HackRF ONE PortaPack H2+ Car Key Signal - Unlock Car Key FOB

[@takeapart]

MUST SEE! check out www.youtube.com/@takeapart/videos

[@rogersmith4926]

What would you recommend, Flipper zero or Mayhem?

[@takeapart]

flipper is way more versatile!

[@MrCtfx]

But with the rolling code can you open or close it only once?

[@takeapart]

yes… but you can record multiple codes

[@MrCtfx]

@@takeapart and here I don't understand: suppose I save a dozen codes after 6 the opening signal with the original remote control is sent to the control unit, will the other 6 signals still be valid?

[@takeapart]

that’s depends on manufacturer…. but mostly rest of the 6 captures won’t work.

[@MrCtfx]

@@takeapartI don't quite understand this attack: hack rf will jam by blocking the original remote control, the Flipper Zero will record the codes. The problem is if the owner were to open the car he can always do it manually with the lock and then he will leave: For closing the Flipper will be able to record the codes but if it is only a closing signal how will I open the car?

[@JReinhoud]

​​@@MrCtfxthat is why the rolling keys are basically pretty save and car manufacturers haven't responded (yet). But in theory you could hide close to a car with rolling keys and if a person did want to open his car with his keyfob and you saved and also blocked the rf signal to make it to the car and somehow the owner forgot he wanted to open the car, you could come back later to open the car and rip something out of it. Or if you have access to a keyfab for a limited time you could record it, and possible dont even have to jam because they keyfob is probably out of range, you could access the car (if the owner hadn't already) and rip something out of it. But if you already had access to the keyfob and want to rip something it would probably make more sense to just rip the keyfob also which will probably help you more cause you now are sure you can enter the vehicle unless he is sure it is stolen en puts his car in a more protected environment for instance his garage. So that leaves only the first example somewhat plausible but not likely. And with that example it is more likely that someone places a device near a place the car will often or very likely park and you record long enough till the keyfob was triggered accidentely. But by viewing only rf you will never know it was by accident so you also need a camera or some other way you would know that to make use of that. If you would be sure the incoming key was blocked and no other keys are tried to open or close the car you could maybe make an educated guess that the keyfob was triggered by accident or the owner changed his mind about entering the car and did think he/she was out of range. I also dont know if a closing key will render a good (and unused) recorded opening key useless. Because that will probably happen when the owner changed his mind and will probably press the closing knob till he sees the lights or hears the locking sound. So in the end it will be more likely someone breaks into your car without keys, or steals your keyfab or bruteforces enough keys to enter your vehicle. I dont know if that last part is even a possibility with the rolling keys technique, because it probably resets itself whenever bad keys are received but I think it is possible because a keyfob is also (or can be) out of sync when a key is already used, but I have read story's that users got them working again when pressing enough times again on the keyfob

[@anthonyrickardii6198]

Awesome example and amazing device. Question! Dumb questions too. When you turn it on and want to play a prank on my brother how can I tell what frequency it’s on in order to make it work? Does automatically does it for you ?

[@Runner-t3b]

hello how can we create an attack relay without having to press the key? could you tell me what material to buy? thanks

[@DryUrEyesMate]

How an i use this to stop or jam the key signal to stop car theft

[@takeapart]

unfortunately you can not

[@technologyreviews3620]

But can you write the files to a new remote so you can give the owner of the car a spare key?

[@takeapart]

NO

[@EWASTEANDGOLD]

I’m having problems getting it replay captures but no idea why do u need specific aerial or setting

[@takeapart]

for cleaner RX TX

[@Adam-qd8jh]

You will need to cut and trim your antenna for the best SWR “standing wave ratio”. If you transmit with an antenna with a high impedance “resistance to RF” all of that power will radiate back into your transmitter blowing the amplifier and damaging your radio. That’s why it’s best to have an antenna cut to the right frequency. And also if you just want to play around without worrying I would get a 50 ohm dummy load or make your own with resistors. But you will not got any range with a dummy load just up close but lastly,Just make sure the dummy load you buy is rated for the right amount of power.

[@matijabensa]

Nice try but this will work only if you capture the key that wasn't used before, that's why you had to move outside the range.

[@takeapart]

correct ✅

[@Karpakurva]

what means 'wasn't use'? A key thet was never connected to the car? Before the first use?

[@haizaki5012]

@@Karpakurvathe signal sent was 0005, the car didn’t received it ever, so the first time it received it was from the device, thats what i understood but not sure

[@eljam8138]

Nice content ! just started playing around ! when capturing it didnt save anything. wonder why

[@takeapart]

hi, maybe wrong SD card … try different types

[@zipit-media]

2014 Kia Optima EX, 2010 Lexus 250h... Rolling codes, So I said in the car while It started and grab captures for opening. No luck! Got a suggestion?

[@takeapart]

you have to be far away from car….(capturing key signal) make sure to be outside of the range so the car won’t receive the key signal… only you will capture it. Then you can replay it and it should work.

[@zipit-media]

Unfortunately it's not working, away from the car 35M outside... Then I get to the car nothing. Does it matter what the antenna is? @@takeapart

[@takeapart]

@zipit-media 35m is still not far enough…. standard range is about 200m ! (in clear line of sight)

[@zipit-media]

@@takeapart I did 300m, nothing. So you need to see the car 200m?

[@heikosoeder]

Jamm the signal with the hackrf and record with flipper or jamm wirt a quansheng.

[@billyjoe3309]

Can you do replay attacks on 2.4ghz band as well?

[@takeapart]

sure can , but what use ?

[@billyjoe3309]

@@takeapart What's the use of doing replay on car keys? Many things run on 2.4Ghz. So the HackRF Repaly you do in the video, can go up to the 2.4Ghz band as well, not just the 433 you played with? :)

[@dripstein6130]

is there a possible way to do brute force with unlocking a car? or is it only possible with capture

[@takeapart]

maybe for very old aftermarket car alarm systems …..

[@honestlocksmith5428]

Absolutely!

[@ahmaddanish2307]

So the first thing to is search the frequency and capture that ? Sorry i still newbie

[@takeapart]

yes, but capture it far away from the car

[@Karpakurva]

@@takeapart why near car does'nt help?

[@FYP420]

How does this work for my keyless entery audi ?

[@takeapart]

hi, it should as hack rf is working from like 1MHz

[@omegadroidzero]

You are going to brick your key FOB. Audi has rolling codes.

[@NicolasAlvesDias]

but how hack rf one produced rolling code ? as it expires after 1 use by key ? idk if im wrong please correct me

[@takeapart]

hack rf doesn’t produce rolling codes… please rewatch the video

[@jamesbarratt593]

So you sneak out the bush and open the car. Only you ain't got the transponder to start the car so you get arrested in the car.

[@takeapart]

nobody is talking about stealing someone’s car … video is about opening the car

[@tiltedchris847]

Hi One question maybe you can help me. I have a portapack h3 and tried to jam the key fob signal. I'm running the correct frequency (imo, analyzed it with the flipper zero) but if I press unlock on the key the car still opens. So there is no signal jamming

[@AndresDeMoya]

Hi, new to the HackRF scene, but from what I've been reading, the HackRF doesn't have a lot of amplification power, so maybe that's what it's going on, the key is overpowering the HackRF's signal. I've just started messing with it, but I had a similar issue.

[@pinklensfb]

you need a rf amplifier

[@ogodogo7319]

Hi Bro i have problem whene I go to (replay/open playlist/captures ) i don t find nothing you can help me please i have hacker rf

[@takeapart]

I think in some fw version there is different folder where hackrf saves captured files. check other folders

[@EvgeniX.]

but can it do a RollJam?

[@takeapart]

absolutely! check out my other video!

[@honestlocksmith5428]

Roll jams are unnecessary.

[@EvgeniX.]

@@honestlocksmith5428 really?! Did you just invented a new wonderful technique of dealing with rolling codes, that makes the good old roll jam unnecessary? If so, share your finding with the audience here, i bet everyone will be glad to hear 🧐

[@bushmaster101]

Dont you need to install a costom firmware?

[@takeapart]

this os called Mayhem

[@qallafabdullah]

Anyone had the issue where after doing this. The car key fob won’t lock/unlock the car? Cuz thats what I’m dealing with rn I have an old volvo

[@takeapart]

you have to gooogle how to relearn key fob on …. some cars does that (not just cars… garage remotes and others )

[@JReinhoud]

thats because the unlock 'code' will change on both the car and normally the FOB. But because you used the portapack to unlock, the car is ahead in the codes. Maybe it will never catch up by its own cause it needs part of the code to keep it in line with each other, but that is just a guess. I had the same problem and after unlocking with the key the manual way (turning the door lock) and also power on the dashboard with my key, the FOB worked again. Or it was the many times I tried unlocking and locking the car with the FOB that eventually resetted it, or brought it back in line again. It is one or the other, maybe both. For reference, it was a VW Caddy 2005 model I tested.

[@omegadroidzero]

You bricked it because of rolling code security.

[@grzesiektabul]

something doesn't feel right here... the turn signals don't flash when opening...

[@takeapart]

yes they do flash

[@BrainstechKnowlogy]

Cool!

[@takeapart]

thanks buddy

[@takeapart]

have you seen other videos? I have seen quite a lot of viral vids there ….

[@HEX1337x]

It is also possible to turn on the car?

[@takeapart]

@HEX1337x probably, but only aftermarket remote start systems….

[@HEX1337x]

@@takeapart what you mean as aftermarket?

[@UfukKay]

If I will prank my friends, how can I capture without to get the key ?

[@takeapart]

hhh not possible… unless you spy on your friends and wait until they press keyfob button

[@johnsandlin09]

How do you make one

[@takeapart]

make what?

[@juddcarey]

How do you find out original frequency of key fob?

[@takeapart]

with frequency analyzer…

[@bnk28zfp]

so you trew up key close to car😮 i wannna know how car talk to key))) but thank you!!!!! 😮

[@takeapart]

Im not 100% sure what you mean … but thanks for watching

[@bnk28zfp]

@@takeapart i need to know what kind hadrware can emulate the key near car!!!!!

[@takeapart]

I have bunch of videos on this topic… check them out.

[@bnk28zfp]

because my honda if i have key in my poket i can open door ill unlock by it self !!!!

[@takeapart]

it depends… some cars using different communications for this. but most combination or just subGhz standard fob buttons

[@JokerInstalls]

Why did the lights flash with the Flipper but not the HackRF?

[@takeapart]

Hi, I think back door wasn’t properly closed…

[@teodorpocs]

How did you got the right frequency?

[@takeapart]

easy … EU - 433.92

[@teodorpocs]

@@takeapart Thank you! For an unknown device that the frequency is not public information for?

[@takeapart]

@teodorpocs use frequency analyzer

[@Arekadiusz]

It's a completly nosense, one-time use only.

[@takeapart]

AKA rolling codes

[@Arekadiusz]

@@takeapart So 99% of nowadays RF devices. So it's more for "test" purposes than actual "offensive" ones.

[@Потомпоидумаю]

Двери открой у машины

[@takeapart]

stay tuned for that

[@jeffreybrunken556]

👍🏻

[@takeapart]

thanks

[@ГарикФарфоров]

My HackRF ONE PortaPack H2 after turning off erases all recordings (Capture) and after the next turn on, only play beep and carrier frequency. Interesting, should it be? How do I save my capture recordings?

[@Dread_Pirate_Homesteader]

SD CARD

[@Saphira_Paix]

yeah with the own keys like ownhotel rooms - pointless. make it at a stranger