Monday, 27 July 2015

Alarm Fob Replacement

I Hate Being Ripped Off

My home alarm remote control had seen better days.  After more than six years of abuse, the case was finally cactus, as can be seen below.  My wife's fob was in better shape but it's days were also numbered.

I thought I'd just be able to jump on line and find a replacement, but it looks like my Nx-305 system is the 'old one' and while the 'new one' has many sources of cheap fobs, I'm out of luck getting replacements for mine.

So, I did a little investigation.  Popping open a fob showed:

.. a little 8 pin SOIC that was marked HCS300.  This is a Microchip Keeloq rolling code chip, and when registered with my receiver, provides a more secure system than the old school fixed code remotes.

The HCS300 handles all the functions of the remote - reads the buttons, provides the encoded output for the 433 MHz transmitter, even flashes the LED.  Nifty.

So, a little reading up on the new Activor system showed that these fob also used Keeloq.  So I took a punt a bought a pair from eBay.

Straight off the bat, I tried to enroll the fob into my receiver.  Unsurprisingly, it didn't work.  So I cracked that puppy open:

And was happy to find that it also used a HCS300.  So why didn't it work with my receiver?

If you look at both boards, you'll notice they both have a row of test pads - or more correctly PROGRAMMING pads.

From reading the datasheet, a manufacturer's code is programmed into each fob.

So, what I obviously needed to do was build a reader to extract the code from my old fob, then upload that to the new one.  Or swap chips.

To borrow from JFK:

"I chose to do the latter, not because it's easy, but because the other way is hard."  

So a few minutes later with the hot air tool, the chips are off the boards, donor chip on the left, useless chip in the middle.

But, of course, I'm not finished there.  The boards have the switches connected to different pins on the HCS300, because of different PCB layouts.  So the 'alarm on' switch is actually open roller door 2 and the disarm is the arm button ... or was it ... wait, nevermind.. time to fix it in hardware!

The traces that connect the buttons to the HCS300 were simply cut

.. and jumper wires installed.  It's at this point I realised I was out of TCW and made a mental note to buy some more.  Which I haven't done.

One down, one to go....

After all that, the cases still went back together and all worked well.  And this style of case seems to be available all over eBay / Deal Extreme so next time the cases are beat up, I'll just be looking at a PCB swap.  Woot!


  1. Hello,
    I have almost the same problem, as you, with my car alarm remote. Something went wrong and now it's not working. I tested in the oscilloscope and the HCS300 seems to work (I can see a PWM when I am pressing the button) so I think that my problem is in the RF circuit. I found a very similar (visually) Chinese remote but the chip was completely different. Can you point me the place you bought this remote.
    Thanks in advance and congrats for this awesome hack!

    1. eBay:

      Just search for 'activor fob'

  2. HCS300/301/200 are Microchip and use KEELOK technology... ( Rolling Code). If you do not acquire the remote from the person taht sold it to you, you will not get it it working... Each transmission is a different code. ( and each manufacturers has basically its own code.

  3. I enjoyed how you talked about the different problems with car alarms. They're so different and unique that they can be very frustrating to use. Your recommendations are spot on. HCS300 can be a complicated system to work on, I agree. As another tech guy, I can appreciate how much work you had to do on this. Thanks for your post.

    Earl Mark @ Eastway Lock