Spoofing TPMS signal - Page 8 - Subaru Outback - Subaru Outback Forums
 45Likes
Reply
 
LinkBack Thread Tools Rating: Thread Rating: 1 votes, 1.00 average.
post #71 of 81 (permalink) Old 06-02-2018, 08:30 PM
Registered User
 
atc98092's Avatar
 
Join Date: Nov 2017
Location: Auburn WA
Car: 2018 Outback Touring 3.6R
Posts: 971
Feedback Score: 0 reviews
I monitored my TP display the other day to see how long it takes. Remember that mine is a 2018 with individual tire pressure readouts, so it's possible earlier years aren't the same. But it took about 30 seconds for my display to show the pressures.


Dan

2018 Outback Touring 3.6R


To view links or images in signatures your post count must be 10 or greater. You currently have 0 posts.
atc98092 is offline  
Sponsored Links
Advertisement
 
post #72 of 81 (permalink) Old 06-02-2018, 08:31 PM
Registered User
 
Dennis_Root's Avatar
 
Join Date: Sep 2017
Location: Cantin, ct USA
Car: 2008 Outback limited 2.5l
Posts: 27
Feedback Score: 0 reviews
I agree that once recoreded you should be able to retransmit and spoof it. When you finally get it recorded, see how often it is transmitted. Probably transmits around once a minute. Atlest that seems to be the avarge of the different chip sets I have seen. If it has to be decoded it should be a binary signal. The preambe of that signal wold most likely be the sensor ID. After that should be the pressure signal. Just a few byte's of data.

Sent from my SM-N950U using Tapatalk

Dennis_Root is online now  
post #73 of 81 (permalink) Old 06-02-2018, 08:50 PM
Registered User
 
Dennis_Root's Avatar
 
Join Date: Sep 2017
Location: Cantin, ct USA
Car: 2008 Outback limited 2.5l
Posts: 27
Feedback Score: 0 reviews
Something else I just thought of. Do you have the tool to trigger the sensor for activation? You may be able to use that. It should wake it up and cause it to transmit. You will need to record all 4 wheels to spoof the sensors.

Sent from my SM-N950U using Tapatalk
Dennis_Root is online now  
post #74 of 81 (permalink) Old 06-02-2018, 09:00 PM Thread Starter
Super Moderator
 
Brucey's Avatar
 
Join Date: Nov 2005
Location: WV
Car: '17 3.6 Limited
Posts: 8,800
Feedback Score: 0 reviews
Quote:
Originally Posted by Dennis_Root View Post
Something else I just thought of. Do you have the tool to trigger the sensor for activation? You may be able to use that. It should wake it up and cause it to transmit. You will need to record all 4 wheels to spoof the sensors.

Sent from my SM-N950U using Tapatalk
I wonder if the quick tool others have recommended can wake up these sensors so I can get a clear signal while they're stationary.
Brucey is offline  
post #75 of 81 (permalink) Old 06-02-2018, 09:03 PM
Registered User
 
Dennis_Root's Avatar
 
Join Date: Sep 2017
Location: Cantin, ct USA
Car: 2008 Outback limited 2.5l
Posts: 27
Feedback Score: 0 reviews
That's what I am thinking. On wake up they should report the same as if in motion without all the waiting around.

Sent from my SM-N950U using Tapatalk
Brucey likes this.
Dennis_Root is online now  
post #76 of 81 (permalink) Old 06-20-2018, 05:28 PM Thread Starter
Super Moderator
 
Brucey's Avatar
 
Join Date: Nov 2005
Location: WV
Car: '17 3.6 Limited
Posts: 8,800
Feedback Score: 0 reviews
Today I borrowed a friends autel maxitpms which made it easy to pick out the signal and get a clear recording. Needed to adjust bandwidth and gain a bit but its clear as day.

Recorded the signal it broadcast as 4 individual files. Had some static too but the signal was clearly there on SDR.

Very strong and noticeable when it broadcast.

Next step: playing .wav files and broadcasting them at 315 mhz.

I'll go ahead and post the files here in case anyone wants to decode it in the mean time.

https://drive.google.com/open?id=1D2...wGJuxtyicEgDxf

https://drive.google.com/open?id=11g...V-G-IdVwbX1sav

https://drive.google.com/open?id=15A...SSa7fyBA7zOGCe

https://drive.google.com/open?id=1uM...mDaLQqFEzO3TNg
skipw, huggy_d1 and N4HHE like this.
Brucey is offline  
post #77 of 81 (permalink) Old 06-21-2018, 04:56 PM Thread Starter
Super Moderator
 
Brucey's Avatar
 
Join Date: Nov 2005
Location: WV
Car: '17 3.6 Limited
Posts: 8,800
Feedback Score: 0 reviews
So working on the transmitter now.

I found pretty thorough how to guide using 433 mhz transmitters with raspberry pi.

https://www.rtl-sdr.com/tutorial-rep...-pi-and-rpitx/

I'm running arduino and 315 mhz but it looks like that pi is configurable as far as frequency it transmits on.
CS_AR likes this.
Brucey is offline  
post #78 of 81 (permalink) Old 07-07-2018, 05:21 PM Thread Starter
Super Moderator
 
Brucey's Avatar
 
Join Date: Nov 2005
Location: WV
Car: '17 3.6 Limited
Posts: 8,800
Feedback Score: 0 reviews
Note for @Fibber2 :

I did the sensible thing you suggested and traded in 3 sets of wheels and tires for 2 set of wheels and tires with a clone-able TPMS system installed.

THAT SAID I still plan to try to fool the car with a clone of the TPMS signal because I can and I'm yet to see anything that tells me I can't.
Fibber2 likes this.
Brucey is offline  
post #79 of 81 (permalink) Old 01-10-2019, 03:15 PM Thread Starter
Super Moderator
 
Brucey's Avatar
 
Join Date: Nov 2005
Location: WV
Car: '17 3.6 Limited
Posts: 8,800
Feedback Score: 0 reviews
https://github.com/JoeSc/Subaru-TPMS...ster/README.md

This guy has the same idea on a WRX and made it a lot further.
N4HHE and subi_driver like this.
Brucey is offline  
post #80 of 81 (permalink) Old 01-11-2019, 12:01 PM
Registered User
 
huggy_d1's Avatar
 
Join Date: Jun 2015
Location: VA/USA
Car: '16 Outback 2.5i Premium WAM, Factory Hitch, Infinity speakers, Alpine Sub, Cargo Tray/Seat Protectors, Husky Liners, Rally Armor Mudflaps, LED Int Ltg, Subaru LOGO LED Projection Puddle Lights, OUTBACK rubber inserts
Posts: 407
Feedback Score: 0 reviews
Quote:
Originally Posted by Brucey View Post
https://github.com/JoeSc/Subaru-TPMS...ster/README.md

This guy has the same idea on a WRX and made it a lot further.
I read through his github documentation. He had some problems, mostly related to not having antennae beaming tpms data close to the receivers. Instead they were trying to use a single centrally located antenna. I wish they had updated the github after using 4 antennae. I bet that worked like a champ.


Best regards,
huggy_d1
huggy_d1 is offline  
Reply

Quick Reply
Message:
Options

Register Now



In order to be able to post messages on the Subaru Outback - Subaru Outback Forums forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.

User Name:
Password
Please enter a password for your user account. Note that passwords are case-sensitive.

Password:


Confirm Password:
Email Address
Please enter a valid email address for yourself.

Email Address:
OR

Log-in










Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page
Rate This Thread
Rate This Thread:



Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

 
For the best viewing experience please update your browser to Google Chrome