KaraZajac
48ee413c9b
New protocols (from ProtoPirate): - Mazda V0: 433MHz, pair-based decoding, XOR deobfuscation - Mitsubishi V0: 868MHz, PWM, bit negation + XOR unscrambling - Porsche Touareg: 433/868MHz, sync preamble, 24-bit rotate cipher - Fiat V1 (Magneti Marelli BSI): 433MHz, auto-detected timing variants Protocol fixes aligned with ProtoPirate reference: - Kia V1: Fix Manchester level mapping (inverted convention), off-by-one bit count, CRC4 simplified to 7 bytes + offset 1 - Kia V2: Fix CRC byte layout (was double-counting nibbles), off-by-one bit count, preamble short-HIGH handling - Fiat V0: Fix endbyte transform (remove (<<1)|1), standard Manchester encoder (was differential), 7 btn bits (was 6), gap path fallback - PSA: Fix modified TEA (XTEA-like dynamic key selection), XOR decrypt byte mapping, critical key2_low construction bug, encoder polarity and preamble, add key1_high nibble validation, dual preamble patterns - Ford V0: Add calculate_checksum (sums all serial+count bytes) for encoder Kia V6 encoder ported: - Forward AES-128 (SubBytes, ShiftRows, MixColumns, encrypt) - encrypt_payload: build plaintext, AES encrypt, pack into 3 parts - Two-pass Manchester upload (640 + 38 preamble pairs) - fx_field extraction stored in DecodedSignal.extra for encode roundtrip Updated README, protocol docs, and version bump to 1.2.0.
52 lines
1.9 KiB
Markdown
52 lines
1.9 KiB
Markdown
---
|
|
layout: default
|
|
---
|
|
|
|
# Kia V6 Protocol
|
|
|
|
**Rust module:** `src/protocols/kia_v6.rs`
|
|
**Reference:** `REFERENCES/ProtoPirate/protocols/kia_v6.c`
|
|
|
|
## Overview
|
|
|
|
Kia V6 uses Manchester encoding at 200/400 µs (level convention inverted vs Flipper). 144 bits in three parts: part1 (64) + part2 (64) + part3 (16); each part stored inverted. Long preamble of 601 pairs; sync bits 1,1,0,1 then data. AES-128 decryption with key derived from KIA V6 A and B keystores (types 11 and 12) and XOR masks.
|
|
|
|
## Timing
|
|
|
|
| Parameter | Value | Notes |
|
|
|-----------|--------|---------|
|
|
| Short | 200 µs | ±100 µs |
|
|
| Long | 400 µs | ±100 µs |
|
|
| Preamble | 601 pairs | |
|
|
| Min bits | 144 | |
|
|
|
|
## Encoding
|
|
|
|
Manchester (event mapping 0/2/4/6 for level convention). Three 64/64/16-bit segments, each inverted when stored.
|
|
|
|
## Frame Layout (144 bits)
|
|
|
|
- Part1: 64 bits (inverted)
|
|
- Part2: 64 bits (inverted)
|
|
- Part3: 16 bits (inverted)
|
|
|
|
AES-128 decrypt with key = f(keystore_a, keystore_b, XOR_MASK_LOW, XOR_MASK_HIGH). Serial/button/counter, CRC, and fx_field extracted after decryption. The fx_field is derived from the top 2 bytes of stored_part1_high and stored in `DecodedSignal.extra`.
|
|
|
|
## Decoder Steps
|
|
|
|
1. **Reset** — Wait for preamble.
|
|
2. **CheckPreamble** — Count 601 pairs; detect sync pattern 1,1,0,1.
|
|
3. **Data** — Manchester decode 144 bits; invert segments; AES-128 decrypt; validate CRC8; return fields.
|
|
|
|
## Encoder
|
|
|
|
Supported. Ported from ProtoPirate (`ENABLE_EMULATE_FEATURE`). Builds plaintext (fx_field, serial, button, counter, S-box CRC, CRC8), AES-128 encrypts, packs into 3 parts, then Manchester encodes with two-pass preamble (640 pairs + data, gap, 38 pairs + data). Requires fx_field from decoded signal's `extra` field.
|
|
|
|
## Frequencies
|
|
|
|
433.92 MHz.
|
|
|
|
## Keystore
|
|
|
|
Requires KIA V6 A and B keys (keystore types 11 and 12: `kia_v6_a_key`, `kia_v6_b_key`). XOR masks applied to derive AES key.
|