Cardin txq449200 Garagedoor 433,92MHZ

[TxFlip]

Dear Flippers,

I am trying since 3 days to copy my garage door opener with 443,92 MHZ

Carding TXQ449200

I tried with RAW Data, and also direct detection which gets me data, but whatever I send its not opening.

Data looks like this:

Any ideas or tricks?

Thanks in advance!

[maqumih]

First of all, “ask makers of your firmware” - it doesn’t look like stock. Second, that’s more or less secure system. You need manufacturer key to copy. Try Googling for it, but do not expect too much.

[jmr]

I found your problem. The website says “Rolling Code”. That means the code changes with every key press.

Technical specifications

    key lock function
    rolling code
    2⁶⁶ possible combinations
    Range: 100-150m
    Power supply: 3V CR2032 lithium battery
    Frequency: 433MHz FM
    Material: impact-resistant plastic housing
    Dimensions (LxWxD): 72 x 34 x 11mm

2-Kanal Handsender TXQ449200 | CARDIN

[TxFlip]

Thanks for your reply!

Alright, so there is no chance that i can capture the RAW data or something else?

[jmr]

You can capture the code out of earshot of your garage. Then it would work to open the garage 1 time assuming the garage remote is not used first. Here is a real basic explanation.

The garage has a list of codes that it will accept. They are all pseudo random. The remote and the garage both know a secret seed that is used to create the codes. They share that seed when they were first paired. Even if you got the secret shared seed you would not know the pseudo random process of generating keys from the seed. The keys they generate from the seed are in order. If key 1 is used it can never be used again.

1. 51265268541852
2. 85482158487828
3. 69478526259829
4. 65484856285888
   … and so on.

Key one is invalid now because you used it. Let’s say that you are at work and you pressed your remote. Maybe you even copied it with the Flipper.

1. 51265268541852 (Already used)
2. 85482158487828 (The garage never heard this code but the remote will never repeat it.)
3. 69478526259829
4. 65484856285888

At this point codes 2,3, and 4 are valid but the remote thinks code two has been used. It will never play that key again. If you had recorded key 2 you could replay key 2 with your Flipper and the garage would open. If instead you tried to save key 2 and used your remote when you got home the remote would play key 3. The garage knows it hasn’t heard key 2 but because it heard key 3 it will blacklist key 2 and key 3 because it knows key 2 should have came first. Now only key 4 is valid. The process continues like this practically to infinity because the keys are much bigger. You could probably sit in front of your garage forever pressing the button and no key would ever repeat.

1. 51265268541852 (Already used)
2. 85482158487828 (Saved to your Flipper but no longer valid)
3. 69478526259829 (Remote played key 3 because it had already played key 2. Garage invalidates key 2 and 3 upon hearing key 3)
4. 65484856285888

Hopefully this gives you an idea of what rolling codes are. It’s a bit more complicated but I tried to keep it basic without losing the concept.

[TxFlip]

Thanks, awesome explanation!