Let's Make Robots!

Car alarm remote control repurposing

A while ago, I got hold of a car alarm unit and its two remote control fobs. When i hooked it up to 12V I realized that it didn’t  work, not responding to any of the commands from the two fobs even though their batteries were OK. Naturally, I opened up the unit to start harvesting parts and noticed the RF module within (the one that sticks out perpendicularly) and I figured it shouldn’t be too hard to use the module with an Arduino.

 

Basically, my code uses pulse in to see whether incoming pulses are longer than 1000 microseconds and if a pulse is longer than that I consider it a ’1′ and if it’s not, a ’0′. So it constructs a string called ‘codein’ about 75 characters long and then it searches for 25 character pre-defined strings within it (using the substring command) , to see whether a button has been pushed on one of the remotes. If a button push has been recorded then it prints out which one over the serial connection. Oh, and I was lucky and discovered that each remote delivers different codes, meaning that I am able to remotely control 8 channels.

To figure out which codes you need to pre-define for your buttons you can un-comment the lines which display the incoming string.So here's the code: 

 


// RF module receiver code for Arduino.
// The module is connected to the Arduino havin 3 pins: +5, GND and data. The data pin is connected to
//digital pin 11 on the arduino.

int inpin = 11;
int onoff = 0;
int i=0;
String codein="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";

//there are about 100 zeros in the initial codein

unsigned long duration;
void setup()
{
Serial.begin(9600);
Serial.println("setup");
}

void loop()
{

for (i = 0; i < 100; i++) {

duration = pulseIn(inpin, HIGH);
if (duration > 1000)
{
codein.setCharAt(i,'1');
}
else {
codein.setCharAt(i,'0');
}

}
Serial.println(codein); //uncomment these two lines to figure out your remote codes
delay(1000); // this is the second line
for (i=0; i<75; i++){
if (codein.substring(i,i+25)=="0010100111000110001010000") // substitute remote codes here
{ Serial.println("lock!!!"); if (onoff == 1){onoff = 0;} else {onoff = 1;} // LED toggle on/off
break;
}
if (codein.substring(i,i+25)=="0010100111000110001001000") // and here
{ Serial.println("unlock!!!");
break;
}
if (codein.substring(i,i+25)=="0010100111000110001000100") //and here
{ Serial.println("mute!!!");
break;
}
if (codein.substring(i,i+25)=="0010100111000110001000010") // you get the idea :)
{ Serial.println("ring!!!");
break;
}

if (codein.substring(i,i+25)=="0010010110111101111001000")
{ Serial.println("lock2!!!");
break;
}
if (codein.substring(i,i+25)=="0010010110111111111000100")
{ Serial.println("unlock2!!!");
break;
}
if (codein.substring(i,i+25)=="0010001001011011111111100")
{ Serial.println("mute2!!!");
break;
}
if (codein.substring(i,i+25)=="0010010010110111111111000")
{ Serial.println("ring2!!!");
break;
}
}

// this toggles the 13 pin led on or off
if (onoff == 1) {
digitalWrite(13,HIGH);
delay(1000);
}
else { digitalWrite(13,LOW);
delay(1000);}
}


 

 

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Huh, I always thought that the code that fobs send changes everytime to prevent people from sniffing your signal and unlocking your car. Maybe if the receiver in the car doesn't talk back the fob sends the same signal? 

The receiver in the car alarm is only a receiver and cannot transmit anything to the fob and the fob cannot receive anything so that isn't it... I guess this one doesn't have rolling code...

After reading this: http://auto.howstuffworks.com/remote-entry2.htm

It seems that a rolling random 40 bit number is sent in addition to a function code. I'm guessing the function code is always the same for a certain button on a certain fob. Is this what you saw? Do you just throw away the 40 bit security portion of the signal? 

Nope, I didn't ignore any part of the signal received by the transmitter. I am aware of remote controls that use that rolling code security system but I'm guessing that this particular remote doesn't use it or that the receiver and emitter are paired in some way and that the output pin of the receiver outputs the same bits each time a button is pressed and the 'rolling code' part is only between the transmitter and receiver. The rolling code part may just be a lie to sell the cheaper car alarms :))... I don't know...

That's really interesting how you broke that out. I've never seen on with a separate RF board. Could be a great way to have a secured remote control robot or homeautomation setup. Good job.

Thanks, but the thing is that I have never seen a remote that had the RF module built in it... I have dissasembled a lot of car alarms and remote unlock modules and all of them had a separate RF board. So maybe you should take a look at the cheaper versions of car alarms :))

Neat!

Thanks a lot!