Transponder Design
#271
Tech Apprentice
Joined: May 2015
Posts: 54
From: Sweden
Yes same person. we have found how to make a old amb id number. but it only works on old decoders, new one require a bit more. And it seems like Payalneg was on to something. If it only was to brute force what numbers that was valid or something more I don't know. But the 7 packages that have a bit counter in them that seems to go along the id number is probably what the new one also want.
I only have a old decoder so I can't test any further. My old decoder accepts numbers from 1 - 99999999 so not much verification on it..
I only have a old decoder so I can't test any further. My old decoder accepts numbers from 1 - 99999999 so not much verification on it..
#272
Tech Initiate
Joined: Aug 2013
Posts: 26
We happenned to swap CT1 & CT2 on howard cano transponders. should i switch them back to where they go? or does it matter if they stay that way?
please help
thanks
please help
thanks
#273
It will work a little better if they are in the correct places, but since the capacitors are so similar in value, and if the transponder works, then don't bother.
#274
Tech Apprentice
Joined: May 2015
Posts: 54
From: Sweden
Is it possible to use a 74ACT86 circuit instead of 74AC86? I guess it is just a slight difference in accepted logical High and Low voltages that differ. It is easier for me to source the 74ACT86 variant...
#275
#276
Tech Rookie
Joined: Dec 2014
Posts: 14
Hello I'm glad you were able to generate your own numbers !!!, I long ago that I'm trying but I could only generate signals from other transponders, unable to inverntar my own number, ABLE help, explaining how coding a number ???? I do not need the firmware but the process of how they are coded, greetings and already thank you very much
#277
Tech Rookie
Joined: Dec 2014
Posts: 14
And finally, i understood, how the mylaps encryption protocol works.
I'ts not 100%, i mean, what i can't make ANY 7-digit number.
At this moment i have list of 9000+ brutforced numbers, some of them are very cool (like 7707077 or 6668885).
Numbers was brutforced at decoder with 4.4 software on board.
I'ts not 100%, i mean, what i can't make ANY 7-digit number.
At this moment i have list of 9000+ brutforced numbers, some of them are very cool (like 7707077 or 6668885).
Numbers was brutforced at decoder with 4.4 software on board.
#278
Tech Rookie
Joined: Dec 2014
Posts: 14
PJT.X.zip
This is My Tranasponder. This is based on PIC16F1509. My transponder only copy the signal generated by an original, but not as generating its own number, can someone explain how. And try many combinations but do not function. Is the first issue of the carrier does not matter at length, luggage the next 3 are all the same transponders, then comes the number, is what I assume and ulimas 3 are the same in all transponders and the latter has no importance length. In total the transitida frame is formed by 22 3.579MHz RF packages. I can now copy the plot of cualqueir transponder type TX160 (equivalent to RC3) but I can not create my own number. I need help at this point, to explain to me how is the binary number that I put in the output, Thanks
This is My Tranasponder. This is based on PIC16F1509. My transponder only copy the signal generated by an original, but not as generating its own number, can someone explain how. And try many combinations but do not function. Is the first issue of the carrier does not matter at length, luggage the next 3 are all the same transponders, then comes the number, is what I assume and ulimas 3 are the same in all transponders and the latter has no importance length. In total the transitida frame is formed by 22 3.579MHz RF packages. I can now copy the plot of cualqueir transponder type TX160 (equivalent to RC3) but I can not create my own number. I need help at this point, to explain to me how is the binary number that I put in the output, Thanks
#279
Tech Apprentice
Joined: Jul 2014
Posts: 86
From: Sweden
Attachment 1300940
This is My Tranasponder. This is based on PIC16F1509. My transponder only copy the signal generated by an original, but not as generating its own number, can someone explain how. And try many combinations but do not function. Is the first issue of the carrier does not matter at length, luggage the next 3 are all the same transponders, then comes the number, is what I assume and ulimas 3 are the same in all transponders and the latter has no importance length. In total the transitida frame is formed by 22 3.579MHz RF packages. I can now copy the plot of cualqueir transponder type TX160 (equivalent to RC3) but I can not create my own number. I need help at this point, to explain to me how is the binary number that I put in the output, Thanks
This is My Tranasponder. This is based on PIC16F1509. My transponder only copy the signal generated by an original, but not as generating its own number, can someone explain how. And try many combinations but do not function. Is the first issue of the carrier does not matter at length, luggage the next 3 are all the same transponders, then comes the number, is what I assume and ulimas 3 are the same in all transponders and the latter has no importance length. In total the transitida frame is formed by 22 3.579MHz RF packages. I can now copy the plot of cualqueir transponder type TX160 (equivalent to RC3) but I can not create my own number. I need help at this point, to explain to me how is the binary number that I put in the output, Thanks
I have made a java program, mentioned in this thread before, that can generate what ever number you want. https://github.com/condac/openAST
To create a number convert it from decimal to binary 3456789 for example is 1101001011111100010101 in binary.
Then reverse bit order
1010100011111101001011
Then you need to add the "ghost bits" (called that because we had no idea what they do, they are NOT checksum, but rather counters for the unknown status packeges)
The ghost bits (x) are placed on every 4th position so you take one ghost bit then 3 of your number bits and fill out 0 in the end
x101x010x001x111x110x100x101x1(00)
The ghost bits can be all 0 for now.
Now run the numbers through the encoding algorithm.
The encoding algorithm is a checksum in sort, it works in a way that if you get a error in the signal it can tell what the next bit should be and fix it. 11 and 00 is a 0, 01 and 10 is a 1.
Running through the encoding algorithm we calculate the sum of certain bits with the formula (n-0)+(n-1)+(n-2)+(n-3)+(n-9)+(n-14)+(n-15)+(n-17)+(n-18)+(n-19)+(n-21)+(n-22)+(n-23) , if it is even or odd we get a 1 or 0. This gets the first bit in the 2 bit pair signal that we send. the second bit is opposite of the first bit from bit n-1.
(0)1010010000101110110010001010100
first bit is 0+0+0+0....+0 because we count non existing bits as 0. and then the data of n-1 is 0 so we get 00.
0(1)010010000101110110010001010100
Second pair is 1+0+0+0.... so we get a 1, and data of n-1 is 0 so for a 0 in data we get the same as the first bit so the second pair is 11
01(0)10010000101110110010001010100
third pair is 0+1+0+0...+0 even so we get 1, and data of n-1 is 1 so we get second bit the opposite as the first so we get 10
and so on...
the result is:
00111000011100101111111101001010010010100000010011 0001110100010011001111110000
but we have to cut the first pair away to get the correct result
11100001110010111111110100101001001010000001001100 01110100010011001111110000
then add the pre-amble. 1111100100010110 in front and you have the id number to send.
BUT this only work on old decoders. As you might have noticed if you try and get data from a transponder it sends more packages apart from the id number. And these packages we have no clue what they are apart from that the ghost bit is counting them with a 3bit-counter so there was 6 or 7 of them if I remember correct. New decoders seems to want this information also for a transponder to work correctly.
#280
Tech Rookie
Joined: Dec 2014
Posts: 14
Thank you very much !!!!, I had seen her and wanted to run the program does not work BSE.exe tells me that I need a library and download the instake in System and System32 on Windows, but the problem is not fixed.
Therefore lower the code in C ++ and I wanted but I skip a compile error. I saw the list of code in Java but not encourage me to download as they were several listings and as such are not compile Java.
But with the data you've been through I will make an algorithm in C in the PIC to generate code to pass me. If you look at my transponder it is based on those used in Moto Cross and race cars in the old TX160 transponders which generate a communication frame 22 RF packets whose times vary at specific times. Not knowing the protocol but read that it was a BPSK system, in this forum, entoces up a circuit of a TX260 which is made with a 16-bit TMS430 and implement my own version using a PIC16F1509 includes a CLC and use for odulador do BPSK data mixing 1 and 0 with the clock signal which is at 3,579 MHz, that's how come on the TX160 and TX260.
The sinusoid is generated in the tank circuit, which is tuned to 3.57MHz. The system works well but just can "clone" the signals generated by other transponders. I got copy 18 transpondersI borrowed but I wanted to create my own codes seeking to change the position of the packages, but I generated errors.
Now with this informmación you have given me, I will develop a new code that generates me a number without "copy signals".
I read that not all numbers can be ??? ARE VALID, Thanks for everything and our Lord God and follow it.
Therefore lower the code in C ++ and I wanted but I skip a compile error. I saw the list of code in Java but not encourage me to download as they were several listings and as such are not compile Java.
But with the data you've been through I will make an algorithm in C in the PIC to generate code to pass me. If you look at my transponder it is based on those used in Moto Cross and race cars in the old TX160 transponders which generate a communication frame 22 RF packets whose times vary at specific times. Not knowing the protocol but read that it was a BPSK system, in this forum, entoces up a circuit of a TX260 which is made with a 16-bit TMS430 and implement my own version using a PIC16F1509 includes a CLC and use for odulador do BPSK data mixing 1 and 0 with the clock signal which is at 3,579 MHz, that's how come on the TX160 and TX260.
The sinusoid is generated in the tank circuit, which is tuned to 3.57MHz. The system works well but just can "clone" the signals generated by other transponders. I got copy 18 transpondersI borrowed but I wanted to create my own codes seeking to change the position of the packages, but I generated errors.
Now with this informmación you have given me, I will develop a new code that generates me a number without "copy signals".
I read that not all numbers can be ??? ARE VALID, Thanks for everything and our Lord God and follow it.
#281
Tech Rookie
Joined: Dec 2014
Posts: 14
CONDAC:I wanted to run the code of their program on my machine, after installing the JDK 7,079. Running as indicated in the HELP tells me that the file is corrupt, you know it can be ???? No java and no is possible that I am doing something wrong
#282
Tech Apprentice
Joined: Jul 2014
Posts: 86
From: Sweden
Thank you very much !!!!, I had seen her and wanted to run the program does not work BSE.exe tells me that I need a library and download the instake in System and System32 on Windows, but the problem is not fixed.
Therefore lower the code in C ++ and I wanted but I skip a compile error. I saw the list of code in Java but not encourage me to download as they were several listings and as such are not compile Java.
But with the data you've been through I will make an algorithm in C in the PIC to generate code to pass me. If you look at my transponder it is based on those used in Moto Cross and race cars in the old TX160 transponders which generate a communication frame 22 RF packets whose times vary at specific times. Not knowing the protocol but read that it was a BPSK system, in this forum, entoces up a circuit of a TX260 which is made with a 16-bit TMS430 and implement my own version using a PIC16F1509 includes a CLC and use for odulador do BPSK data mixing 1 and 0 with the clock signal which is at 3,579 MHz, that's how come on the TX160 and TX260.
The sinusoid is generated in the tank circuit, which is tuned to 3.57MHz. The system works well but just can "clone" the signals generated by other transponders. I got copy 18 transpondersI borrowed but I wanted to create my own codes seeking to change the position of the packages, but I generated errors.
Now with this informmación you have given me, I will develop a new code that generates me a number without "copy signals".
I read that not all numbers can be ??? ARE VALID, Thanks for everything and our Lord God and follow it.
Therefore lower the code in C ++ and I wanted but I skip a compile error. I saw the list of code in Java but not encourage me to download as they were several listings and as such are not compile Java.
But with the data you've been through I will make an algorithm in C in the PIC to generate code to pass me. If you look at my transponder it is based on those used in Moto Cross and race cars in the old TX160 transponders which generate a communication frame 22 RF packets whose times vary at specific times. Not knowing the protocol but read that it was a BPSK system, in this forum, entoces up a circuit of a TX260 which is made with a 16-bit TMS430 and implement my own version using a PIC16F1509 includes a CLC and use for odulador do BPSK data mixing 1 and 0 with the clock signal which is at 3,579 MHz, that's how come on the TX160 and TX260.
The sinusoid is generated in the tank circuit, which is tuned to 3.57MHz. The system works well but just can "clone" the signals generated by other transponders. I got copy 18 transpondersI borrowed but I wanted to create my own codes seeking to change the position of the packages, but I generated errors.
Now with this informmación you have given me, I will develop a new code that generates me a number without "copy signals".
I read that not all numbers can be ??? ARE VALID, Thanks for everything and our Lord God and follow it.
I don't know why java don't work for you, you have to try your java with some other .jar program to verify your installation is working I think. It can be that your anti virus software if any is blocking it.. also JDK 7.079 is old but it should work with old java... It was compiled in java 7 something i think.
I just downloaded and run the .jar from github on my linux machine and it works, not corrupted in any way. my output: $ java -version
java version "1.8.0_25"
Java(TM) SE Runtime Environment (build 1.8.0_25-b17)
Not all numbers works on nev transponder systems. Payalneg said he found out a way to brute force numbers that worked but he have not said any details to what he found out. My self I have access to old decoder box that accept any number, and yes I mean any number from 1 to 99999999.
The system for motocross might work different. It might use a diffrent coding algorithm. But its easy to verify if you have recorded the bits from the signal and know the number you can generate and compare if it is the same.
#283
Tech Rookie
Joined: Dec 2014
Posts: 14
Thank you so much for your time !!! I will check my JDK work with another piece of software and keep it updated on my progress. Whenever I get my new code I put in the forum so that others can make transponders and can save a few dollars !!!
A hug !!!!
A hug !!!!
#284
Tech Rookie
Joined: Dec 2014
Posts: 14
CONDAC: I could finally run the program !!! NetBean Intale the environment and there as I could compile and run without problems !!!!. I have some questions about the outcome that generates:
The result encode2 does it do?
The result encodeOut: the string that is passed ???
In this case what is the address data output, comes the most significant bit or less less significant first ???
* I finally do not match because the string bits encodeOut with the constant LDI hexa who are then ????
I hope not generate large molestiann with my questions but I need because it depends on the way in which I will develop my code in PIC, as out of a bit at a time as if it were a serial asynchronous communication, Greetings
The result encode2 does it do?
The result encodeOut: the string that is passed ???
In this case what is the address data output, comes the most significant bit or less less significant first ???
* I finally do not match because the string bits encodeOut with the constant LDI hexa who are then ????
I hope not generate large molestiann with my questions but I need because it depends on the way in which I will develop my code in PIC, as out of a bit at a time as if it were a serial asynchronous communication, Greetings
#285
Tech Rookie
Joined: Dec 2014
Posts: 14
CONDAC:you can you send or post a picture of the signal generated by the transponder RC3 where they could generate their own ID, as did the routine to generate the signal, using an ID I clone and it works because the decoder reads, but the signal generated my routine generates a carrier formed by very different signal packets clone.
I charge number is 721 583, usate may charge this number in one of its transponders and take a picture of the shape of the carrier with some packages so you can see if it generates my team and to know if this bad my routine or RC3 coding system can not be applied to the transponders TX160 Moto Cross. Thank you very much for your help
I charge number is 721 583, usate may charge this number in one of its transponders and take a picture of the shape of the carrier with some packages so you can see if it generates my team and to know if this bad my routine or RC3 coding system can not be applied to the transponders TX160 Moto Cross. Thank you very much for your help



3Likes