KaraZajac
754af4134a
Brings KAT to 32 protocol decoders. Ported from the ProtoPirate reference and the D4C1-Labs/Flipper-ARF firmware: ProtoPirate (8): Kia V7, Ford V1, Ford V2, Ford V3, Chrysler V0, Honda Static, Honda V1, Land Rover V0. Flipper-ARF (6): Toyota, Land Rover RKE, Mazda Siemens, BMW CAS4, Porsche Cayenne, PSA2. Each decoder is gated (CRC / checksum / fixed markers / frame structure) so it cannot false-match existing protocols; every previously-decoding IMPORTS capture decodes unchanged. Real-capture decodes added for Ford V3 (LDV T80), Honda Static (Honda), Toyota (Camry NRZ variant), and PSA2 (Groupe PSA, serial 0x99EB25); the rest are validated by encode/decode round-trip and synthetic-frame tests. Also fixes a debug-only underflow panic in keeloq_common::keeloq_decrypt (15 - r underflowed; now wrapping_sub to match the reference's unsigned wrap; release behavior unchanged). Adds per-protocol docs, updates the README protocol table, capture metadata (encoding / RF / encryption), make-suggestion mapping, and CHANGELOG. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JEfaKqzB3T4qsrybwfEi73
3.2 KiB
layout
| layout |
|---|
| default |
Mazda Siemens Protocol
Rust module: src/protocols/mazda_siemens.rs
Reference: Flipper-ARF lib/subghz/protocols/mazda_siemens.c
Overview
The Siemens/VDO keyfob cipher used on some Mazda vehicles — a DIFFERENT protocol from KAT's existing
"Mazda V0" (Pandora) decoder, even though both ride a 250/500 µs pair-based stream at 433.92 MHz FM. The
decoder is pair-based: feed() ignores level and interprets raw durations in pairs (process_pair),
collecting bits with inverted polarity (state_bit == 0 → stored 1). 64-bit frame.
Siemens obfuscation (mazda_xor_deobfuscate): parity-dependent XOR mask, then bit-deinterleave of bytes
5/6. The inner Siemens cipher's plaintext is left as-is (no key); only this obfuscation/interleave layer
is reversed. The gate is an additive checksum sum(data[0..7]) == data[7], plus the structural
preamble/sync/bit-count constraints, which keeps it from false-matching other 250/500 µs Manchester
protocols.
Note: KAT's existing "Mazda V0" decoder implements the same algorithm and keeps first-match priority, so on a shared frame Mazda V0 fires first.
Timing
| Parameter | Value | Notes |
|---|---|---|
| Short | 250 µs | ±100 µs (te_delta) |
| Long | 500 µs | ±100 µs |
| Min bits | 64 | |
| Preamble | ≥13 short/short pairs | |
| Completion | 80–105 collected bits |
Frame Layout (64 bits / 8 bytes, after deobfuscation)
The 14-byte buffer's leading sync byte is discarded, leaving 8 bytes:
- serial:
data >> 32(32-bit) - button:
(data >> 24) & 0xFF— Lock=0x10, Unlock=0x20, Trunk=0x40 - counter:
(data >> 8) & 0xFFFF(16-bit) - byte 7: additive checksum of bytes 0–6
RF
- Encoding: pair-based Manchester (inverted polarity), 250/500 µs
- RF modulation: FM
- Encryption: Siemens obfuscation (parity XOR + bit-interleave); gated on the additive checksum
- Frequencies: 433.92 MHz only
Decoder Steps
- Reset — a short pulse begins the preamble.
- PreambleSave/PreambleCheck — count short/short pairs (≥13); a short→long transition seeds the leading sync bit (a 1) and enters data.
- DataSave/DataCheck — process duration pairs into bits; on a non-matching pair, run
check_completion(discard sync byte, deobfuscate, validate additive checksum) and emit.
Encoder
Supported (subghz_protocol_encoder_mazda_siemens_get_upload). Increments the counter byte, recomputes
the checksum, obfuscates (interleave + XOR), then emits a 12-byte 0xFF preamble, a 50 ms gap, 0xFF 0xFF 0xD7, the 8 obfuscated bytes transmitted as 255 − byte, a 0x5A tail, and a trailing 50 ms gap.
Manchester per byte: bit 1 → (H,L), bit 0 → (L,H) at te_short. As in the C, the decoder and encoder are
not a clean raw-timing round-trip pair (the encoder targets a TX upload).
Validation
Verified by an encode→decode round-trip / synthetic-frame check (no local capture available). Unit tests cover the obfuscate/deobfuscate XOR+interleave cipher layer (a true inverse, both parity branches), the field layout, and the TX upload smoke test.