Abus CFA-1000

[Ernst Cozijnsen]

I was reading the manual of my Abus RF lock and i noticed that the RF transmission is done on 868,35Mhz AM
As i understood from previous emails this is the slow-RF mode on which FS20 is also functioning.

My question is why cant i see any messages if the frequency and the modulation are correct.

--
Mvgr,,

Ernst Cozijnsen

[Rudolf Koenig]

> My question is why cant i see any messages if the frequency and the
> modulation are correct.

- The sync sequence is not consisting of at least 4 0-bits followed by a 1-bit
(or at least 4 1-bits followed by a 0-bit)
- If sync is ok, then none of the checksums are correct. Such packets are
reported by the X67
- something else :)

[Ernst Cozijnsen]

Ok... i see :-/ forgive my total noobness in this but iḿ trying to understand why and how.

I ran X67 and after pressing a button on the remote i see this:

p 3  384  352  592  560 12  6 6 07 158B8014C0EF64
p 3  368  864  736  496  4  6 7 F8 2D4467F5F0FFFB
p 3  448  768  848  416  4  6 7 FA 2D4467F5F0FFFA
p 3  448  784  832  416  5  6 7 FB 2D4467F5F0FFFA
p 3  432  784  848  400  4  6 7 FB 2D4467F5F0FFFA
p 3  448  784  864  400  4  6 7 FB 2D4467F5F0FFFA
p 3  448  784  848  416  4  6 7 FC 2D4467F5F0FFFA
p 3  432  784  848  416  4  6 7 FE 2D4467F5F0FFFA
p 3  416  800  848  416  4  6 7 FF 2D4467F5F0FFFA
p 3  768  464  368  864  7  3 2 FE 41E000A0
p 3  832  416  432  800  4  5 5 02 65E0283C0010
p 3  832  416  432  784  4  5 5 03 65E0283C0014
p 3  848  416  432  800  4  5 5 03 65E0283C0014
p 3  816  448  400  816  4  5 5 01 65E0283C0014
p 3  848  432  400  832  4  5 5 02 65E0283C0014
p 3  816  448  416  800  4  5 5 02 65E0283C0014
p 3  816  448  384  816  4  5 5 01 65E0283C0014
p 3  784  464  368  832  4  5 5 01 65E0283C0014
p 3  816  448  416  800  4  5 5 00 65E0283C0014
p 3  848  416  432  800  4  5 5 07 65E0283C0014
p 3  816  448  416  800  6  3 2 03 41E00080
p 3  784  464  384  848  6  3 2 03 41E000A0
p 3  848  416  448  800  6  3 2 02 41E000A0
p 3  816  448  400  816  6  3 2 01 41E000A0
p 3  816  448  400  800  6  3 2 02 41E000A0
p 3  816  448  416  816  6  3 2 02 41E000A0
p 3  784  464  400  832  6  3 2 01 41E000A0
p 3  848  416  464  800  6  3 2 02 41E000A0
p 3  784  448  416  816  6  3 2 02 41E000A0
p 3  848  416  416  816  6  3 2 04 41E000A0
p 3  784  448  416  816  6  3 2 0A 41E000A0
p 3  432  800  848  400  5  6 6 07 D39617EBE1FFF6
p 3  416  816  816  432  5  6 6 06 D39617EBE1FFF4
p 3  416  816  784  448  5  6 6 06 D39617EBE1FFF4
p 3  416  800  816  448  5  6 6 06 D39617EBE1FFF4
p 3  416  816  784  448  5  6 6 05 D39617EBE1FFF4
p 3  416  816  784  464  5  6 6 05 D39617EBE1FFF4
p 3  416  816  784  448  5  6 6 05 D39617EBE1FFF4
p 3  432  800  864  400  5  6 6 0F D39617EBE1FFF4

I pressed the same button 4 or 5 times and every time you end up with a different sequence.
Is this because the remote uses a rolling code?

please explain this n00b ;-)

--
To unsubscribe from this group, send email to
cul-fans+u...@googlegroups.com

--
Mvgr,,

Ernst Cozijnsen

[Rudolf Koenig]

> I ran X67 and after pressing a button on the remote i see this:

For an explanation see the last paragraph in
http://culfw.de/commandref.html#protocol2 (starting with If bit 3)

> Is this because the remote uses a rolling code?

It would make sense, after all it is a door-opener.

[sunfreak]

Hi Ernst,

AFAIK is the Abus door lock an OEM product of the ELV Keymatic IQ+
(http://www.elv.de/KeyMaticreg-IQ-Komplettset,-Braun/x.aspx/cid_74/
detail_10/detail2_12503/flv_/bereich_/marke_).
So its working with rolling codes.
In the FHEM forum was a discussion about the possibilities to connect
with a CUL to this device. Its more or less impossible and make no
sense out of security reasons.

Only my 2 cents ... ;-)

Rgds,
Juergen

[Ernst Cozijnsen]

Ho... Hold... impossible? everything is possible but its just a matter of time ;-)

The downside is that when it gets public you would be able to crack all the houses that have these locks installed. That would be a bit shitty for the people involved and Abus ;-)

As i found on the internet there are more ways to interface with the lock since you have a connector on the bottom. I'm exchanging some code with a spanish guy and hopefully within a few week.... there will be more.

Regards,

Ernst

--
To unsubscribe from this group, send email to
cul-fans+u...@googlegroups.com

--
Mvgr,,

Ernst Cozijnsen