← Back to Labs

Sub-GHz RF & Rolling Code Security

Step through 315/433 MHz ASK signal transmission, KeeLoq framing, SDR rolljam timing, and counter resynchronization

ASK 433MHz (N=1000)🔑 KEY FOB⚡Counter RegisterN = 1000📡 SDR ATTACKERBuf A: EmptyBuf B: Empty🚗 CAR BCM🔓UNLOCKEDExpected RegisterN_exp = 1000COUNTER SYNCED (N = 1000)
STEP 1 OF 6

Normal Key Fob Transmission

When you press your car key fob, it sends an RF signal (315 MHz or 433.92 MHz ASK/OOK) containing an encrypted rolling code counter (N=1000). The vehicle receiver decrypts the code and unlocks because the counter matches expectations.

Arrow keys to navigate · R to reset

Tap dots to jump to any step

Read the full article →Take the quiz →