This video presents a teardown and analysis of a generic retrofit "smart" car key fob purchased from AliExpress. The device is an enclosure designed to house an original car key's circuit board, adding a touchscreen interface and keyless entry functionality. The teardown reveals the fob is powered by a Realtek RTL8762DT microcontroller with 16MB of external flash memory. The "keyless go" feature is enabled by a simple OBD adapter that continuously broadcasts a Bluetooth Low Energy (BLE) signal, which the fob detects to unlock the car. The creator's primary goal was to assess if the device could run the game "Doom." However, the investigation concludes that this is impossible due to the Realtek chip's limited 192KB of RAM, despite having sufficient flash storage. The video also identifies debug ports and confirms that the device's firmware can be dumped and modified using official Realtek tools.
Inside a "Smart" Key Fob: Teardown and Hacking Potential
0:01 - Retrofit Key Fob: The device is an aftermarket enclosure that houses the PCB from an original car key. It provides a modern touchscreen interface to trigger the original key's functions (lock, unlock, trunk).
1:04 - Keyless Entry Mechanism: The keyless entry feature uses a simple OBD adapter that plugs into the car. This adapter only draws power and constantly broadcasts a Bluetooth Low Energy (BLE) advertising packet. When the fob comes within range, it detects this signal and triggers the unlock function.
6:46 - Core Components Revealed: The teardown shows the device is built around a Realtek RTL8762DT microcontroller, paired with a 16MB external flash chip. Other components include the touchscreen, battery, and a USB charging port.
8:36 - Functional Operation: The Realtek chip manages the display and uses MOSFETs to electronically "press" the buttons on the original key's PCB, which is connected internally.
9:26 - The Ultimate Goal: Running Doom: The creator's primary motivation for the teardown was to see if the device could be hacked to run the classic game "Doom."
9:29 - Insufficient RAM Prevents Doom: The project is ultimately a failure. While the 16MB of flash storage is adequate, the Realtek RTL8762DT chip only contains 192KB of RAM, which is not enough to run the game.
10:05 - Modding and Firmware Access: The PCB has accessible RX, TX, and bootloader pins. The creator notes that it's possible to dump the device's entire firmware in clear text and flash custom firmware using Realtek's official MP (Mass Production) tool.
10:45 - Cost and Availability: These types of smart key fobs are increasingly common on sites like AliExpress, with this particular model costing around β¬40.