Support Request: V2 Phoenix (Phox)


I’ve captured my V2 Phoenix fob.

Frequency: 433.92 MHz
Modulation: AM
Code: Rolling code could be enabled or disabled, TBH no idea what’s on mine.

Samples 1-10 are BTN1, samples 11-20 are BTN2.

This Phoenix model was replaced with the Phox. I have one fob of this kind as well, for a different gate though. I believe the transmission modes (at least some) are the same, since I know there are both types used with one gate.

There’s no “send master key” option on the controller and I currently don’t have access to the receiver side. Anyway, if there’s something I could record from the remote, tell me. I’m definitely a n00b with programming these things.

Hi-res pics

Samples (55.4 KB)

Manuals, it that helps.
phoenix_programming.pdf (137.0 KB)
phoenix_manual.pdf (89.2 KB)

the signal is exactly rolling

the chip looks like something

check, so far only static mode. or maybe someone will figure out how the counter is generated, well, or it will mischief me

Phoenix_V2 52bit
	serial  key CNT  CNT-BIN
Key:F0FBD7E 7F 04B6 0000010010110110
Key:F0FBD7E 7F 7433 0111010000110011
Key:F0FBD7E 7F 6534 0110010100110100
Key:F0FBD7E 7F 10D1 0001000011010001
Key:F0FBD7E 7F 01D6 0000000111010110
Key:F0FBD7E 7F 7153 0111000101010011
Key:F0FBD7E 7F 6054 0110000001010100
Key:F0FBD7E 7F D290 1101001010010000
Key:F0FBD7E 7F C397 1100001110010111
Key:F0FBD7E 7F B312 1011001100010010
Key:F0FBD7E 7F A215 1010001000010101
Key:F0FBD7E 7F C3E8 1100001111101000
Key:F0FBD7E 7F D2EF 1101001011101111
Key:F0FBD7E 7F A26A 1010001001101010
Key:F0FBD7E 7F B36D 1011001101101101
Key:F0FBD7E 7F 01A9 0000000110101001
Key:F0FBD7E 7F 10AE 0001000010101110
Key:F0FBD7E 7F 602B 0110000000101011
Key:F0FBD7E 7F 712C 0111000100101100
Key:F0FBD7E 7F 04C9 0000010011001001

I actually started to dig into the counter logic a while back.
I bought from aliexpress a remote that capable to copy phox. I soldered put it’s micro controller and connected its wires to an arduino board ,then i copied into that remote a few signals and generated the whole 2^16 available codes for some serials. Because of the bitrate it takes a few hours for each serial
I can share the data that i have if someone is interested. From what I remember, for a key=FFF… or key=000… the counter shows up as a regular counter=counter+1
That’s is still interesting to see the actual endianness or the order of the bytes.

if you can figure out the counter coding algorithm let me know, I will add it to the firmware, and yes cnt=cnt+1

I have access to a receiver and I managed to acquire the encryption values ​​with those written in the receiver, encryption-counter.

I have 65536 frames of 2 controls, could you help me solve this protocol?

Interested also on Phoenix V2.

Can’t emulate the signal to open my garage door.

I am also interested. I have quite a few rolling codes from different controls recorded consecutively.

I’m interested on Phoenix V2 [w rolling codes] too, I’m also available if anyone need any type of help like testing, photos, raw data, etc

Same here. Own a Phoenix v2 (w rolling codes) and can’t figure out how to emulate with flipper.