AliExpress 433 MHz copy remote

A 4-button “duplicator” remote from AliExpress, sold to copy other 433 MHz gate and garage remotes. I bought it as a spare for our gate remote. It couldn’t learn it: the gate remotes send a rolling code, and their brand isn’t on its list. I then used it as the test transmitter for my CC1101 scanner, since its own code is simple and fixed.

Specs

Sold as	“Universal garage door remote control 433MHZ opener Cloning 4 key … remote control duplicator”
Frequency	433.92 MHz
Buttons	4: A to D on the shell, K1 to K4 on the board
Battery	27A, 12 V
Board	520B V2.1
Microcontroller	FMD FT60E021, 8 pins
Transmitter	A 2SC3356 RF transistor with an R433 SAW resonator
Antenna	A copper trace printed on the board
Code out of the box	Fixed, EV1527 style: 24 bits, a 20-bit ID and 4 button bits, shortest pulse (TE) 340 µs
Copies, fixed code (its sheet)	Remotes with these chips: 2260, 2262, PT2264, 5326, SC5262, HT600, HT680, HT6207, HT6010, HT6012, HT6014, SMC918, 527, 1527, 2240
Copies, rolling code (its sheet)	48 models from 21 brands, among them CAME, Nice, BFT, FAAC, DEA and Beninca: the full list is in the sheet
Shell	Chrome and black, a key ring and a clip

The copy remote.

What it sends

Out of the box, before it has copied anything, it sends a fixed code: the same bits on every press. My CC1101 scanner decoded all 4 buttons:

Code	ID	Button bits
0x0B80A1	0x0B80A	0001
0x0B80A2	0x0B80A	0010
0x0B80A4	0x0B80A	0100
0x0B80A8	0x0B80A	1000

I haven’t checked which button sends which. A short press sent the code 3 to 7 times, since a remote repeats it while the button is down. On my scanner the presses came in at −18 to −20 dBm, against a noise floor of −88 dBm.

Teardown

Out of its shell, next to its 12 V 27A battery.

The front: the chip at the top left, the resonator in the middle, the 4 buttons down the right.

The top half, where the part labels are readable.

The parts, from their markings:

Part	Marking	What it is
U2	FMD FT60E021	The microcontroller: reads the buttons, makes the code and keeps the copied codes. It’s the only chip on the board
X1	R433	433 MHz SAW resonator: sets the transmit frequency
Q2	R25	2SC3356, an NPN RF transistor. With X1 it’s the 433 MHz transmitter
Q1	2TY	S8550, a PNP transistor
Q3	J3Y	S8050, an NPN transistor
Q4, Q5	3EM	Not identified
D1	5.1V	5.1 V zener diode
K1 to K4		The 4 push buttons
LED		Top left, under a small hole in the shell

The microcontroller runs on 2.0 to 5.5 V, so it can’t take the battery’s 12 V straight. The 5.1 V zener is probably what holds its supply down.

There’s no receiver chip on the board. That would explain why the sheet wants the two remotes less than 10 mm apart while copying: at that range the original’s signal is strong enough to pick up without one.

The chip

The FMD FT60E021.

The FT60E021 is from FMD’s FT60E02x family: a PIC16-like 8-bit core, 2K words of program memory, 128 bytes of RAM, 256 bytes of data EEPROM, an internal 16 MHz oscillator, 2.0 to 5.5 V. It’s a general-purpose microcontroller, not a remote encoder chip, so everything it sends comes from its firmware. That’s how one chip can send EV1527-style fixed codes and also act as a CAME or Nice rolling-code remote. Our gate remotes have a dedicated KeeLoq encoder instead, Microchip’s HCS300.

The back

The back: the board name, 520B V2.1, and the printed antenna, the zigzag trace at the left.

The instruction sheet

The chips and the rolling-code brands it says it copies.

The copy steps.

How to use it, from the sheet:

1. Clear it: hold buttons 1 and 2 until the LED flashes 3 times. Keep holding 1, let go of 2, then press 2 slowly 3 times (the LED flashes fast). Let go of both.
2. Copy a fixed-code remote: hold the original’s button and the copy’s button at the same time, less than 10 mm apart, until the copy’s LED flashes. Repeat for each button.
3. Copy a listed rolling-code remote: the same, for button 1 only. The other buttons follow by themselves. Then pair the copy with the receiver, the way the receiver’s manual pairs a new remote.
4. Undo a clear: hold buttons 3 and 4 until the LED flashes. The last code comes back.

These copiers can’t clone a rolling code. For a brand on the list, it works out the brand from one press, then acts as a new remote of that brand, using the brand’s key from its firmware. That’s why step 3 ends with pairing. The sheet contradicts itself here: under the brand table it says those remotes work “without re-matching to the receivers”, and at the end it says to re-match them.

Richmond, our gate’s brand, isn’t on the list.

Used in

• CC1101 on an FT232H: a 433 MHz scanner in the terminal: the test transmitter. Its listen screen decodes the 4 codes above.

Sources

• FMD FT60E02x datasheet (PDF): the FT60E021’s memory and supply voltage
• SMD marking codes: R25 = 2SC3356, J3Y = S8050 and 2TY = S8550
• The instruction sheet that came with it (photos above)

Change history

• 2 Nov 2026: First published.

This guide as plain Markdown, for LLMs and scripts: aliexpress-433-mhz-copy-remote.md. All posts: API and Markdown.