Hormann HSP 4 BiSecur 868 MHz

Hi all!
I’m trying to reply a signal from hand transmitter barrier gate opener.
Here are the Technical data (no FCC ID, I’m in Europe):

Opener is probably using a fixed code, because it doesn’t have any BiSecur gateway.
Flipper doesn’t decode the signal, so I’ve tried to read a raw signal. I’ve tried all modulation settings, but none of them works when I reply the signal (see attached recordings).
868_fm476.sub (27.4 KB)
868_fm238.sub (76.6 KB)
868_am650.sub (172 Bytes)
868_am270.sub (414 Bytes)

Any idea what to try next? How to find the correct modulation if none of predefined works?

@Oldfox Did you manage to make progress?
I’m interested as well.

Unfortunately not yet. I’ve purchased some other tools (HackRF), but I need to get an Ubuntu box for further analysis.

BiSecur uses AES encryption without a key and an algorithm, nothing will work for you, you need firmware from the remote control and then you can try something

Can you provide a longer capture for the AM modulations?

Anything new about this? I’m trying to capture / send Hormann too but no results :-/

Remote what I’m trying to read is Hörmann Hand Transmitter HSE1 868-BS

Sorry for the late reply, been busy.
Ok, I’ll provide longer am capture and recordings from Hackrf later

Here are mine captured with Flipper. Hope it helps.
Am270.sub (438 Bytes)
Am650.sub (196 Bytes)