Blow S50 26-108# keyless entry system receiver teardown

[ESXi]

Blow S50 inners:

• ULN2003A sop 16 NPN darlington array for relay coils
• Mystery chip (mcu?) blank chip not engraved with part number sop 14 possibly contains the "rolling code security" subroutines (pin 11 connected to 590R pin 5)
• 3x JQC-3FF-M2 relays 12vdc 15amps
• 78L05 sot-223 LDO
• Sacoh SYN590R RF Wireless Receiver IC sop 8
• Eeprom sop 8 ATHYC802 24C02N (fake? Atmel eeprom 2Kbit ( 256 x 8 ))

Electrolytic caps:
1x LFM® 470uF 16v -40+105°c
1x DWBJ® 470uF 25v -40+105°c

Silkscreen witting:
EG-500TWL-3
PCB:1.6mm
2021.07.10

PCB weight (/wo enclosure):
56.34 grams

Seems to be a generic unit rebranded.
https://www.alibaba.com/product-detail/Universal-12V-Auto-Remote-Central-Kit_62217648487.html



More images:
https://imgur.com/a/LU8DD7W

Security:
Level: weak
Vector: signal sniffing & replay attack
Reference: https://www.rtl-sdr.com/a-review-of-the-hackrf-portapack-with-havok-firmware/

Manufactured by:
Guangdong Victor Electronics Co., Ltd.
Business Type: Manufacturer
Location: Guangdong, China (Mainland)
Year Established: 2006
Main Markets: Mid East 32.89% Eastern Europe 21.67% South America 17.69%

Sold here in the local market for around ~30 euro pop, per qty 9.80 $ (new Bluetooth controlled version) on Alibaba.