Hormann Garage Opener

Sub-GHz
#13

Is that enough info for the firmware to start decoding these then now without a manual record and re-transmit?

Mostly.

If you can follow the steps described here, that would make it complete.

(I don’t think step 6 does something differently. I think it just keeps repeating the same code over and over again, but I haven’t rigorously tested.)

Alternately, someone could look into copying the existing hormann.c to a new file, and altering things as appropriate:

Mostly:

Where https://github.com/flipperdevices/flipperzero-firmware/blob/9b138424671e0e1bdea7e93ca152703427af6bee/lib/subghz/protocols/hormann.c#L264-L265 is where I think it is saved if the decoding is deemed succesful.

So, instead of subghz_protocol_hormann_const.te_short * 64 we’d want 24*short_high and then the 45 bits. But maybe only if the first bits are 8*0 or we might wrongly match other protocols. Therefore having additional sub files from more people would be beneficial.

#14

Did someone have any luck with a HSE4-868-BS? Captures in RAW, no luck with the replay.

#15

I can provide raw files from HackRF, for Hormann HSP 4 BiSecur if it helps

1 Like
#16

is there any news to this topic?

#17

I lost my remote for a Hörmann A 460 garage door (HET-E2 24 BiSecur)
Can I learn a new remote with my flipper without a existing remote?

[Protocol Request] Hormann, fixed code, 868.35mhz
#18

Hi,

I am a bit late to the party here but having a look at the raw data provided in this thread it seems like you can interpret this using the following:

Screenshot from 2022-11-22 14-24-34
Screenshot from 2022-11-22 14-24-34809×191 16.6 KB

The sample HORMANN.sub posted here therefore equates to 00 67 27 45 0B C0. As you can see there are a few errors in this one but having tried a raw recording i took myself it appears to be bang on.

Screenshot from 2022-11-22 14-24-49
Screenshot from 2022-11-22 14-24-49810×177 47.8 KB

I have checked this against a few raw sample files and the common pattern appears to be

\x00 \xXX \xXX \xXX \xXX \xC0

Still to test this but there is my 10p.

cab.

1 Like
#19

my subs upload here and photo of hw

1 Like
#20

easiest way to check, record raw and replay, works or not?

#21

Record raw and replay works for me. I guess it works for the rest too. (For the “old school” HSM4 868mhz, that is.)

#22

in fact, there is support for this protocol in the flipper, it may need to be tweaked a little. if it doesn’t bother you, could you collect all the RAW records for this protocol in a heap and post it again. so I can download and see everything at once.

#23

i also got an Hormann bi-secure.
What can i do go get the FlipperZero work with it?

#24

Could you help me out with this bro i cant seem to get mine right

#25

I beg you to check. and I need 2+ more entries from these key fobs (DIFFERENT) I think they always transfer from 8 units, I need to check this and set it as a pattern

#26

@SkorP Hope this helps. I have the Hormann HSE2-868-BS remote. I’ve recorded both the up and down buttons though I’ve always used the up one to open the garage, I think you can use either.

Please let me know if the recordings aren’t right as this is my first time recording one. (Recorded on 868.35 @ AM650.
Hormann Remote.zip (3.9 MB)

#27

I can provide HSP 4 BS if it helps.

#28

Cool ! Thanks for adding this as well.

#29

Confirmed that the codes are now read with flipper 0.74.2 into which the PR was merged.

One remark: it records Btn 0x1 (iii), 0x2 (iv), 0x4 (ii) and 0x8 (i) for the different buttons, but they do not correspond to the front side button number (the Roman numerals). Not sure if this is relevant in any way.

As for the values; my python script gave us something like:

0000.0000.1001.1010.xxxx.xxxx.xxxx.xxxx.1000.0111.1100.0

The new code by SkorP:

Filetype: Flipper SubGhz Key File
Version: 1 
Frequency: 868350000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Hormann HSM
Bit: 44
Key: 00 00 0F F6 5x xx x7 83

There, the bits are flipped with regard to my python example (0=1):

0000.0000.1001.1010.xxxx.xxxx.xxxx.xxxx.1000.0111.1100.0
1111.1111.0110.0101.xxxx.xxxx.xxxx.xxxx.0111.1000.0011.1
   F    F    6    5    x    x    x    x    7    8    3

That matches. So, that’s sound, as far as I can tell.

It will take a while before I can test replay though, as I’m not in the vicinity of my garage door atm.

#30

For the attached HORMANN.sub by @Str0nArm.

1111.1111.1001.1000.1101.1000.1011.1010.1111.0100.0011.1
   F    F    9    8    D    8    B    A    F    4    3

That should produce this file:

Filetype: Flipper SubGhz Key File
Version: 1 
Frequency: 868350000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Hormann HSM
Bit: 44
Key: 00 00 0F F9 8D 8B AF 43
#31

I output the nibble responsible for the button, and in different remotes the layout of the board may differ

#32

I have HSE2-868-BS and current RC and read doesn’t work for me.