Hello, I am trying to brute force my garage door. I know it uses CAME 12bit 433.92mhz (I have cloned the transmitter, but I want to see if I can brute force it).
Do i just “Add Manually” in Subghz and use this protocol, will it then spam codes at the door until it opens? Or is there something more I need to do, to get this to work?
Thanks for your help
Add manually is the process you do to have the Flipper pretend to be a real remote. Then you would follow the pairing process your garage uses to add the Flipper as a real remote. It has nothing to do with bypassing any security. Brute force is a very different thing. You will want to look for one of the Brute force files on GitHub. There are many repositories with interesting stuff. Here is one of those that should contain what you want under SubGhz. I’m not linking directly to the section because i think it will be interesting to you to see what else is there. I’d encourage you to poke around.
This is another one specifficaly for IR codes.
Thank you, I know what to do now, and lots of other cool stuff to play with here too 
Maybe wanna check UberGuidoz collection, i think he made some CAMEbrute sub files you could play without using sub brute applications.
Yep I’ve been checking all that stuff out, got some of the IR stuff working, turned my AC on and off, and annoyed my wife by messing with the TV volume.
A weird thing happened when I tried the bruteforce on the garage door. The subghz command I have from copying my actual garage remote says CAME 12bit 433.92mhz, but I tried all the codes and none of them worked. Just on a whim I tried the 868.35 and strangely that did work, though it seems to have sent two signals because the door started to open and then immediately stopped.
Wonder why that happened.
Same! 
Best guess is you were very close to the remote and picked up a harmonic. Transmitters tend to resonate at multiple frequencies. They typically use filters to remove the harmonics but they don’t always do it well. Next capture put the Flipper in one hand and the remote in the other. Keep them apart arms distance and retry the capture. I’m guessing you don’t live in the US and 868 is the real frequency.
I wonder why does this world has two highly popular frequencies differing almost precisely 2x. Does it make anything simpler, or only adds to confusion?
As far as I remember from the CB time, the 433MHz frequency range is free to use in most countries. So a company can build one for all solutions without much licensing and yearly fee for each region.
When the transmitter sends with less than 10mW … But this is enough for most garage doors, gates, window blinds, …
The Automobil industry has enough money and power to go through the registration process.
This band is very crowded/noisy. And the MCUs are more powerful, the Oszillator more precise and the power sources more efficient. In short: today we can go higher.
And 868 is the first harmonic (I don’t know the exact translation of the German ‘oberton’). So I assume the law is extender at this frequency as well.
Just a thought.
It might make the transmitters and receivers easier to produce. An IF mixer could double the frequency. The antenna would not need to be changed because the same antenna would be resonant on both frequencies. Then only software would need to be changed to turn the IF mixer on or off. A simple 1 or 0 in code would be enough.
We don’t use 868MHz as one of the free bands in the US. Instead we use a band in the 900MHz range just a little above. There is a nice table of ISM bands on Wikipedia.
We have our CB band way down in the 26MHz range. That gives it very different properties. It can skip if the weather is right and go 1000miles easily although in normal conditions 6 miles is more common unless you have a very high antenna.
Somehow didn’t think of it. Thanks for explanation.
Good old times, when your phone was still located in a static place in your house. I had a 27mc box in one of my first cars, back then it was pretty cool 
I was wrong. The thing that worked was the sub that is called CAME_bruteforce_all.sub
But as mentioned, it sends, I think, two signals, so it opens the door but then stops again after a second or so.
This is where it gets interesting. I looked at this file, and it is 433 so that part was correct. Whats funny is I compared this “All” file to the 4096 (in theory, also “all”) file for 433 and they have the same amount of lines, but it’s not the same data.
So in theory neither of these files actually has the full range of codes to bruteforce the 433.
Suppose I take this “All” file and break it down into smaller files, that way I can narrow down which code is correct (which I guess is the point of the other files in there).
If someone who understands the content of these files a little better can explain to me why they are different I would be ever grateful
UPDATE: The “ALL” file starts each chunk of codes with -11520, But the 4096 file that is supposed to be all 433 codes starts each chunk with -9000. Other than that each “piece” seems to be made of similar combinations of numbers.
Are you specifically trying to brute CAME devices? What do you want to brute-force? On what bandwidth , what modulationtype ? is it ASK/OOK/FSK etc… ? Can you explain something more about the target device you are testing?
I am trying to bruteforce my garage door. I’m fairly certain its a CAME 12bit 433mhz, that’s about all I know.
If it is really a 12bit bitshift registery ASK it should be easy to trigger it.
https://drive.google.com/drive/folders/17WNjPZygFVRjpYoDHf7iVchta0zUtbCz?usp=sharing
Try the 433mhz subs from that gdrive, if it is bitshift 12 bit retro it should work (the 16bit ask one) , otherwise you would want to try a application that is able to do this , there are multiple githubs that offer these applications specifically for things like this including multiple CAME implementations.
what aboput this thing its median is 915 but 905-925 i believe 2FSK-F1D
I wonder if this could be solved with a debrujin sequence program? Veritasium has talked about that already, I would love to see that on a flipper
Only for very old garage doors that used shift registers. Even garage doors that have more then one command or a simple header are completely immune.
Check the g-drive link above, those sub files are based on these sequences but are very stupid files that like mentioned only works on very old bitshift registry devices, so you might find a old gate after trying 1000 of them if you are lucky. Anything that has more logic and expects preamble that matches, has crc or even better verification of transmission in the protocol this is basically just creating noise on the band, so you will find very little applications for it. it is gonna be really cheap or really old stuff, at least it should have been replaced by now, otherwise i would be angry at the vendor, and ask support why they implemented 1975 tech. 12-16 or even 18 bit packages that could be bruted reasonable fast without preamble and logic that checks for communication is pretty prehistoric tech.