looks like in general and at what frequency it is transmitted) and URH (so that you can repeat it)

[Belgio]

Hey, have you succeeded with Clemsa?

[Solilord]

Sorry! I oversaw your reply!

Yes SDR Capture is on my plan already but i wont get a FOB until next week.
I will upload it as soon as i can!
Do you want the different DipSw positions captured with SDR? or Flipper?

I tried replaying with flipper in all 4 modulations. no success. but i was 10m away. The original FOB also is kinda weak and i have to be kinda near. I will try that again soon.

[Solilord]

Okay, i managed to capture today already.

The Files are named pretty self explanatory.
The “All -” Files are captured with SDR# AND URH.
If you need something else, just say that!

Thanks!

Clemsa-AllDips -.zip (8.1 MB)
URH-differentDisPos.zip (3.3 MB)

[Solilord]

i tested some more today. i only can replay the raw files captured from flipper.
Is There a possbility to replay what SDR has captured? (i dont have a HackRf, only MalchiteSDR and Flipper)

[Solilord]

i tried decoding using my already captured files (in am270 am650 fm238 and fm 467)
(I merged the PR [FL-2787] into dev branch locally and compiled)

Not recognizing. I have no kefob with me atm
So probably [FL-2787] isnt the right protocol

@SkorP Any News?

[Solilord]

I just uploaded the .sub file to Kauiju for fun.
Ist says:

Maybe this helps more @SkorP

[SkorP]

It might help if you explain what you need from him.

[Solilord]

My Clemsa FOB is still not working.

You said, youre awaiting my reply, if maybe the other Clemsa Protocol you added (CLEMSA Garage Door)
is working with my FOB, but it did not

[SkorP]

It’s like FSK, for the record in the URH trip to ASK. but the recordings are very bad I can’t get the flipper to catch them. need SUB records, normal for the initial analysis of the protocol, I’m not a magician

[SkorP]

where are these records?

[Solilord]

Two .subs are attached in first post.

Here is another set of sub captures with every modulation
Clemsa_AMandFM-subs.zip (36.0 KB)

[Esteban_Martinena_Guerrero]

Hi! I have the same Clemsa FOB. I only have the Flipper Zero no SDR.
Is there anything I can contribute to help find a way to make it works on FZ?

[Er_SeVi]

Buenas, tengo el mismo sistema pero tengo acceso a la centralita, por lo tanto puedo dar de alta al flipper zero en la centralita, pero como hago para mandar una señal como si fuera un mando nuevo a la centralita??

Saludos.