Yes, thank you very much, it feels like the transmission is going on all 3 frequencies at once.
now please also record 10 clicks with the URH program so that I can reproduce it myself (pre-tune to the frequency through the analyzer in URH) There is a very high chance that we will succeed
Apologies, I thought the link should have been public when I created it. I just granted you access.
Thanks so much for looking at this!
Is the URH the flipper raw scan?
Ive captured 315 and 390 with the flipper. It seems 310 is not available.
Uploading here.
chamberlain.zip (38.0 KB)
URH -Universal Radio Hacker
There is good news, the flipper normally accepts this protocol. call it security + 2.0, I would also like to find an older chamberlain protocol security + 1.0 in it, and I would like to add it. records of this protocol are needed
I’ve got a garage door with Security+ 1.0 - the older, 390 MHz generation for 1996-2005, not the newer 315 MHz Security+ 1.0 for 2006-2014. Specifically, it’s a Chamberlain LiftMaster 1255R.
Unfortunately, this means FCC region restrictions would prevent me from creating a new rolling code remote to teach to my garage door, but it may still be useful for research, the 315 MHz version, and for other regions.
Chamberlain has a detailed compatibility guide that may help others determine what they have:
(Source: Chamberlain, myQ & LiftMaster Garage Door Opener Manuals & Parts | Chamberlain Group )
My Flipper is able to record this, and I’d assume since it’s rolling code, recording 10× presses wouldn’t put me at risk of someone cloning the remote.
@SkorP Should I just follow the steps for reporting an unsupported protocol as a reply here, or do you want any specific/different information?
I only need raw records, you can throw it here too
| Item | Value |
|---|---|
| Product | Chamberlain LiftMaster 971LM remote |
| Frequency | 390 MHz |
| Modulation |
AM650 or AM270? |
| FCC ID | HBW1241 |
| Control IC | 125C0126, 9B1847, 0042 (might have misread) |
| Source | 971LM Remote Control | LiftMaster |
I only have a 1 button model, but the circuit board has places for 4 buttons. I could try jumping/shorting those briefly to see if that functionality works on this remote. There’s a good chance it’s just treated as 4 unique rolling codes given the manual advertises using any button to control any Security+ device.
LiftMaster 971LM 390 MHz remotes.zip (42.0 KB)
Archived as the Security+ 1.0 protocol has been implemented. If needed, feel free to message me.
I wasn’t sure if it was AM270 or AM650, so I recorded a bit with both modulations.
| Filename | Description |
|---|---|
LiftMaster_Remote1_AM650.sub |
10× pressing remote 1’s single button, recorded with AM650
|
LiftMaster_Remote2_AM270.sub |
10× pressing remote 2’s single button, recorded with AM270
|
LiftMaster_Remote3_AM650.sub |
10× pressing remote 3’s single button, recorded with AM650
|
Note: All three remotes are the same model. I merely wasn’t sure which modulation it’s using or if it’d be helpful to have multiple. Trying either FM[…] modulation appeared to not contain any data based on the Flipper’s signal graph.
Skipped as suggested. I can take photos if desired though!
Ok!
dachshund security + 2.0 won today, you need to brush it a little. the author of the encoding, of course, did not smoke like a child. much more interesting than keelog but not so secret
Awesome!
From reading https://github.com/argilo/secplus it sounds like Security+ 1.0 has zero overlap with 2.0 so there’s no concern, but if it’d be useful, I could verify that my Security+ 1.0 remote isn’t incorrectly detected as the 2.0 protocol.
Hopefully @Fatvod can check with their Security+ 2.0 remotes soon.
Come on, check and write how it works. security + 1.0 will also add
It works! I scanned with 315 and it picked it up right away. It doesnt allow me to replay the signal, is that expected?
Thanks!
Based on the documentation, it looks like Flipper can only save signals with a static code.
From what I’ve read elsewhere, you’re encouraged to create a new remote with the correct protocol, then put your garage door in “learning” mode to teach it this new remote. This helps avoid accidentally locking yourself out by de-syncing your normal remote with Flipper advancing the rolling code, similar to what happened to someone on Reddit (who tried to clone as if it was a static code).
There may also be legal requirements or concerns around disabling saving recordings of existing dynamic code signals. I’m not sure.
Yes, there are legal restrictions, I don’t want the device to be banned for sale at all. about adding a remote control. not yet either. First you need to find out again the legal point of view on this. Or wait in a non-official firmware, if you manage to add
I can verify that this recognizes my 315 MHz Security+ v1 remotes just fine.
What’s the problem with allowing to manually add and emulate one of these? Given the rolling code nature it’s not like this would make it possible to emulate an existing remote, and I would need physical access to my garage door opener to pair that emulated remote with the receiver, so I don’t see how there’s a legal problem here if flipper is already allowed to transmit on these frequencies.
Updated to 1ca9817, and I’m able to read my 390 MHz door opener’s Security+ 1.0 signal as well, thank you!
Adding on to this, it looks like the Security+ 1.0 patent has expired, and the Security+ 2.0 patent has been abandoned.
However, I wouldn’t be surprised if there are other concerns despite 315 MHz being allowed for transmit under U.S. FCC certification (i.e. this wouldn’t apply to my 390 MHz garage door opener). I am not a lawyer.
if the creation and transfer of code is allowed, who said that this will not allow emulating an existing keychain? this is a double-edged sword, so let’s do it ourselves, I don’t break the law