THREAD - Retekess pagers reversing: Thanks to the awesome response from all of you we managed to learn more about pagers systems, fix our ( @ShotokanZH ) research and improve upon it! #AlwaysDigDeeper #flipperzero @flipperzero
@ShotokanZH @flipperzero the first thing we fixed was our interpretation of the plots and what to assign 0s and 1s to. (using 0=[n00,-m00] 1=[m00,-n00] now instead of a simmetry along the x axis) thanks to @pablollopis comments!
@gandaldf was so kind to provide us some more raw signals from a similar retekess pager system and he was able to tell me the pager number aswell for each registration
@gandaldf this means we might finally be able to actually know if the data transmitted contains the actual number on the pager or if it is a totally different id!
@gandaldf i converted the known pager numbers (4, 18, 19, 21) to binary and tried to look at the transmitted data if they would show up.. not exactly but i noticed something...
0000110000, 0011000011, 1111000011, 1100110011 are not the binaries for the ids i had BUT, if we take them by pairs, we get: 00100, 01001, 11001, 10101. that's them but mirrored! 
that means that our initial bruteforcer is actually wrong, and that the last bits in the transmission are not a long footer but bits we need to bruteforce, keeping in mind that ids are doubled in pairs and mirrored
new bruteforcers will now look like this
next step will be understanding if restaurant ids are there too, we need you guys for this so go sniff some raw signals from retekess pagers :D or now here the fixed bruteforcer and a new one for the model
• • •
Missing some Tweet in this thread? You can try to
force a refresh
