Electronic building access key/garage transmitter replication

[Mandelbrot]

Hello,

I just moved into a new apartment where I was told before I moved in that I would have separate keys and garage transmitter. However, I was only given a single unit that acts as the transmitter for the garage door and as a proximity key to get into the building. Unfortunately, I had promised to lend my parking spot to somebody so now I'm screwed because we can't both have access to the building/parking garage.

Of course the easy thing is to ask for another key, but they say it will be "a few weeks" and they aren't even sure if they can do that. I haven't had good experience with them so far so I don't have high expectations there. Anyway, I opened it up hoping the garage opener and the door key would be easy to separate, but I don't really know what I'm looking at. I know one side of the board is just a 2032 battery and a 1000uH inductor but I can't tell how this thing opens the proximity locks. I see a 433 MHz oscillator and a single chip which I am able to make out as a PIC16F636.

Is there anything I can do here? I have taken a course in wireless hardware design, but I only know theory and that was months ago so I don't think I remember much of it. I was able to duplicate my electronic room key last year but that had a physical electronic contact I was able to work with which made it easier.

I am unfamiliar with these types of door locks and I don't really know anything at all about practical wireless communication, so any advice on would be much appreciated.

I've attached pictures of the board for reference.

[nctnico]

I'm quite sure you'll find cheap devices on Ebay which can replicate the 433MHz signal.

[mikerj]

The PIC16F636 contains Microchips own "KeeLoq" cryptographic engine which is very often used for these kind of remote keys.  This creates a rolling code that changes every time the device is used, which means a code grabbed by someone nearby is theoretically useless since it can't be re-used (unless the receiver was jammed to prevent reception).

Whilst variants of the Keeloq system have been cracked in the past, you don't realistically have a chance of cloning this remote unless the manufacturer did something really silly such as leaving the micro unprotected.

[Mandelbrot]

I found a bunch of cheap 433 MHz garage door replicator type products on ebay but I assumed they wouldn't work with this because it likely used a rolling code because this apartment complex is pretty new and there were no switches or anything like that on the board. Good to have someone else agree on that though, thanks.

Any idea how this thing reacts to the door locks when I bring the fob close to them? I was kind of hoping there would be an RFID tag in there that I could just pull out because that would solve my problem as well. I can't figure out how that part is working.

EDIT:

I figured it out. There was an RFID tag. It was covered in black gunk and hidden inside the black plastic case. I am able to remove that and give the rest to my friend. Not very exciting, but an experience nonetheless. Thanks for the input.

[SL4P]

Yes, separating the RFID tag and keyless remote is fine.
Of course test it before stepping over the threshold!
- and remember that if you break either, one you'll get a chance to see how long it takes to get a replacement!
The owners jay charge a call out fee when the locksmith visited to 'learn' the new keys.