Skip to content

v1.3.0

Latest

Choose a tag to compare

@KaraZajac KaraZajac released this 24 Jun 21:21

v1.3.0 — 14 new keyfob protocols

Brings KAT to 32 protocol decoders, ported from the ProtoPirate reference and the D4C1-Labs/Flipper-ARF firmware.

Added

ProtoPirate (8): Kia V7 (Manchester, header 0x4C + CRC8), Ford V1 (Manchester 65/130, descramble + CRC16/CCITT), Ford V2 (Manchester, 0x7FA7 sync), Ford V3 (Manchester, plaintext, decode-only), Chrysler V0 (PWM, seed-XOR; Dodge/Jeep), Honda Static (FM, XOR checksum), Honda V1 (PWM/PPM, CRC-fold), Land Rover V0 (differential Manchester, 3-bit check).

Flipper-ARF (6): Toyota (dual PWM + NRZ, KeeLoq, decode-only; Lexus), Land Rover RKE (PWM, KeeLoq), Mazda Siemens (Siemens XOR/interleave), BMW CAS4 (Manchester, 0x30/0xC5 markers, decode-only), Porsche Cayenne (PWM, VAG rolling-register cipher), PSA2 / "PSA OLD" (Manchester, TEA with gated brute-force).

  • Real-capture validation where samples exist: Ford V3 (LDV T80), Honda Static (Honda), Toyota (Camry NRZ variant), PSA2 (Groupe PSA, recovered serial 0x99EB25). The rest are validated by encode→decode round-trip and synthetic-frame unit tests.
  • Per-protocol docs, README protocol table, capture metadata (encoding / RF / encryption), and make-suggestion mapping added.

Fixed

  • KeeLoq decrypt debug-panickeeloq_common::keeloq_decrypt underflowed on 15 - r; now uses wrapping_sub to match the reference's unsigned wraparound (release behavior unchanged).

Notes

All new decoders are gated (CRC / checksum / fixed markers / frame structure) so they don't false-match existing protocols — every previously-decoding capture is unchanged. Where two decoders share a wire protocol (Porsche Cayenne ↔ Touareg; Mazda Siemens ↔ Mazda V0; Toyota variant-A ↔ Kia V3/V4 KeeLoq), the pre-existing decoder keeps priority.