Subaru Outback - Subaru Outback Forums - Reply to Topic
Thread: Spoofing TPMS signal Reply to Thread
Title:
Message:
Trackback:
Send Trackbacks to (Separate multiple URLs with spaces) :
Post Icons
You may choose an icon for your message from the following list:
 
   

Register Now



In order to be able to post messages on the Subaru Outback - Subaru Outback Forums forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.

User Name:
Password
Please enter a password for your user account. Note that passwords are case-sensitive.

Password:


Confirm Password:
Email Address
Please enter a valid email address for yourself.

Email Address:
OR

Log-in










  Additional Options
Miscellaneous Options

  Topic Review (Newest First)
01-11-2019 12:07 PM
Brucey
Quote:
Originally Posted by huggy_d1 View Post
I read through his github documentation. He had some problems, mostly related to not having antennae beaming tpms data close to the receivers. Instead they were trying to use a single centrally located antenna. I wish they had updated the github after using 4 antennae. I bet that worked like a champ.
I will try and contact the user. Let's find out.
01-11-2019 12:01 PM
huggy_d1
Quote:
Originally Posted by Brucey View Post
https://github.com/JoeSc/Subaru-TPMS...ster/README.md

This guy has the same idea on a WRX and made it a lot further.
I read through his github documentation. He had some problems, mostly related to not having antennae beaming tpms data close to the receivers. Instead they were trying to use a single centrally located antenna. I wish they had updated the github after using 4 antennae. I bet that worked like a champ.
01-10-2019 03:15 PM
Brucey https://github.com/JoeSc/Subaru-TPMS...ster/README.md

This guy has the same idea on a WRX and made it a lot further.
07-07-2018 05:21 PM
Brucey Note for @Fibber2 :

I did the sensible thing you suggested and traded in 3 sets of wheels and tires for 2 set of wheels and tires with a clone-able TPMS system installed.

THAT SAID I still plan to try to fool the car with a clone of the TPMS signal because I can and I'm yet to see anything that tells me I can't.
06-21-2018 04:56 PM
Brucey So working on the transmitter now.

I found pretty thorough how to guide using 433 mhz transmitters with raspberry pi.

https://www.rtl-sdr.com/tutorial-rep...-pi-and-rpitx/

I'm running arduino and 315 mhz but it looks like that pi is configurable as far as frequency it transmits on.
06-20-2018 05:28 PM
Brucey Today I borrowed a friends autel maxitpms which made it easy to pick out the signal and get a clear recording. Needed to adjust bandwidth and gain a bit but its clear as day.

Recorded the signal it broadcast as 4 individual files. Had some static too but the signal was clearly there on SDR.

Very strong and noticeable when it broadcast.

Next step: playing .wav files and broadcasting them at 315 mhz.

I'll go ahead and post the files here in case anyone wants to decode it in the mean time.

https://drive.google.com/open?id=1D2...wGJuxtyicEgDxf

https://drive.google.com/open?id=11g...V-G-IdVwbX1sav

https://drive.google.com/open?id=15A...SSa7fyBA7zOGCe

https://drive.google.com/open?id=1uM...mDaLQqFEzO3TNg
06-02-2018 09:03 PM
Dennis_Root That's what I am thinking. On wake up they should report the same as if in motion without all the waiting around.

Sent from my SM-N950U using Tapatalk
06-02-2018 09:00 PM
Brucey
Quote:
Originally Posted by Dennis_Root View Post
Something else I just thought of. Do you have the tool to trigger the sensor for activation? You may be able to use that. It should wake it up and cause it to transmit. You will need to record all 4 wheels to spoof the sensors.

Sent from my SM-N950U using Tapatalk
I wonder if the quick tool others have recommended can wake up these sensors so I can get a clear signal while they're stationary.
06-02-2018 08:50 PM
Dennis_Root Something else I just thought of. Do you have the tool to trigger the sensor for activation? You may be able to use that. It should wake it up and cause it to transmit. You will need to record all 4 wheels to spoof the sensors.

Sent from my SM-N950U using Tapatalk
06-02-2018 08:31 PM
Dennis_Root I agree that once recoreded you should be able to retransmit and spoof it. When you finally get it recorded, see how often it is transmitted. Probably transmits around once a minute. Atlest that seems to be the avarge of the different chip sets I have seen. If it has to be decoded it should be a binary signal. The preambe of that signal wold most likely be the sensor ID. After that should be the pressure signal. Just a few byte's of data.

Sent from my SM-N950U using Tapatalk
This thread has more than 10 replies. Click here to review the whole thread.

Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

 
For the best viewing experience please update your browser to Google Chrome