Compare commits

...

8 Commits

Author SHA1 Message Date
David
bfdf60944f Remove unused fields from Kia V5 protocol 2026-03-11 18:48:03 +01:00
David
0290f601a0 Remove NULL function pointers from Kia V3/V4 protocol
Removed unused function pointers from the Kia V3/V4 protocol structure.
2026-03-11 18:47:07 +01:00
David
2e5648f3f4 Refactor Kia V5 protocol functions and includes 2026-03-11 17:59:35 +01:00
David
cffd268950 Update 2026-03-11 17:59:14 +01:00
David
ddb85d034f Refactor Kia V3/V4 protocol functions and types 2026-03-11 17:58:44 +01:00
David
55f770328c Update 2026-03-11 17:58:20 +01:00
Andrea
72d3992092 Update Fiat Mystery to Fiat Marelli in README 2026-03-11 15:01:14 +01:00
Andrea Santaniello
c1d145c9cc Updated fiat mistery (magneti marelli BSI) 2026-03-11 14:48:19 +01:00
6 changed files with 788 additions and 999 deletions

View File

@@ -34,7 +34,7 @@ This project may incorporate, adapt, or build upon **other open-source projects*
| PSA (Peugeot/Citroën/DS) | PSA GROUP | 433 MHz | AM/FM | Yes | Yes |
| Ford | Ford V0 | 315/433 MHz | AM | Yes | Yes |
| Fiat | Fiat SpA | 433 MHz | AM | Yes | Yes |
| Fiat | Fiat Mystery | 433 MHz | AM | No | Yes |
| Fiat | Fiat Marelli | 433 MHz | AM | No | Yes |
| Subaru | Subaru | 433 MHz | AM | Yes | Yes |
| Mazda | Siemens (5WK49365D) | 315/433 MHz | FM | Yes | Yes |
| Kia/Hyundai | Kia V0 | 433 MHz | FM | Yes | Yes |

View File

@@ -4,18 +4,26 @@
#define TAG "FiatMystery"
// Fiat Panda "pandarella e tonino":
// te_short ~260us, te_long ~520us (Manchester)
// Suspected Magneti Marelli BSI keyfob protocol
// Found on: Fiat Panda (and possibly other Fiat/Lancia/Alfa ~2003-2012)
//
// RF: 433.92 MHz, Manchester encoding
// te_short ~260us, te_long ~520us
// Preamble: ~191 short-short pairs (alternating 260us HIGH/LOW)
// Gap: ~3126us LOW
// Sync: ~2065us HIGH
// Data: 86 Manchester bits
// Retransmissions: 7-8 per press
// Data: 88 Manchester bits (often decoded as 104 with 16-bit 0xFFFF preamble residue)
// Retransmissions: 7-10 per press
//
// Frame layout (after stripping 16-bit 0xFFFF preamble):
// Bytes 0-3: Fixed ID / Serial (32 bits)
// Byte 4: Button (upper nibble) | Type (lower nibble, always 0x2)
// Bytes 5-10: Rolling/encrypted code (48 bits)
#define FIAT_MYSTERY_PREAMBLE_MIN 200 // Min preamble pulses (100 pairs)
#define FIAT_MYSTERY_GAP_MIN 2500 // Gap detection threshold (us)
#define FIAT_MYSTERY_SYNC_MIN 1500 // Sync pulse minimum (us)
#define FIAT_MYSTERY_SYNC_MAX 2600 // Sync pulse maximum (us)
#define FIAT_MYSTERY_MAX_DATA_BITS 96 // Max data bits to collect
#define FIAT_MYSTERY_MAX_DATA_BITS 104 // Max data bits to collect (13 bytes)
static const SubGhzBlockConst subghz_protocol_fiat_mystery_const = {
.te_short = 260,
@@ -31,7 +39,7 @@ struct SubGhzProtocolDecoderFiatMystery {
ManchesterState manchester_state;
uint8_t decoder_state;
uint16_t preamble_count;
uint8_t raw_data[12]; // Up to 96 bits (12 bytes)
uint8_t raw_data[13]; // Up to 104 bits (13 bytes)
uint8_t bit_count;
uint32_t extra_data; // Bits beyond first 64, right-aligned
uint32_t te_last;
@@ -292,13 +300,20 @@ void subghz_protocol_decoder_fiat_mystery_feed(void* context, bool level, uint32
if(frame_complete) {
instance->generic.data_count_bit = instance->bit_count;
// Frame layout: bytes 0-1 are 0xFFFF preamble residue
// Bytes 2-5: Fixed ID (serial)
// Byte 6: Button (upper nibble) | subtype (lower nibble)
// Bytes 7-12: Rolling/encrypted code (48 bits)
instance->generic.serial =
((uint32_t)instance->raw_data[4] << 24) |
((uint32_t)instance->raw_data[5] << 16) |
((uint32_t)instance->raw_data[6] << 8) |
((uint32_t)instance->raw_data[7]);
instance->generic.cnt = (uint32_t)(instance->generic.data >> 32);
instance->generic.btn = 0;
((uint32_t)instance->raw_data[2] << 24) |
((uint32_t)instance->raw_data[3] << 16) |
((uint32_t)instance->raw_data[4] << 8) |
((uint32_t)instance->raw_data[5]);
instance->generic.btn = (instance->raw_data[6] >> 4) & 0xF;
instance->generic.cnt =
((uint32_t)instance->raw_data[7] << 16) |
((uint32_t)instance->raw_data[8] << 8) |
((uint32_t)instance->raw_data[9]);
FURI_LOG_I(
TAG,
@@ -385,22 +400,41 @@ SubGhzProtocolStatus subghz_protocol_decoder_fiat_mystery_deserialize(
return ret;
}
static const char* fiat_mystery_button_name(uint8_t btn) {
switch(btn) {
case 0x2:
return "Btn A";
case 0x4:
return "Btn B";
default:
return "Unknown";
}
}
void subghz_protocol_decoder_fiat_mystery_get_string(void* context, FuriString* output) {
furi_check(context);
SubGhzProtocolDecoderFiatMystery* instance = context;
uint8_t total_bytes = (instance->bit_count + 7) / 8;
if(total_bytes > 12) total_bytes = 12;
if(total_bytes > 13) total_bytes = 13;
furi_string_cat_printf(
output,
"%s %dbit\r\n"
"Key:%08lX%08lX\r\n"
"Sn:%08lX Btn:%s(0x%X)\r\n"
"Roll:%02X%02X%02X%02X%02X%02X\r\n"
"Data:",
instance->generic.protocol_name,
instance->bit_count,
(uint32_t)(instance->generic.data >> 32),
(uint32_t)(instance->generic.data & 0xFFFFFFFF));
instance->generic.serial,
fiat_mystery_button_name(instance->generic.btn),
instance->generic.btn,
instance->raw_data[7],
instance->raw_data[8],
instance->raw_data[9],
(total_bytes > 10) ? instance->raw_data[10] : 0,
(total_bytes > 11) ? instance->raw_data[11] : 0,
(total_bytes > 12) ? instance->raw_data[12] : 0);
for(uint8_t i = 0; i < total_bytes; i++) {
furi_string_cat_printf(output, "%02X", instance->raw_data[i]);

File diff suppressed because it is too large Load Diff

View File

@@ -1,37 +1,31 @@
#pragma once
#include "kia_generic.h"
#include "base.h"
#include "../blocks/math.h"
#define SUBGHZ_PROTOCOL_KIA_V3_V4_NAME "KIA/HYU V3/V4"
#define KIA_PROTOCOL_V3_V4_NAME "Kia V3/V4"
typedef struct SubGhzProtocolDecoderKiaV3V4 SubGhzProtocolDecoderKiaV3V4;
typedef struct SubGhzProtocolEncoderKiaV3V4 SubGhzProtocolEncoderKiaV3V4;
extern const SubGhzProtocol subghz_protocol_kia_v3_v4;
// Decoder functions
void* kia_protocol_decoder_v3_v4_alloc(SubGhzEnvironment* environment);
void kia_protocol_decoder_v3_v4_free(void* context);
void kia_protocol_decoder_v3_v4_reset(void* context);
void kia_protocol_decoder_v3_v4_feed(void* context, bool level, uint32_t duration);
uint8_t kia_protocol_decoder_v3_v4_get_hash_data(void* context);
SubGhzProtocolStatus kia_protocol_decoder_v3_v4_serialize(
void* subghz_protocol_decoder_kia_v3_v4_alloc(SubGhzEnvironment* environment);
void subghz_protocol_decoder_kia_v3_v4_free(void* context);
void subghz_protocol_decoder_kia_v3_v4_reset(void* context);
void subghz_protocol_decoder_kia_v3_v4_feed(void* context, bool level, uint32_t duration);
uint8_t subghz_protocol_decoder_kia_v3_v4_get_hash_data(void* context);
SubGhzProtocolStatus subghz_protocol_decoder_kia_v3_v4_serialize(
void* context,
FlipperFormat* flipper_format,
SubGhzRadioPreset* preset);
SubGhzProtocolStatus
kia_protocol_decoder_v3_v4_deserialize(void* context, FlipperFormat* flipper_format);
void kia_protocol_decoder_v3_v4_get_string(void* context, FuriString* output);
subghz_protocol_decoder_kia_v3_v4_deserialize(void* context, FlipperFormat* flipper_format);
void subghz_protocol_decoder_kia_v3_v4_get_string(void* context, FuriString* output);
// Encoder functions
void* kia_protocol_encoder_v3_v4_alloc(SubGhzEnvironment* environment);
void kia_protocol_encoder_v3_v4_free(void* context);
void* subghz_protocol_encoder_kia_v3_v4_alloc(SubGhzEnvironment* environment);
void subghz_protocol_encoder_kia_v3_v4_free(void* context);
SubGhzProtocolStatus
kia_protocol_encoder_v3_v4_deserialize(void* context, FlipperFormat* flipper_format);
void kia_protocol_encoder_v3_v4_stop(void* context);
LevelDuration kia_protocol_encoder_v3_v4_yield(void* context);
// Encoder helper functions for UI
void kia_protocol_encoder_v3_v4_set_button(void* context, uint8_t button);
void kia_protocol_encoder_v3_v4_set_counter(void* context, uint16_t counter);
void kia_protocol_encoder_v3_v4_increment_counter(void* context);
uint16_t kia_protocol_encoder_v3_v4_get_counter(void* context);
uint8_t kia_protocol_encoder_v3_v4_get_button(void* context);
subghz_protocol_encoder_kia_v3_v4_deserialize(void* context, FlipperFormat* flipper_format);
void subghz_protocol_encoder_kia_v3_v4_stop(void* context);
LevelDuration subghz_protocol_encoder_kia_v3_v4_yield(void* context);

File diff suppressed because it is too large Load Diff

View File

@@ -1,36 +1,36 @@
#pragma once
#include "kia_generic.h"
#include <lib/toolbox/manchester_decoder.h>
#include "base.h"
#include "../blocks/math.h"
#define KIA_PROTOCOL_V5_NAME "Kia V5"
#define SUBGHZ_PROTOCOL_KIA_V5_NAME "KIA/HYU V5"
typedef struct SubGhzProtocolDecoderKiaV5 SubGhzProtocolDecoderKiaV5;
typedef struct SubGhzProtocolEncoderKiaV5 SubGhzProtocolEncoderKiaV5;
extern const SubGhzProtocolDecoder kia_protocol_v5_decoder;
extern const SubGhzProtocolEncoder kia_protocol_v5_encoder;
extern const SubGhzProtocol subghz_protocol_kia_v5;
// Decoder functions
void* kia_protocol_decoder_v5_alloc(SubGhzEnvironment* environment);
void kia_protocol_decoder_v5_free(void* context);
void kia_protocol_decoder_v5_reset(void* context);
void kia_protocol_decoder_v5_feed(void* context, bool level, uint32_t duration);
uint8_t kia_protocol_decoder_v5_get_hash_data(void* context);
SubGhzProtocolStatus kia_protocol_decoder_v5_serialize(
void* subghz_protocol_decoder_kia_v5_alloc(SubGhzEnvironment* environment);
void subghz_protocol_decoder_kia_v5_free(void* context);
void subghz_protocol_decoder_kia_v5_reset(void* context);
void subghz_protocol_decoder_kia_v5_feed(void* context, bool level, uint32_t duration);
uint8_t subghz_protocol_decoder_kia_v5_get_hash_data(void* context);
SubGhzProtocolStatus subghz_protocol_decoder_kia_v5_serialize(
void* context,
FlipperFormat* flipper_format,
SubGhzRadioPreset* preset);
SubGhzProtocolStatus
kia_protocol_decoder_v5_deserialize(void* context, FlipperFormat* flipper_format);
void kia_protocol_decoder_v5_get_string(void* context, FuriString* output);
subghz_protocol_decoder_kia_v5_deserialize(void* context, FlipperFormat* flipper_format);
void subghz_protocol_decoder_kia_v5_get_string(void* context, FuriString* output);
// Encoder functions
void* kia_protocol_encoder_v5_alloc(SubGhzEnvironment* environment);
void kia_protocol_encoder_v5_free(void* context);
void* subghz_protocol_encoder_kia_v5_alloc(SubGhzEnvironment* environment);
void subghz_protocol_encoder_kia_v5_free(void* context);
SubGhzProtocolStatus
kia_protocol_encoder_v5_deserialize(void* context, FlipperFormat* flipper_format);
void kia_protocol_encoder_v5_stop(void* context);
LevelDuration kia_protocol_encoder_v5_yield(void* context);
subghz_protocol_encoder_kia_v5_deserialize(void* context, FlipperFormat* flipper_format);
void subghz_protocol_encoder_kia_v5_stop(void* context);
LevelDuration subghz_protocol_encoder_kia_v5_yield(void* context);
void subghz_protocol_encoder_kia_v5_set_button(void* context, uint8_t button);
void subghz_protocol_encoder_kia_v5_set_counter(void* context, uint16_t counter);
void subghz_protocol_encoder_kia_v5_increment_counter(void* context);
uint16_t subghz_protocol_encoder_kia_v5_get_counter(void* context);
uint8_t subghz_protocol_encoder_kia_v5_get_button(void* context);