Clemsa GateFOB

Hey there,

I have another Keyfob, but thats a bit harder (than the Marantec)

Its a Spanish Manufacturer.
The Keyfob sneds at 433.92MHz and semms to be a fixed Code (Dip Switches) but with a manufacturer code.
Replay Attack DIDNT work.

More infos are very hard to get.
I found a spanish compliance document and a scanned Manual in Spanish. (I do not know spanish… :D)

Apparently you can copy Key FOBs directly ( → Mando garaje clemsa MV 12 mastercode nuevo modelo - YouTube)

I have attached 4 Photos, 2 Captures from flipper (I can do SDR as well but only if needed, we dont have enough of the key FOBs at my work to take them home) and the Documents i have found online.
Its not for a high security Gate but for a simple Car barrier to our Carpark.

The Capures are a) 10x pressed, and b) one Long/hold Press, Idk if this makes a difference or sends the mastercode, but maybe it helps.

Zschr_nr2_10.sub (92.2 KB)
Mastercode_I_dont_know.sub (21.6 KB)

manual_mando_mastercode_1_canal_mv_1_clemsa_8.pdf (89.6 KB)
MT.0107.20.pdf (5.4 MB)

Thank you SO much guys!

records with different switch positions are also needed. and calculate from the description how the master code is transmitted. if the recording repetition attack is not reproduced, then either the modulation is wrong or the code is dynamic

1 Like

Okay, no Problem. i can capture them on Saturday.

Maybe, i didnt try much, cause this may looks suspicios :smiley: ( iam allowed to be there, but standing around the gate doent make sense)

From many websites i know, that this sould be static.

I try to figure out, IF there is a possibility to trigger the mastercode.
But at least from the Copy Manual you only hold buttons on the NEW remote (seems to set the new one in capturing mode) and normal press one button on the original fob.
(Maybe there isnt a mastercode; and “MASTERCODE” is only the Marketing name.)


1 Like

Okay. I found some useful information:

„ The CLEMSA Mastercode hand-held transmitters have dealer coding (personalization) and additional coding via DIP switches.
The CLEMSA MV12D hand transmitter can learn this dealer code (personalization) from a working CLEMSA MV1 or MV12 hand transmitter. The coding of the DIP switches must then be adopted from the old MV hand-held transmitter.
The old hand-held transmitter can be electronically coded, in which case it is not possible for the customer to code the new hand-held transmitter.
You can determine whether your hand-held transmitter is electronically coded by changing a DIP switch. If the gate or barrier still opens, the hand-held transmitter is electronically encoded.“

(MV12D is the 2 Button FOB. But it seems the same one as mine, mine isn’t produced anymore so the description is always linked to the MV12D one)

Seems like the manufacturer code gets learned automatically. Without extra sending function.

I will try the last thing as well

The Multicode thing is mentioned cause the receivers can be used in multiple Modes, like MutanCode and so on.
The FOB is an older one, so that this should use only Manufacturer code and dipSw. (Or the „electronically encoded“(?)

many letters, little sense. record a transmission with different switch positions and see what is there and how, how the turn will reach this protocol

1 Like