KaraZajac
754af4134a
Brings KAT to 32 protocol decoders. Ported from the ProtoPirate reference and the D4C1-Labs/Flipper-ARF firmware: ProtoPirate (8): Kia V7, Ford V1, Ford V2, Ford V3, Chrysler V0, Honda Static, Honda V1, Land Rover V0. Flipper-ARF (6): Toyota, Land Rover RKE, Mazda Siemens, BMW CAS4, Porsche Cayenne, PSA2. Each decoder is gated (CRC / checksum / fixed markers / frame structure) so it cannot false-match existing protocols; every previously-decoding IMPORTS capture decodes unchanged. Real-capture decodes added for Ford V3 (LDV T80), Honda Static (Honda), Toyota (Camry NRZ variant), and PSA2 (Groupe PSA, serial 0x99EB25); the rest are validated by encode/decode round-trip and synthetic-frame tests. Also fixes a debug-only underflow panic in keeloq_common::keeloq_decrypt (15 - r underflowed; now wrapping_sub to match the reference's unsigned wrap; release behavior unchanged). Adds per-protocol docs, updates the README protocol table, capture metadata (encoding / RF / encryption), make-suggestion mapping, and CHANGELOG. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JEfaKqzB3T4qsrybwfEi73
2.6 KiB
layout
| layout |
|---|
| default |
BMW CAS4 Protocol
Rust module: src/protocols/bmw_cas4.rs
Reference: Flipper-ARF lib/subghz/protocols/bmw_cas4.c
Overview
BMW CAS4 uses Manchester encoding at 500/1000 µs. 64 bits (8 bytes), AM/OOK. The CAS4 rolling cipher's
manufacturer key is not available, so the encrypted portion is left as-is — the frame is only framed and
validated, not decrypted. Emission is gated on two fixed marker bytes (byte[0] == 0x30 and
byte[6] == 0xC5), which makes the protocol specific and prevents false matches.
The Manchester decoder uses Flipper's manchester_decoder.h transition table, with polarity
level ? Low : High (the same mapping as Ford V0 / common).
Timing
| Parameter | Value | Notes |
|---|---|---|
| Short | 500 µs | ±150 µs (te_delta) |
| Long | 1000 µs | ±150 µs |
| Preamble pulse | 300–700 µs | |
| Gap | ≥1800 µs | separates preamble from data |
| Min bits | 64 | 8 bytes |
| Preamble | ≥10 pulses |
Frame Layout (64 bits / 8 bytes)
- byte 0: fixed marker
0x30 - bytes 1–3: serial (24-bit)
- byte 5: counter
- byte 6: fixed marker
0xC5 - byte 7: button
The CAS4 rolling cipher is left undecrypted; the two markers serve as the integrity gate.
RF
- Encoding: Manchester (Flipper table, polarity
level ? Low : High) - RF modulation: AM/OOK
- Encryption: CAS4 rolling cipher left undecrypted (no manufacturer key); gated on fixed markers
0x30/0xC5 - Frequencies: 433.92 MHz only
Decoder Steps
- Reset — begin on a HIGH preamble pulse within the 300–700 µs window.
- Preamble — count preamble pulses; a long LOW gap (≥1800 µs) with ≥10 pulses enters Data.
- Data — Manchester-decode 64 bits MSB-first; at the 64th bit, require
byte[0]==0x30 && byte[6]==0xC5, build the signal on success, and reset. An out-of-range pulse aborts.
Encoder
Not supported (the reference encoder is a non-functional stub: yield returns reset, deserialize
returns error). Decode-only.
Validation
Verified by a synthetic-frame check (no local capture available): a unit test Manchester-encodes a frame by driving the decoder's own transition table (the Flipper table is differential, so there is no fixed per-bit pattern), confirms it decodes with the right serial/counter/button, and confirms a frame with wrong marker bytes is rejected.