Universal Remote Clone

[Robinette Ith]

Iwanted to clone my garage door remote to learn more about IoT security in particular so I read a lot about rolling codes, and the more I read the more I am convinced there is no way to actually clone any rolling/hopping code remote even with its master key (seed value or encrypting key) - there are many algorithms out there to derive the next values for a given synchronisation counter and seed value/encrypting key.

And yet! The so-called "universal remote" manage to clone rolling-code remotes when fed the master key in addition to the button signal... How is that possible? Do they use a very common encrypting technique and just assume that the majority of remotes out there use the same algorithm (I stumbled upon the HCS301 during my research, maybe Keeloq is the most widespread?)?

Most of the key fobs use proprietary algorithms to generate rolling codes. You can't create a universal remote even if you know which algorithm manufacturers are using. The seed value is unique per key fob. To generate same rolling code as the targeted key fob, you need to know this seed value or a secret key depends on the implementation.

This attack works on any key fob which doesn't authenticate the device. A generic remote exploiting this attack can be built using software defined radio. You don't even need to know the underlying implementation.

It is still not universal. The master key is specific to the manufacturer and its car model. You can derive the secret key for key fob using this master key but you also need to implement the same algorithm specific to the manufacturer.

PREREQUISITE: The cloning instructions below are written using Solidremote Universal RF Remote Control Duplicator / Self-Learning Copy Remote to ensure successful copying of most garage door remote controls, the original garage door remote control should be either fixed-code or learning code model, rolling-code model is not supported, detailed prerequisites & cloning tips can be found at bottom of this page.

NOTE: Solidremote RF Remote Control recommended when using our self-learning Universal RF Remote Control Duplicator / Self-Learning Copy Remote. Although our Universal RF Remote Control Duplicator / Self-Learning Copy Remote should work on most standard RF Remote Controls out there in the market, please be aware that it may not work properly on some non-standard RF Remote Controls. Please consult us for detailed compatibility information.

Press and hold down buttons A and B on Copy Remote simultaneously, LED flashes once, after approximately 5 seconds, LED on Copy Remote flashes quickly, all the transmitter codes in the memory have now been erased.

Place your Original Remote next to Copy Remote. Press and hold down the button on Original Remote that you wish to program onto the corresponding button on Copy Remote, and then press and hold down the corresponding button on Copy Remote. Hold both buttons down until you see LED on Copy Remote flashes quickly. This should only take a few seconds, and then you have successfully duplicated the code from Original Remote.

After successfully learned, LED will turn on and remains on when any button on Copy Remote is pressed, and the button on Copy Remote will function the same as Original Remote, the clone procedure is now complete.

If you have cleared the code by accident, press and hold down buttons C and D on Copy Remote simultaneously, after approximately 5 seconds, LED on Copy Remote flashes twice or three times, then flashes quickly, all the transmitter codes in memory have now been recovered.

If you have followed exactly the above programming procedure, but the Copy Remote does not work with your garage door opener, there are basically two major factors to consider: Firstly, your existing remote control might not be fixed code type. Secondly, your existing remote control and Copy Remote must transmit signal on the same frequency. The frequency is factory preset to 315MHz which is the standard for radio remote control apparatus in USA and China. The frequency can be changed to anywhere between 240MHz and 960MHz if required.

Cloning of Rolling-Code Model NOT Supported: Our Solidremote Universal RF Remote Control Duplicator can clone a vast majority of fixed-code RF remote controls, in which circumstance each time when the remote control button is pressed, the same code is encoded and transmitted. While when the RF remote control is equipped with Code Hopping or Rolling-Code Technology, it's not possible to clone because these type of remote controls transmit a different code each time the remote control button is pressed for better security.

TIPS: Fixed-code model is widely used in common remote control field such as Garage Door Openers, while Rolling-Code model is widely used in high security remote control field such as Car Security Systems, but today more and more latest Garage Door Openers model are equipped with Rolling-Code Technology, so contact us for compatibility information before placing an order.

Our 433Mhz Cloning remote is universal across any remote on this frequency that is set to "Fixed Code". Fixed code is the most basic form of transmitters / receivers which send singular coding that is programmed via dipswitches.

It is very important to know the remote you are programming from is going to be compatible before committing to a purchase. This remote will not copy "Rolling Code" or any remote that is not on the same frequency (433Mhz).

If you are ever unsure about compatibility or would like to know more about the technology in how it works, please contact our friendly Technical Sales team on 01384 569942 or via in...@easygates.co.uk.

With over 25 years experience in the industry, EasyGates is the largest electric gate automation supplier in the Midlands. Our reputation in the gate automation world is renowned, and we supply and support very large national automation companies throughout the UK.

I looked at many forums and online questions to try to figure out how to program the wdtv remote into another universal remote. I wanted to post my soulution so that others could have an easier time if they have the same problem. This worked for the WDTV SMP but I am certain would work for any model!

Now you can set up all your devices on the remote using the smart codes provided. It has a Wesern Digital code but it doesnt work. So instead for the WDTV remote you can clone the remote using the LEARN feature. (This also worked in my Telus PVR and Samsung Soundbar, neither codes found or worked.)

You press the input button on the new remote you want to use to control your WDTV (CBL/TV/DVR/HD) and then press and hold the LEARN button down while also simultaniously holding down another button i.e. POWER until the light goes solid red. Then while placing the WDTV remote 5 cm away facing the new remote, press and hold the WDTV POWER button unitl the red light blinks on the new remote.

Now your power button will work on the new remote. You have to continue this step for every other button, choosing what buttons you want control of and which buttons on the new remote should control them. It takes a while but it works!

I have 5 devices and 5 remotes and it is exhausting looking for each one to do what I want. I didnt think I could find one that worked on the WDTV but I did find one, and the cheap one worked despite the sales guy telling me it wouldnt and I had to spend at least $80 for a harmony that would.

Are other "rolling code" encoding standard remote controls interoperable, or do I need a more detailed description of the "rolling code" (like a chip modal number, for ex. HCS301 / HCS300 / HCS200) and perhaps some other things?

So the question is: "Does having both remotes with the same chip (for example HSC301) working on the same 433.92MHz frequency, make them compatible with respect to copying (duplicating)?"

In practice (in Keeloq and similar systems, which to my knowlege means all rolling code systems in existence) the code gets changed each time the transmitter is activated, and the receiver keeps track of the last code it received from the transmitter.

For example imagine a rolling code transmitter with code sequence "ABC" -- in other words on the first five activations the transmitter would transmit codes ABC01, ABC02, ABC03, ABC04, ABC05. After that fifth transmission (assuming it was received by the receiver!) then the receiver would only accept code ABC06 or later. That's what makes the rolling code resistant to the record-and-replay hack.

Now let's copy our first transmitter (TX1) over to a second transmitter (TX2). We pair them up using the next transmission, code ABC06 and all seems well. On their next activation each transmitter will transmit code ABC07.

Hopefully you already see the problem. If activate TX1, it transmits code ABC07 and the receiver responds. But the next time I try to activate TX2, it also transmits code ABC07 and so the receiver rejects it as an old code. Maybe if TX2 were activated a few times it would get ahead of TX1 and activate the receiver... but then later on TX1 would need to "catch up" to TX2, and the whole system is... less than good.

So you cannot copy rolling code transmitters because copying a rolling code transmitter would only work well if you could somehow keep the two transmitters in sync with one another, and there is no practical way to do this. It is far easier to simply pair a second, new rolling code transmitter with the receiver, as Abel mentioned in the comments.

Yes it is possible. In fact I have consistently used 433.92 rolling code clone remotes to copy other remotes. Works fine as long as all those cloning are rolling code. I copy the transmitter used to open the gate but do so out of range of the receiver. Please don't be telling people it doesn't work because I have cloned dozens of rolling code remotes.

3a8082e126