HCS301 - Page 1
Forum section: electronics / rf-microwave

author: Charlie86
author_rank: Regular Contributor
timestamp: January 03, 2020, 11:58:00 am
content: Hi,Is there any way to clone garage door opener based od HCS301 chip.I am looking some universal remotes on ebay and AliExpress. Some of them claim that they can clone rolling code from original remote and some doesn’t.At work we have only few remotes so we need to share them, it would be nice if we can clone then so everyone would have it.Thanks

author: rvalente
author_rank: Frequent Contributor
timestamp: January 19, 2020, 07:41:15 pm
content: HCS is based on a fixed code + rolling code. The fixed has the SN + pressed buttons, the rolling has after description, the last SN digits + pressed buttons + the counter. The counter incs every time a button is pressed. The encryption them will change because the counter increased.Lets assume the device can decrypt the key and them clone the SN. If you have two remotes with the same code, and the receiver keeps tracks of the counter (which is the safety afterall) only one remote will work at a time.Lets say the controller A has a counter of 15, and has been cloned. Now you have two remotes with the same code and counters. If remote A is used the counter is now 16 as remote B is 15. The keeps track of the SN of remote A and its counter, 16. When remote B is used the counter is 16, which is equal and the receiver will just ignore it, since the counter to be valid has to be bigger them the stored value.So, cloning HCS is pretty straight forward, but wont work. (Of course, if it has been correctly implemented).Maybe this cloner will generate a random or different (inc maybe) SN, that would work. But if your neighboor happen to have the same SN, you can open each other garage door..Soo keeping track of the SN is very important.After all, why bother, cant you buy the remote? Is that expensive?

author: ozcar
author_rank: Frequent Contributor
timestamp: January 19, 2020, 09:27:42 pm
content: Quote from: rvalente on January 19, 2020, 07:41:15 pmI bought a couple of so-called cloners (mentioned here:https://www.eevblog.com/forum/chat/universal-fixed-and-rolling-code-remote-control-duplicator/), and as expected they do not really clone the original, as that could cause trouble if you then tried to use both the original and new remotes. The serial numbers they used did appear to be randomly generated.Once you have completed the copy/clone process (which really seems to just be a way to work out which manufacturer key to use), the new remote still has to be programmed to the receiver by the normal process for that receiver (typically, by pressing a "learn" button).If genuine or cheaper generic replacements remotes for you specific receiver are available, there is not much point in getting one of the so-called cloner remotes. One situation where they may be useful though, is if you want to operate multiple door openers of different brands from the same remote.

author: rvalente
author_rank: Frequent Contributor
timestamp: January 21, 2020, 11:04:53 am
content: I'm not by far a cryptography expert, but i believe this so called "cloners" may have a few decryption keys inside, them they test the signal from your remote and generate a random new SN.

author: ozcar
author_rank: Frequent Contributor
timestamp: January 21, 2020, 07:04:15 pm
content: Quote from: rvalente on January 21, 2020, 11:04:53 amA remote built on a HCS301 only contains the encryption key for that specific remote (as identified by the serial number). A receiver for such a remote, on the other hand, needs to be able to determine the decryption key to use for remotes with different serial numbers, and that is typically done by using another master or "manufacturer" key to derive the specific device key from the serial number (in some cases, together with a "seed" value). So the receiver has to contain the manufacturer key, while the remotes only contain a derived device key.The fact that these so-called cloning remotes appear to generate a random serial number, seems to imply that they must contain a table of different manufacturer keys. If they used a pre-assigned serial number, the remotes would only need a table of device keys for different manufacturers. From a security point of view, having a single device containing multiple manufacturer keys does not sound like a good idea, but perhaps they do it the way they do because it simplifies the manufacturing process (no need to program each remote with a serial number, and a corresponding set of derived device keys).