Five Finger Code Finder

A device to quickly crack PIN codes on Ford automobiles with a PIN entry keypad, and to demonstrate the shortcomings of this system.

Similar projects worth following
The Five Finger Code Finder is an electromechanical device and software designed to efficiently find the PIN code that will unlock Ford automobiles equipped with a 5 button entry keypad.

Its purpose is to demonstrate how the design of this system allows PIN codes to be found in a MUCH SHORTER TIME than would normally be required to brute force search and try all possible PINs. This system allows a good level of usability but in the process sacrifices security. The purpose of this project is to demonstrate how design decisions that put a priority on ease of use can greatly compromise the security of a system such as this.

The system uses an Arduino for control, a standard HD44780 compatible LCD, and five solenoids to press the keypad buttons in sequence.

This project builds on the previous work of Samy Kamkar and the authors of “The Car Hacking Handbook.” Samy discovered a method to quickly open garage door openers that use a remote with a fixed binary code set by dip switches. Despite the development of rather secure rolling code systems these remotes are still in wide use in situations such as apartment parking garages where a large number of remotes must operate the same door.

Samy discovered that the logic that checks for a code match rechecks the entire code sequence as each individual bit arrives, rather than waiting for a full code word to be received, and that there is no delay after checking for a match and no penalty for an incorrect match. If you have a 12 bit code the check system will check the first 12 bits for a match. If a 13th bit arrives, it will immediately check bits 2 through 13 for a match. If a 14th bit arrives, it will check bits 3 through 14, and so on. This facilitates much faster code searching as you have just checked three different 12 bit codes with only 14 bits sent.

The authors of “The Car Hackers Handbook” discovered that the entry keypads on Ford vehicles utilize this same shift by one and check for a match system. Also with no delays and no penalties for incorrect entries. In this case you have five keys to use in the code instead of just the ones and zeros of a binary code but the concept remains the same. In their book they published an optimal sequence for manually trying all possible codes as efficiently as possible. They state that one can enter this sequence manually in approximately 20 minutes and find the code to unlock a Ford vehicle with this system.

Well, I’m to lazy to do that, and thought it would be a fun project to implement a machine that can enter the sequence automatically for me as quickly as the door keypad will recognize button presses.

  • 1 × Arduino Aruduino UNO or compatilbe
  • 1 × Character LCD Hitachi HD44780 Compatible Character LCD
  • 5 × Solenoids Push type solenoids
  • 1 × ULN2003 Transistor Driver High voltage high current darlington transistor drivers
  • 5 × Red LED

View all 6 components

  • Start of First Five Finger Code Finder Prototype

    Carl Smith10/16/2017 at 02:34 0 comments

    Today I decided it was time to build something to give people a better idea of the device I intend to build.  So I grabbed a piece of acrylic plastic sheet and started drilling holes to build the actual unit. 

    Turns out I need to find a better way to drill holes in plastic sheets.  When I tried to drill 3/8 inch holes for the solenoids with a normal drill bit it would chatter and I figured it would break the plastic before I got the hole drilled.  So I used my Dremel drill press and a somewhat cone shaped grinding stone to make the holes.  Problem was that it basically melted through the plastic and didn't stay centered where I wanted so the holes aren't aligned as well as I wanted.  I suppose when I build a final version I'll have to make some sort of jig to hold things in place as I drill.  And I scratched up the plastic a bit scraping the melted mess off around the holes.  But it's a workable first attempt and does a good job of showing what I intended.

    As you can see I also drilled holes in the corners and mounted a couple flat head screws.  I put magnets on the heads of the screws to hold the device to the door.   I need to order some magnets with holes in the center for screws.  And add two more to the bottom corners.  Using screws in this way will allow me to adjust the space between the keypad and the solenoids, allowing me to find that optimal height with the most solenoid force.  And the acrylic sheet plastic makes it easier to see the alignment of the solenoids with the keypad and just looks cool.

    Also mounted on this plastic sheet would be the Arduino, LCD, a board with the ULN2003 driver chip, and the push button switches (maybe I need a bigger piece of plastic).

  • Time To Build a Pushing Power Testing Apparatus?

    Carl Smith10/12/2017 at 03:40 0 comments

    I've been experimenting with the push type solenoids I obtained for this project to determine how to get them to operate with enough force to push the keypad buttons reliably.  The force produced increases significantly by increasing the voltage from 12V to more like 24V.   As I said in a previous log, I think this will work fine due to the low duty cycle that will be applied.

    But I discovered another property of these push solenoids.  The force produced varies significantly based on the initial position of the armature.

    These solenoids work differently than most - the pin pushes outward instead of pulling inward.  How do you get the pin to push outward when the armature is attracted to the coil, not repelled?  The main part of the armature is thicker than the pusher end pin and so even though the pin is pulled inward the much thicker opposite end is pulled in with much more force, so the net force is to push the pin outward, until the large part of the pin bottoms out against the small hole end.

    You would think that the point of maximum push force would be right before the pin hits bottom, as this point would have as much pin as possible inside the coil and would result in the best magnetic coupling between the pin and coil.  So when building my device I should place the solenoids as high as possible so that the keypad button is pressed just before the pin bottoms out.

    But experimenting at my workbench reveals that the just-before-bottom position is NOT where the solenoid produces the most force.  There seems to be a point with the pin farther back and the fat end of the armature farther out the back of the solenoid that produces significantly more force.  But finding this point of maximum force is hard to find just holding a solenoid by hand over the surface of my workbench.

    I need a device to reliably hold the solenoid in a stable, adjustable, and repeatable distance over a surface and a way to measure the force produced, so that I may build my device with the optimal spacing between the solenoid body and the keypad button surface.

    So I am now thinking about building some sort of frame I can clamp to my workbench.  A frame on which I can mount a solenoid over my digital scale so I can power the solenoid, read the force produced, and adjust the spacing of the solenoid to find the optimal distance.

  • Breadboard Hardware Working

    Carl Smith10/11/2017 at 03:49 0 comments

    The hardware for the breadboard prototype is now complete.  I recently got the push buttons wired up, hooked up 5 red LEDs to blink with the solenoids, since everyone likes blinky LEDs, and got the ULN2003 driver chip working and powering solenoids.

    I've written several crude Arduino programs to test each of these functions and they all work.  Now I have to just start putting the puzzle pieces together to make a code search program with a usable user interface,

    A side note, I've been doing electronics for decades and I've worked with microcontrollers since ceramic package PIC 16C54's were a thing.  But I've never done an Arduino project before.  Just never got around to it and I don't know much about the Arduino language, so this is a bit of a learning experience.

    One dilemma I am facing is whether or not I should bother writing switch debouncing routines. I find it extremely annoying to use an electronic device that fails to do proper switch debouncing and just as you have clicked a switch several times it bounces and jumps right over whatever you were trying to select.  So the OCD side of me says things won't be right in the world unless I implement proper switch debouncing.

    But in the course of testing my hardware I found a chunk of code online that tests for switch debouncing and found that it isn't much of a problem.  I can click the buttons I used maybe 20 or 30 times before detecting any actual bounce.   And it's not like this project is meant to be a polished consumer product.  So the practical side of me says don't bother with the switch debouncing software.

    I don't know yet if it will be the practical side or the OCD side of me that wins that argument...

  • Wimpy Solenoids

    Carl Smith10/05/2017 at 04:22 0 comments

    So I figured that before I got much further into this project I should check if the solenoids I bought have enough force to push the buttons on my keypad.  The solenoids I purchased were from All Electronics, part number SOL-102.  They are a bit odd in that they are push type solenoids, but that is what I need to push buttons without having to build some sort of rocker mechanism.

    I was going to start to build a plate with the five solenoids mounted so I could place it over the keypad, but then I decided to just hold the solenoid over the button and energize it with the specified 12 volts.   Turns out they don't have the force to reliably push the button.

    So now I have to figure out how to fix this problem.  I could look for bigger, stronger solenoids, but I would have to find ones that fit in the spacing of the keypad, and are push type.  I would rather not have to do more searching, order more parts, etc.

    I could hit the solenoids with a voltage much higher than their 12 volt rating.  This would probably not cause a failure of the solenoids, since we are pushing five different buttons and each one would be energized less than one fifth of the time on the average.  And it would take a significantly higher voltage to break down the insulation internally in the coil.

    Another option would be to use a different method entirely.  Servos would have much more force.  Problem is that they would also be much slower, and one goal of this project is to complete entering the number sequence as fast as the car can recognize the button presses.

    So I will try the second option.  Hitting the solenoids with a higher voltage is quick and easy and will likely work fine.

  • What I've Accomplished So Far

    Carl Smith09/27/2017 at 02:28 0 comments

    So my first log entry is a retroactive entry to catch up on what I have already done.  I have been working on this project off and on for months.  Mostly off and not a lot of on.  As you can see in the photo I have cobbled together a proof of concept test on my workbench with a breadboard and an Arduino and an LCD.  

    I also did some research on the De Bruijn sequence as I didn't want to just copy the sequence from The Car Hackers Handbook.  I found some python code on Wikipedia.  I've never programmed in python but it was easy to run the code and change it to work with only the digits 1 through 5.  I then modified the code to output the sequence with commas and spaces to make it easy to cut and paste the number sequence into an array declaration in the Arduino code.

    So now I was prepared to whip up some Arduino code.   Despite programming for decades I have not done an Arudino project before, so it took a bit of learning to get everything going, especially how to get the sequence holding the array to store in flash instead of being copied into RAM, which did not have enough space. 

    So now I have a breadboard version of the project that boots up the LCD and displays the sequence rolling across the bottom line of the LCD.   I've also added some pushbuttons for the user interface as eventually I want to be able to control playback of the sequence to rewind and step through parts of the sequence.

    I'm currently working on wiring up some LEDs to indicate the actuation of the solenoids that will actually push the buttons and a ULN2003 darlington transistor driver to power the solenoids.

    Once I get the LEDs blinking and the solenoids tapping, then I can start building a more robust unit that can actually be attached to the car door (magnets?) and also work on the user interface code.

    Maybe I can add a microphone that can hear the "thunk" when the door lock opens and stop the playback of the sequence so the code can be read back from the LCD.

View all 5 project logs

Enjoy this project?



Carl Smith wrote 10/15/2017 at 18:01 point

I have submitted this project for the Anything Goes round of the 2017 Hackaday Prize.  This project addresses challenges in security, with the purpose being to demonstrate how compromises that make user interfaces easier and increase user convenience can reduce the effectiveness of your security system.  This principle applies well beyond unlocking car doors, and is becoming more important as more devices utilize similar forms of access control.

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates