Ford/Lincoln/Mazda 315MHz key fob

Just throwing this out there in case it is of interest. Even if you don’t care about this fob, there is useful information below. (Once you find the FCC ID of a device by examining it or googling it, you can get all kinds of info from fcc.report)

These are for 02-14 Ford trucks/vans/SUVs etc. A list of applications can be found here.

Trying to determine the chip on this fob.

It’s 315MHz and uses ASK protocol.
51wkqi55O1L.AC_SY350

3 or 4 button
Trucks lack the trunk button and have the bottom PANIC button centered.
Cars have a square layout with the 4th button for trunk.

Appears to be FCC ID CWTWB1U345 or GQ43VT11T or CWTWB1U212

Similar to CWTWB1U331.
schematic

My remote, which is aftermarket, is more like this one.
The circuit board is identical except the lower left button is on the lower center pad, and there is no lower right button.

Great photo of the board here


shows exactly where the traces go.

The 8 pin chip’s connections appear to be:
1 - VSS
2 - NC (does terminate at a test pad though)
3 - door lock switch
4 - data out
5 - door unlock switch
6 - trunk switch
7 - panic switch
8 - VDD

Pretty sure this is a Microchip KeeLoq device, but which one? (there is no/obscured label)

Microchip KeeLoq devices (page 26)

Well it appears that none of the HCS### chips match the pinout.
Possibly PIC12F635?

Question: What is the 6 pin SMD by the 26MHz crystal? (Mine is labelled OA3Q3; search turned up nothing.)

I thought it might be fun to try to determine what this chip is and interface it to the FZ’s GPIO to read the rolling codes as needed and transmit using the FZ on 315MHz. (well actually the chip would produce the entire payload including the serial, rolling code and function/button)

The more info the better, but I suppose it doesn’t matter what the chip is.
I just need to figure out how to write code to transmit on 315MHz using the FZ, and then interface the chip to the GPIO.

If I continue in this effort, I’ll update this thread. (It has pretty limited usefulness other than because-I-can)
If I can find an OEM fob (not aftermarket like mine) I will compare the boards.

If anyone has any relevant info, please share.

you wrote a lot, but did not give the main one. Where is the RAW signal recording? but judging by the FCC tests, Keelog 315 MHz AM modulation is used there