Support Request: V2 Phoenix (Phox)

Sub-GHz
#1

Hi,

I’ve captured my V2 Phoenix fob.

Frequency: 433.92 MHz
Modulation: AM
Code: Rolling code could be enabled or disabled, TBH no idea what’s on mine.

Samples 1-10 are BTN1, samples 11-20 are BTN2.

This Phoenix model was replaced with the Phox. I have one fob of this kind as well, for a different gate though. I believe the transmission modes (at least some) are the same, since I know there are both types used with one gate.

There’s no “send master key” option on the controller and I currently don’t have access to the receiver side. Anyway, if there’s something I could record from the remote, tell me. I’m definitely a n00b with programming these things.

Hi-res pics

IMG_1816
IMG_18163024×4032 3.64 MB

IMG_1810
IMG_18103024×4032 3.34 MB

IMG_1813
IMG_18133024×4032 3.18 MB

IMG_1815
IMG_18153024×4032 3.55 MB

Samples
samples.zip (55.4 KB)

Manuals, it that helps.
phoenix_programming.pdf (137.0 KB)
phoenix_manual.pdf (89.2 KB)

#3

the signal is exactly rolling

#4

https://pdf1.alldatasheet.com/datasheet-pdf/view/319843/FREESCALE/MC9S08QG4CDTE.html

the chip looks like something

#5

check, so far only static mode. or maybe someone will figure out how the counter is generated, well, or it will mischief me

Phoenix_V2 52bit
	serial  key CNT  CNT-BIN
Key:F0FBD7E 7F 04B6 0000010010110110
Key:F0FBD7E 7F 7433 0111010000110011
Key:F0FBD7E 7F 6534 0110010100110100
Key:F0FBD7E 7F 10D1 0001000011010001
Key:F0FBD7E 7F 01D6 0000000111010110
Key:F0FBD7E 7F 7153 0111000101010011
Key:F0FBD7E 7F 6054 0110000001010100
Key:F0FBD7E 7F D290 1101001010010000
Key:F0FBD7E 7F C397 1100001110010111
Key:F0FBD7E 7F B312 1011001100010010
Key:F0FBD7E 7F A215 1010001000010101
Key:F0FBD7E 7F C3E8 1100001111101000
Key:F0FBD7E 7F D2EF 1101001011101111
Key:F0FBD7E 7F A26A 1010001001101010
Key:F0FBD7E 7F B36D 1011001101101101
Key:F0FBD7E 7F 01A9 0000000110101001
Key:F0FBD7E 7F 10AE 0001000010101110
Key:F0FBD7E 7F 602B 0110000000101011
Key:F0FBD7E 7F 712C 0111000100101100
Key:F0FBD7E 7F 04C9 0000010011001001
#6

I actually started to dig into the counter logic a while back.
I bought from aliexpress a remote that capable to copy phox. I soldered put it’s micro controller and connected its wires to an arduino board ,then i copied into that remote a few signals and generated the whole 2^16 available codes for some serials. Because of the bitrate it takes a few hours for each serial
I can share the data that i have if someone is interested. From what I remember, for a key=FFF… or key=000… the counter shows up as a regular counter=counter+1
That’s is still interesting to see the actual endianness or the order of the bytes.

#7

if you can figure out the counter coding algorithm let me know, I will add it to the firmware, and yes cnt=cnt+1

#8

I have access to a receiver and I managed to acquire the encryption values ​​with those written in the receiver, encryption-counter.

I have 65536 frames of 2 controls, could you help me solve this protocol?

#9

Interested also on Phoenix V2.

Can’t emulate the signal to open my garage door.

#10

I am also interested. I have quite a few rolling codes from different controls recorded consecutively.

#11

I’m interested on Phoenix V2 [w rolling codes] too, I’m also available if anyone need any type of help like testing, photos, raw data, etc

#12

Same here. Own a Phoenix v2 (w rolling codes) and can’t figure out how to emulate with flipper.