NDIAS 2026 - Classic KeeLoq Garage: Find the Key

Challenge Overview

Category: Keyfob Files: capture_c5c6.bin, memo_c5c6.txt Flag format: flag{KEY64}

Recover the 64-bit DeviceKey of a “Classic” KeeLoq garage remote.

1. Memo

The installer memo gives the legacy key derivation explicitly:

Model: KG-370
Button map: 0x01 = OPEN
Fixed part: SERIAL(32) || BTN(8)
Legacy derive: K = SEED || (SEED XOR SERIAL)
Seed: 6D3A91C4
Disc bits: lower 10 bits
Learn window: 16

So the manufacturer key derivation is:

DeviceKey = (SEED << 32) | (SEED XOR SERIAL)

with SEED = 0x6D3A91C4. SERIAL is the 32-bit fixed code in every wire frame, which we still need to demodulate.

2. Demodulation

Same OOK / Manchester pipeline as the earlier Falcon X1 fob challenges: 500 µs chip period, sync byte 0xD5, G.E. Thomas convention.

Each Classic KeeLoq frame is 80 bits / 10 bytes on the wire:

SYNC(8) | HOP(32, MSB-first) | SERIAL(32, MSB-first) | BTN(8)

3. Decoded Frames

So:

• SERIAL = 0x01D4A2B7
• BTN = 0x01 — matches the memo’s 0x01 = OPEN

4. Key Recovery

SERIAL       = 0x01D4A2B7
SEED         = 0x6D3A91C4
SEED ^ SER   = 0x6CEE3373
DeviceKey    = SEED || (SEED ^ SERIAL)
             = 0x6D3A91C4 6CEE3373

5. Verification

Decrypting each captured hop with this key using standard KeeLoq (NLF table 0x3A5C742E, 528 rounds) gives clean (DISC || COUNTER) plaintexts:

The high 16 bits stay constant at 0xADC4 (the DISC) and the low 16 bits are a monotone counter — exactly the sanity check we want.

Flag

flag{6D3A91C46CEE3373}