Hormann Garage Opener

Did someone have any luck with a HSE4-868-BS? Captures in RAW, no luck with the replay.

I can provide raw files from HackRF, for Hormann HSP 4 BiSecur if it helps

1 Like

is there any news to this topic?

I lost my remote for a Hörmann A 460 garage door (HET-E2 24 BiSecur)
Can I learn a new remote with my flipper without a existing remote?


I am a bit late to the party here but having a look at the raw data provided in this thread it seems like you can interpret this using the following:

The sample HORMANN.sub posted here therefore equates to 00 67 27 45 0B C0. As you can see there are a few errors in this one but having tried a raw recording i took myself it appears to be bang on.

I have checked this against a few raw sample files and the common pattern appears to be

\x00 \xXX \xXX \xXX \xXX \xC0

Still to test this but there is my 10p.


1 Like

my subs upload here and photo of hw

1 Like

easiest way to check, record raw and replay, works or not?

Record raw and replay works for me. I guess it works for the rest too. (For the “old school” HSM4 868mhz, that is.)

in fact, there is support for this protocol in the flipper, it may need to be tweaked a little. if it doesn’t bother you, could you collect all the RAW records for this protocol in a heap and post it again. so I can download and see everything at once.

i also got an Hormann bi-secure.
What can i do go get the FlipperZero work with it?

Could you help me out with this bro i cant seem to get mine right

I beg you to check. and I need 2+ more entries from these key fobs (DIFFERENT) I think they always transfer from 8 units, I need to check this and set it as a pattern

@SkorP Hope this helps. I have the Hormann HSE2-868-BS remote. I’ve recorded both the up and down buttons though I’ve always used the up one to open the garage, I think you can use either.

Please let me know if the recordings aren’t right as this is my first time recording one. (Recorded on 868.35 @ AM650.
Hormann Remote.zip (3.9 MB)

I can provide HSP 4 BS if it helps.

Cool ! Thanks for adding this as well.

Confirmed that the codes are now read with flipper 0.74.2 into which the PR was merged.

One remark: it records Btn 0x1 (iii), 0x2 (iv), 0x4 (ii) and 0x8 (i) for the different buttons, but they do not correspond to the front side button number (the Roman numerals). Not sure if this is relevant in any way.

As for the values; my python script gave us something like:


The new code by SkorP:

Filetype: Flipper SubGhz Key File
Version: 1 
Frequency: 868350000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Hormann HSM
Bit: 44
Key: 00 00 0F F6 5x xx x7 83

There, the bits are flipped with regard to my python example (0=1):

   F    F    6    5    x    x    x    x    7    8    3

That matches. So, that’s sound, as far as I can tell.

It will take a while before I can test replay though, as I’m not in the vicinity of my garage door atm.

For the attached HORMANN.sub by @Str0nArm.

   F    F    9    8    D    8    B    A    F    4    3

That should produce this file:

Filetype: Flipper SubGhz Key File
Version: 1 
Frequency: 868350000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Hormann HSM
Bit: 44
Key: 00 00 0F F9 8D 8B AF 43

I output the nibble responsible for the button, and in different remotes the layout of the board may differ

I have HSE2-868-BS and current RC and read doesn’t work for me.

The latest 0.74.2 works for me and it detects a Hormann opener.