Reverse Engineering Banvie 1 Car Remote Start System - Part 5 - Injecting Key Fob Codes via Arduino

Welcome to Part 5 of my multipart reverse engineering series on the Banvie 1 Car Remote Start and Keyless Entry System! With the pin map and RF protocol figured out in earlier videos, it's time to put it all to use: injecting key fob codes directly into the system with an Arduino, no remote key required. I wire a NodeMCU into the Banvie board through the same pink wire tapped into pin 1 of the Holtek microcontroller, and drive it over USB serial from my PC (the NodeMCU's onboard WiFi is there for a reason - more on that soon). Each key fob function gets encoded as a 25-bit sequence of long and short pulses, and a simple serial command set (L, U, and so on) lets me fire off lock, unlock, trunk release, and muted lock on demand - verified both on the oscilloscope and by listening for the relays click. I also stress-test the protocol's timing tolerance: sweeping the short and long pulse durations to find the actual valid ranges the Banvie system will accept (short pulse: ~250-650 µs, long pulse: ~800-1400 µs), showing just how robust this on-off keying scheme is to real-world timing variation. Finally, I inject three consecutive unlock codes back-to-back to trigger a full remote engine start - completely bypassing the physical key fob. Code is up on GitHub and my personal site - links below. Up next: installing this whole system in my 2003 Mitsubishi Lancer and controlling it with voice commands. Stay tuned! 🔗 Code: [] 🔗 Website: []