Handicap door fob/remote 125mhz?

ConcentratedEvil · May 18, 2024, 1:14pm

I have tried to read either of these with the flipper and now the proxmark3. I can’t get either to read these. The installation manual says its a 125mgz signal. I lost one of the fobs and they don’t sell replacements, I’d have to rewire the reader, etc. (I have the reader also btw…)

I have been googling and following video tutorials for weeks and I haven’t been able to figure this out. I am getting pretty good at normal prox cards but until I can read this that does me no good.

Any advice?

Thanks in advance!

Pilgrimsmaster · May 19, 2024, 7:44am

Can you check and confirm

125MHz???

The Proxmark3 generally operates between
125kHz -
13.56MHz

The button key fob, looks to be battery operated, my guess is it is more likely to be
315MHz
or
433MHz
possibly, but unlikey ~860MHz

Can you open it up and look for any clues on the board.

The keyring, can you try a
lf search
and
hf search

and post your results

hadoukenboy628 · May 19, 2024, 9:33am

I believe olide button remotes are 433 mhz. Ypu should be able to find universal clone fobs that you can copy the signal too. You don’t need a like for like remote. Just abfour button remote. I can’t identify the snall hrey gob though. Any numbers or brand written on it?

Aoxhwjfoavdlhsvfpzha · May 19, 2024, 9:40am

I’ve never seen a handicap door that took a remote or a tag, so that’s pretty neato! Any chance you could share a little more about the system?

You could try to use the Frequency Analyzer option in the Sub-Ghz app on the Flipper and scan the remote that way

You could also try some already known handicap door signals, maybe you’ll get lucky:

hadoukenboy628 · May 19, 2024, 11:34am

Well all i did was google image search.

Actually on their website they do actually offer the button fob on it’s own so im guessing they all use the same codes or can be cloned.

ConcentratedEvil · May 19, 2024, 1:13pm

Sorry about the typo, I’m a sw developer so everything in my world is “mega” or “giga”, lol.

The box and the manual say it’s double frequency. 125 KHz and 2.4Ghz.

I’ll upload pictures of both. I did try ls search with no luck for the remote and the fob. I’ll try hf search, thanks! I can open it and post pictures too…

Thank you for the help, I really appreciate it.

ConcentratedEvil · May 19, 2024, 1:16pm

The manual does say 125 KHZ, I’ll post pictures of the inside of the FOB and anything I find. I agree I don’t need the remote cloned. I just posted that for info in case it helped anyone like yourself that was familiar.

You’re correct it’s an Olide, I should have posted that, sorry. I’ll add pictures and the model, etc.

ConcentratedEvil · May 19, 2024, 1:18pm

That’s the one! I was going to update my post with that info today, sorry to make you search for it.

I’ll look again, but all I found on the website was a new reader with 2 fobs. I didn’t see any fobs by themselves, I’ll go look again.

But now I have the flipper and the proxmark, I am down this rabbit hole and either way I want to figure it out. It’s not in my nature to give up.

Thank you for the help.

ConcentratedEvil · May 19, 2024, 1:20pm

Yes, the door opener is an Olide like the others have figured out (I really should have posted that…) I’ll post pictures of manual(s) with the model numbers. I tried the flipper first in all it’s default modes with no luck. I’ll read the post you put up, can you tell me how you found it so I can learn to fish a little better?

Thanks!

ConcentratedEvil · May 19, 2024, 1:33pm

Ok here are the model numbers and more pictures:

Interestingly the box says “12.5KHz” and the manual says “125KHz” top left, section 2 “Product over-view” under the third bullet.

ConcentratedEvil · May 19, 2024, 1:42pm

Here’s the actual model with more info:

Olide-504W Smart Pet Collar Sensor for Automatic Door System – olidesmart

ConcentratedEvil · May 19, 2024, 1:51pm

And here’s the fob’s board:

fwiw, this is for a support dog for a PTSD situation. Although they also advertise this for personal support robots for handicapped people now as well. The door can be opened with the remote or a door button for people or the fob can be connected to a wheelchair for example.

Thanks again, we lost one of the fobs and it’s been a huge pain. Since I couldn’t find a way to buy replacement fobs I thought copying this to the blue rfid tags would make life a lot easier and I wouldn’t have to get on a ladder and try to rewire the reader by myself.

hadoukenboy628 · May 19, 2024, 5:56pm

I think one of the key things here is are you using it for it’s intended purpose. I.e. animal access. I think the battery operates the 2.4 ghz frequency to broadcast and have a larger read range. The only other option is try the flipper in debug mode and do a raw read. If that works then it mmight be an unsupported 125khz format. However, all is not lost, there are single odibe fobs available to purchase and i understand the system let’s you have up to three enrolled.

You may have already come across these anyway but if you need links etc to what I’ve found, let me know. I appreciate you approached the forum about cloning the fob rather than buying and enrolling new fobs.

Pilgrimsmaster · May 19, 2024, 6:12pm

LF = Low Frequency = 125kHz
HF = High Frequency = 13.56MHz

So you’ll actually want
`lf search’

if that doesn’t work, try

lf t5 detect
This may not give you an answer, but it will narrow down some options

This is a great idea, if this happens, there may be another option; this isn’t something I can guarantee, but if we can line it up, it will require you being without the fob for a few weeks.

Lets see how you go with other options above first…

hadoukenboy628 · May 19, 2024, 6:28pm

Well it was actually your idea a long time ago when i had a similar issue!

ConcentratedEvil · May 19, 2024, 9:18pm

No luck with hf search, lf search or lf t5 detect, nothing is found. I even took out the board and flipped it around every angle for a test each time and nothing.

But when I sit the thing down on the couch it’s within range of the door so the door opens. That gave me an idea, I ran lf search and put the board on the proxmark and moved both closer to the door. Then I got a reading:

Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[=] Odd size, false positive?
[+] Indala (len 349) Raw: 800000000606000001040000220300400060606066000406000fe000

[+] Valid Indala ID found!

[=] Couldn’t identify a chipset

Any thoughts now?

Thanks!

ConcentratedEvil · May 19, 2024, 9:26pm

Ok, I just walked the proxmark over to the receiver and it does the same thing. Am I picking up it’s broadcast?

Aoxhwjfoavdlhsvfpzha · May 19, 2024, 9:39pm

Indala reads are quite often a false positive, I’d ignore that

You can give lf search -u a try which searches for unknown LF tags, though I’ve never tried it myself so I don’t know exactly how much it’ll help

ConcentratedEvil · May 19, 2024, 10:27pm

Well I got a different output with lf search -u.

This is from the receiver with no fob in range:

[=] Note: False Positives ARE possible
[=]
[=] Checking for known tags…
[=]
[-] No known 125/134 kHz tags found!
[=] Checking for unknown tags…

[=] FSK clock… no
[=] ASK clock… detected
[=] ASK demodulation… failed
[=] NRZ clock… detected
[+] NRZ demoded bitstream
[=] ---------------------
[+] DemodBuffer:
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 11111111111111111111111111111111
[+] 1111

[=] NRZ … false positive

[=] PSK clock… detected
[=] PSK demodulation… failed
[-] Failed to demodulated signal
[=] Couldn’t identify a chipset

I couldn’t get the fob to work so I put it on the proxmark and got slowly closer to the receiver. That didn’t work so I was going to quit, but I put it down on the couch again and as soon as I picked up the fob it got the same feedback as the door and the door opened.

So then I tried another test, I hovered the fob above the proxmark and then just moved it slightly toward the door and then I got this:

[=] NRZ - auto correlations
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size

[=] PSK clock… detected
[+] PSK1 demoded bitstream
[=] ----------------------
[+] DemodBuffer:
[+] 11111010101010101010.10101.01010
[+] .10101010101.010101010101.010101
[+] .0101.0101010.101010.10101001010
[+] 10101010101010010101010101001010
[+] 10101010101010101010101001011011
[+] 00101010101010100010101010101010
[+] 10101010101010101010101010101010
[+] 10101010101101010101010101011010
[+] 10101010101010101010101010101010
[+] 10101010101010100101010101010010
[+] 10010101010101010101010101011010
[+] 10101010101010101010101010101010
[+] 10101010101010101011010101010101
[+] 01010101010101001010101010101010
[+] 10101010101010101010101010101010
[+] 10101010101010101010101010110110
[+] 10101010101010101010100101010101
[+] 01010101010101010101010010101010
[+] 10101010101010101010101010101010
[+] 10101010101010110101010101010101
[+] 01010110101010101010101010101010
[+] 10101010101010101001010101010101
[+] 01010101010101010101010101010101
[+] 10101010101010101000101010101010
[+] 10101010010101010101010101010101
[+] 01010101010101010101010101010101
[+] 01010101010101010101010101010101
[+] 01010101010101101010101010101010
[+] 11010101010101010101010101010101
[+] 01101110101010101001010101010101
[+] 01010101010101010101010101010101
[+] 01010101010101010010010100100010
[+] 10101010100100111010110010100101
[+] 01001010101010001101000100101010
[+] 10010110100100101010010101010101
[+] 01011001010101101010110101010100
[+] 10100100101001101001010100100101
[+] 01110101010100101010110101000011
[+] 01010101010101110100010101000101
[+] 01010101010010101000101010101

[=] Possible PSK1 modulation detected!
[=] Could also be PSK2 - try ‘data rawdemod --p2’
[=] Could also be PSK3 - [currently not supported]
[=] Could also be NRZ - try 'data rawdemod --nr

[=] PSK - auto correlations
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size
[?] No repeating pattern found, try increasing window size

Progress?

mhcasc · May 19, 2024, 11:59pm

I’m pretty sure what you have isn’t RFID.

You say it reads from “the couch” (presumably the couch is more than a few cm from the reader, normal RFID tags (excluding UHF) don’t work over that range
It has a battery, normal RFID tags (again excluding some UHF models) are powered by the reader
Two of the chips I can see on the board are AS3933 LF Receiver and BK2461 RF SOC.
There appears to be a radio style antenna (as opposed to an RFID coil) on the board next to the BK2461

The AS3933 is specifically marketed for waking up a device when it detects a specific 15-150 kHz signal, and the BK2461 operates in the 2.4GHz range (which match the product brochure). I think the door emits a 125kHz signal, when the tag gets close enough to detect the door signal it wakes up and broadcasts a 2.4GHz beacon that triggers the door.

It might be possible to DIY another tag (although you are unlikely to get it anywhere near as small or power efficient as the official tag) but it will be 2.4GHz radio, not an RFID tag.