In other words, if I wanted to create a receiver that would detect a nearby fob, what would I need to listen for? Is it within the Bluetooth range of 2.402 GHz to 2.480 GHz range?

3 Answers 3


Automotive keyless entry systems typically operate at either 315MHz or 433MHz. If you use an RTL-SDR you can pickup the signals. There are also aftermarket antennas specifically tuned to pickup these signals. Depending on the transmitter, you may also be able to get an antenna+decoder pair that will decode/decrypt the (probably) encrypted signal.

Despite these systems typically being encrypted, they very well may be vulnerable to practical attacks. Theese systems are generally designed to hinder sniffing and/or forging a valid message (given the proper hardware), but many implementations are flawed. KeeLoq is popular a popular algorithm, but it's vulnerable to replay attacks as well as being weak enough to be reasonably brute-forced.


Each transmitter has an FCC ID somewhere on it. My Toyota remote has "FCC ID HYQ14FBA" in embossed plastic on the back of the remote. Use this to plug in at FCC ID Search. The Grantee Code in this case is "HYQ" and the product code is "14FBA" for the search form. Records for this product should be shown. In my case, you can see the transmitter operates at 2 frequencies: 312.10 MHz and 314.35 MHz. You can dig into the other detailed documents and find it is an FSK signal, and I see the signal hops back and forth between the 2 frequencies for each key press of the remote on my communications analyizer.

  • Surely FCC codes would only be present on fobs sold in the USA.
    – Chenmunka
    Jan 4 at 18:17

160mhz on FM analog will pick up frequency

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .