Velux - Roller shutters for roof windows

[Bobyx]

Hello,

I searched, but unless I am mistaken, I did not find a match.

I am trying to clone the remote control for my Velux - Integra (en) roller shutters. Mod KLI 310/312/313
Radio frequency given by the manufacturer: 868 Mhz

No information in “read” mode

Radio frequency read by the Flipper “Frequency analyzer” : 868.350 Mhz
(Modulation AM650)

I recovered the information that I could in “Read Raw” mode, here they are:
Velux.sub (143 Bytes)

Photos:

Thank you!

[enigmeta]

I think I have the exact same one.

Looking at your sub file in the pulse plotter, it contains only a single sample:

Your sample

I’ve tried it myself and don’t get much better results. I get 868.349 as a frequency in the analyzer. Only AM650 seems to give results:

My sample

I’ll dig a bit deeper with my HackRF, see if that brings up anything.

[enigmeta]

Looking at the signal in HackRF/GQRX, I see a spike where the middle is at 868.95Mhz. The 868.35Mhz the Flipper Zero is tuned to seems to only receive a very weak signal, not enough for the device to pick up.

Looking at the signal, I think it looks like frequency-shift keying? There are no periodic pulses like with ASK, and the signal is spread out over multiple small frequencies.

[enigmeta]

Okay, this took a bit of extra work:

• I had to add a custom frequency to subghz_setting.c. I added it after the indicated line, with frequency 868950000.
• I compiled and flashed a custom firmware with ./fbt and qFlipper.

The resulting firmware allows me to capture the signal:

Replaying it work but doesn’t open the shutter, I assume because it has a rolling code.

[sodoku]

I think you can just add the frquency to the ‘subghz/assets/setting_user’ file. No need to compile the firmware.

[Bobyx]

All this is very technical for me, I am a newbie on this subject
Well, I added the frequency to the setting_user file. I’ll test it, but indeed, there is a good chance that there is a rolling code

Thank you!

[enigmeta]

No worries! If you want to learn a bit more about the subject, I suggest watching the “Reverse Engineering Protocols” video from Hak5 with Michael Ossmann:

Radio Hacking: Reverse Engineering Protocols Part 1 - Hak5 1913

It’s an absolute fascinating world, and the Flipper Zero is great to get started!

[Bobyx]

Thank you!
very instructive indeed, I will watch the other episodes in my spare time

[flipp]

Is there any progress on this topic?

[Darg]

+1 Algun avance?

[Bobyx]

+1

[isu]

Also interested in this +1

[AlphaMeep]

+1, found new shutters in a house I moved into

[Chris_Parks]

IIRC the Velux system is 2 way. The device shares its current position to the remote as well as the remote sending commands.