I moved into to a new rental property and was given one key fob for the garage. I thought I might clone it and use an Arduino to make some more but I cant track down the frequency its running on. I have been scanning with an RTL-SDR across the 300 - 433mhz range but nothing, any ideas on what to try next?

 

Are there any numbers/codes/labels printed or moulded on the casing of the key fob or the reverse side of the circuit board?
Even if you know the RF frequency, the fob for a recent opener may be using a rolling code. How would you synchronise your clone with that?

 

What does the other side of the PCB show? Some door operators use or used to use a SAW oscillator (https://www.microsemi.com/product-d...aw-products/3880-rf-microwave-saw-oscillators), and the ones I have opened were marked with a frequency. There is also an obvious antenna, which I don't see on on the side you show.

 

What does the other side of the PCB show? Some door operators use or used to use a SAW oscillator (https://www.microsemi.com/product-d...aw-products/3880-rf-microwave-saw-oscillators), and the ones I have opened were marked with a frequency. There is also an obvious antenna, which I don't see on on the side you show.

Yeah i was looking for a crystal or something to give some sort of indication but found nothing. the reverse side of the pcb doesn't help much but you can see the track that is used for the antenna but still doesn't help

 

There is a trimmer capacitor and to its left in the picture a black thing surrounded by three capacitors. The black thing has three terminals from the pcb rear picture.
I think the black thing is an inductor which, with capacitors forms a tuned circuit which sets the TX frequency so the only accurate way of getting the frequency is to measure it but as it will be some form of pulsed output when a button is pressed this will be difficult/impossible with 'normal' frequency meters. You might be able to do it with a spectrum analyser or a grid dip oscillator.

 

Are you sure you need the frequency? If in the US, consider getting a cheap, 2-button, programmable "universal" opener, and see if it works. You want an opener that can learn, not the older type that uses switches for the code.

Maybe you can work backwards? What brand of opener is in the garage? Apparently Genie are all 315 and 390 MHz. Chamberlain and LiftMaster may have their own preferred frequencies.

 

Maybe you can work backwards?

That's what I was going to suggest - get up on a ladder and read whatever you can off the motor/chain housing. A little searching on the model number should uncover both the frequency and how it works. Or just get a learning remote. My cars all have buttons that can learn your garage door code. They work great and have a larger range. I never use the opener that came with the opener anymore.

 

@Andrewlapham The transmitter likely operates at 340Mhz, from what I've found regarding remotes and garage door openers that use that IC. The RT1762PN produces the control signals and modulates the carrier. You can see L1, VC1, and Several other capacitors which are used to tune it. I admit I'm a bit stumped without reverse engineering it, as I don't see X1 (crystal) anywhere-- It is possible this IC has one internally as a later revision of an earlier RT1762xN by RATO.

This is the ONLY document I could find thus far- and even it doesn't quite match:



I'm looking to see if I have a datasheet for the RT1762PN.

EDIT: I did not make the above drawing, I found it online.

 

@Andrewlapham The transmitter likely operates at 340Mhz, from what I've found regarding remotes and garage door openers that use that IC. The RT1762PN produces the control signals and modulates the carrier. You can see L1, VC1, and Several other capacitors which are used to tune it. I admit I'm a bit stumped without reverse engineering it, as I don't see X1 (crystal) anywhere-- It is possible this IC has one internally as a later revision of an earlier RT1762xN by RATO.

This is the ONLY document I could find thus far- and even it doesn't quite match:

View attachment 229675

I'm looking to see if I have a datasheet for the RT1762PN.

I couldn't find any datasheet for the chip anywhere. I was completely stumped too but then assumed that the chip must have had the oscillator built in. it would be great if you had a datasheet though. thanks for the frequency lead though i'll start scoping around the 340mhz range and see if I find anything.

 

I couldn't find any datasheet for the chip anywhere. I was completely stumped too but then assumed that the chip must have had the oscillator built in. it would be great if you had a datasheet though. thanks for the frequency lead though i'll start scoping around the 340mhz range and see if I find anything.

I do not think the RT1762PN chip has the oscillator. This is probably the oscillator section with an RF NPN transistor:



Those components connect to the loop antenna. Here's a typical circuit from another garage door remote:

 

Do you have a scope with FFT mode and a sampling rate of 1 GHz or more? Using a 60 MHz scope with those specs you can probably spot the signal unless it is half the scope's sampling rate or the manufacturer took liberties with the bandwidth rolloff.

The SDR scanner should have caught something.

Is the fob known to work?

 

Do you have a scope with FFT mode and a sampling rate of 1 GHz or more? Using a 60 MHz scope with those specs you can probably spot the signal unless it is half the scope's sampling rate or the manufacturer took liberties with the bandwidth rolloff.

The SDR scanner should have caught something.

Is the fob known to work?

Yes it does work, I've tested the SDR with my car keys that run on 433Mhz and can see the signal so i know that the SDR and the Garage key are both functional.

 

Yes it does work, I've tested the SDR with my car keys that run on 433Mhz and can see the signal so i know that the SDR and the Garage key are both functional.

At this point I'm actually considering putting a servo next to the box inside to physically press the button lol

 

What brand of opener/opener receiver is it? Your fob may be missing the FCC notice, but the receiver shouldn't be.

 

What brand of opener/opener receiver is it? Your fob may be missing the FCC notice, but the receiver shouldn't be.

Its a Steel-Line. i will take the cover off today and have a look at the PCB but considering there is a tuning pot on the side of the case id assume that the circuit would be similar to the fob as in the oscillator may be made up of passive components.

 

I do not think the RT1762PN chip has the oscillator. This is probably the oscillator section with an RF NPN transistor:

View attachment 229728

Those components connect to the loop antenna. Here's a typical circuit from another garage door remote:


View attachment 229727

The problem is that the above is a variable capacitor, and I cannot find a transistor anywhere on the PCB (either side). Can the TP get another shot of the above, better lit?

 

The problem is that the above is a variable capacitor, and I cannot find a transistor anywhere on the PCB (either side). Can the TP get another shot of the above, better lit?

 

View attachment 229787

I Can only see a tiny bit of the transistor label and can make out 'H1'

 

Its a Steel-Line. i will take the cover off today and have a look at the PCB but considering there is a tuning pot on the side of the case id assume that the circuit would be similar to the fob as in the oscillator may be made up of passive components.

A tuning pot? I suspect that is not for tuning but for setting something like obstruction sensitivity, light timer, closing distance, and so forth.


Maybe this will help focus the search for operating frequency:


Now you know where to look with your SDR.

As for the transistor, the picture I posted in #10 clear shows something consistent with a T0-92 when lightened.

 

A tuning pot? I suspect that is not for tuning but for setting something like obstruction sensitivity, light timer, closing distance, and so forth.


Maybe this will help focus the search for operating frequency:
View attachment 229811

Now you know where to look with your SDR.

As for the transistor, the picture I posted in #10 clear shows something consistent with a T0-92 when lightened.

Bingo 310mhz!