Compare commits

..

9 Commits

Author SHA1 Message Date
David
bfdf60944f Remove unused fields from Kia V5 protocol 2026-03-11 18:48:03 +01:00
David
0290f601a0 Remove NULL function pointers from Kia V3/V4 protocol
Removed unused function pointers from the Kia V3/V4 protocol structure.
2026-03-11 18:47:07 +01:00
David
2e5648f3f4 Refactor Kia V5 protocol functions and includes 2026-03-11 17:59:35 +01:00
David
cffd268950 Update 2026-03-11 17:59:14 +01:00
David
ddb85d034f Refactor Kia V3/V4 protocol functions and types 2026-03-11 17:58:44 +01:00
David
55f770328c Update 2026-03-11 17:58:20 +01:00
Andrea
72d3992092 Update Fiat Mystery to Fiat Marelli in README 2026-03-11 15:01:14 +01:00
Andrea Santaniello
c1d145c9cc Updated fiat mistery (magneti marelli BSI) 2026-03-11 14:48:19 +01:00
d4rks1d33
6507bed882 Kia V0/V1/V2 now fully working 2026-03-10 13:36:26 -03:00
11 changed files with 805 additions and 1012 deletions

View File

@@ -34,7 +34,7 @@ This project may incorporate, adapt, or build upon **other open-source projects*
| PSA (Peugeot/Citroën/DS) | PSA GROUP | 433 MHz | AM/FM | Yes | Yes | | PSA (Peugeot/Citroën/DS) | PSA GROUP | 433 MHz | AM/FM | Yes | Yes |
| Ford | Ford V0 | 315/433 MHz | AM | Yes | Yes | | Ford | Ford V0 | 315/433 MHz | AM | Yes | Yes |
| Fiat | Fiat SpA | 433 MHz | AM | Yes | Yes | | Fiat | Fiat SpA | 433 MHz | AM | Yes | Yes |
| Fiat | Fiat Mystery | 433 MHz | AM | No | Yes | | Fiat | Fiat Marelli | 433 MHz | AM | No | Yes |
| Subaru | Subaru | 433 MHz | AM | Yes | Yes | | Subaru | Subaru | 433 MHz | AM | Yes | Yes |
| Mazda | Siemens (5WK49365D) | 315/433 MHz | FM | Yes | Yes | | Mazda | Siemens (5WK49365D) | 315/433 MHz | FM | Yes | Yes |
| Kia/Hyundai | Kia V0 | 433 MHz | FM | Yes | Yes | | Kia/Hyundai | Kia V0 | 433 MHz | FM | Yes | Yes |

View File

@@ -4,18 +4,26 @@
#define TAG "FiatMystery" #define TAG "FiatMystery"
// Fiat Panda "pandarella e tonino": // Suspected Magneti Marelli BSI keyfob protocol
// te_short ~260us, te_long ~520us (Manchester) // Found on: Fiat Panda (and possibly other Fiat/Lancia/Alfa ~2003-2012)
//
// RF: 433.92 MHz, Manchester encoding
// te_short ~260us, te_long ~520us
// Preamble: ~191 short-short pairs (alternating 260us HIGH/LOW) // Preamble: ~191 short-short pairs (alternating 260us HIGH/LOW)
// Gap: ~3126us LOW // Gap: ~3126us LOW
// Sync: ~2065us HIGH // Sync: ~2065us HIGH
// Data: 86 Manchester bits // Data: 88 Manchester bits (often decoded as 104 with 16-bit 0xFFFF preamble residue)
// Retransmissions: 7-8 per press // Retransmissions: 7-10 per press
//
// Frame layout (after stripping 16-bit 0xFFFF preamble):
// Bytes 0-3: Fixed ID / Serial (32 bits)
// Byte 4: Button (upper nibble) | Type (lower nibble, always 0x2)
// Bytes 5-10: Rolling/encrypted code (48 bits)
#define FIAT_MYSTERY_PREAMBLE_MIN 200 // Min preamble pulses (100 pairs) #define FIAT_MYSTERY_PREAMBLE_MIN 200 // Min preamble pulses (100 pairs)
#define FIAT_MYSTERY_GAP_MIN 2500 // Gap detection threshold (us) #define FIAT_MYSTERY_GAP_MIN 2500 // Gap detection threshold (us)
#define FIAT_MYSTERY_SYNC_MIN 1500 // Sync pulse minimum (us) #define FIAT_MYSTERY_SYNC_MIN 1500 // Sync pulse minimum (us)
#define FIAT_MYSTERY_SYNC_MAX 2600 // Sync pulse maximum (us) #define FIAT_MYSTERY_SYNC_MAX 2600 // Sync pulse maximum (us)
#define FIAT_MYSTERY_MAX_DATA_BITS 96 // Max data bits to collect #define FIAT_MYSTERY_MAX_DATA_BITS 104 // Max data bits to collect (13 bytes)
static const SubGhzBlockConst subghz_protocol_fiat_mystery_const = { static const SubGhzBlockConst subghz_protocol_fiat_mystery_const = {
.te_short = 260, .te_short = 260,
@@ -31,7 +39,7 @@ struct SubGhzProtocolDecoderFiatMystery {
ManchesterState manchester_state; ManchesterState manchester_state;
uint8_t decoder_state; uint8_t decoder_state;
uint16_t preamble_count; uint16_t preamble_count;
uint8_t raw_data[12]; // Up to 96 bits (12 bytes) uint8_t raw_data[13]; // Up to 104 bits (13 bytes)
uint8_t bit_count; uint8_t bit_count;
uint32_t extra_data; // Bits beyond first 64, right-aligned uint32_t extra_data; // Bits beyond first 64, right-aligned
uint32_t te_last; uint32_t te_last;
@@ -292,13 +300,20 @@ void subghz_protocol_decoder_fiat_mystery_feed(void* context, bool level, uint32
if(frame_complete) { if(frame_complete) {
instance->generic.data_count_bit = instance->bit_count; instance->generic.data_count_bit = instance->bit_count;
// Frame layout: bytes 0-1 are 0xFFFF preamble residue
// Bytes 2-5: Fixed ID (serial)
// Byte 6: Button (upper nibble) | subtype (lower nibble)
// Bytes 7-12: Rolling/encrypted code (48 bits)
instance->generic.serial = instance->generic.serial =
((uint32_t)instance->raw_data[4] << 24) | ((uint32_t)instance->raw_data[2] << 24) |
((uint32_t)instance->raw_data[5] << 16) | ((uint32_t)instance->raw_data[3] << 16) |
((uint32_t)instance->raw_data[6] << 8) | ((uint32_t)instance->raw_data[4] << 8) |
((uint32_t)instance->raw_data[7]); ((uint32_t)instance->raw_data[5]);
instance->generic.cnt = (uint32_t)(instance->generic.data >> 32); instance->generic.btn = (instance->raw_data[6] >> 4) & 0xF;
instance->generic.btn = 0; instance->generic.cnt =
((uint32_t)instance->raw_data[7] << 16) |
((uint32_t)instance->raw_data[8] << 8) |
((uint32_t)instance->raw_data[9]);
FURI_LOG_I( FURI_LOG_I(
TAG, TAG,
@@ -385,22 +400,41 @@ SubGhzProtocolStatus subghz_protocol_decoder_fiat_mystery_deserialize(
return ret; return ret;
} }
static const char* fiat_mystery_button_name(uint8_t btn) {
switch(btn) {
case 0x2:
return "Btn A";
case 0x4:
return "Btn B";
default:
return "Unknown";
}
}
void subghz_protocol_decoder_fiat_mystery_get_string(void* context, FuriString* output) { void subghz_protocol_decoder_fiat_mystery_get_string(void* context, FuriString* output) {
furi_check(context); furi_check(context);
SubGhzProtocolDecoderFiatMystery* instance = context; SubGhzProtocolDecoderFiatMystery* instance = context;
uint8_t total_bytes = (instance->bit_count + 7) / 8; uint8_t total_bytes = (instance->bit_count + 7) / 8;
if(total_bytes > 12) total_bytes = 12; if(total_bytes > 13) total_bytes = 13;
furi_string_cat_printf( furi_string_cat_printf(
output, output,
"%s %dbit\r\n" "%s %dbit\r\n"
"Key:%08lX%08lX\r\n" "Sn:%08lX Btn:%s(0x%X)\r\n"
"Roll:%02X%02X%02X%02X%02X%02X\r\n"
"Data:", "Data:",
instance->generic.protocol_name, instance->generic.protocol_name,
instance->bit_count, instance->bit_count,
(uint32_t)(instance->generic.data >> 32), instance->generic.serial,
(uint32_t)(instance->generic.data & 0xFFFFFFFF)); fiat_mystery_button_name(instance->generic.btn),
instance->generic.btn,
instance->raw_data[7],
instance->raw_data[8],
instance->raw_data[9],
(total_bytes > 10) ? instance->raw_data[10] : 0,
(total_bytes > 11) ? instance->raw_data[11] : 0,
(total_bytes > 12) ? instance->raw_data[12] : 0);
for(uint8_t i = 0; i < total_bytes; i++) { for(uint8_t i = 0; i < total_bytes; i++) {
furi_string_cat_printf(output, "%02X", instance->raw_data[i]); furi_string_cat_printf(output, "%02X", instance->raw_data[i]);

View File

@@ -1,6 +1,13 @@
#include "kia_v0.h" #include "kia_v0.h"
#include "../blocks/custom_btn_i.h" #include "../blocks/custom_btn_i.h"
static const char* kia_v0_btn_name(uint8_t btn) {
if(btn == 0x01) return "Lock";
if(btn == 0x02) return "Unlock";
if(btn == 0x03) return "Boot";
return "?";
}
static uint8_t kia_v0_get_btn_code() { static uint8_t kia_v0_get_btn_code() {
uint8_t custom_btn = subghz_custom_btn_get(); uint8_t custom_btn = subghz_custom_btn_get();
uint8_t original_btn = subghz_custom_btn_get_original(); uint8_t original_btn = subghz_custom_btn_get_original();
@@ -259,6 +266,7 @@ SubGhzProtocolStatus
furi_check(context); furi_check(context);
SubGhzProtocolEncoderKIA* instance = context; SubGhzProtocolEncoderKIA* instance = context;
flipper_format_rewind(flipper_format);
instance->encoder.is_running = false; instance->encoder.is_running = false;
instance->encoder.front = 0; instance->encoder.front = 0;
instance->encoder.repeat = 10; instance->encoder.repeat = 10;
@@ -370,8 +378,7 @@ SubGhzProtocolStatus
} else { } else {
instance->button = (key >> 8) & 0x0F; instance->button = (key >> 8) & 0x0F;
} }
if(subghz_custom_btn_get_original() == 0) subghz_custom_btn_set_original(instance->button);
subghz_custom_btn_set_original(instance->button);
subghz_custom_btn_set_max(4); subghz_custom_btn_set_max(4);
instance->button = kia_v0_get_btn_code(); instance->button = kia_v0_get_btn_code();
@@ -726,8 +733,7 @@ void subghz_protocol_decoder_kia_get_string(void* context, FuriString* output) {
SubGhzProtocolDecoderKIA* instance = context; SubGhzProtocolDecoderKIA* instance = context;
subghz_protocol_kia_check_remote_controller(&instance->generic); subghz_protocol_kia_check_remote_controller(&instance->generic);
if(subghz_custom_btn_get_original() == 0) subghz_custom_btn_set_original(instance->generic.btn);
subghz_custom_btn_set_original(instance->generic.btn);
subghz_custom_btn_set_max(4); subghz_custom_btn_set_max(4);
uint32_t code_found_hi = instance->generic.data >> 32; uint32_t code_found_hi = instance->generic.data >> 32;
uint32_t code_found_lo = instance->generic.data & 0x00000000ffffffff; uint32_t code_found_lo = instance->generic.data & 0x00000000ffffffff;
@@ -740,14 +746,14 @@ void subghz_protocol_decoder_kia_get_string(void* context, FuriString* output) {
output, output,
"%s %dbit\r\n" "%s %dbit\r\n"
"Key:%08lX%08lX\r\n" "Key:%08lX%08lX\r\n"
"Sn:%07lX Btn:%X Cnt:%04lX\r\n" "Sn:%07lX Btn:[%s] Cnt:%04lX\r\n"
"CRC:%02X %s\r\n", "CRC:%02X %s\r\n",
instance->generic.protocol_name, instance->generic.protocol_name,
instance->generic.data_count_bit, instance->generic.data_count_bit,
code_found_hi, code_found_hi,
code_found_lo, code_found_lo,
instance->generic.serial, instance->generic.serial,
kia_v0_get_btn_code(), kia_v0_btn_name(kia_v0_get_btn_code()),
instance->generic.cnt, instance->generic.cnt,
received_crc, received_crc,
crc_valid ? "(OK)" : "(FAIL)"); crc_valid ? "(OK)" : "(FAIL)");

View File

@@ -3,7 +3,7 @@
#include "kia_generic.h" #include "kia_generic.h"
#define KIA_PROTOCOL_V0_NAME "Kia V0" #define KIA_PROTOCOL_V0_NAME "KIA/HYU V0"
typedef struct SubGhzProtocolDecoderKIA SubGhzProtocolDecoderKIA; typedef struct SubGhzProtocolDecoderKIA SubGhzProtocolDecoderKIA;
typedef struct SubGhzProtocolEncoderKIA SubGhzProtocolEncoderKIA; typedef struct SubGhzProtocolEncoderKIA SubGhzProtocolEncoderKIA;

View File

@@ -3,7 +3,7 @@
#include "kia_generic.h" #include "kia_generic.h"
#define KIA_PROTOCOL_V1_NAME "Kia V1" #define KIA_PROTOCOL_V1_NAME "KIA/HYU V1"
typedef struct SubGhzProtocolDecoderKiaV1 SubGhzProtocolDecoderKiaV1; typedef struct SubGhzProtocolDecoderKiaV1 SubGhzProtocolDecoderKiaV1;
typedef struct SubGhzProtocolEncoderKiaV1 SubGhzProtocolEncoderKiaV1; typedef struct SubGhzProtocolEncoderKiaV1 SubGhzProtocolEncoderKiaV1;

View File

@@ -265,8 +265,7 @@ SubGhzProtocolStatus
} else { } else {
instance->generic.btn = (uint8_t)((instance->generic.data >> 16) & 0x0F); instance->generic.btn = (uint8_t)((instance->generic.data >> 16) & 0x0F);
} }
if(subghz_custom_btn_get_original() == 0) subghz_custom_btn_set_original(instance->generic.btn);
subghz_custom_btn_set_original(instance->generic.btn);
subghz_custom_btn_set_max(4); subghz_custom_btn_set_max(4);
instance->generic.btn = kia_v2_get_btn_code(); instance->generic.btn = kia_v2_get_btn_code();
@@ -538,8 +537,7 @@ SubGhzProtocolStatus
void kia_protocol_decoder_v2_get_string(void* context, FuriString* output) { void kia_protocol_decoder_v2_get_string(void* context, FuriString* output) {
furi_check(context); furi_check(context);
SubGhzProtocolDecoderKiaV2* instance = context; SubGhzProtocolDecoderKiaV2* instance = context;
if(subghz_custom_btn_get_original() == 0) subghz_custom_btn_set_original(instance->generic.btn);
subghz_custom_btn_set_original(instance->generic.btn);
subghz_custom_btn_set_max(4); subghz_custom_btn_set_max(4);
uint8_t crc = instance->generic.data & 0x0F; uint8_t crc = instance->generic.data & 0x0F;

View File

@@ -4,7 +4,7 @@
#include <lib/toolbox/manchester_decoder.h> #include <lib/toolbox/manchester_decoder.h>
#define KIA_PROTOCOL_V2_NAME "Kia V2" #define KIA_PROTOCOL_V2_NAME "KIA/HYU V2"
typedef struct SubGhzProtocolDecoderKiaV2 SubGhzProtocolDecoderKiaV2; typedef struct SubGhzProtocolDecoderKiaV2 SubGhzProtocolDecoderKiaV2;
typedef struct SubGhzProtocolEncoderKiaV2 SubGhzProtocolEncoderKiaV2; typedef struct SubGhzProtocolEncoderKiaV2 SubGhzProtocolEncoderKiaV2;

File diff suppressed because it is too large Load Diff

View File

@@ -1,37 +1,31 @@
#pragma once #pragma once
#include "kia_generic.h" #include "base.h"
#include "../blocks/math.h"
#define SUBGHZ_PROTOCOL_KIA_V3_V4_NAME "KIA/HYU V3/V4"
#define KIA_PROTOCOL_V3_V4_NAME "Kia V3/V4" typedef struct SubGhzProtocolDecoderKiaV3V4 SubGhzProtocolDecoderKiaV3V4;
typedef struct SubGhzProtocolEncoderKiaV3V4 SubGhzProtocolEncoderKiaV3V4;
extern const SubGhzProtocol subghz_protocol_kia_v3_v4; extern const SubGhzProtocol subghz_protocol_kia_v3_v4;
// Decoder functions void* subghz_protocol_decoder_kia_v3_v4_alloc(SubGhzEnvironment* environment);
void* kia_protocol_decoder_v3_v4_alloc(SubGhzEnvironment* environment); void subghz_protocol_decoder_kia_v3_v4_free(void* context);
void kia_protocol_decoder_v3_v4_free(void* context); void subghz_protocol_decoder_kia_v3_v4_reset(void* context);
void kia_protocol_decoder_v3_v4_reset(void* context); void subghz_protocol_decoder_kia_v3_v4_feed(void* context, bool level, uint32_t duration);
void kia_protocol_decoder_v3_v4_feed(void* context, bool level, uint32_t duration); uint8_t subghz_protocol_decoder_kia_v3_v4_get_hash_data(void* context);
uint8_t kia_protocol_decoder_v3_v4_get_hash_data(void* context); SubGhzProtocolStatus subghz_protocol_decoder_kia_v3_v4_serialize(
SubGhzProtocolStatus kia_protocol_decoder_v3_v4_serialize(
void* context, void* context,
FlipperFormat* flipper_format, FlipperFormat* flipper_format,
SubGhzRadioPreset* preset); SubGhzRadioPreset* preset);
SubGhzProtocolStatus SubGhzProtocolStatus
kia_protocol_decoder_v3_v4_deserialize(void* context, FlipperFormat* flipper_format); subghz_protocol_decoder_kia_v3_v4_deserialize(void* context, FlipperFormat* flipper_format);
void kia_protocol_decoder_v3_v4_get_string(void* context, FuriString* output); void subghz_protocol_decoder_kia_v3_v4_get_string(void* context, FuriString* output);
// Encoder functions void* subghz_protocol_encoder_kia_v3_v4_alloc(SubGhzEnvironment* environment);
void* kia_protocol_encoder_v3_v4_alloc(SubGhzEnvironment* environment); void subghz_protocol_encoder_kia_v3_v4_free(void* context);
void kia_protocol_encoder_v3_v4_free(void* context);
SubGhzProtocolStatus SubGhzProtocolStatus
kia_protocol_encoder_v3_v4_deserialize(void* context, FlipperFormat* flipper_format); subghz_protocol_encoder_kia_v3_v4_deserialize(void* context, FlipperFormat* flipper_format);
void kia_protocol_encoder_v3_v4_stop(void* context); void subghz_protocol_encoder_kia_v3_v4_stop(void* context);
LevelDuration kia_protocol_encoder_v3_v4_yield(void* context); LevelDuration subghz_protocol_encoder_kia_v3_v4_yield(void* context);
// Encoder helper functions for UI
void kia_protocol_encoder_v3_v4_set_button(void* context, uint8_t button);
void kia_protocol_encoder_v3_v4_set_counter(void* context, uint16_t counter);
void kia_protocol_encoder_v3_v4_increment_counter(void* context);
uint16_t kia_protocol_encoder_v3_v4_get_counter(void* context);
uint8_t kia_protocol_encoder_v3_v4_get_button(void* context);

File diff suppressed because it is too large Load Diff

View File

@@ -1,36 +1,36 @@
#pragma once #pragma once
#include "kia_generic.h" #include "base.h"
#include <lib/toolbox/manchester_decoder.h> #include "../blocks/math.h"
#define SUBGHZ_PROTOCOL_KIA_V5_NAME "KIA/HYU V5"
#define KIA_PROTOCOL_V5_NAME "Kia V5"
typedef struct SubGhzProtocolDecoderKiaV5 SubGhzProtocolDecoderKiaV5; typedef struct SubGhzProtocolDecoderKiaV5 SubGhzProtocolDecoderKiaV5;
typedef struct SubGhzProtocolEncoderKiaV5 SubGhzProtocolEncoderKiaV5; typedef struct SubGhzProtocolEncoderKiaV5 SubGhzProtocolEncoderKiaV5;
extern const SubGhzProtocolDecoder kia_protocol_v5_decoder;
extern const SubGhzProtocolEncoder kia_protocol_v5_encoder;
extern const SubGhzProtocol subghz_protocol_kia_v5; extern const SubGhzProtocol subghz_protocol_kia_v5;
// Decoder functions void* subghz_protocol_decoder_kia_v5_alloc(SubGhzEnvironment* environment);
void* kia_protocol_decoder_v5_alloc(SubGhzEnvironment* environment); void subghz_protocol_decoder_kia_v5_free(void* context);
void kia_protocol_decoder_v5_free(void* context); void subghz_protocol_decoder_kia_v5_reset(void* context);
void kia_protocol_decoder_v5_reset(void* context); void subghz_protocol_decoder_kia_v5_feed(void* context, bool level, uint32_t duration);
void kia_protocol_decoder_v5_feed(void* context, bool level, uint32_t duration); uint8_t subghz_protocol_decoder_kia_v5_get_hash_data(void* context);
uint8_t kia_protocol_decoder_v5_get_hash_data(void* context); SubGhzProtocolStatus subghz_protocol_decoder_kia_v5_serialize(
SubGhzProtocolStatus kia_protocol_decoder_v5_serialize(
void* context, void* context,
FlipperFormat* flipper_format, FlipperFormat* flipper_format,
SubGhzRadioPreset* preset); SubGhzRadioPreset* preset);
SubGhzProtocolStatus SubGhzProtocolStatus
kia_protocol_decoder_v5_deserialize(void* context, FlipperFormat* flipper_format); subghz_protocol_decoder_kia_v5_deserialize(void* context, FlipperFormat* flipper_format);
void kia_protocol_decoder_v5_get_string(void* context, FuriString* output); void subghz_protocol_decoder_kia_v5_get_string(void* context, FuriString* output);
// Encoder functions void* subghz_protocol_encoder_kia_v5_alloc(SubGhzEnvironment* environment);
void* kia_protocol_encoder_v5_alloc(SubGhzEnvironment* environment); void subghz_protocol_encoder_kia_v5_free(void* context);
void kia_protocol_encoder_v5_free(void* context);
SubGhzProtocolStatus SubGhzProtocolStatus
kia_protocol_encoder_v5_deserialize(void* context, FlipperFormat* flipper_format); subghz_protocol_encoder_kia_v5_deserialize(void* context, FlipperFormat* flipper_format);
void kia_protocol_encoder_v5_stop(void* context); void subghz_protocol_encoder_kia_v5_stop(void* context);
LevelDuration kia_protocol_encoder_v5_yield(void* context); LevelDuration subghz_protocol_encoder_kia_v5_yield(void* context);
void subghz_protocol_encoder_kia_v5_set_button(void* context, uint8_t button);
void subghz_protocol_encoder_kia_v5_set_counter(void* context, uint16_t counter);
void subghz_protocol_encoder_kia_v5_increment_counter(void* context);
uint16_t subghz_protocol_encoder_kia_v5_get_counter(void* context);
uint8_t subghz_protocol_encoder_kia_v5_get_button(void* context);