Update subghz_scene_kl_bf_cleanup.c

applications/main/subghz/scenes/subghz_scene_config.h

@@ -31,4 +31,6 @@ ADD_SCENE(subghz, keeloq_keys, KeeloqKeys)
 ADD_SCENE(subghz, keeloq_key_edit, KeeloqKeyEdit)
 ADD_SCENE(subghz, psa_decrypt, PsaDecrypt)
 ADD_SCENE(subghz, keeloq_decrypt, KeeloqDecrypt)
+ADD_SCENE(subghz, keeloq_bf2, KeeloqBf2)
+ADD_SCENE(subghz, kl_bf_cleanup, KlBfCleanup)
 ADD_SCENE(subghz, counter_bf, CounterBf)

applications/main/subghz/scenes/subghz_scene_counter_bf.c

@@ -5,9 +5,10 @@
 #define TAG "SubGhzCounterBf"
 
 // How many ticks to wait between transmissions (1 tick ~100ms)
-#define COUNTER_BF_TX_INTERVAL_TICKS 3
+#define COUNTER_BF_TX_INTERVAL_TICKS 5
 
 typedef enum {
+    CounterBfStateWarning,
     CounterBfStateIdle,
     CounterBfStateRunning,
     CounterBfStateStopped,
@@ -22,8 +23,16 @@ typedef struct {
     uint32_t tick_wait;
 } CounterBfContext;
 
-#define CounterBfEventStart (0xC0)
-#define CounterBfEventStop  (0xC1)
+#define CounterBfEventStart     (0xC0)
+#define CounterBfEventStop      (0xC1)
+#define CounterBfEventWarningOk (0xC2)
+
+static void counter_bf_warning_callback(GuiButtonType result, InputType type, void* context) {
+    SubGhz* subghz = context;
+    if(result == GuiButtonTypeCenter && type == InputTypeShort) {
+        view_dispatcher_send_custom_event(subghz->view_dispatcher, CounterBfEventWarningOk);
+    }
+}
 
 static void counter_bf_widget_callback(GuiButtonType result, InputType type, void* context) {
     SubGhz* subghz = context;
@@ -32,18 +41,36 @@ static void counter_bf_widget_callback(GuiButtonType result, InputType type, voi
     }
 }
 
+static void counter_bf_draw_warning(SubGhz* subghz) {
+    widget_reset(subghz->widget);
+    widget_add_string_multiline_element(
+        subghz->widget,
+        64,
+        20,
+        AlignCenter,
+        AlignCenter,
+        FontSecondary,
+        "WARNING:\nThis may desync\nyour fob!");
+    widget_add_button_element(
+        subghz->widget,
+        GuiButtonTypeCenter,
+        "OK",
+        counter_bf_warning_callback,
+        subghz);
+}
+
 static void counter_bf_draw(SubGhz* subghz, CounterBfContext* ctx) {
     widget_reset(subghz->widget);
     FuriString* str = furi_string_alloc();
     furi_string_printf(
         str,
         "Counter BruteForce\n"
-        "Cnt: 0x%08lX\n"
-        "Sent: %lu pkts\n"
-        "Start: 0x%08lX",
-        ctx->current_cnt,
-        ctx->packets_sent,
-        ctx->start_cnt);
+        "Cnt: 0x%06lX\n"
+        "Start: 0x%06lX\n"
+        "Sent: %lu",
+        ctx->current_cnt & 0xFFFFFF,
+        ctx->start_cnt & 0xFFFFFF,
+        ctx->packets_sent);
     widget_add_string_multiline_element(
         subghz->widget, 0, 0, AlignLeft, AlignTop, FontSecondary, furi_string_get_cstr(str));
     furi_string_free(str);
@@ -57,14 +84,12 @@ static void counter_bf_draw(SubGhz* subghz, CounterBfContext* ctx) {
 }
 
 static void counter_bf_save(SubGhz* subghz, CounterBfContext* ctx) {
-    // Escribir el Cnt final directamente en el archivo .sub en disco.
-    // No usar subghz_save_protocol_to_file() porque ese serializa el estado
-    // actual del encoder (que puede tener el Cnt ya incrementado internamente).
     Storage* storage = furi_record_open(RECORD_STORAGE);
     FlipperFormat* file_fff = flipper_format_buffered_file_alloc(storage);
     if(flipper_format_buffered_file_open_existing(
            file_fff, furi_string_get_cstr(subghz->file_path))) {
-        if(!flipper_format_update_uint32(file_fff, "Cnt", &ctx->current_cnt, 1)) {
+        uint32_t cnt = ctx->current_cnt & 0xFFFFFF;
+        if(!flipper_format_update_uint32(file_fff, "Cnt", &cnt, 1)) {
             FURI_LOG_E(TAG, "Failed to update Cnt in .sub file");
         }
     } else {
@@ -77,16 +102,15 @@ static void counter_bf_save(SubGhz* subghz, CounterBfContext* ctx) {
 static void counter_bf_send(SubGhz* subghz, CounterBfContext* ctx) {
     subghz_txrx_stop(subghz->txrx);
 
-    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+    uint32_t delta = (ctx->current_cnt - ctx->start_cnt) & 0xFFFFFF;
+    furi_hal_subghz_set_rolling_counter_mult((int32_t)delta);
+    subghz_block_generic_global_counter_override_set(ctx->current_cnt & 0xFFFFFF);
 
+    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
     uint32_t repeat = 20;
     flipper_format_rewind(fff);
     flipper_format_update_uint32(fff, "Repeat", &repeat, 1);
 
-    // Actualizar Cnt DESPUES de Repeat (update es secuencial en el buffer)
-    flipper_format_rewind(fff);
-    flipper_format_update_uint32(fff, "Cnt", &ctx->current_cnt, 1);
-
     subghz_tx_start(subghz, fff);
 
     ctx->packets_sent++;
@@ -98,42 +122,38 @@ void subghz_scene_counter_bf_on_enter(void* context) {
 
     CounterBfContext* ctx = malloc(sizeof(CounterBfContext));
     memset(ctx, 0, sizeof(CounterBfContext));
-    ctx->state = CounterBfStateIdle;
+    ctx->state = CounterBfStateWarning;
     ctx->step = 1;
+    furi_hal_subghz_set_rolling_counter_mult(0);
+    subghz_key_load(subghz, furi_string_get_cstr(subghz->file_path), false);
 
-    // FIX: Leer el Cnt DIRECTAMENTE del archivo en disco con un FlipperFormat
-    // propio, completamente separado del fff en memoria (que puede tener el Cnt
-    // modificado por TXs previas y no refleja el estado real del .sub).
     {
-        Storage* storage = furi_record_open(RECORD_STORAGE);
-        FlipperFormat* file_fff = flipper_format_buffered_file_alloc(storage);
-        if(flipper_format_buffered_file_open_existing(
-               file_fff, furi_string_get_cstr(subghz->file_path))) {
-            uint32_t cnt = 0;
-            if(flipper_format_read_uint32(file_fff, "Cnt", &cnt, 1)) {
-                ctx->current_cnt = cnt;
-                ctx->start_cnt = cnt;
-            } else {
-                FURI_LOG_W(TAG, "Cnt field not found in file");
-            }
+        FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+        flipper_format_rewind(fff);
+        uint32_t cnt = 0;
+        if(flipper_format_read_uint32(fff, "Cnt", &cnt, 1)) {
+            ctx->current_cnt = cnt & 0xFFFFFF;
+            ctx->start_cnt   = cnt & 0xFFFFFF;
         } else {
-            FURI_LOG_E(TAG, "Failed to open .sub file for Cnt read");
+            FURI_LOG_W(TAG, "Cnt not in fff after key_load, reading from disk");
+            Storage* storage = furi_record_open(RECORD_STORAGE);
+            FlipperFormat* file_fff = flipper_format_buffered_file_alloc(storage);
+            if(flipper_format_buffered_file_open_existing(
+                   file_fff, furi_string_get_cstr(subghz->file_path))) {
+                if(flipper_format_read_uint32(file_fff, "Cnt", &cnt, 1)) {
+                    ctx->current_cnt = cnt & 0xFFFFFF;
+                    ctx->start_cnt   = cnt & 0xFFFFFF;
+                }
+            }
+            flipper_format_free(file_fff);
+            furi_record_close(RECORD_STORAGE);
         }
-        flipper_format_free(file_fff);
-        furi_record_close(RECORD_STORAGE);
     }
 
     scene_manager_set_scene_state(
         subghz->scene_manager, SubGhzSceneCounterBf, (uint32_t)(uintptr_t)ctx);
 
-    // Deshabilitar auto-increment del protocolo para controlar el Cnt manualmente
-    furi_hal_subghz_set_rolling_counter_mult(0);
-
-    // Recargar el protocolo DESPUES de haber leído el Cnt del disco,
-    // para preparar el fff para TX sin que pise nuestro valor leído.
-    subghz_key_load(subghz, furi_string_get_cstr(subghz->file_path), false);
-
-    counter_bf_draw(subghz, ctx);
+    counter_bf_draw_warning(subghz);
     view_dispatcher_switch_to_view(subghz->view_dispatcher, SubGhzViewIdWidget);
 }
 
@@ -144,15 +164,21 @@ bool subghz_scene_counter_bf_on_event(void* context, SceneManagerEvent event) {
     if(!ctx) return false;
 
     if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == CounterBfEventWarningOk) {
+            ctx->state = CounterBfStateIdle;
+            counter_bf_draw(subghz, ctx);
+            return true;
+        }
+
         if(event.event == CounterBfEventStart) {
+            if(ctx->state == CounterBfStateWarning) return true;
+
             if(ctx->state != CounterBfStateRunning) {
                 ctx->state = CounterBfStateRunning;
                 ctx->tick_wait = 0;
                 subghz->state_notifications = SubGhzNotificationStateTx;
                 counter_bf_send(subghz, ctx);
             } else {
-                // FIX 2: Al detener, guardar el contador actual en el .sub
-                // para que al volver a emular manualmente continúe desde acá.
                 ctx->state = CounterBfStateStopped;
                 subghz_txrx_stop(subghz->txrx);
                 subghz->state_notifications = SubGhzNotificationStateIDLE;
@@ -167,19 +193,24 @@ bool subghz_scene_counter_bf_on_event(void* context, SceneManagerEvent event) {
             if(ctx->tick_wait > 0) {
                 ctx->tick_wait--;
             } else {
-                ctx->current_cnt += ctx->step;
+                ctx->current_cnt = (ctx->current_cnt + ctx->step) & 0xFFFFFF;
                 counter_bf_send(subghz, ctx);
+                counter_bf_save(subghz, ctx);
                 counter_bf_draw(subghz, ctx);
             }
         }
         return true;
     } else if(event.type == SceneManagerEventTypeBack) {
+        if(ctx->state == CounterBfStateWarning) {
+            furi_hal_subghz_set_rolling_counter_mult(1);
+            free(ctx);
+            scene_manager_previous_scene(subghz->scene_manager);
+            return true;
+        }
+
         subghz_txrx_stop(subghz->txrx);
         subghz->state_notifications = SubGhzNotificationStateIDLE;
-
-        // FIX 2 (también en Back): guardar siempre al salir
         counter_bf_save(subghz, ctx);
-
         furi_hal_subghz_set_rolling_counter_mult(1);
         free(ctx);
         scene_manager_previous_scene(subghz->scene_manager);

applications/main/subghz/scenes/subghz_scene_keeloq_bf2.c

@@ -0,0 +1,253 @@
+#include "../subghz_i.h"
+#include <lib/subghz/protocols/keeloq.h>
+#include <dialogs/dialogs.h>
+
+enum {
+    KlBf2IndexLoadSig1,
+    KlBf2IndexLoadSig2,
+    KlBf2IndexType,
+    KlBf2IndexStartBf,
+};
+
+static const char* kl_bf2_type_labels[] = {
+    "Type: Auto (6>7>8)",
+    "Type: 6 (Serial 1)",
+    "Type: 7 (Serial 2)",
+    "Type: 8 (Serial 3)",
+};
+static const uint8_t kl_bf2_type_values[] = {0, 6, 7, 8};
+
+static bool kl_bf2_extract_key(SubGhz* subghz, uint32_t* out_fix, uint32_t* out_hop) {
+    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+    flipper_format_rewind(fff);
+    uint8_t key_data[8] = {0};
+    if(!flipper_format_read_hex(fff, "Key", key_data, 8)) return false;
+    *out_fix = ((uint32_t)key_data[0] << 24) | ((uint32_t)key_data[1] << 16) |
+               ((uint32_t)key_data[2] << 8) | key_data[3];
+    *out_hop = ((uint32_t)key_data[4] << 24) | ((uint32_t)key_data[5] << 16) |
+               ((uint32_t)key_data[6] << 8) | key_data[7];
+    return true;
+}
+
+static bool kl_bf2_is_keeloq(SubGhz* subghz) {
+    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+    flipper_format_rewind(fff);
+    FuriString* proto = furi_string_alloc();
+    bool ok = flipper_format_read_string(fff, "Protocol", proto) &&
+              furi_string_equal_str(proto, "KeeLoq");
+    furi_string_free(proto);
+    return ok;
+}
+
+static void kl_bf2_submenu_callback(void* context, uint32_t index) {
+    SubGhz* subghz = context;
+    view_dispatcher_send_custom_event(subghz->view_dispatcher, index);
+}
+
+static bool kl_bf2_load_signal(SubGhz* subghz, FuriString* out_path) {
+    DialogsFileBrowserOptions browser_options;
+    dialog_file_browser_set_basic_options(
+        &browser_options, SUBGHZ_APP_FILENAME_EXTENSION, &I_sub1_10px);
+    browser_options.base_path = SUBGHZ_APP_FOLDER;
+
+    FuriString* selected = furi_string_alloc();
+    furi_string_set(selected, SUBGHZ_APP_FOLDER);
+
+    bool res = dialog_file_browser_show(subghz->dialogs, selected, selected, &browser_options);
+
+    if(res) {
+        res = subghz_key_load(subghz, furi_string_get_cstr(selected), true);
+        if(res) {
+            furi_string_set(out_path, selected);
+        }
+    }
+
+    furi_string_free(selected);
+    return res;
+}
+
+static void kl_bf2_rebuild_menu(SubGhz* subghz) {
+    submenu_reset(subghz->submenu);
+
+    char label1[64];
+    char label2[64];
+
+    if(subghz->keeloq_bf2.sig1_loaded) {
+        FuriString* name = furi_string_alloc();
+        path_extract_filename(subghz->keeloq_bf2.sig1_path, name, true);
+        snprintf(label1, sizeof(label1), "Sig 1: %s", furi_string_get_cstr(name));
+        furi_string_free(name);
+    } else {
+        snprintf(label1, sizeof(label1), "Load Signal 1");
+    }
+
+    if(subghz->keeloq_bf2.sig2_loaded) {
+        FuriString* name = furi_string_alloc();
+        path_extract_filename(subghz->keeloq_bf2.sig2_path, name, true);
+        snprintf(label2, sizeof(label2), "Sig 2: %s", furi_string_get_cstr(name));
+        furi_string_free(name);
+    } else {
+        snprintf(label2, sizeof(label2), "Load Signal 2");
+    }
+
+    submenu_add_item(
+        subghz->submenu, label1, KlBf2IndexLoadSig1,
+        kl_bf2_submenu_callback, subghz);
+    submenu_add_item(
+        subghz->submenu, label2, KlBf2IndexLoadSig2,
+        kl_bf2_submenu_callback, subghz);
+
+    int type_idx = 0;
+    for(int i = 0; i < 4; i++) {
+        if(kl_bf2_type_values[i] == subghz->keeloq_bf2.learn_type) {
+            type_idx = i;
+            break;
+        }
+    }
+    submenu_add_item(
+        subghz->submenu, kl_bf2_type_labels[type_idx], KlBf2IndexType,
+        kl_bf2_submenu_callback, subghz);
+
+    if(subghz->keeloq_bf2.sig1_loaded && subghz->keeloq_bf2.sig2_loaded) {
+        submenu_add_item(
+            subghz->submenu, "Start BF", KlBf2IndexStartBf,
+            kl_bf2_submenu_callback, subghz);
+    }
+
+    view_dispatcher_switch_to_view(subghz->view_dispatcher, SubGhzViewIdMenu);
+}
+
+void subghz_scene_keeloq_bf2_on_enter(void* context) {
+    SubGhz* subghz = context;
+
+    subghz->keeloq_bf2.sig1_loaded = false;
+    subghz->keeloq_bf2.sig2_loaded = false;
+    subghz->keeloq_bf2.learn_type = 0;
+
+    kl_bf2_rebuild_menu(subghz);
+}
+
+bool subghz_scene_keeloq_bf2_on_event(void* context, SceneManagerEvent event) {
+    SubGhz* subghz = context;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == KlBf2IndexLoadSig1) {
+            FuriString* path = furi_string_alloc();
+            if(kl_bf2_load_signal(subghz, path)) {
+                if(!kl_bf2_is_keeloq(subghz)) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Not a KeeLoq\nprotocol file");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                uint32_t fix, hop;
+                if(!kl_bf2_extract_key(subghz, &fix, &hop)) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Cannot read Key\nfrom file");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                subghz->keeloq_bf2.fix = fix;
+                subghz->keeloq_bf2.hop1 = hop;
+                subghz->keeloq_bf2.serial = fix & 0x0FFFFFFF;
+                subghz->keeloq_bf2.sig1_loaded = true;
+                furi_string_set(subghz->keeloq_bf2.sig1_path, path);
+
+                subghz->keeloq_bf2.sig2_loaded = false;
+            }
+            furi_string_free(path);
+            kl_bf2_rebuild_menu(subghz);
+            return true;
+
+        } else if(event.event == KlBf2IndexLoadSig2) {
+            if(!subghz->keeloq_bf2.sig1_loaded) {
+                dialog_message_show_storage_error(
+                    subghz->dialogs, "Load Signal 1 first");
+                kl_bf2_rebuild_menu(subghz);
+                return true;
+            }
+
+            FuriString* path = furi_string_alloc();
+            if(kl_bf2_load_signal(subghz, path)) {
+                if(!kl_bf2_is_keeloq(subghz)) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Not a KeeLoq\nprotocol file");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                uint32_t fix2, hop2;
+                if(!kl_bf2_extract_key(subghz, &fix2, &hop2)) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Cannot read Key\nfrom file");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                uint32_t serial2 = fix2 & 0x0FFFFFFF;
+                if(serial2 != subghz->keeloq_bf2.serial) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Serial mismatch!\nMust be same remote");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                if(hop2 == subghz->keeloq_bf2.hop1) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Same hop code!\nUse a different\ncapture");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                subghz->keeloq_bf2.hop2 = hop2;
+                subghz->keeloq_bf2.sig2_loaded = true;
+                furi_string_set(subghz->keeloq_bf2.sig2_path, path);
+            }
+            furi_string_free(path);
+            kl_bf2_rebuild_menu(subghz);
+            return true;
+
+        } else if(event.event == KlBf2IndexType) {
+            uint8_t cur = subghz->keeloq_bf2.learn_type;
+            if(cur == 0) cur = 6;
+            else if(cur == 6) cur = 7;
+            else if(cur == 7) cur = 8;
+            else cur = 0;
+            subghz->keeloq_bf2.learn_type = cur;
+            kl_bf2_rebuild_menu(subghz);
+            return true;
+
+        } else if(event.event == KlBf2IndexStartBf) {
+            if(!subghz->keeloq_bf2.sig1_loaded || !subghz->keeloq_bf2.sig2_loaded) {
+                return true;
+            }
+
+            if(!subghz_key_load(
+                   subghz,
+                   furi_string_get_cstr(subghz->keeloq_bf2.sig1_path),
+                   true)) {
+                dialog_message_show_storage_error(
+                    subghz->dialogs, "Cannot reload\nSignal 1");
+                kl_bf2_rebuild_menu(subghz);
+                return true;
+            }
+
+            scene_manager_next_scene(subghz->scene_manager, SubGhzSceneKeeloqDecrypt);
+            return true;
+        }
+    }
+    return false;
+}
+
+void subghz_scene_keeloq_bf2_on_exit(void* context) {
+    SubGhz* subghz = context;
+    submenu_reset(subghz->submenu);
+}

applications/main/subghz/scenes/subghz_scene_keeloq_decrypt.c

@@ -25,8 +25,12 @@ typedef struct {
     uint8_t btn;
     uint16_t disc;
 
+    uint32_t hop2;
+
+    uint32_t candidate_count;
     uint64_t recovered_mfkey;
     uint16_t recovered_type;
+    uint32_t recovered_cnt;
 
     bool ble_offload;
 } KlDecryptCtx;
@@ -59,37 +63,59 @@ static void kl_ble_data_received(uint8_t* data, uint16_t size, void* context) {
         memcpy(&cnt, data + 18, 4);
         memcpy(&elapsed_ms, data + 22, 4);
 
-        if(found) {
+        if(found == 1) {
             uint16_t learn_type = (size >= 27) ? data[26] : 6;
 
-            furi_string_printf(
-                ctx->result,
-                "Key FOUND!\n"
-                "MfKey:%08lX%08lX\n"
-                "DevKey:%08lX%08lX\n"
-                "Cnt:%04lX Sn:%07lX\n"
-                "Saved to user keys",
-                (uint32_t)(mfkey >> 32), (uint32_t)(mfkey & 0xFFFFFFFF),
-                (uint32_t)(devkey >> 32), (uint32_t)(devkey & 0xFFFFFFFF),
-                cnt, ctx->serial);
-
-            FlipperFormat* fff = subghz_txrx_get_fff_data(ctx->subghz->txrx);
-            flipper_format_rewind(fff);
-
-            char mf_str[20];
-            snprintf(mf_str, sizeof(mf_str), "BF_%07lX", ctx->serial);
-            flipper_format_insert_or_update_string_cstr(fff, "Manufacture", mf_str);
-
-            uint32_t cnt_val = cnt;
-            flipper_format_rewind(fff);
-            flipper_format_insert_or_update_uint32(fff, "Cnt", &cnt_val, 1);
-
+            ctx->candidate_count++;
             ctx->recovered_mfkey = mfkey;
             ctx->recovered_type = learn_type;
-            ctx->success = true;
-        }
+            ctx->recovered_cnt = cnt;
 
-        view_dispatcher_send_custom_event(ctx->subghz->view_dispatcher, KL_DECRYPT_EVENT_DONE);
+            subghz_view_keeloq_decrypt_update_candidates(
+                ctx->subghz->subghz_keeloq_decrypt, ctx->candidate_count);
+
+            if(!ctx->subghz->keeloq_keys_manager) {
+                ctx->subghz->keeloq_keys_manager = subghz_keeloq_keys_alloc();
+            }
+            char key_name[32];
+            snprintf(key_name, sizeof(key_name), "BF_%07lX_%lu", ctx->serial, ctx->candidate_count);
+            subghz_keeloq_keys_add(
+                ctx->subghz->keeloq_keys_manager,
+                mfkey,
+                learn_type,
+                key_name);
+            subghz_keeloq_keys_save(ctx->subghz->keeloq_keys_manager);
+
+        } else if(found == 2) {
+            ctx->success = (ctx->candidate_count > 0);
+
+            if(ctx->candidate_count > 0) {
+                furi_string_printf(
+                    ctx->result,
+                    "Found %lu candidate(s)\n"
+                    "Last: %08lX%08lX\n"
+                    "Type:%u Cnt:%04lX\n"
+                    "Saved to user keys",
+                    ctx->candidate_count,
+                    (uint32_t)(ctx->recovered_mfkey >> 32),
+                    (uint32_t)(ctx->recovered_mfkey & 0xFFFFFFFF),
+                    ctx->recovered_type,
+                    ctx->recovered_cnt);
+
+                FlipperFormat* fff = subghz_txrx_get_fff_data(ctx->subghz->txrx);
+                flipper_format_rewind(fff);
+
+                char mf_str[20];
+                snprintf(mf_str, sizeof(mf_str), "BF_%07lX", ctx->serial);
+                flipper_format_insert_or_update_string_cstr(fff, "Manufacture", mf_str);
+
+                uint32_t cnt_val = ctx->recovered_cnt;
+                flipper_format_rewind(fff);
+                flipper_format_insert_or_update_uint32(fff, "Cnt", &cnt_val, 1);
+            }
+
+            view_dispatcher_send_custom_event(ctx->subghz->view_dispatcher, KL_DECRYPT_EVENT_DONE);
+        }
     }
 }
 
@@ -112,10 +138,10 @@ static bool kl_ble_start_offload(KlDecryptCtx* ctx) {
 
     uint8_t req[18];
     req[0] = KL_MSG_BF_REQUEST;
-    req[1] = 0;
+    req[1] = ctx->subghz->keeloq_bf2.learn_type;
     memcpy(req + 2, &ctx->fix, 4);
     memcpy(req + 6, &ctx->hop, 4);
-    memset(req + 10, 0, 4);
+    memcpy(req + 10, &ctx->hop2, 4);
     memcpy(req + 14, &ctx->serial, 4);
     bt_custom_data_tx(bt, req, sizeof(req));
 
@@ -154,6 +180,7 @@ void subghz_scene_keeloq_decrypt_on_enter(void* context) {
     ctx->serial = ctx->fix & 0x0FFFFFFF;
     ctx->btn = ctx->fix >> 28;
     ctx->disc = ctx->serial & 0x3FF;
+    ctx->hop2 = subghz->keeloq_bf2.sig2_loaded ? subghz->keeloq_bf2.hop2 : 0;
 
     scene_manager_set_scene_state(
         subghz->scene_manager, SubGhzSceneKeeloqDecrypt, (uint32_t)(uintptr_t)ctx);
@@ -188,6 +215,8 @@ bool subghz_scene_keeloq_decrypt_on_event(void* context, SceneManagerEvent event
     if(event.type == SceneManagerEventTypeCustom) {
         if(event.event == KL_DECRYPT_EVENT_DONE) {
             kl_ble_cleanup(ctx);
+            subghz->keeloq_bf2.sig1_loaded = false;
+            subghz->keeloq_bf2.sig2_loaded = false;
 
             if(ctx->success) {
                 subghz_save_protocol_to_file(
@@ -195,17 +224,6 @@ bool subghz_scene_keeloq_decrypt_on_event(void* context, SceneManagerEvent event
                     subghz_txrx_get_fff_data(subghz->txrx),
                     furi_string_get_cstr(subghz->file_path));
 
-                if(subghz->keeloq_keys_manager) {
-                    char key_name[24];
-                    snprintf(key_name, sizeof(key_name), "BF_%07lX", ctx->serial);
-                    subghz_keeloq_keys_add(
-                        subghz->keeloq_keys_manager,
-                        ctx->recovered_mfkey,
-                        ctx->recovered_type,
-                        key_name);
-                    subghz_keeloq_keys_save(subghz->keeloq_keys_manager);
-                }
-
                 subghz_view_keeloq_decrypt_set_result(
                     subghz->subghz_keeloq_decrypt, true, furi_string_get_cstr(ctx->result));
             } else if(!ctx->cancel) {

applications/main/subghz/scenes/subghz_scene_kl_bf_cleanup.c

@@ -0,0 +1,139 @@
+#include "../subghz_i.h"
+#include <lib/subghz/protocols/keeloq_common.h>
+
+typedef struct {
+    uint32_t serial;
+    uint32_t hop;
+    uint8_t btn;
+    uint16_t disc;
+    size_t bf_indices[32];
+    size_t bf_count;
+    size_t valid_indices[32];
+    size_t valid_count;
+} KlCleanupCtx;
+
+static bool kl_cleanup_validate_key(uint64_t key, uint32_t hop, uint8_t btn, uint16_t disc) {
+    uint32_t dec = subghz_protocol_keeloq_common_decrypt(hop, key);
+    if((dec >> 28) != btn) return false;
+    uint16_t dec_disc = (dec >> 16) & 0x3FF;
+    if(dec_disc == disc) return true;
+    if((dec_disc & 0xFF) == (disc & 0xFF)) return true;
+    return false;
+}
+
+void subghz_scene_kl_bf_cleanup_on_enter(void* context) {
+    SubGhz* subghz = context;
+
+    KlCleanupCtx* ctx = malloc(sizeof(KlCleanupCtx));
+    memset(ctx, 0, sizeof(KlCleanupCtx));
+
+    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+    flipper_format_rewind(fff);
+
+    uint8_t key_data[8] = {0};
+    if(flipper_format_read_hex(fff, "Key", key_data, 8)) {
+        uint32_t fix = ((uint32_t)key_data[0] << 24) | ((uint32_t)key_data[1] << 16) |
+                       ((uint32_t)key_data[2] << 8) | key_data[3];
+        ctx->hop = ((uint32_t)key_data[4] << 24) | ((uint32_t)key_data[5] << 16) |
+                   ((uint32_t)key_data[6] << 8) | key_data[7];
+        ctx->serial = fix & 0x0FFFFFFF;
+        ctx->btn = fix >> 28;
+        ctx->disc = ctx->serial & 0x3FF;
+    }
+
+    scene_manager_set_scene_state(
+        subghz->scene_manager, SubGhzSceneKlBfCleanup, (uint32_t)(uintptr_t)ctx);
+
+    if(!subghz->keeloq_keys_manager) {
+        subghz->keeloq_keys_manager = subghz_keeloq_keys_alloc();
+    }
+
+    char prefix[16];
+    snprintf(prefix, sizeof(prefix), "BF_%07lX_", ctx->serial);
+    size_t prefix_len = strlen(prefix);
+
+    size_t user_count = subghz_keeloq_keys_user_count(subghz->keeloq_keys_manager);
+    ctx->bf_count = 0;
+    ctx->valid_count = 0;
+
+    for(size_t i = 0; i < user_count && ctx->bf_count < 32; i++) {
+        SubGhzKey* k = subghz_keeloq_keys_get(subghz->keeloq_keys_manager, i);
+        if(!k || !k->name) continue;
+        const char* name = furi_string_get_cstr(k->name);
+        if(strncmp(name, prefix, prefix_len) == 0) {
+            ctx->bf_indices[ctx->bf_count] = i;
+            if(kl_cleanup_validate_key(k->key, ctx->hop, ctx->btn, ctx->disc)) {
+                ctx->valid_indices[ctx->valid_count++] = i;
+            }
+            ctx->bf_count++;
+        }
+    }
+
+    FuriString* msg = furi_string_alloc();
+
+    if(ctx->bf_count == 0) {
+        furi_string_set_str(msg, "No BF candidate keys\nfound for this serial.");
+    } else if(ctx->bf_count == 1) {
+        furi_string_set_str(msg, "Only 1 BF key exists.\nNothing to clean up.");
+    } else if(ctx->valid_count == 1) {
+        size_t deleted = 0;
+        for(int i = (int)ctx->bf_count - 1; i >= 0; i--) {
+            if(ctx->bf_indices[i] != ctx->valid_indices[0]) {
+                subghz_keeloq_keys_delete(subghz->keeloq_keys_manager, ctx->bf_indices[i]);
+                deleted++;
+            }
+        }
+
+        char new_name[24];
+        snprintf(new_name, sizeof(new_name), "BF_%07lX", ctx->serial);
+
+        size_t new_user_count = subghz_keeloq_keys_user_count(subghz->keeloq_keys_manager);
+        for(size_t i = 0; i < new_user_count; i++) {
+            SubGhzKey* k = subghz_keeloq_keys_get(subghz->keeloq_keys_manager, i);
+            if(!k || !k->name) continue;
+            const char* n = furi_string_get_cstr(k->name);
+            if(strncmp(n, prefix, prefix_len) == 0) {
+                subghz_keeloq_keys_set(
+                    subghz->keeloq_keys_manager, i, k->key, k->type, new_name);
+                break;
+            }
+        }
+        subghz_keeloq_keys_save(subghz->keeloq_keys_manager);
+
+        furi_string_printf(msg,
+            "Cleaned %u keys.\nKept valid key:\n%s",
+            deleted, new_name);
+    } else if(ctx->valid_count == 0) {
+        furi_string_printf(msg,
+            "%u BF keys found\nbut none validates\nhop. Kept all.",
+            ctx->bf_count);
+    } else {
+        furi_string_printf(msg,
+            "%u BF keys, %u valid.\nCannot auto-select.\nKept all.",
+            ctx->bf_count, ctx->valid_count);
+    }
+
+    widget_add_text_scroll_element(subghz->widget, 0, 0, 128, 64, furi_string_get_cstr(msg));
+    furi_string_free(msg);
+
+    view_dispatcher_switch_to_view(subghz->view_dispatcher, SubGhzViewIdWidget);
+}
+
+bool subghz_scene_kl_bf_cleanup_on_event(void* context, SceneManagerEvent event) {
+    UNUSED(context);
+    UNUSED(event);
+    return false;
+}
+
+void subghz_scene_kl_bf_cleanup_on_exit(void* context) {
+    SubGhz* subghz = context;
+
+    KlCleanupCtx* ctx = (KlCleanupCtx*)(uintptr_t)scene_manager_get_scene_state(
+        subghz->scene_manager, SubGhzSceneKlBfCleanup);
+    if(ctx) {
+        free(ctx);
+        scene_manager_set_scene_state(subghz->scene_manager, SubGhzSceneKlBfCleanup, 0);
+    }
+
+    widget_reset(subghz->widget);
+}

applications/main/subghz/scenes/subghz_scene_saved_menu.c

@@ -6,8 +6,8 @@ enum SubmenuIndex {
     SubmenuIndexDelete,
     SubmenuIndexSignalSettings,
     SubmenuIndexPsaDecrypt,
-    SubmenuIndexKeeloqDecrypt,
-    SubmenuIndexCounterBf
+    SubmenuIndexCounterBf,
+    SubmenuIndexKlBfCleanup,
 };
 
 void subghz_scene_saved_menu_submenu_callback(void* context, uint32_t index) {
@@ -20,7 +20,6 @@ void subghz_scene_saved_menu_on_enter(void* context) {
 
     FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
     bool is_psa_encrypted = false;
-    bool is_keeloq_unknown = false;
     bool has_counter = false;
     if(fff) {
         FuriString* proto = furi_string_alloc();
@@ -34,17 +33,6 @@ void subghz_scene_saved_menu_on_enter(void* context) {
                     is_psa_encrypted = true;
                 }
                 furi_string_free(type_str);
-            } else if(furi_string_equal_str(proto, "KeeLoq")) {
-                FuriString* mf_str = furi_string_alloc();
-                flipper_format_rewind(fff);
-                if(flipper_format_read_string(fff, "Manufacture", mf_str)) {
-                    if(furi_string_equal_str(mf_str, "Unknown")) {
-                        is_keeloq_unknown = true;
-                    }
-                } else {
-                    is_keeloq_unknown = true;
-                }
-                furi_string_free(mf_str);
             }
         }
         furi_string_free(proto);
@@ -58,6 +46,18 @@ void subghz_scene_saved_menu_on_enter(void* context) {
         }
     }
 
+    bool has_bf_keys = false;
+    if(fff) {
+        FuriString* mfg = furi_string_alloc();
+        flipper_format_rewind(fff);
+        if(flipper_format_read_string(fff, "Manufacture", mfg)) {
+            if(furi_string_start_with_str(mfg, "BF_")) {
+                has_bf_keys = true;
+            }
+        }
+        furi_string_free(mfg);
+    }
+
     submenu_add_item(
         subghz->submenu,
         "Emulate",
@@ -95,14 +95,6 @@ void subghz_scene_saved_menu_on_enter(void* context) {
             subghz_scene_saved_menu_submenu_callback,
             subghz);
     }
-    if(is_keeloq_unknown) {
-        submenu_add_item(
-            subghz->submenu,
-            "KeeLoq BF (Phone)",
-            SubmenuIndexKeeloqDecrypt,
-            subghz_scene_saved_menu_submenu_callback,
-            subghz);
-    }
     if(has_counter) {
         submenu_add_item(
             subghz->submenu,
@@ -111,6 +103,14 @@ void subghz_scene_saved_menu_on_enter(void* context) {
             subghz_scene_saved_menu_submenu_callback,
             subghz);
     }
+    if(has_bf_keys) {
+        submenu_add_item(
+            subghz->submenu,
+            "Clean BF Keys",
+            SubmenuIndexKlBfCleanup,
+            subghz_scene_saved_menu_submenu_callback,
+            subghz);
+    }
 
     submenu_set_selected_item(
         subghz->submenu,
@@ -148,16 +148,16 @@ bool subghz_scene_saved_menu_on_event(void* context, SceneManagerEvent event) {
                 subghz->scene_manager, SubGhzSceneSavedMenu, SubmenuIndexPsaDecrypt);
             scene_manager_next_scene(subghz->scene_manager, SubGhzScenePsaDecrypt);
             return true;
-        } else if(event.event == SubmenuIndexKeeloqDecrypt) {
-            scene_manager_set_scene_state(
-                subghz->scene_manager, SubGhzSceneSavedMenu, SubmenuIndexKeeloqDecrypt);
-            scene_manager_next_scene(subghz->scene_manager, SubGhzSceneKeeloqDecrypt);
-            return true;
         } else if(event.event == SubmenuIndexCounterBf) {
             scene_manager_set_scene_state(
                 subghz->scene_manager, SubGhzSceneSavedMenu, SubmenuIndexCounterBf);
             scene_manager_next_scene(subghz->scene_manager, SubGhzSceneCounterBf);
             return true;
+        } else if(event.event == SubmenuIndexKlBfCleanup) {
+            scene_manager_set_scene_state(
+                subghz->scene_manager, SubGhzSceneSavedMenu, SubmenuIndexKlBfCleanup);
+            scene_manager_next_scene(subghz->scene_manager, SubGhzSceneKlBfCleanup);
+            return true;
         }
     }
     return false;

applications/main/subghz/scenes/subghz_scene_start.c

@@ -55,6 +55,12 @@ void subghz_scene_start_on_enter(void* context) {
         SubmenuIndexKeeloqKeys,
         subghz_scene_start_submenu_callback,
         subghz);
+    submenu_add_item(
+        subghz->submenu,
+        "KeeLoq BF (2 Signals)",
+        SubmenuIndexKeeloqBf2,
+        subghz_scene_start_submenu_callback,
+        subghz);
     submenu_set_selected_item(
         subghz->submenu, scene_manager_get_scene_state(subghz->scene_manager, SubGhzSceneStart));
 
@@ -112,6 +118,11 @@ bool subghz_scene_start_on_event(void* context, SceneManagerEvent event) {
                 subghz->scene_manager, SubGhzSceneStart, SubmenuIndexKeeloqKeys);
             scene_manager_next_scene(subghz->scene_manager, SubGhzSceneKeeloqKeys);
             return true;
+        } else if(event.event == SubmenuIndexKeeloqBf2) {
+            scene_manager_set_scene_state(
+                subghz->scene_manager, SubGhzSceneStart, SubmenuIndexKeeloqBf2);
+            scene_manager_next_scene(subghz->scene_manager, SubGhzSceneKeeloqBf2);
+            return true;
         }
     }
     return false;

applications/main/subghz/scenes/subghz_scene_start.h

@@ -10,4 +10,5 @@ enum SubmenuIndex {
     SubmenuIndexProtocolList,
     SubmenuIndexRadioSetting,
     SubmenuIndexKeeloqKeys,
+    SubmenuIndexKeeloqBf2,
 };

applications/main/subghz/subghz.c

@@ -95,6 +95,11 @@ SubGhz* subghz_alloc(bool alloc_for_tx_only) {
 
     subghz->keeloq_keys_manager = NULL;
 
+    subghz->keeloq_bf2.sig1_loaded = false;
+    subghz->keeloq_bf2.sig2_loaded = false;
+    subghz->keeloq_bf2.sig1_path = furi_string_alloc();
+    subghz->keeloq_bf2.sig2_path = furi_string_alloc();
+
     subghz->file_path = furi_string_alloc();
     subghz->file_path_tmp = furi_string_alloc();
 
@@ -363,7 +368,9 @@ void subghz_free(SubGhz* subghz, bool alloc_for_tx_only) {
     furi_string_free(subghz->file_path);
     furi_string_free(subghz->file_path_tmp);
 
-    // KeeLoq key manager (may still be live if app exited from within the edit scene)
+    furi_string_free(subghz->keeloq_bf2.sig1_path);
+    furi_string_free(subghz->keeloq_bf2.sig2_path);
+
     if(subghz->keeloq_keys_manager) {
         subghz_keeloq_keys_free(subghz->keeloq_keys_manager);
         subghz->keeloq_keys_manager = NULL;

applications/main/subghz/subghz_i.h

@@ -104,13 +104,25 @@ struct SubGhz {
     // KeeLoq key management
     SubGhzKeeloqKeysManager* keeloq_keys_manager;
     struct {
-        uint8_t key_bytes[8]; // ByteInput result
-        char name[65];        // TextInput result
-        uint16_t type;        // selected learning type 1..8
-        bool is_new;          // true = add, false = edit
-        size_t edit_index;    // valid when is_new == false
-        uint8_t edit_step;    // 0 = key, 1 = name, 2 = type
+        uint8_t key_bytes[8];
+        char name[65];
+        uint16_t type;
+        bool is_new;
+        size_t edit_index;
+        uint8_t edit_step;
     } keeloq_edit;
+
+    struct {
+        uint32_t fix;
+        uint32_t hop1;
+        uint32_t hop2;
+        uint32_t serial;
+        bool sig1_loaded;
+        bool sig2_loaded;
+        FuriString* sig1_path;
+        FuriString* sig2_path;
+        uint8_t learn_type;
+    } keeloq_bf2;
 };
 
 void subghz_blink_start(SubGhz* subghz);

applications/main/subghz/views/subghz_keeloq_decrypt.c

@@ -19,6 +19,7 @@ typedef struct {
     uint32_t eta_sec;
     bool done;
     bool success;
+    uint32_t candidates;
     FuriString* result_str;
     char status_line[40];
 } SubGhzKeeloqDecryptModel;
@@ -72,15 +73,21 @@ static void subghz_view_keeloq_decrypt_draw(Canvas* canvas, void* _model) {
         }
         canvas_draw_str(canvas, 2, 48, speed_str);
 
-        char elapsed_str[24];
-        uint32_t el_m = model->elapsed_sec / 60;
-        uint32_t el_s = model->elapsed_sec % 60;
-        if(el_m > 0) {
-            snprintf(elapsed_str, sizeof(elapsed_str), "Elapsed: %lum %lus", el_m, el_s);
+        if(model->candidates > 0) {
+            char cand_str[32];
+            snprintf(cand_str, sizeof(cand_str), "Candidates: %lu", model->candidates);
+            canvas_draw_str(canvas, 2, 58, cand_str);
         } else {
-            snprintf(elapsed_str, sizeof(elapsed_str), "Elapsed: %lus", el_s);
+            char elapsed_str[24];
+            uint32_t el_m = model->elapsed_sec / 60;
+            uint32_t el_s = model->elapsed_sec % 60;
+            if(el_m > 0) {
+                snprintf(elapsed_str, sizeof(elapsed_str), "Elapsed: %lum %lus", el_m, el_s);
+            } else {
+                snprintf(elapsed_str, sizeof(elapsed_str), "Elapsed: %lus", el_s);
+            }
+            canvas_draw_str(canvas, 2, 58, elapsed_str);
         }
-        canvas_draw_str(canvas, 2, 58, elapsed_str);
 
         canvas_draw_str_aligned(canvas, 126, 64, AlignRight, AlignBottom, "Hold BACK");
     } else {
@@ -124,6 +131,7 @@ SubGhzViewKeeloqDecrypt* subghz_view_keeloq_decrypt_alloc(void) {
             model->eta_sec = 0;
             model->done = false;
             model->success = false;
+            model->candidates = 0;
         },
         false);
 
@@ -205,6 +213,7 @@ void subghz_view_keeloq_decrypt_reset(SubGhzViewKeeloqDecrypt* instance) {
             model->eta_sec = 0;
             model->done = false;
             model->success = false;
+            model->candidates = 0;
             furi_string_reset(model->result_str);
             model->status_line[0] = '\0';
         },
@@ -225,3 +234,13 @@ void subghz_view_keeloq_decrypt_set_status(SubGhzViewKeeloqDecrypt* instance, co
         },
         true);
 }
+
+void subghz_view_keeloq_decrypt_update_candidates(
+    SubGhzViewKeeloqDecrypt* instance, uint32_t count) {
+    furi_check(instance);
+    with_view_model(
+        instance->view,
+        SubGhzKeeloqDecryptModel * model,
+        { model->candidates = count; },
+        true);
+}

applications/main/subghz/views/subghz_keeloq_decrypt.h

@@ -32,3 +32,6 @@ void subghz_view_keeloq_decrypt_set_result(
 void subghz_view_keeloq_decrypt_reset(SubGhzViewKeeloqDecrypt* instance);
 
 void subghz_view_keeloq_decrypt_set_status(SubGhzViewKeeloqDecrypt* instance, const char* status);
+
+void subghz_view_keeloq_decrypt_update_candidates(
+    SubGhzViewKeeloqDecrypt* instance, uint32_t count);