Unlocking Vehicles by Brute Forcing Rolling Code Systems

The talk examines an aftermarket rolling code key fob system used by many vehicles to prevent cloning. The researcher sorts key fob schemes into fixed, learning and rolling designs, then records a fob and decodes its amplitude-keyed radio signal. The frame turns out to hold several counters and a short random value sent in plain text rather than encrypted. Mapping how each counter advances gives the full frame layout.

Next, the talk moves from passive capture to active testing. The random field is only six bits, so guessing it is quick once the layout is known. A rollback weakness in the resynchronization logic lets an attacker move the receiver's counter window back to older values. Combined with brute forcing, demonstrations unlock a car in under a minute, and one sniffed code plus the rollback is enough to clone a fob. Observed responses from the receiver microcontroller are used to reconstruct its validation logic.

Three or four CVEs were assigned in 2026 after coordinated disclosure. The speaker reports similar algorithms in other aftermarket fobs and traces how parts pass through distributors in Latin America whose staff often cannot name the manufacturer. The takeaway for practitioners is that a rolling counter alone is not sufficient: counter window size, resync rules and random-value entropy must be tested directly.