KaraZajac
48ee413c9b
New protocols (from ProtoPirate): - Mazda V0: 433MHz, pair-based decoding, XOR deobfuscation - Mitsubishi V0: 868MHz, PWM, bit negation + XOR unscrambling - Porsche Touareg: 433/868MHz, sync preamble, 24-bit rotate cipher - Fiat V1 (Magneti Marelli BSI): 433MHz, auto-detected timing variants Protocol fixes aligned with ProtoPirate reference: - Kia V1: Fix Manchester level mapping (inverted convention), off-by-one bit count, CRC4 simplified to 7 bytes + offset 1 - Kia V2: Fix CRC byte layout (was double-counting nibbles), off-by-one bit count, preamble short-HIGH handling - Fiat V0: Fix endbyte transform (remove (<<1)|1), standard Manchester encoder (was differential), 7 btn bits (was 6), gap path fallback - PSA: Fix modified TEA (XTEA-like dynamic key selection), XOR decrypt byte mapping, critical key2_low construction bug, encoder polarity and preamble, add key1_high nibble validation, dual preamble patterns - Ford V0: Add calculate_checksum (sums all serial+count bytes) for encoder Kia V6 encoder ported: - Forward AES-128 (SubBytes, ShiftRows, MixColumns, encrypt) - encrypt_payload: build plaintext, AES encrypt, pack into 3 parts - Two-pass Manchester upload (640 + 38 preamble pairs) - fx_field extraction stored in DecodedSignal.extra for encode roundtrip Updated README, protocol docs, and version bump to 1.2.0.
1.9 KiB
1.9 KiB
KAT Protocol Documentation
This folder describes how each keyfob protocol supported by KAT works. Each document corresponds to a decoder/encoder in src/protocols/.
Capture/encode model: Decoded signals expose optional extra (e.g. VAG: vag_type + key_idx). When present, the app stores it in Capture.data_extra so retransmit can encode from the capture without decoder instance state. See vag.md for the VAG encode-from-capture flow.
| Protocol | Rust module | Doc |
|---|---|---|
| Kia V0 | kia_v0.rs |
kia_v0.md |
| Kia V1 | kia_v1.rs |
kia_v1.md |
| Kia V2 | kia_v2.rs |
kia_v2.md |
| Kia V3/V4 | kia_v3_v4.rs |
kia_v3_v4.md |
| Kia V5 | kia_v5.rs |
kia_v5.md |
| Kia V6 | kia_v6.rs |
kia_v6.md |
| Ford V0 | ford_v0.rs |
ford_v0.md |
| Subaru | subaru.rs |
subaru.md |
| VAG | vag.rs |
vag.md |
| Fiat V0 | fiat_v0.rs |
fiat_v0.md |
| Fiat V1 | fiat_v1.rs |
fiat_v1.md |
| Mazda V0 | mazda_v0.rs |
mazda_v0.md |
| Mitsubishi V0 | mitsubishi_v0.rs |
mitsubishi_v0.md |
| Porsche Touareg | porsche_touareg.rs |
porsche_touareg.md |
| Suzuki | suzuki.rs |
suzuki.md |
| Scher-Khan | scher_khan.rs |
scher_khan.md |
| Star Line | star_line.rs |
star_line.md |
| PSA | psa.rs |
psa.md |
| KeeLoq generic (fallback) | keeloq_generic.rs |
keeloq_generic.md |
KeeLoq generic is not a registered decoder; it runs when no protocol matches and tries KeeLoq with every keystore manufacturer key (using keeloq_common). Successful decodes appear as Keeloq (keystore name).
Implementations are aligned with the ProtoPirate reference in REFERENCES/ProtoPirate/protocols/.