KaraZajac
754af4134a
Brings KAT to 32 protocol decoders. Ported from the ProtoPirate reference and the D4C1-Labs/Flipper-ARF firmware: ProtoPirate (8): Kia V7, Ford V1, Ford V2, Ford V3, Chrysler V0, Honda Static, Honda V1, Land Rover V0. Flipper-ARF (6): Toyota, Land Rover RKE, Mazda Siemens, BMW CAS4, Porsche Cayenne, PSA2. Each decoder is gated (CRC / checksum / fixed markers / frame structure) so it cannot false-match existing protocols; every previously-decoding IMPORTS capture decodes unchanged. Real-capture decodes added for Ford V3 (LDV T80), Honda Static (Honda), Toyota (Camry NRZ variant), and PSA2 (Groupe PSA, serial 0x99EB25); the rest are validated by encode/decode round-trip and synthetic-frame tests. Also fixes a debug-only underflow panic in keeloq_common::keeloq_decrypt (15 - r underflowed; now wrapping_sub to match the reference's unsigned wrap; release behavior unchanged). Adds per-protocol docs, updates the README protocol table, capture metadata (encoding / RF / encryption), make-suggestion mapping, and CHANGELOG. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JEfaKqzB3T4qsrybwfEi73
3.0 KiB
layout
| layout |
|---|
| default |
Honda Static Protocol
Rust module: src/protocols/honda_static.rs
Reference: REFERENCES/ProtoPirate/protocols/honda_static.c
Overview
Honda/Acura fixed-code keyfobs. 64-bit frame. Unlike most KAT decoders, Honda Static does NOT use the
Flipper manchester_decoder.h transition table: it buffers a per-element symbol stream (one bit per
~63 µs element) and then performs a custom Manchester unpack over symbol pairs. A short pulse contributes
one symbol equal to the pulse level; a long pulse contributes two symbols of the same level. Anything
outside both ranges (e.g. the 700 µs sync or a trailing gap) terminates the buffer and triggers a parse.
The checksum is an XOR of the first 7 packet bytes. Emission is gated on the checksum, so Honda Static will not false-match. The parser tries the inverted-Manchester interpretation first (what the encoder emits), then non-inverted forward, then a bit-reversed-bytes pass.
Timing
| Parameter | Value | Notes |
|---|---|---|
| Element | 63 µs | one symbol per element |
| Short pulse | 28–98 µs | base 28 µs, span 70 µs |
| Long pulse | 61–191 µs | base 61 µs, span 130 µs (two symbols) |
| Sync | 700 µs | terminates the symbol buffer |
| Min symbols | 36 | before a parse is attempted |
| Min bits | 64 |
(Reported timing profile: te_short 63 µs, te_long 700 µs, te_delta 120 µs.)
Frame Layout (64 bits, MSB-first into 8 bytes)
- bits 0–3: button (4-bit) — Lock=1, Unlock=2, Trunk=4, Remote Start=5, Panic=8, Lock×2=9
- bits 4–31: serial (28-bit)
- bits 32–55: counter (24-bit)
- bits 56–63: checksum (XOR of bytes 0–6)
The exported data (Key) word is the C generic.data: a compact nibble-packed layout, NOT the raw
decoded packet bytes. The KAT counter field is the low 16 bits of the 24-bit counter.
RF
- Encoding: custom symbol-stream Manchester over ~63 µs elements
- RF modulation: FM
- Encryption: none — gated on the XOR checksum + valid button + valid serial (serial ≠ 0 and ≠ 0x0FFFFFFF)
- Frequencies: 315 MHz, 433.92 MHz
Decoder Steps
- feed — classify each pulse: short → 1 symbol, long → 2 symbols; buffer them.
- On an out-of-range pulse (700 µs sync or gap), if ≥36 symbols are buffered, walk past the alternating preamble + sync run, Manchester-unpack 64 bits over symbol pairs (inverted first, then non-inverted), validate, and emit. Then clear the buffer.
Encoder
Supported (matches honda_static_build_upload). Emits a 700 µs HIGH sync, a 160-element alternating
preamble at 63 µs, 64 data bits (each as !value/value at 63 µs), and a trailing 700 µs sync.
Validation
Decodes REAL IMPORTS captures (IMPORTS/honda Lock and Unlock). Also covered by encode→decode round-trip and packet-validate unit tests.