Garage Door Hacker

This is the instructions and schematic for a garage door hacker. It modifies an existing door opener to run through every possible code.

The garage door hacker uses a 555 timer as a pulse generator to transmit pulses to a binary counter. Each pulse will increment the binary counter by one. You can adjust the speed of the counting by turning R1. Go ahead and experiment to find just the right speed to use. Switch one is for resetting the count back to the beginning.

As you may notice, the schematics don't show how to connect directly to the garage door opener. What I do is this: First you must desolder the DIP switches from the door opener and solder an IC socket into where the DIP switches were. (This will allow you to put the DIP switches back, when operating in normal mode.) Second, you should connect the output to a wirewrap IC socket. If you mount the IC socket on your pc or perfboard you can use the socket to plug right in to the door opener. When connecting the output, be sure that the connections on the wirewrap socket correspond to the ON setting of the DIP switches.

Parts List

Resistors
R1 - PC mount 100k potentiometer
R2 - 1k ohm 1/4 watt

Capacitors
C1 - 22MFD
Integrated Circuits
IC1 - 555CP Timer
IC2 - CD4040BE 12 stage binary counter

Misc
LED1 - 10 Light Emitting Diodes
S1 - Normally Closed Momentary Push Button Switch
Perfboard
9V Battery

Additional Assembly Hints

You should have 12 leads coming from the circut when it is completed - 10 from the binary counter and 2 for power, + and -.

The 10 from the counter should go where the DIP switch was; there will be an empty socket where it was removed (obviously). One row of holes will be shorted together and go to ground, and in the other row each hole will connect individually to a pin of a nearby IC chip. Connect the 10 leads from your circut to the holes that go to the IC chip, not the ones that are shorted together.

That leaves the positive and ground leads from your circut still hanging around, just connect them to an external 9v battery or the one already used by the door opener. When connecting the positive lead to the battery, insert a 65 ohm resistor (R3 - not shown in schematic or on parts list) in series between the two - this cuts the operating voltage to about 6v, reducing the operating temperature and prolonging the life of the circut.

The most important modification of the original plans is to substitute a 20k ohm potentiometer for R1 instead of using a 100k ohm. This gives much better control over the speed at wich the circut cycles through codes.

Also, in place of using 10 individual LEDs in the circut, Radio Shack's got a nice little 10-segment LED bargraph display that makes things look a lot neater (cat. 276-081)

THis circuit sounds pretty cool. I was just wondering if you connect pin 16 of IC2 and pin 8 of the 555 timer to the same lead of the 9v battery. Also i was wondering what type of capacitor was used. But my biggest problem is that the circuit seams to be designed for garage remotes that have 10 switches on the dip switch in the remote. I live in Australia and the remote that i have only has nine switches. Does any one know how to configure the binary counter so that it goes up to 9 instead of 10.
Thanks.

Does anyone have any suggestions?
Thanks

need parts

I cant seem to find the
Integrated Circuits
IC1 - 555CP Timer
IC2 - CD4040BE 12 stage binary counter

anywere.
Help please

Re: need parts

TeaOneAndOnly said:

I cant seem to find the
Integrated Circuits
IC1 - 555CP Timer
IC2 - CD4040BE 12 stage binary counter

anywere.
Help please

Click to expand...

They are just standard components,

IC1 is a 555 timer

IC2 is a CMOS logic chip 4040

The numbers are the important part, the letters tend to just be a particular manufacturers varient.

Has anyone got this going yet? (any one in Aust')


-Jake

Well actually i did this once... but instead of that binary generator i used a pic16f84a. the program was made using picbasic and i was able to connect the output pins from the chip to the switchers on the garage remote. if you use a pic you will be able to use 9 pins instead of 10 (i hope this helps BigDavo). The program is a simple decimal to binary converter. after knowing the binary you just need to associate it to the pins from the chip.

A bit of a bump, but does anyone know what parts I'd need to make the opener from scratch? My Craftsman opener has been broken for months, but looking at the inside of it, there's only one other part in there besides the main microcontroller and capacitors/resistors/transistors - I'd assume this to be the transmitter. Any info on this?

hi, this is my first post and my third electronics project, i was just wondering if it was at all possible to hook up a a 10 character LCD screen (like that of a scientific calculater) to this project to display each code as it's scanning through them. if it is, a detailed description and an extra parts list would be very helpful. or is this endevor to advanced for a n00b like myself. either way, i'd apprciate the input. thank you all in advance.
raistlin

I'm a total noob too but the 10 char display is unnecessary as the leds work fine. All the display would ever show is 0 and 1. The leds represent the 0 and 1 by being on or off. Anyway I think that it would go too fast to be able to read.

i think that you are right. thanks

The Evil Genie Garage Door Scanner-Hacker

I was looking for some schematics on the Net on a garage door scanner. I hadn't been able to find one in the years that I had been looking. (Well... I have seen the design that's at the beginning of this thread, but it's pretty basic.) So anyway.... I had to set out to create one of my own. My design is the result of many hours of dedication and troubleshooting. I call it The Evil Genie and I think it's pretty damn cool.

It basically built around the 12-bit 4040 binary counter to count from 0 up to 1024 in binary (ones and zeros) thereby, electronically switching every dipswich to an ON (1) or OFF (0) position.

Since my garage door opener only has 10 switches (10-bits, so 1024 positions), and the scanner (4040 chip) can count up to 4096 (12-bits) I had to wire the scanner to reset to zero when the count reaches 1025.

It also has the ability to count UP and DOWN at varying rates.

It has a 4 digit LED readout that can be paused at anytime during a scan and then scan up or down from that point to "home-in" on the desired frequency.

It has the ability to INPUT any 4-digit code corresponding to your desired frequency. (0000 to 1024 corresponding to the binary "dipswitch" on the opener) Included in this: the ability to start at any code and scan up/down.

Upon discovering the code, you can store it, thus eliminating the need for further scanning. I designed it to interface more than just one garage remote, so it still has the ability to scan the remotes with 9 and 12 position dipswitches if I need it to.

It's bad@ss! I'll post the schematics as soon as I can. If anyone has any questions, let me know I'd be glad to help.

Masowai

i need some letest small projects lists.
i can build it

i want to make this project can any anbody help me ?

Hold on, we'll be right there!

how big shold the led's be?

v:
mA:

Type?

My opener uses 9 dip switches, but they are all single pole, triple throw (sptt). The throws are open (0), closed (+), and closed (-). I'm also having trouble locating info on the ic: +B8608 (top) MM53206N (bottom). I can't think of any way to adapt for sptt dips, any suggestions?

I have been in the garage door industry for 13 years.
can anyone tell me how to mod the remote to send all the codes at one time.
The new rolling codes work with a set code and a set clock. That is how it is so hard to break. But I think if you over run the buffer with to many codes at one time it would open the door.
The only way for me to test this would be to build a remote that sends to many codes at one time.
I know an airplane transponder does this to an opener.
It is just a bet.
[[/I]

All codes at once??

Hi,
First of all, a garage door opener sends the code in a serial form, in a series of "on's" and "off's" of different timings, usually starting with a "on" pulse of a known duration to syncronize a receiver. When the receiver receives a correct sequence, repeated a certain amount of times, depends on the decoder, it signals the relay to open the door. An ancient chip the TEA5500, used in old Renault vehicles, working no in RF but Infrared, locked itself out for some time, after, I think, 5 wrong codes. You could still hide some device to "steal" the code and then use it to violate the lock. With roling codes, the story is a little different. The Keeloq technology from Microchip, uses a very complex algorithm to calculate a 69 bit long key, every time it transmits a code. Each new code shuffles at least, half off the bits. The code is generated using yhe algorithm, a serial number, unique to each device and a user progammed code. The receiver knows exacly the code he's going to receive when the key transmits, so if it receives a pre-used "stolen" code, it will lock itself out. If you play with the key, without being near the receiver, you also risk being lockek out as well, sinse the receiver will not recognize your key because it can only calculate the the "rolled" key a few keys away from the last one. By the way, every key for a certain lock, must be associated, so each key is unique. It's therefor impossible to send more than one code at a time.

PS. Pardon my English.

Greatings,
HF