KaraZajac
754af4134a
Brings KAT to 32 protocol decoders. Ported from the ProtoPirate reference and the D4C1-Labs/Flipper-ARF firmware: ProtoPirate (8): Kia V7, Ford V1, Ford V2, Ford V3, Chrysler V0, Honda Static, Honda V1, Land Rover V0. Flipper-ARF (6): Toyota, Land Rover RKE, Mazda Siemens, BMW CAS4, Porsche Cayenne, PSA2. Each decoder is gated (CRC / checksum / fixed markers / frame structure) so it cannot false-match existing protocols; every previously-decoding IMPORTS capture decodes unchanged. Real-capture decodes added for Ford V3 (LDV T80), Honda Static (Honda), Toyota (Camry NRZ variant), and PSA2 (Groupe PSA, serial 0x99EB25); the rest are validated by encode/decode round-trip and synthetic-frame tests. Also fixes a debug-only underflow panic in keeloq_common::keeloq_decrypt (15 - r underflowed; now wrapping_sub to match the reference's unsigned wrap; release behavior unchanged). Adds per-protocol docs, updates the README protocol table, capture metadata (encoding / RF / encryption), make-suggestion mapping, and CHANGELOG. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JEfaKqzB3T4qsrybwfEi73
68 lines
3.4 KiB
Markdown
68 lines
3.4 KiB
Markdown
---
|
||
layout: default
|
||
---
|
||
|
||
# Porsche Cayenne Protocol
|
||
|
||
**Rust module:** `src/protocols/porsche_cayenne.rs`
|
||
**Reference:** `Flipper-ARF lib/subghz/protocols/porsche_cayenne.c`
|
||
|
||
## Overview
|
||
|
||
Porsche keyfobs (internal firmware header name "Porsche AG"). PWM at 1680/3370 µs: SHORT LOW + LONG HIGH
|
||
= bit 0, LONG LOW + SHORT HIGH = bit 1. 64-bit MSB-first frame, preceded by a 73-pulse 3370 µs sync
|
||
preamble + a 5930 µs gap pair. The cipher is a 24-bit rotating-register VAG cipher; the counter is
|
||
recovered by brute-forcing 1..=256 and matching the recomputed encrypted bytes (the C's validity signal).
|
||
|
||
> **Note:** Porsche Cayenne shares the wire protocol with KAT's existing **Porsche Touareg** decoder
|
||
> (the Touareg port is itself a port of this same `porsche_cayenne.c` source). The two are the **same
|
||
> wire protocol** — identical timing, preamble, 64-bit frame, VAG cipher, and validity check. Cayenne is
|
||
> registered AFTER Touareg, so Touareg keeps first-match priority and Cayenne never steals a Touareg
|
||
> capture. Emission is additionally gated on `frame_type` being one of the three values the C emits
|
||
> (`0b001` Cont, `0b010` First, `0b100` Final) — a strict subset of what Touareg accepts. Cayenne adds an
|
||
> encoder (the Touareg port is decode-only).
|
||
|
||
## Timing
|
||
|
||
| Parameter | Value | Notes |
|
||
|-------------|---------|------------------------|
|
||
| Short | 1680 µs | ±500 µs (te_delta) |
|
||
| Long | 3370 µs | ±500 µs |
|
||
| Sync | 3370 µs | preamble pulse |
|
||
| Gap | 5930 µs | preamble→data boundary |
|
||
| Min bits | 64 | |
|
||
| Sync min | 15 pairs| (firmware emits 73) |
|
||
|
||
## Frame Layout (64 bits / 8 bytes)
|
||
|
||
- **byte 0:** `(button << 4) | (frame_type & 0x07)` — button d-pad: Lock=0x01, Unlock=0x02, Trunk=0x04, Open/Panic=0x08; frame_type First=0x02, Cont=0x01, Final=0x04
|
||
- **bytes 1–3:** serial (24-bit, big-endian)
|
||
- **bytes 4–7:** encrypted cipher output (24-bit rotating-register VAG cipher seeded from serial, rotated `4 + counter_low` times)
|
||
|
||
The `extra` word carries the frame_type; `protocol_display_name` is `Porsche Cayenne [First|Cont|Final]`.
|
||
|
||
## RF
|
||
|
||
- **Encoding:** PWM (SHORT LOW + LONG HIGH = 0, LONG LOW + SHORT HIGH = 1)
|
||
- **RF modulation:** AM/OOK
|
||
- **Encryption:** 24-bit rotating-register VAG cipher; counter recovered by brute force, `counter != 0` is the validity gate
|
||
- **Frequencies:** 433.92 MHz, 868.35 MHz
|
||
|
||
## Decoder Steps
|
||
|
||
1. **Reset** — wait for a LOW pulse at ~3370 µs.
|
||
2. **Sync** — count sync pulses (HIGH and LOW at 3370 µs); a 5930 µs gap with ≥15 sync pulses enters GapHigh/GapLow.
|
||
3. **GapHigh/GapLow** — expect the complementary 5930 µs gap pulse, then enter Data.
|
||
4. **Data** — decode bit pairs (SHORT LOW + LONG HIGH = 0, LONG LOW + SHORT HIGH = 1); at 64 bits, `parse_data` applies the Cayenne frame_type gate + counter recovery and emits (or stays silent so Touareg owns the frame).
|
||
|
||
## Encoder
|
||
|
||
Supported (matches `porsche_cayenne_build_upload`). Emits a 4-frame burst (frame types 0b010/0b001/0b100/
|
||
0b100, cipher counters cnt+1..cnt+4), each frame being 73 sync pairs + 1 gap pair + 64 MSB-first PWM bits.
|
||
|
||
## Validation
|
||
|
||
Verified by encode→decode round-trips / synthetic-frame checks (no local capture available). Unit tests
|
||
cover the full encoder path, all three frame types, rejection of undocumented frame types and truncated
|
||
frames, the counter-recovery limit matching the C, and shared cipher vectors with the Touareg port.
|