Lift Master (Security+ 2)

  1. Find the exact frequency of your system
    I am using 390Mhz.
  1. Attach the high resolution photo of your remote, to make FCC ID can be seen clearly.

I’ll hopefully post the rest of the assets momentarily due to the new user limitation.

  1. If Flipper Zero supports your frequency in default configuration, and your signal is ASK (OOK, AM) modulation, please capture the RAW signal on Flipper. Press each button on your remote for 10 times, and record the RAW signal of each button pressed on a different file and attach this files to your topic on forum.
    Here are copies of the non raw versions. Note that the file name corresponds to the FCC ID on the back of the remotes.

7359_1.sub (208 Bytes)
7359_2.sub (208 Bytes)

7539_3.sub (208 Bytes)
7964.sub (208 Bytes)

RAW with 10+ button presses each:

7964_raw.sub (77.7 KB)
7359_r_1.sub (52.8 KB)

7359_r_2.sub (62.9 KB)
7359_r_3.sub (52.4 KB)

Thanks. Yes, buttons can be those that are not used. if someone else has the same remotes, please also throw off the recordings, I’ll take a look today

7964 had one usable button I could pick up in the 390 range so I recorded one read with the protocol and one with raw button presses.

7359 had 3 usable buttons which is why I gave 3 sets of raw recordings for it in addition to the copies read by the sec+ 2 protocol you built.

RAW_CAPTURE_315.sub (36.0 KB)

Attached is a raw capture for analysis. Please let me know if I can contribute anything else.

1 Like

@SkorP Do you need more remotes?


I’ll keep an eye on Reddit and the discord. I have been trying to find others that want this support.

Here’s the raw from my 891LM with HBW7359 FCC ID.
7359_raw.sub (42.6 KB)

1 Like


Raw_signal_1.sub (98.0 KB)
Liftmaster remote
Model: 893LM
Assembled in Mexico
IC: 2666A- TX7359
Chamberland Group Inc.
Elmherst, IL 60126, USA
Patent #
7,071,850 7,561,075

Do you need more remotes?


Just a bit of a bump and bookmark for myself.
I’ve experienced a similar issue in that i can manually add security +2 and try to link it to my garage door opener. The roller acknowledges the manually entered remote and flashes as it should to indicate pairing, but then when I go to open or close the door with the emulated remote, I get nothing. My door uses 433.92 in Australia though, so I had to grab a random security +2, and edit the file to the frequency my door operates on per the below.

Filetype: Flipper SubGhz Key File
Version: 1
Frequency: 433920000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Security+ 2.0
Bit: 62
Key: 00 00 3D 29 1B A9 B2 D8
Secplus_packet_1: 00 00 3C 01 62 3D CF 61

If you need my raw capture, I’m happy to attach it, but reading the above, it looks like youve got all you want/need for now.

Happy to play Guinee pig as well if you need SkorP.

I didn’t quite understand what you want. Yes, you can manually edit the frequency and the emulated console should work on it. BUT the data in the key must be generated correctly

Ok, feeling like a noob now. How do I “generate the data correctly”?
I have the information the original remote sends saved, but obviously I cant just emulate that. Do I need to copy some of the info from the attached screenshot of the captured remote, onto the manual security +2 entry (listed below)?

Filetype: Flipper SubGhz Key File
Version: 1
Frequency: 433920000
Preset: FuriHalSubGhzPresetOok650Async
Protocol: Security+ 2.0
Bit: 62
Key: 00 00 3D 29 1B A9 B2 D8
Secplus_packet_1: 00 00 3C 01 62 3D CF 61
garage read

I see a similar issue as @shamusmcfly without changing frequency at all. I have “manually added” all frequencies of the Security+2.0 implementation (310mhz, 315mhz, and 390mhz) for my opener that uses a FCC ID: HBW7359 remote (same remote as the original photos). The garage opener acknowledges when learning the Flipper as an opener with any of those rolling codes, however the flipper does not open and close the door after being learned

I am able to read my remote at 310mhz, 315mhz, and 390mhz (AM650) however when reading at 310mhz I get what i assume to be responses coming in (2 captures for each button push) so i assume that is the correct frequency?

Hoppy to provide captures if it helps, but i am assuming that there is something wrong with that way i am going about this rather than this being a flipper issue. Any tips are appreciated

@iwantmyhatback , nice to see I’m not the only one struggling with this.

An update on mine though…
Now that my Chamberlain garage door opener is paired with my flipper, when I hit the button on flipper, it turns the garage door light on and off, so its definitely working. What I assume is the issue is that my legitimate remote has 2 buttons, but the flipper only has allowance for 1 button, and that button has been assigned as the one that turns the light on and off.

I guess my question for @SkorP is, is there a way to add a button so there is 2 to choose from, or a way to change the assigned button from Btn:0:0 (which flipper currently uses) to Btn:0xEA (which was the captured button from the legitimate remote)