1

I have been looking for my lost car key. I have RTL-SDR and I am able to listen to key fobs frequency which varies between 350-444MHZ. I was trying to understand how most of the keyless entry systems work but I'm not sure whether:

  1. Key fob detects a car in proximity and requests and exchanges information
  2. Car detects key fob, meaning key fob must be emitting signal once in a while.

Obviously, I would be able to locate the key if the key fob is emitting a signal. Problem is, the key has been lost at a pretty large property and is the only one I have, so it's quite a pickle.

RTL-SDR easily picks up other car key signal with buttons.

Improve this question

1 Answer 1

Reset to default
1

When the door handle is pulled, car advertises a random challenge along with its Vehicle ID known to the keyless entry fob (Customer-Identification Device (CID)). CID answers with a Message Authentication Code (MAC) over the challenge. Car verifies the MAC and unlocks the door. The same thing happen when the start button is pushed and the trunk is being open. Car also periodically scans the presence of keyless entry fob when the car is running.

CID passively listens to the advertising signal so it won't show up in SDR. You can generate random advertising signal of your car for the CID and tune SDR to the transmitting spectrum of CID. Note that it won't work if your CID is equipped with motion detection. CID refuses response if it's not detecting motion. Motion detection is a preventive measure against Signal Amplification Relay Attack.

Improve this answer
2
  • Thank you, that's helpful. I tried recording signal from the car, my car is sending 3 different packets at different quite unusual frequencies and keyfob responds with 3 packets at mhz range. Recorded signal didn't trigger even the one key I have, I'm assuming that there is pretty strict time tolerance between those packets at different frequencies, nothing is impossible but at this point new key is cheaper. Cheers (update - i found one spare, hence I was able to record)
    – mack44452
    Jul 24, 2021 at 4:44
  • If you are receiving the response, you can find it by following the signal strength. Are you relaying the signal or moving the car around?
    – defalt
    Jul 24, 2021 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .