[yyyyyyyyyy]

Hi,

I am interested in finding out how to build, or how to get, the equipment to relay attack a car with passive keyless entry/start system. Does anyone know where to find information on this?

/Mike

[jBloq]

A few "keyless" system operate through radio waves. Find the FCC ID of the car you are interested in and see what frequency it listens on. Afterwards, use a RTL SDR to capture the data transmitted over the frequency. Then create a simple board that uses RF to transmit data on the frequency and it should work.

ps: you have a long journey ahead

[Nechifor]

Send me a pm, i have some info about that.

[FriendZone]

A few "keyless" system operate through radio waves. Find the FCC ID of the car you are interested in and see what frequency it listens on. Afterwards, use a RTL SDR to capture the data transmitted over the frequency. Then create a simple board that uses RF to transmit data on the frequency and it should work.

ps: you have a long journey ahead

He should also use the first captured signal to open the car for the owner after the first attempt capturing the second one and using it before a third generated signal.

Basically he needs something able to jam the signal and capture it, the car won’t open, use it as soon the target car owner use a second signal to open the car, jam and capture it again, and simultaneously use the previous capture signal to open the car for the owner.

[-Aspect-]

https://www.youtube.com/watch?v=M2JY1_Xmokg&t

---

Just checking in.
I published this video a few days ago




It's possible, and it's cheap.
Although, rolling keys take a bit more effort, as jamming is necessary.

[Nechifor]

That's not what he's looking for. That's a device like Samy's RollJam, but he's looking for a passive keyless entry/ start device like those guys using in the Youtube "Relay attack Solihull" video

[leoneldahma]

Hi isn't it a radio signal booster you are wanting. I know English keyless cars are on 433.92mhz

[cyberkun]

Hi,

I am interested in finding out how to build, or how to get, the equipment to relay attack a car with passive keyless entry/start system. Does anyone know where to find information on this?

/Mike

Hi Mike.depending on your location you just buy them online.If you are good with electronics and coding, only the will you be able to reverse engineer or build similar devices from plans , books and other info available. most of the parts are easily available but the programming of the chips and the pcb design will be tricky.
You have to relay 2 different frequency spectrums,if you want to go for maximum attack range LF (NFC for the wake up signal and the key challenge) and HF(UHF) to actually unlock and lock the vehicles( also works on some motor bikes) . but by taking that route you will have to tweak the signal runtime, by using the righ frequency and the right chips for fast processing..you only have few ms for the whole process to succeed.if you need more info hit me up.

A few "keyless" system operate through radio waves. Find the FCC ID of the car you are interested in and see what frequency it listens on. Afterwards, use a RTL SDR to capture the data transmitted over the frequency. Then create a simple board that uses RF to transmit data on the frequency and it should work.

ps: you have a long journey ahead

A few? 99% of all PKES use radio waves and less than 1% uses biometrics as a "key". capturing the system is not working on keyless systems for several reasons.

The wake up signal between keyfob and BCM are time restricted and can not be replayed...thats why it's called a relay attack .your advice is useless for what the OP is asking.

He should also use the first captured signal to open the car for the owner after the first attempt capturing the second one and using it before a third generated signal.

Basically he needs something able to jam the signal and capture it, the car won’t open, use it as soon the target car owner use a second signal to open the car, jam and capture it again, and simultaneously use the previous capture signal to open the car for the owner.

Same as above...completely wrong attack...

Unlock Cars with a Raspberry Pi And SDR - Replay attack - YouTube

---

Just checking in.
I published this video a few days ago
[video=youtube]Unlock Cars with a Raspberry Pi And SDR - Replay attack - YouTube[/video]

It's possible, and it's cheap.
Although, rolling keys take a bit more effort, as jamming is necessary.

still the wrong attack but nice video though

Hi isn't it a radio signal booster you are wanting. I know English keyless cars are on 433.92mhz

Yes, but just boosting the signals is not enough as i wrote previously. In most cases the frequencies used are according to international standards or the asigned/available frequency spectrum plus all unmodified keyless vehicles use 125 / 130 kHz (Audi: 20 kHz) in the LF spectrum and with small deviations Europe: 433 MHz/868 MHz and Japan and the USA: 315 MHz in the HF spectrum.

[Jinxter]

Hi Mike.depending on your location you just buy them online.If you are good with electronics and coding, only the will you be able to reverse engineer or build similar devices from plans , books and other info available. most of the parts are easily available but the programming of the chips and the pcb design will be tricky.
You have to relay 2 different frequency spectrums,if you want to go for maximum attack range LF (NFC for the wake up signal and the key challenge) and HF(UHF) to actually unlock and lock the vehicles( also works on some motor bikes) . but by taking that route you will have to tweak the signal runtime, by using the righ frequency and the right chips for fast processing..you only have few ms for the whole process to succeed.if you need more info hit me up.




A few? 99% of all PKES use radio waves and less than 1% uses biometrics as a "key". capturing the system is not working on keyless systems for several reasons.

The wake up signal between keyfob and BCM are time restricted and can not be replayed...thats why it's called a relay attack .your advice is useless for what the OP is asking.


Same as above...completely wrong attack...
still the wrong attack but nice video though



Yes, but just boosting the signals is not enough as i wrote previously. In most cases the frequencies used are according to international standards or the asigned/available frequency spectrum plus all unmodified keyless vehicles use 125 / 130 kHz (Audi: 20 kHz) in the LF spectrum and with small deviations Europe: 433 MHz/868 MHz and Japan and the USA: 315 MHz in the HF spectrum.

Listen to this man, great advice right there.

---

Hi isn't it a radio signal booster you are wanting. I know English keyless cars are on 433.92mhz

Boosting can work over a limited range but it is the 125khz signal that needs to be 'boosted' or relayed and without relaying the 433Mhz signal back you are limited to it's normal range.

This is what's happening in many of the videos or news articles you see, the 433Mhz remote in the house is in range of the car already.

[gasvo99]

hi,
i want to make a keyless go amplifier.
It may be for short distances for testing purposes.
Anyone have any interesting information? what is best to use what works?

Thanks

[cyrusdavirus]

@cyberkun please contact me as soon as possible

[bisla002J]

A guy literally uploaded a video on the same topic on youtube

[BigEzA]

Anyone have a link to a cheap relay set up? I have spent hours looking for just the right system but I don’t have thousands of dollars right now.

---

Anyone have a link to a cheap relay set up? I have spent hours looking for just the right system but I don’t have thousands of dollars right now.

[SIM-5186353]

Anyone have a link to a cheap relay set up? I have spent hours looking for just the right system but I don’t have thousands of dollars right now.

---

Anyone have a link to a cheap relay set up? I have spent hours looking for just the right system but I don’t have thousands of dollars right now.

Try buying a rtl sdr and a hackrf, for roll jam attacks. The clone hackrf it's pretty good, and it's better if you buy the portapack.

[BigEzA]

I’m looking to copy the fob and send the signal