2
$\begingroup$

It seems that a lot of cheap ASK transmitters (for remote controls, etc.) use a similar line encoding, an example can be seen here: Reverse Engineering a wireless doorbell and performing a replay attack – Part1. The one in this article can be described like that:

  • 0 is sent as: high - low - low
  • 1 is sent as: high - high - low

I'm currently trying to replay a wireless doorbell (different from the one described in the article) and it seems similar but not exactly the same: ASK signal

I think that here:

  • 0 is sent as: low - high - low
  • 1 is sent as: high - high - low

So the signal in the screenshot can be interpreted as: 001101010110011111

I tried to look at some line encoding articles in wikipedia (Manchester code, NRZI, etc.) but I can't find an exact match. How is this scheme called?

$\endgroup$
2
  • $\begingroup$ A popular scheme is "Manchester encoding" where the value of the bit is indicated by the transition from low-to-high or high-to-low mixed in with timing pulses. I recommend you look up that reference and see if that matches your doorbell. $\endgroup$ – Duston Apr 26 at 14:28
  • $\begingroup$ Do you know the contents of the message, before encoding? If not, it doesn't matter if its Manchester, NRZ, 8b/10b etc, inverted or not. If it's clearly ASK, and stays the same every time (not a rolling code), just sample it 10x faster than the shortest feature, and replay it. You only need to know more if you want a general method to synthesise a valid signal from (say) the known dip-switch settings on Tx or Rx. $\endgroup$ – tomnexus Apr 26 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.