TPMS sensor decoding Universal Radio Hacker URH HackRF RTL-SDR

I am trying to make a simulator for a TPMS sensor, because i need to re-transmit other sensor IDs simulating other sensors to the TPMS system receiver.
I am capturing the sensor transmition in URH, but i am having extremely hard time to decode correctly the signal. Any parameters i use i can get to the bytes below.
I know exactly what is the data string that my real sensor is transmitting and i also know from the supplier that the sensor uses an Infineon SP37T chip, which uses Manchester BiPhase encoding of up to 10kbit/s (20kchips/s). The supplier said they use FSK modultation. This is the string my real sensor sends (in Hex):
54 50 56 2C A7 00 2C 00 0F 2C 00 66 2C 00 20 2C 00 00 2C 00 45 2C 00 FF 2C 00 51 0D 0A
Bytes 00 0F 00 66 00 20 are the sensor ID.
Bytes 45 and 51 are temperature and CRC (it may vary on examples i am sending)
HERE are some samples i recorded with URH. They are slightly different because i was trying different gains, antennas, sample rate and also tried with HackRF and RTL-SDR. Nevertheless, they are all the same sensor transmitting the same string, except temperature and CRC thay may vary as i said before.
I also have noticed that the sensor sends 2 different blocks of data, not sure exactly why. For sure it is not a repetition.
Appreciate any help. Thanks!

2 Likes

I’ve been messing with TPMS as well using RTL_433 to decode. At some point I want to create a Flipper app for it. I’ve been sidetracked by rolling code remotes however.

1 Like