I’ve been working long hours to finish a project for NASA. I finally succeeded late Saturday night. I struck plasma on our largest head (6 inches) using my control board. It’s a pretty good feeling to see that thing light up for the first time. It worked with out any problems… no arcing or sputtering.

Anyways, I have learned a ton about hardcore RF. This stuff used to intimidate me… but if you have some basic concepts down on passive devices and how they effect phase and magnitude (smith chart is key) then it gets a lot easier.

Get some!

So I finished the idea for the RF Hack. In the remaining 8 hours of my weekend I decided to take a look at my car problems. My car has trouble starting from time to time. When it does I can hear the solenoid on the starter engage (click) but no cranking. So, it’s either the contacts on the solenoid or the starter. I started digging through the Acura Service Manual to figure out how I am going to replace it. The information on the starter is burried deep inside the electrical section. As I thumbed through the pages I found the schematics for the ignition system. I then completely forgot about what I originally set out to find.

I’ve got an idea to start my car and warm it up or cool it off from a distance. More specifically I would like to call my car… not to have conversations (although there would be nothing wrong with that) but to give it commands. It’s actually pretty simple, everything is fairly low current.

There are only a few problems. I have a manual transmission which creates a bit of a safety concern. There is the potential that my car, if left in gear, could lurch forward. The best way around this would be to create some sort of sensor to verify that the transmission is in neutral. There is no such indicator in the car so it has to be made. The next best option would be to use the existing parking break sensor. The car would still lurch forward however… just not as much. I do however park with the transmission in neutral 99% of the time. I’ll have to think on this some more.

The clutch must be depressed to start the vehicle. There is an interlock switch on the clutch. Shorting this would bypass this safety feature.

Finally, how do you know if the car has started? I think you can determine this using the feed back from the tachometer sensor. It should have a zero reading during cranking… I believe. Anyways, if this is the case there happens to be a nice tachometer test harness right up by the firewall.

Gotta gather more information but I may just do this. What was I going to do again?

The remote is pretty simple opened up… I am just gonna desolder that dip switch and insert my circuit on 100 mil spaced SIP header. I have created a solution… it’s pretty simple as well. I’ve got a PIC10F interfaced to two buttons to stop/start the scan process. The PIC10F will iterate from 0-1024 while transmitting 3 times over a 5 second interval. The interface to the 10 pins is accomplished via two serial shift registers cascaded to get the 10 bits. I was going to place 4 7 segment LED’s on board but I figured if I wasn’t smart enough to read the binary code on 10 individual LED’s then I probably shouldn’t be making this device.

I have only one concern. I know nothing of the IC inside this remote. I assume it to be CMOS since it’s tied directly to the power supply (9V). My circuitry will be running off of a 5V regulator. A logic high is slightly higher than half the rail (CMOS levels) so I *should* have no problems. But… that’s *if* my assumption is correct. Worst case… it doesn’t work and I’ll have to integrate 10 mosfets.

We will find out how it all works in about 3-4 weeks!

1. It’s not protecting Fort Knox… it’s just an apartment complex.
2. It would be quite a hassle to outfit ever cop in Placentia with a trained remote for rolling/code hopping technology. It has to be a simple!

So, I can buy a remote off the shelf right? But these remotes work only when encoded with the right “key”. It’s a simple binary code. Usually 10 bits wide and set within the remote. Given that it’s 10 bits, it is certainly reasonable to attempt a brute force method of hacking the system right? 2^10 yields only 1024 combinations. Say (conservatively) it takes 10 seconds to try a code… that’s only 2.8 hours (worst case) to hack the gate. Statistically I should have the gate hacked in 1.4 hours. Sounds do-able!

Now, I just have to figure out what I want this thingy to do and implement it. I think I’ll provide an external port out of my remote control and have this thing external. It’s pretty cramped inside. This is my new years resolution… at least for January. I am gonna beat that gate!