KaraZajac
754af4134a
Brings KAT to 32 protocol decoders. Ported from the ProtoPirate reference and the D4C1-Labs/Flipper-ARF firmware: ProtoPirate (8): Kia V7, Ford V1, Ford V2, Ford V3, Chrysler V0, Honda Static, Honda V1, Land Rover V0. Flipper-ARF (6): Toyota, Land Rover RKE, Mazda Siemens, BMW CAS4, Porsche Cayenne, PSA2. Each decoder is gated (CRC / checksum / fixed markers / frame structure) so it cannot false-match existing protocols; every previously-decoding IMPORTS capture decodes unchanged. Real-capture decodes added for Ford V3 (LDV T80), Honda Static (Honda), Toyota (Camry NRZ variant), and PSA2 (Groupe PSA, serial 0x99EB25); the rest are validated by encode/decode round-trip and synthetic-frame tests. Also fixes a debug-only underflow panic in keeloq_common::keeloq_decrypt (15 - r underflowed; now wrapping_sub to match the reference's unsigned wrap; release behavior unchanged). Adds per-protocol docs, updates the README protocol table, capture metadata (encoding / RF / encryption), make-suggestion mapping, and CHANGELOG. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JEfaKqzB3T4qsrybwfEi73
72 lines
3.2 KiB
Markdown
72 lines
3.2 KiB
Markdown
---
|
||
layout: default
|
||
---
|
||
|
||
# Land Rover RKE Protocol
|
||
|
||
**Rust module:** `src/protocols/land_rover_rke.rs`
|
||
**Reference:** `Flipper-ARF lib/subghz/protocols/landrover_rke.c`
|
||
|
||
## Overview
|
||
|
||
Ported from the Flipper-ARF firmware (D4C1-Labs), itself derived from Pandora DXL 5000 firmware. Land
|
||
Rover shares the Ford/Jaguar baseband (firmware protocol ID `0x0E`) but uses a distinct 66-bit frame.
|
||
Encoding is fixed-width PWM with a 1000 µs bit period: Bit-1 = 700 µs HIGH + 300 µs LOW, Bit-0 = 300 µs
|
||
HIGH + 700 µs LOW. Preamble = 20× (400 µs HIGH + 600 µs LOW); sync = 400 µs HIGH + 9600 µs LOW.
|
||
|
||
KeeLoq: the hop code is the raw 32-bit KeeLoq ciphertext. Full decryption needs the per-fob manufacturer
|
||
key (provisioned, not in firmware), so KAT exposes the framed fields and leaves the hop encrypted —
|
||
`crc_valid = false` since no cryptographic check is performed. Emission is still gated tightly on the long
|
||
preamble run, the distinctive 9.6 ms sync gap, and exactly 66 PWM bits, so this loose-looking PWM decoder
|
||
does not false-match Kia/Subaru/Ford captures.
|
||
|
||
## Timing
|
||
|
||
| Parameter | Value | Notes |
|
||
|----------------|---------|-----------------------------|
|
||
| Bit-1 | 700 µs HIGH + 300 µs LOW | ±20% (relative) |
|
||
| Bit-0 | 300 µs HIGH + 700 µs LOW | ±20% |
|
||
| Preamble pair | 400 µs HIGH + 600 µs LOW | ×20 |
|
||
| Sync | 400 µs HIGH + 9600 µs LOW | |
|
||
| Repeat gap | 12000 µs | |
|
||
| Min bits | 66 | |
|
||
| Preamble min | 16 pairs| |
|
||
|
||
(Reported timing profile: te_short 300 µs, te_long 700 µs, te_delta 140 µs.)
|
||
|
||
## Frame Layout (66 bits, MSB-first)
|
||
|
||
- **[65:34]:** 32-bit KeeLoq encrypted hopping code
|
||
- **[33:10]:** 24-bit fixed fob serial
|
||
- **[9:6]:** 4-bit button — Lock=0x1, Unlock=0x2, Boot/Tailgate=0x4, Panic=0x8
|
||
- **[5:2]:** 4-bit function/repeat flags
|
||
- **[1:0]:** 2-bit status — battery-low=0x1, repeat=0x2
|
||
|
||
66 bits do not fit a u64: `data` holds the low 64 frame bits and `extra` holds the top 2 (the high 2 bits
|
||
of the hop code), so encode round-trips the hop losslessly. The KAT counter field surfaces the low 16
|
||
bits of the hop ciphertext.
|
||
|
||
## RF
|
||
|
||
- **Encoding:** fixed-width PWM
|
||
- **RF modulation:** OOK/AM
|
||
- **Encryption:** KeeLoq hop left encrypted (no manufacturer key); `crc_valid = false`
|
||
- **Frequencies:** 433.92 MHz, 315 MHz
|
||
|
||
## Decoder Steps
|
||
|
||
1. **Reset** — wait for the first ~400 µs preamble HIGH.
|
||
2. **Preamble** — count 400/600 µs pairs; the distinctive ~9600 µs LOW after a ~400 µs HIGH (with ≥16 pairs) enters DataHigh.
|
||
3. **DataHigh/DataLow** — read each bit from its HIGH/LOW half pair (±20% windows). At 66 bits, build the signal and emit.
|
||
|
||
## Encoder
|
||
|
||
Supported. Reconstructs the original frame to preserve hop code / func bits / status, overrides only the
|
||
button, and emits 4 repetitions of preamble + sync + 66 MSB-first PWM bits, separated by 12 ms gaps.
|
||
|
||
## Validation
|
||
|
||
Verified by encode→decode round-trips / synthetic-frame checks (no local capture available). Unit tests
|
||
cover pack/unpack round trips, encode→decode across multiple serials/hops/buttons, and rejection of
|
||
truncated frames and wrong sync gaps.
|