I wanted to clone my garage door remote to learn more about IoT security in particular so I read a lot about rolling codes, and the more I read the more I am convinced there is no way to actually clone any rolling/hopping code remote even with its master key (seed value or encrypting key) - there are many algorithms out there to derive the next values for a given synchronisation counter and seed value/encrypting key.
And yet! The so-called "universal remote" manage to clone rolling-code remotes when fed the master key in addition to the button signal... How is that possible? Do they use a very common encrypting technique and just assume that the majority of remotes out there use the same algorithm (I stumbled upon the HCS301 during my research, maybe Keeloq is the most widespread?)?