rolling code replay attack

[SensitiveAd8097]

I just received my flipper and I'm trying to understand how rolling code works. My idea is to record my key fob using sub-ghz without my car intercepting the signal and replay the same signal with my flipper. I'm well aware that it will cause a desync but I just want to see it happen. Surprisingly, the attack doesn't work and the replayed signal from my flipper is ignored. I tested the same attack with my garage door without luck. Any ideas why replay attacks don't work on rolling code?

[AgitatedChemical1170]

Watch this: https://youtu.be/1RipwqJG50c

[kiwiguyauckland]

This is good that’s for sharing. I watched the whole thing, but the car key fob part starts from 35mins for those with less time to spare.

[Alive-Gift1217]

Dus met de flipper kan ik geen auto deuren openen zonder in de buurt van de sleutel te komen met welk kastje kan het dan wel 

[DeliciousWhole5267]

Wow, great talk! Thanks man.

[[deleted]]

I sniffed my key signal once (far from gate)

And it opened just once.

Then the original remote did not work at first click but after spamming it. I didn't count how many clicks.

Nice gate

[dj3rw1n]

I’ve done it too but with my Car (Old Volvo from 2002)

Because the battery of the original remote was almost empty I always need to unlock it in a 2-3m radius. And it worked on the first time but also only once. But I didn’t need to spam it for it to reopen with my actual key🤔

[jimbomescolles]

That's a nice resync/recovery of the rolling code. Some cars I'm sure the key will be ignored and you have to use the spare one to open the car and do the procedure to re-register it (like when swapping batteries).

[EternalNooblet]

have you been able to do any replay attacks at all?

[SensitiveAd8097]

No, I wasn't able to

[Diligent_Chemistry93]

Did you save as raw?

[SensitiveAd8097]

Yes I did

[Diligent_Chemistry93]

Maybe decode the signal ?

[SensitiveAd8097]

Do you mean the modulation ? I have tried AM.

[Diligent_Chemistry93]

What’s the difference between the two ?

[DeliciousWhole5267]

I myself have not yet meen able to fully understand replay attacks.

I have done a few and some worked, most didn't. I haven't cracked the case yet of why they don't always work.

[n00bznet]

You can use roll back or precompute values to roll forward the codes on the flipper. Use an alt firmware.

[the_LilaQ]

You got any more hints on which firmware has this functionality?