Tpms 433 +125

Sub-GHz
#1

RU
Доброго времени
Как владельца автомобиля с системой TPMS (443MHz) интересует вопрос считывания, клонирования и пробуждения на 125 MHz, датчиков давления и температуры в шинах. Эта тема также будет востребована авто-диагностами имеющими кучу устройств под разные брэнды…
Спасибо

Good day!
As the owner of a car with TPMS (443MHz) system, I’m interested in the question of reading, cloning and waking up at 125 MHz of tire pressure and temperature sensors. This topic will also be in the demand by the auto-diagnosticians who have a lot of devices for different brands …
Thanks

4 Likes
#2

Any updates? Looks like TPMS uses FSK but that currently Flipper Zero decodes the following.

  1. AM270
  2. AM650
  3. FM238
  4. FM476

Those modulation encodes are exclusive to eachother right? So we need to add FSK decoding to the subGhz capture to get anything, is that right?

ref:
https://www.sigidwiki.com/wiki/Tire_Pressure_Monitoring_System_(TPMS)

#3

Depends on the TPMS system. I decoded and successfully sent a low tire alarm for a Subaru Crosstrex 2018. The TPMS sensor was made by Schrader and had the following info:

Manufacturer - Schrader
Modulation - ASK (OOK)
Data Rate - 8192
Frequency - 315.00 MHz
Endcoding - After preamble was Manchester II
Data - Status code, ID, Pressure (kPA * 20)

Most of the ones on 443MHz are FSK and should work on the Flipper unless the frequency deviation is to large.

1 Like
#4

I would also like to learn more about this TPMS system as i purchased a programmer the other day to fix a tire sensor on one of my vehicles and it would be awesome to have the flipper be able to program the sensors

2 Likes
#5

but flipper zero doesn’t decode FSK, or does it?

#6
1 Like
#7

What settings did you choose on the menu to decode?

#8

I manually decoded the signal capture using Universal Radio Hacker. Once I was able to decode the protocol (which is different for every brand TPMS sensor) I could craft a low psi TPMS packet. Which I replayed first with the HackRF and did a raw capture with the flipper. If I knew C, I could program a decoder on the flipper but my C is trash. I have all the protocol details for Elantra2012, Schrader, Toyota brand sensors. Schrader is in tons of types of vehicles including Subaru. If anyone wants to program a decoder, I would be willing to package up all my info and assist in getting captures/replays.
Example:

time : 2022-06-19 02:49:22
model : Elantra2012 type : TPMS id : cf4ea4cd
Pressure : 241.0 kPa Temperature: 23 C Battery : 1 LF Triggered: 0
Storage mode: 1 All Flags : c4 Integrity : CRC

1 Like
#9

Im waiting on my device right now but im hoping to do something similiar but i know a great deal about TPMS systems. Realistically if you need to be “fixing” sensors with a tool (i use a bartec) then more than likely you got a sensor going bad.

Most cars wont need anything other that a signal exchange with the device or car for it to re recognize. If i have someone riding a spare it will usually cause a fault code (flashing then solid) after putting the original assembly back on the car i just scan that sensor and shes good to go.