Files

T

KaraZajac 48ee413c9b v1.2.0: Add 4 new protocols, fix 5 existing, port Kia V6 encoder

New protocols (from ProtoPirate):
- Mazda V0: 433MHz, pair-based decoding, XOR deobfuscation
- Mitsubishi V0: 868MHz, PWM, bit negation + XOR unscrambling
- Porsche Touareg: 433/868MHz, sync preamble, 24-bit rotate cipher
- Fiat V1 (Magneti Marelli BSI): 433MHz, auto-detected timing variants

Protocol fixes aligned with ProtoPirate reference:
- Kia V1: Fix Manchester level mapping (inverted convention), off-by-one
  bit count, CRC4 simplified to 7 bytes + offset 1
- Kia V2: Fix CRC byte layout (was double-counting nibbles), off-by-one
  bit count, preamble short-HIGH handling
- Fiat V0: Fix endbyte transform (remove (<<1)|1), standard Manchester
  encoder (was differential), 7 btn bits (was 6), gap path fallback
- PSA: Fix modified TEA (XTEA-like dynamic key selection), XOR decrypt
  byte mapping, critical key2_low construction bug, encoder polarity and
  preamble, add key1_high nibble validation, dual preamble patterns
- Ford V0: Add calculate_checksum (sums all serial+count bytes) for encoder

Kia V6 encoder ported:
- Forward AES-128 (SubBytes, ShiftRows, MixColumns, encrypt)
- encrypt_payload: build plaintext, AES encrypt, pack into 3 parts
- Two-pass Manchester upload (640 + 38 preamble pairs)
- fx_field extraction stored in DecodedSignal.extra for encode roundtrip

Updated README, protocol docs, and version bump to 1.2.0.

2026-03-22 12:05:01 -04:00

3.1 KiB

Raw Blame History

layout

layout
default

PSA (Peugeot/Citroen) Protocol

Rust module: src/protocols/psa.rs Reference: REFERENCES/ProtoPirate/protocols/psa.c

Overview

PSA uses Manchester encoding with dual preamble pattern support. 128 bits total: key1 (64) + validation (16) + key2/rest (48). Modified TEA (XTEA-like) with dynamic key selection (key[sum & 3] and key[(sum >> 11) & 3]). Two decode modes: mode 0x23 (direct XOR decrypt with checksum validation) and mode 0x36 (TEA with BF1/BF2 key schedules). Brute-force decryption for mode 0x36 is deferred/partial.

Timing

Parameter	Value	Notes
Symbol short	250 us	+/-100 us
Symbol long	500 us	+/-100 us
Preamble P1	250 us sub-symbols	Pattern 1
Preamble P2	125 us sub-symbols	Pattern 2
End marker	1000 us (P1), 500 us (P2)
Min bits	128

Dual Preamble Patterns

Pattern 1 (250 us): Preamble uses 250 us sub-symbols; Manchester decode at 250/500 us. Threshold: 70+ transitions.
Pattern 2 (125 us): Preamble uses 125 us sub-symbols; Manchester decode at 125/250 us. Threshold: 69+ transitions.

Pattern type is auto-detected from the first preamble pulse duration.

Frame Layout (128 bits)

key1: 64 bits
validation: 16 bits
key2/rest: 48 bits

Encryption

Modified TEA (XTEA-like)

Uses dynamic key word selection per round:

Encrypt: k_idx1 = sum & 3, then sum += DELTA, then k_idx2 = (sum >> 11) & 3
Decrypt: k_idx2 = (sum >> 11) & 3, then sum -= DELTA, then k_idx1 = sum & 3
Round function: (key[k_idx] + sum) ^ (((v >> 5) ^ (v << 4)) + v)

Mode 0x23 (Direct XOR)

Setup byte buffer from key1/key2 (little-endian unpack).
Calculate checksum over buffer[2..8] (nibble sum * 16).
Validate: (checksum ^ key2_high_byte) & 0xF0 == 0.
XOR decrypt using psa_copy_reverse byte reordering.
Extract: serial (24-bit), counter (16-bit), button (4-bit), CRC.

Mode 0x36 (TEA Brute-Force)

Direct TEA decrypt attempted with BF1 and BF2 key schedules. Full brute-force (16M iterations per schedule) is available in ProtoPirate but not fully ported to KAT.

Key schedules:

BF1: [0x4A434915, 0xD6743C2B, 0x1F29D308, 0xE6B79A64]
BF2: [0x4039C240, 0xEDA92CAB, 0x4306C02A, 0x02192A04]

Decoder Steps

WaitEdge (State0) -- Detect preamble pattern type from first HIGH pulse (250 us -> Pattern 1, 125 us -> Pattern 2).
CountPattern250 (State1) -- Count 250 us preamble pairs; on long pulse with count > 70, transition to Manchester decode.
DecodeManchester250 (State2) -- Manchester decode at 250/500 us. End on 1000 us marker or 121+ bits.
CountPattern125 (State3) -- Count 125 us preamble pairs; on 250 us pulse with count >= 69, transition to Manchester decode.
DecodeManchester125 (State4) -- Manchester decode at 125/250 us. End on 500 us marker or 121+ bits.

Encoder

Supported (mode 0x23 only). XOR encrypt, then modified TEA encrypt with BF1 key schedule. Preamble: 70 cycles of 125/125 us + 250/250 us sync. Manchester encoded key1 (64 bits) + validation (16 bits). End marker: 1000 us LOW.

Frequencies

433.92 MHz.

3.1 KiB Raw Blame History