Velux - Roller shutters for roof windows

Hello,

I searched, but unless I am mistaken, I did not find a match.

I am trying to clone the remote control for my Velux - Integra (en) roller shutters. Mod KLI 310/312/313
Radio frequency given by the manufacturer: 868 Mhz

No information in “read” mode

Radio frequency read by the Flipper “Frequency analyzer” : 868.350 Mhz
(Modulation AM650)

I recovered the information that I could in “Read Raw” mode, here they are:
Velux.sub (143 Bytes)

Photos:


Thank you!

I think I have the exact same one.

Looking at your sub file in the pulse plotter, it contains only a single sample:

Your sample

I’ve tried it myself and don’t get much better results. I get 868.349 as a frequency in the analyzer. Only AM650 seems to give results:

My sample

I’ll dig a bit deeper with my HackRF, see if that brings up anything.

Looking at the signal in HackRF/GQRX, I see a spike where the middle is at 868.95Mhz. The 868.35Mhz the Flipper Zero is tuned to seems to only receive a very weak signal, not enough for the device to pick up.

Looking at the signal, I think it looks like frequency-shift keying? There are no periodic pulses like with ASK, and the signal is spread out over multiple small frequencies.

1 Like

Okay, this took a bit of extra work:

  • I had to add a custom frequency to subghz_setting.c. I added it after the indicated line, with frequency 868950000.
  • I compiled and flashed a custom firmware with ./fbt and qFlipper.

The resulting firmware allows me to capture the signal:

Replaying it work but doesn’t open the shutter, I assume because it has a rolling code.

I think you can just add the frquency to the ‘subghz/assets/setting_user’ file. No need to compile the firmware.

3 Likes

All this is very technical for me, I am a newbie on this subject :wink:
Well, I added the frequency to the setting_user file. I’ll test it, but indeed, there is a good chance that there is a rolling code

Thank you!

No worries! If you want to learn a bit more about the subject, I suggest watching the “Reverse Engineering Protocols” video from Hak5 with Michael Ossmann:

It’s an absolute fascinating world, and the Flipper Zero is great to get started!

1 Like

Thank you!
very instructive indeed, I will watch the other episodes in my spare time :wink:

1 Like

Is there any progress on this topic?