In other words, if I wanted to create a receiver that would detect a nearby fob, what would I need to listen for? Is it within the Bluetooth range of 2.402 GHz to 2.480 GHz range?


Automotive keyless entry systems typically operate at either 315MHz or 433MHz. If you use an RTL-SDR you can pickup the signals. There are also aftermarket antennas specifically tuned to pickup these signals. Depending on the transmitter, you may also be able to get an antenna+decoder pair that will decode/decrypt the (probably) encrypted signal.

Despite these systems typically being encrypted, they very well may be vulnerable to practical attacks. Theese systems are generally designed to hinder sniffing and/or forging a valid message (given the proper hardware), but many implementations are flawed. KeeLoq is popular a popular algorithm, but it's vulnerable to replay attacks as well as being weak enough to be reasonably brute-forced.


160mhz on FM analog will pick up frequency

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.