Rick's b.log - 2022/04/01
It is the 18th of December 2024 You are 3.139.87.234, pleased to meet you!

April Fool?

Oh dear - brrr!

I have wrapped up my grape in the hope that it will survive the coming weekend. When it might snow. Well, not so much here but quite possibly in Paris. The forecast is yoyoing between -3 and -1. Which for me would imply -5 to -3 (being in a dip, it's always a couple of degrees colder).

Sadly, I cannot say that the weather forecast was an April Fool. Just open the door and... yeah... close it really quickly. I think I'll be watching Netflix this weekend - I'm quite enjoying Lucifer, a bizarre police procedural where the useful assistant is the devil...and everybody seems to think that it is some sort of peculiar roleplay that the guy is doing.

I have wrapped up the grape, I hope it makes it. And right now I have two nice sized potatoes in the halogen oven. When they are done, a bit of cheddar from Somerset (thankfully not broken by Brexit) will be a nice filling.

Trying to protect my grape from the cold.

Oh dear - work without me

The cleaning, on the other hand, had not been done. Thankfully one of the management bods had thought to change the bin bags. But the floors, toilets, break room... not touched.
And it showed.
On Monday, lots of complaints about how bad it was.
Now? People saying "You can tell when Richard is back".

I guess it's nice to be missed...

Key fob hack

Replacement remote control.

It is supposed to run off of two CR2016 cells (6V), but recently I've been running it from a single CR2032 cell. The reason is basically two cells cost more than one. It does work, but less power means shorter transmission range.

With a small stack of dead batteries on the table, I decided that enough was enough. Time to look for a Plan B.

Here is the button side:

Remote control, button side.

And here is the component side:

Remote control, component side.

I think I have figured out why the original Aixam key could no longer be programmed to my car (I tried, it failed).
If you recall from my entry on hacking the door lock, you may recall that the code transmitted was the same. This utter lameness meant that a simple capture and repeat could unlock my car, as the standard lock was based upon the HS2240 chip.
Well, I guess it was to my benefit that the thing was broken, as it appears that they failed to find a working controller so instead opted to completely replace it with a different one. This one working with an HCS301 chip inside it. This device transmits a larger data stream in two parts. The first part is a plain serial number and what buttons are pressed, and the second part is a scrambled code that uses rolling numbers, so capturing a tranmission to replay will not work as a code that has been "seen" will be rejected because the receiver will know which codes are expected next.
Actually, I think most receivers manage a window of something like 32 to 256 advance codes, so you won't be locked out of your car if you fiddle with the controller and press the buttons a few times.
Now, I'm not sure if my car's receiver pays attention to the encoded part or if it just ignores that and uses the serial number to match and then the button details. I have not yet been able to find the receiver box. I did find one, about the size of an old style Tictacs box but thinner, however there's no antenna wire coming from it so I would guess that the thing that I found is the controller for the automatic windows.

Back to our plan. Now there are two primary things to observe, along with their responses.

• My car only uses two buttons - lock and unlock.
  The control has three buttons.
• The battery runs flat in a week or so.
  The battery should, therefore, be switched.

You can see what we're aiming for, right?

Amazingly, it looks like the remote control board was designed to facilitate a Rick hacking power control into the thing. The +ve side of the battery is the big metal holder, which is soldered to the board at both top and bottom.
The top, closest to the chip, is electrically connected to provide positive power to the circuit. The other side is just there to hold the metal holder in place, it isn't connected to anything.
It is, however, right beside the unused button.
Even better, the buttons are all wired to the positive line (so a button press will pull one of the inputs up to +ve level).

The method is now really clear, and it's literally a five minute job.

The first step is to unsolder the battery holder from the +ve input. I'll have to leave that disconnected and wrap it in tape to prevent it making contact. The battery will remain in place as there's not really anywhere it can go when inside the shell of the remote.

The next step is to cut the connection between the unused button and the chip.

The final step is to scrape the insulation off of the circuit track leading to the unused button, and with a short piece of wire, bridge the gap between the battery holder and the button.

Like this:

Remote control, modified.

That's it. Job done.

I now have to press the third button as well as either the lock or unlock buttons (it works best if I press it just a half second before the lock control, give the chip and oscillator time to power up).

If it is reliable (as in, battery doesn't die in a week) then I'll get some CR2016's to power it properly from the expected 6V.

Your comments:

David Pilling, 3rd April 2022, 16:56

That's a good fix.  You could have just turned on your heat vision and spotted the component where the energy is going to waste.  First step connect current meter and see what the battery drain is when doing nothing.  Something must be leaking, but finding it might be difficult. See what the isolation is like when no switches are pressed, is the power leaking through the switches. Guess might be a capacitor across the battery which is leaking. The bad news is probably the chip is leaking.