Considering a key fob for RKE (remote keyless entry, automotive) its signal has been captured: It sends at 433,92MHz simple on/off.
Following I regard the deltas (time differences between on-off or off-on). The greatest common divisor of these deltas is 500µs.
The signal is the following (*500µs each, starting LOW):
50,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,10, 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,1,1,1,1,1,2, 1,1,1,1,1,1,1,1,1,2,1,2,1,1,1,3,1,1,1,1,1,3, 1,2,1,1,1,1,1,2,1,3,1,1,1,1,1,2,1,2,1,3,1,3, 1,2,1,2,1,2,1,1,1,1,1,2,1,3,1,1,1 other samples:
52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 2 1 2 1 1 1 1 1 2 1 2 1 1 1 2 1 2 1 1 1 1 1 2 1 1 1 2 1 3 1 2 1 2 1 1 1 1 1 2 1 1 1 1 1 1 1 2 1 3 1 1 1 1 1 2 1 1 1 2 1 3 1 2 1 1 1 1 1 2 1 1 1 1 1 1 1 52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 2 1 1 1 1 1 1 1 2 1 1 1 2 1 1 1 2 1 1 1 3 1 1 1 1 1 1 1 1 1 1 1 3 1 1 1 2 1 2 1 1 1 1 1 1 1 1 1 3 1 3 1 3 1 1 1 1 1 2 1 1 1 2 1 2 1 2 1 1 1 52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 3 1 3 1 3 1 2 1 2 1 1 1 3 1 1 1 1 1 2 1 2 1 1 1 1 1 3 1 2 1 2 1 2 1 1 1 2 1 2 1 2 1 2 1 1 1 2 1 1 1 1 1 1 1 1 1 3 1 2 1 1 1 1 1 1 1 1 1 2 1 1 1 52 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 2 1 2 1 1 1 1 1 1 1 3 1 1 1 1 1 1 1 3 1 1 1 3 1 3 1 1 1 3 1 1 1 1 1 2 1 1 1 1 1 1 1 1 1 2 1 3 1 1 1 1 1 2 1 1 1 1 1 1 1 1 1 2 1 2 1 1 1 1 1 2 1 2 1 2 1 (50 might be 50~52, 10 might be 11, however this is not important), the receiver is sensitive enough to seperate 500,1000,1500µs -- these are the important datas.
It does NOT seem to be Manchester because there is only 1 and 2 times the "main delta", not 3*500. Some sort of PWM? So what is the main width and duty cycle?
I ask for the name of this encoding. 50 and 10 (x500µs) seems special, interesting is the part beginning after the 10*500µs=5000µs.
Update I did a simple replay attack: Captured a signal like the samples above (enough distance to car, so that it doesn't hear it), then replayed the signal with my 433MHz Transmitter and car opened successfully! That proves data is accurate enough and things are working properly. However now comes the hard part... Addition: I spotted two things: The duration of every signal is the same, if you want to further analyze it, write it like this (just example, no captured signal):
1 1 1 2 1 3 1 1 1 1 1 1 1 1 1 1 1 In addition: There is always this prefix
50 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 11 1 1 1 1 1 1 1 1 1 Then it is maybe helpful to spot that between two non-1 (2 or 3), there is an odd amount of 1 always. Conclusion: The longer times (2 or 3) are always LOW because first 50*500µs is LOW, short pulses (1*500µs) can be both hi/lo.
I guess no one knows the encryption, but someone knows the encoding? Some sort of "line code" ?
Update2
Concerning request by @JimmyB I am adding binary representation, whereby a single 0 or 1 represents a 500µs pulse with the corresponding amplitude (0 or 1).
The prefix becomes this:
000000000000000000000000000000000000000000000000000101010101010101010100000000000101010101 Many samples following (sample hereby refers to the data after prefix, so the complete data is simply prefix+data), one sample per line:
00100101010010010100100101010010100100010010010101001010101001000101010010100100010010101001010101 01010101001010101001010010100101000101010101010001010010010101010100010001000101010010100100100101 00010001000100100101000101010010010101000100100100101001001001001010010101010100010010101010100101 00100101010100010101010001010001000101000101010010101010100100010101001010101010010010101001001001 01010100101010010101010100100101000101010001001010100100010101001001000100010010010010101001000101 01001001010100010001001010010101000101010001010101001001000101000101010100100101010010100101001001 00010101001010100100101001010101000100101010010101000100100101001001010101010010010010100100101001 01000101001010100100101010101010100100101001001010100100010101010001000100100101000100100101001001 01000100101001010101001010010001010101001001010010010100101010010101001001010100100100100100100101 01010010100101010010010100010101001001001001000101001010100101010001001001000100010010101010100101 00100101001010100101000101001001010010100101000100010010100101000100101010010001000100100100100101 01010001010101010100010100101001010001001001001001010100100101001001000100101001010010101010010001 00010100100100101010010100101010101010101010100101001010010010100100100101000100100100101001010101 Using this representation, it is clearly visible that all samples have same duration (might or might not be important for further analysis). Now looking for patterns? This is all I can provide, I guess. Due to the fact that this is in Germany, something like FCC-ID doesn't exist, so there would be chance of getting more information even though the interesting parts normally are non-public...
