Files

T

KaraZajac 48ee413c9b v1.2.0: Add 4 new protocols, fix 5 existing, port Kia V6 encoder

New protocols (from ProtoPirate):
- Mazda V0: 433MHz, pair-based decoding, XOR deobfuscation
- Mitsubishi V0: 868MHz, PWM, bit negation + XOR unscrambling
- Porsche Touareg: 433/868MHz, sync preamble, 24-bit rotate cipher
- Fiat V1 (Magneti Marelli BSI): 433MHz, auto-detected timing variants

Protocol fixes aligned with ProtoPirate reference:
- Kia V1: Fix Manchester level mapping (inverted convention), off-by-one
  bit count, CRC4 simplified to 7 bytes + offset 1
- Kia V2: Fix CRC byte layout (was double-counting nibbles), off-by-one
  bit count, preamble short-HIGH handling
- Fiat V0: Fix endbyte transform (remove (<<1)|1), standard Manchester
  encoder (was differential), 7 btn bits (was 6), gap path fallback
- PSA: Fix modified TEA (XTEA-like dynamic key selection), XOR decrypt
  byte mapping, critical key2_low construction bug, encoder polarity and
  preamble, add key1_high nibble validation, dual preamble patterns
- Ford V0: Add calculate_checksum (sums all serial+count bytes) for encoder

Kia V6 encoder ported:
- Forward AES-128 (SubBytes, ShiftRows, MixColumns, encrypt)
- encrypt_payload: build plaintext, AES encrypt, pack into 3 parts
- Two-pass Manchester upload (640 + 38 preamble pairs)
- fx_field extraction stored in DecodedSignal.extra for encode roundtrip

Updated README, protocol docs, and version bump to 1.2.0.

2026-03-22 12:05:01 -04:00

2.3 KiB

Raw Permalink Blame History

layout

layout
default

Mazda V0 Protocol

Rust module: src/protocols/mazda_v0.rs Reference: REFERENCES/ProtoPirate/protocols/mazda_v0.c

Overview

Mazda V0 uses a custom pair-based encoding (not standard Manchester). The level parameter is ignored; the decoder processes raw duration pairs. Preamble: 13+ short/short pairs followed by a short+long transition into data. Data bits are collected using a prev_state tracker with inverted polarity, then XOR-deobfuscated, checksum-validated, and parsed.

Timing

Parameter	Value	Notes
Short	250 us	+/-100 us
Long	500 us	+/-100 us
Min bits	64
Completion	80-105 bits

Frame Layout (64 bits after deobfuscation)

Raw data collects into a 14-byte buffer. First byte is discarded (sync); bytes [1..9] form the 8-byte data frame.

After XOR deobfuscation:

Bytes 0-3: Serial (32 bits)
Byte 4: Button (8 bits)
Bytes 5-6: Counter (16 bits)
Byte 7: Checksum (additive sum of bytes 0-6)

Pair-Based Bit Decoding

Pair (te_last, duration)	Action
Long + Short	Collect bit(0), bit(1), prev_state=1
Short + Long	Collect bit(1), prev_state=0
Short + Short	Collect bit(prev_state)
Long + Long	Collect bit(0), bit(1), prev_state=0

Bit collection uses inverted polarity: state_bit=0 stores a 1.

XOR Deobfuscation

Compute parity of data[7] (XOR fold to single bit).
If parity is odd: XOR bytes [0..6] with data[6] as mask.
If parity is even: XOR bytes [0..5] with data[5] as mask, also XOR data[6] with data[5].
Bit interleave swap bytes 5 and 6: swap even/odd bit positions between them.

Decoder Steps

Reset -- Wait for short pulse; save and go to PreambleCheck.
PreambleSave -- Save duration, go to PreambleCheck.
PreambleCheck -- Count short+short pairs; on short+long with count >= 13, start data.
DataSave -- Save duration, go to DataCheck.
DataCheck -- Process pair; if valid continue; if invalid, check completion (80-105 bits + checksum).

Buttons

Code	Name
0x10	Lock
0x20	Unlock
0x40	Trunk

Encoder

Not supported (decode-only).

Frequencies

433.92 MHz.

2.3 KiB Raw Permalink Blame History