Add Airkey AK3TX4 samples

[magJ]

Hoping to get some pointers as to how to go about decoding these messages.

[zuckschwerdt]

The six packets you see are alternating OOK and FSK, very unique.
The data then seem s simple PWM 400/800 µs. There is preamble of 16 bit FF FF

To get codes try rtl_433 -R 0 -X 'n=name,m=OOK_PWM,s=400,l=800,r=1000,bits>=68'

E.g.
g003_433.92M_250k.cu8: {69}882ea481e800631240
g005_433.92M_250k.cu8: {69}8bfc0af8e800631220

Get a row of codes and you may be able to spot a counter in there.

[magJ]

Thank you @zuckschwerdt, very helpful.

I didn't consider a counter as an anti-cloning feature, that would make sense, if the transmitter has an incrementing counter, the receiver only needs to store the last seen counter, and then sending old cloned codes won't work.

I grabbed a bunch of samples using your spec, each button press seems to send the code 3 times(I guess 6 total, 3 times with OOK encoding, and 3 times with FSK encoding?).

I wonder if the alternating OOK and FSK is a security feature or a compatibility feature?

Here are the 43 codes I grabbed in hex:

c3a7ceaae800631260
a0af34c9e800631200
c9c7be15e800631240
691cb8b3e800631200
e3037c1ee800631220
bf425d75e800631220
cf8ee20de800631200
a8eb19f1e800631220
37e78116e800631240
d4a0482ee800631200
8c02c356e800631220
db523bb0e800631240
386e792ee800631240
32489999e800631200
3f849645e800631260
50c304e0e800631220
d2a8ab59e800631260
16926a57e800631240
c292867ce800631260
60616d81e800631200
bf17c209e800631260
a81e1cfbe800631200
70c05431e800631220
892f58d0e800631220
e2937cfee800631240
4ed3ac71e800631220
6e81863ee800631240
4d02a227e800631240
f3677c2be800631260
54291a6ae800631200
35841cb4e800631220
74b7a46fe800631240
dbdd3682e800631240
5c79033ee800631260
811bb336e800631200
b3bd676fe800631260
b78cdacde800631260
afc2e0f6e800631220
1911785de800631240
4b3e5e3ae800631220
71680e22e800631220
34491e19e800631200
b42026a2e800631200
946a488ee800631200

and in binary:

Bytes
0        1        2        3        4        5        6        7        8
Bits
0        8        16       24       32       40       48       56       64
11000011 10100111 11001110 10101010 11101000 00000000 01100011 00010010 01100000
10100000 10101111 00110100 11001001 11101000 00000000 01100011 00010010 00000000
11001001 11000111 10111110 00010101 11101000 00000000 01100011 00010010 01000000
01101001 00011100 10111000 10110011 11101000 00000000 01100011 00010010 00000000
11100011 00000011 01111100 00011110 11101000 00000000 01100011 00010010 00100000
10111111 01000010 01011101 01110101 11101000 00000000 01100011 00010010 00100000
11001111 10001110 11100010 00001101 11101000 00000000 01100011 00010010 00000000
10101000 11101011 00011001 11110001 11101000 00000000 01100011 00010010 00100000
00110111 11100111 10000001 00010110 11101000 00000000 01100011 00010010 01000000
11010100 10100000 01001000 00101110 11101000 00000000 01100011 00010010 00000000
10001100 00000010 11000011 01010110 11101000 00000000 01100011 00010010 00100000
11011011 01010010 00111011 10110000 11101000 00000000 01100011 00010010 01000000
00111000 01101110 01111001 00101110 11101000 00000000 01100011 00010010 01000000
00110010 01001000 10011001 10011001 11101000 00000000 01100011 00010010 00000000
00111111 10000100 10010110 01000101 11101000 00000000 01100011 00010010 01100000
01010000 11000011 00000100 11100000 11101000 00000000 01100011 00010010 00100000
11010010 10101000 10101011 01011001 11101000 00000000 01100011 00010010 01100000
00010110 10010010 01101010 01010111 11101000 00000000 01100011 00010010 01000000
11000010 10010010 10000110 01111100 11101000 00000000 01100011 00010010 01100000
01100000 01100001 01101101 10000001 11101000 00000000 01100011 00010010 00000000
10111111 00010111 11000010 00001001 11101000 00000000 01100011 00010010 01100000
10101000 00011110 00011100 11111011 11101000 00000000 01100011 00010010 00000000
01110000 11000000 01010100 00110001 11101000 00000000 01100011 00010010 00100000
10001001 00101111 01011000 11010000 11101000 00000000 01100011 00010010 00100000
11100010 10010011 01111100 11111110 11101000 00000000 01100011 00010010 01000000
01001110 11010011 10101100 01110001 11101000 00000000 01100011 00010010 00100000
01101110 10000001 10000110 00111110 11101000 00000000 01100011 00010010 01000000
01001101 00000010 10100010 00100111 11101000 00000000 01100011 00010010 01000000
11110011 01100111 01111100 00101011 11101000 00000000 01100011 00010010 01100000
01010100 00101001 00011010 01101010 11101000 00000000 01100011 00010010 00000000
00110101 10000100 00011100 10110100 11101000 00000000 01100011 00010010 00100000
01110100 10110111 10100100 01101111 11101000 00000000 01100011 00010010 01000000
11011011 11011101 00110110 10000010 11101000 00000000 01100011 00010010 01000000
01011100 01111001 00000011 00111110 11101000 00000000 01100011 00010010 01100000
10000001 00011011 10110011 00110110 11101000 00000000 01100011 00010010 00000000
10110011 10111101 01100111 01101111 11101000 00000000 01100011 00010010 01100000
10110111 10001100 11011010 11001101 11101000 00000000 01100011 00010010 01100000
10101111 11000010 11100000 11110110 11101000 00000000 01100011 00010010 00100000
00011001 00010001 01111000 01011101 11101000 00000000 01100011 00010010 01000000
01001011 00111110 01011110 00111010 11101000 00000000 01100011 00010010 00100000
01110001 01101000 00001110 00100010 11101000 00000000 01100011 00010010 00100000
00110100 01001001 00011110 00011001 11101000 00000000 01100011 00010010 00000000
10110100 00100000 00100110 10100010 11101000 00000000 01100011 00010010 00000000
10010100 01101010 01001000 10001110 11101000 00000000 01100011 00010010 00000000

I can see that bytes 4-7 are always identical, maybe an identifier for which encryption key to decode with?
I'm not sure what is happening in the last byte, bits 65-66 seem to toggle around randomly, maybe some kind of error correction/parity?

I don't see any non-encrypted counter.
I guess the first 4 bytes are the encrypted message, probably contains the serial number and a counter I guess.