Merge pull request #4 from LTX128/main

Add Device Name changer in System Settings

README.md

@@ -60,6 +60,10 @@ This project may incorporate, adapt, or build upon **other open-source projects*
 | Subaru | Subaru | 433 MHz | AM | Yes | Yes | No |
 | Suzuki | Suzuki | 433 MHz | FM | Yes | Yes | Yes |
 | Mitsubishi | Mitsubishi V0 | 868 MHz | FM | Yes | Yes | No |
+| Starline | Star Line | 433 MHz | AM | Yes | Yes | No |
+| Scher-Khan | Scher-Khan | 433 MHz | FM | Yes | Yes | No |
+| Scher-Khan | Magic Code PRO1/PRO2 | 433 MHz | FM | Yes | Yes | Yes |
+| Sheriff | Sheriff CFM (ZX-750/930) | 433 MHz | AM | Yes | Yes | No |
 
 ### Gate / Access Protocols
 

applications/main/subghz/views/transmitter.c

@@ -155,6 +155,22 @@ bool subghz_view_transmitter_input(InputEvent* event, void* context) {
         true);
 
     if(can_be_sent) {
+        if(event->type == InputTypeLong) {
+            if(event->key == InputKeyUp) {
+                subghz_custom_btn_set(SUBGHZ_CUSTOM_BTN_UP);
+                subghz_custom_btn_set_long(true);
+        } else if(event->key == InputKeyDown) {
+            subghz_custom_btn_set(SUBGHZ_CUSTOM_BTN_DOWN);
+            subghz_custom_btn_set_long(true);
+        } else if(event->key == InputKeyLeft) {
+            subghz_custom_btn_set(SUBGHZ_CUSTOM_BTN_LEFT);
+            subghz_custom_btn_set_long(true);
+        } else if(event->key == InputKeyRight) {
+            subghz_custom_btn_set(SUBGHZ_CUSTOM_BTN_RIGHT);
+            subghz_custom_btn_set_long(true);
+        }
+    }
+
         if(event->key == InputKeyOk && event->type == InputTypePress) {
             subghz_custom_btn_set(SUBGHZ_CUSTOM_BTN_OK);
             with_view_model(

applications/services/desktop/desktop.c

@@ -282,6 +282,7 @@ static Desktop* desktop_alloc(void) {
     desktop->pin_input_view = desktop_view_pin_input_alloc();
     desktop->pin_timeout_view = desktop_view_pin_timeout_alloc();
     desktop->slideshow_view = desktop_view_slideshow_alloc();
+    //desktop->tos_view = desktop_view_tos_alloc();
 
     desktop->main_view_stack = view_stack_alloc();
     desktop->main_view = desktop_main_alloc();
@@ -326,6 +327,10 @@ static Desktop* desktop_alloc(void) {
         desktop->view_dispatcher,
         DesktopViewIdSlideshow,
         desktop_view_slideshow_get_view(desktop->slideshow_view));
+    //view_dispatcher_add_view(
+        //desktop->view_dispatcher,
+        //DesktopViewIdTos,
+        //desktop_view_tos_get_view(desktop->tos_view));
 
     // Lock icon
     desktop->lock_icon_viewport = view_port_alloc();
@@ -511,7 +516,9 @@ int32_t desktop_srv(void* p) {
 
     if(storage_file_exists(desktop->storage, SLIDESHOW_FS_PATH)) {
         scene_manager_next_scene(desktop->scene_manager, DesktopSceneSlideshow);
-    }
+    } //else {
+        //scene_manager_next_scene(desktop->scene_manager, DesktopSceneTos);
+    //}
 
     if(!furi_hal_version_do_i_belong_here()) {
         scene_manager_next_scene(desktop->scene_manager, DesktopSceneHwMismatch);

applications/services/desktop/desktop_i.h

@@ -11,6 +11,8 @@
 #include "views/desktop_view_lock_menu.h"
 #include "views/desktop_view_debug.h"
 #include "views/desktop_view_slideshow.h"
+//#include "views/desktop_view_tos.h"
+
 
 #include <gui/gui.h>
 #include <gui/view_stack.h>

applications/services/desktop/scenes/desktop_scene_slideshow.c

@@ -30,6 +30,7 @@ bool desktop_scene_slideshow_on_event(void* context, SceneManagerEvent event) {
         switch(event.event) {
         case DesktopSlideshowCompleted:
             scene_manager_previous_scene(desktop->scene_manager);
+            //scene_manager_search_and_switch_to_another_scene(desktop->scene_manager, DesktopSceneTos);
             consumed = true;
             break;
         case DesktopSlideshowPoweroff:

applications/settings/system/application.fam

@@ -3,7 +3,7 @@ App(
     name="System",
     apptype=FlipperAppType.SETTINGS,
     entry_point="system_settings_app",
-    requires=["gui", "locale"],
-    stack_size=1 * 1024,
+    requires=["gui", "locale", "storage"],
+    stack_size=2 * 1024,
     order=30,
 )

applications/settings/system/system_settings.c

@@ -2,6 +2,9 @@
 #include <loader/loader.h>
 #include <lib/toolbox/value_index.h>
 #include <locale/locale.h>
+#include <flipper_format/flipper_format.h>
+#include <power/power_service/power.h>
+#include <applications/services/namechanger/namechanger.h>
 
 const char* const log_level_text[] = {
     "Default",
@@ -208,6 +211,81 @@ static void filename_scheme_changed(VariableItem* item) {
     }
 }
 
+// ---- Device Name --------------------------------------------------------
+
+#define DEVICE_NAME_ITEM_INDEX 11
+
+static bool system_settings_device_name_validator(
+    const char* text,
+    FuriString* error,
+    void* context) {
+    UNUSED(context);
+    for(; *text; ++text) {
+        const char c = *text;
+        if((c < '0' || c > '9') && (c < 'A' || c > 'Z') && (c < 'a' || c > 'z')) {
+            furi_string_printf(error, "Letters and\nnumbers only!");
+            return false;
+        }
+    }
+    return true;
+}
+
+static void system_settings_device_name_callback(void* context) {
+    SystemSettings* app = context;
+
+    // Save name to SD card (same path as namechanger service)
+    FlipperFormat* file = flipper_format_file_alloc(app->storage);
+    bool saved = false;
+    do {
+        if(app->device_name[0] == '\0') {
+            // Empty name -> remove file to restore real name
+            storage_simply_remove(app->storage, NAMECHANGER_PATH);
+            saved = true;
+            break;
+        }
+        if(!flipper_format_file_open_always(file, NAMECHANGER_PATH)) break;
+        if(!flipper_format_write_header_cstr(file, NAMECHANGER_HEADER, NAMECHANGER_VERSION)) break;
+        if(!flipper_format_write_string_cstr(file, "Name", app->device_name)) break;
+        saved = true;
+    } while(false);
+    flipper_format_free(file);
+
+    if(saved) {
+        // Reboot to apply
+        Power* power = furi_record_open(RECORD_POWER);
+        power_reboot(power, PowerBootModeNormal);
+    } else {
+        // Go back silently on failure
+        view_dispatcher_switch_to_view(app->view_dispatcher, SystemSettingsViewVarItemList);
+    }
+}
+
+static void system_settings_enter_callback(void* context, uint32_t index) {
+    SystemSettings* app = context;
+    if(index == DEVICE_NAME_ITEM_INDEX) {
+        text_input_reset(app->text_input);
+        text_input_set_header_text(app->text_input, "Device Name (empty=reset)");
+        text_input_set_validator(
+            app->text_input, system_settings_device_name_validator, NULL);
+        text_input_set_minimum_length(app->text_input, 0);
+        text_input_set_result_callback(
+            app->text_input,
+            system_settings_device_name_callback,
+            app,
+            app->device_name,
+            FURI_HAL_VERSION_ARRAY_NAME_LENGTH,
+            false);
+        view_dispatcher_switch_to_view(app->view_dispatcher, SystemSettingsViewTextInput);
+    }
+}
+
+static uint32_t system_settings_text_input_back(void* context) {
+    UNUSED(context);
+    return SystemSettingsViewVarItemList;
+}
+
+// -------------------------------------------------------------------------
+
 static uint32_t system_settings_exit(void* context) {
     UNUSED(context);
     return VIEW_NONE;
@@ -218,6 +296,7 @@ SystemSettings* system_settings_alloc(void) {
 
     // Load settings
     app->gui = furi_record_open(RECORD_GUI);
+    app->storage = furi_record_open(RECORD_STORAGE);
 
     app->view_dispatcher = view_dispatcher_alloc();
     view_dispatcher_set_event_callback_context(app->view_dispatcher, app);
@@ -314,6 +393,19 @@ SystemSettings* system_settings_alloc(void) {
     variable_item_set_current_value_index(item, value_index);
     variable_item_set_current_value_text(item, filename_scheme[value_index]);
 
+    // Device Name (index = DEVICE_NAME_ITEM_INDEX = 11)
+    const char* current_name = furi_hal_version_get_name_ptr();
+    strlcpy(
+        app->device_name,
+        current_name ? current_name : "",
+        FURI_HAL_VERSION_ARRAY_NAME_LENGTH);
+    item = variable_item_list_add(app->var_item_list, "Device Name", 0, NULL, app);
+    variable_item_set_current_value_text(
+        item, app->device_name[0] != '\0' ? app->device_name : "<default>");
+
+    variable_item_list_set_enter_callback(
+        app->var_item_list, system_settings_enter_callback, app);
+
     view_set_previous_callback(
         variable_item_list_get_view(app->var_item_list), system_settings_exit);
     view_dispatcher_add_view(
@@ -321,6 +413,15 @@ SystemSettings* system_settings_alloc(void) {
         SystemSettingsViewVarItemList,
         variable_item_list_get_view(app->var_item_list));
 
+    // TextInput for device name
+    app->text_input = text_input_alloc();
+    view_set_previous_callback(
+        text_input_get_view(app->text_input), system_settings_text_input_back);
+    view_dispatcher_add_view(
+        app->view_dispatcher,
+        SystemSettingsViewTextInput,
+        text_input_get_view(app->text_input));
+
     view_dispatcher_switch_to_view(app->view_dispatcher, SystemSettingsViewVarItemList);
 
     return app;
@@ -328,12 +429,16 @@ SystemSettings* system_settings_alloc(void) {
 
 void system_settings_free(SystemSettings* app) {
     furi_assert(app);
+    // TextInput
+    view_dispatcher_remove_view(app->view_dispatcher, SystemSettingsViewTextInput);
+    text_input_free(app->text_input);
     // Variable item list
     view_dispatcher_remove_view(app->view_dispatcher, SystemSettingsViewVarItemList);
     variable_item_list_free(app->var_item_list);
     // View dispatcher
     view_dispatcher_free(app->view_dispatcher);
     // Records
+    furi_record_close(RECORD_STORAGE);
     furi_record_close(RECORD_GUI);
     free(app);
 }

applications/settings/system/system_settings.h

@@ -2,17 +2,24 @@
 
 #include <furi.h>
 #include <furi_hal.h>
+#include <furi_hal_version.h>
 
 #include <gui/gui.h>
 #include <gui/view_dispatcher.h>
 #include <gui/modules/variable_item_list.h>
+#include <gui/modules/text_input.h>
+#include <storage/storage.h>
 
 typedef struct {
     Gui* gui;
     ViewDispatcher* view_dispatcher;
     VariableItemList* var_item_list;
+    TextInput* text_input;
+    Storage* storage;
+    char device_name[FURI_HAL_VERSION_ARRAY_NAME_LENGTH];
 } SystemSettings;
 
 typedef enum {
     SystemSettingsViewVarItemList,
+    SystemSettingsViewTextInput,
 } SystemSettingsView;

lib/subghz/blocks/custom_btn.c

@@ -5,6 +5,8 @@ static uint8_t custom_btn_original = 0;
 static uint8_t custom_btn_max_btns = 0;
 static uint8_t controller_programming_mode = PROG_MODE_OFF;
 
+static bool subghz_custom_btn_long = false;
+
 bool subghz_custom_btn_set(uint8_t btn_id) {
     if(btn_id > custom_btn_max_btns) {
         custom_btn_id = SUBGHZ_CUSTOM_BTN_OK;
@@ -36,6 +38,7 @@ void subghz_custom_btns_reset(void) {
     custom_btn_max_btns = 0;
     controller_programming_mode = PROG_MODE_OFF;
     custom_btn_id = SUBGHZ_CUSTOM_BTN_OK;
+    subghz_custom_btn_long = false;
 }
 
 bool subghz_custom_btn_is_allowed(void) {
@@ -49,3 +52,11 @@ void subghz_custom_btn_set_prog_mode(ProgMode prog_mode) {
 ProgMode subghz_custom_btn_get_prog_mode(void) {
     return controller_programming_mode;
 }
+
+void subghz_custom_btn_set_long(bool v) {
+    subghz_custom_btn_long = v;
+}
+
+bool subghz_custom_btn_get_long(void) {
+    return subghz_custom_btn_long;
+}

lib/subghz/blocks/custom_btn.h

@@ -25,6 +25,9 @@ void subghz_custom_btns_reset(void);
 
 bool subghz_custom_btn_is_allowed(void);
 
+void subghz_custom_btn_set_long(bool v);
+bool subghz_custom_btn_get_long(void);
+
 #ifdef __cplusplus
 }
 #endif

lib/subghz/protocols/protocol_items.c

@@ -74,6 +74,7 @@ const SubGhzProtocol* const subghz_protocol_registry_items[] = {
     &subghz_protocol_mitsubishi_v0,
     &subghz_protocol_star_line,
     &subghz_protocol_scher_khan,
+    &subghz_protocol_sheriff_cfm,
 };
 
 const SubGhzProtocolRegistry subghz_protocol_registry = {

lib/subghz/protocols/protocol_items.h

@@ -76,3 +76,4 @@
 #include "mazda_siemens.h"
 #include "star_line.h"
 #include "scher_khan.h"
+#include "sheriff_cfm.h"

lib/subghz/protocols/scher_khan.c

@@ -2,8 +2,129 @@
 #include "../blocks/custom_btn_i.h"
 #include "../blocks/generic.h"
 
+#include <string.h>
+
 #define TAG "SubGhzProtocolScherKhan"
 
+static const uint8_t sk_pi_bytes[146] = {
+    0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+    0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+    0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+    0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89,
+    0x45, 0x28, 0x21, 0xE6, 0x38, 0xD0, 0x13, 0x77,
+    0xBE, 0x54, 0x66, 0xCF, 0x34, 0xE9, 0x0C, 0x6C,
+    0xC0, 0xAC, 0x29, 0xB7, 0xC9, 0x7C, 0x50, 0xDD,
+    0x3F, 0x84, 0xD5, 0xB5, 0xB5, 0x47, 0x09, 0x17,
+    0x92, 0x16, 0xD5, 0xD9, 0x89, 0x79, 0xFB, 0x1B,
+    0xD1, 0x31, 0x0B, 0xA6, 0x98, 0xDF, 0xB5, 0xAC,
+    0x2F, 0xFD, 0x72, 0xDB, 0xD0, 0x1A, 0xDF, 0xB7,
+    0xB8, 0xE1, 0xAF, 0xED, 0x6A, 0x26, 0x7E, 0x96,
+    0xBA, 0x7C, 0x90, 0x45, 0xF1, 0x2C, 0x7F, 0x99,
+    0x24, 0xA1, 0x99, 0x47, 0xB3, 0x91, 0x6C, 0xF7,
+    0x08, 0x01, 0xF2, 0xE2, 0x85, 0x8E, 0xFC, 0x16,
+    0x63, 0x69, 0x20, 0xD8, 0x71, 0x57, 0x4E, 0x69,
+    0xA4, 0x58, 0xFE, 0xA3, 0xF4, 0x93, 0x3D, 0x7E,
+    0x0D, 0x95, 0x74, 0x8F, 0x72, 0x8E, 0xB6, 0x58,
+    0x71, 0x8B,
+};
+
+static const uint8_t sk_pro1_encoded[64] = {
+    0x63, 0x5A, 0x58, 0x98, 0xD6, 0xB3, 0x7E, 0x91,
+    0x37, 0x1E, 0xBB, 0x78, 0x43, 0x06, 0x20, 0x65,
+    0xC7, 0x4B, 0x3F, 0x73, 0x0D, 0xAE, 0x36, 0x86,
+    0x1E, 0x7A, 0xDA, 0xEB, 0xBB, 0x0F, 0x5A, 0xA9,
+    0x26, 0x3A, 0x51, 0xB2, 0x7A, 0xE0, 0x44, 0x61,
+    0xAC, 0x53, 0x02, 0xFA, 0x42, 0xBD, 0x2D, 0x6F,
+    0x85, 0xBB, 0x4A, 0xB5, 0xF9, 0x28, 0x46, 0xAF,
+    0x2B, 0xB4, 0xB2, 0x90, 0xD0, 0x05, 0x19, 0x64,
+};
+
+static const uint8_t sk_pro2_encoded[64] = {
+    0x90, 0x27, 0xA3, 0x9C, 0xEA, 0x6B, 0x8B, 0x4F,
+    0x91, 0x47, 0x58, 0x87, 0x8A, 0xD8, 0xD1, 0x99,
+    0x3B, 0xCD, 0x15, 0xFE, 0xF4, 0x1D, 0xEE, 0xE1,
+    0xBF, 0xA4, 0x9E, 0xCB, 0x1C, 0x72, 0x5F, 0x95,
+    0xAC, 0x28, 0xB0, 0x36, 0xE3, 0x2B, 0x1B, 0xAC,
+    0x30, 0x91, 0xFE, 0x62, 0xD0, 0xD3, 0x6B, 0xA6,
+    0x4F, 0x64, 0xC0, 0xF2, 0xD2, 0xCF, 0xCA, 0x36,
+    0x53, 0x3D, 0x36, 0xAA, 0x33, 0x67, 0x19, 0x7F,
+};
+
+static const uint8_t sk_pro_crc_encoded[2] = {
+    0x5B, 0x8C,
+};
+
+static void sk_pi_decode(uint8_t* out, const uint8_t* encoded, size_t offset, size_t len) {
+    for(size_t i = 0; i < len; i++) {
+        out[i] = encoded[i] ^ sk_pi_bytes[offset + i];
+    }
+}
+
+static uint8_t scher_khan_pro_checksum(const uint8_t* data, uint8_t poly) {
+    uint8_t cs = 0xFF;
+    for(uint8_t a = 0; a < 6; a++) {
+        uint8_t c = data[a];
+        for(uint8_t b = 0; b < 8; b++) {
+            uint8_t _cs = cs;
+            cs <<= 1;
+            if((_cs ^ c) & 0x80) cs ^= poly;
+            c <<= 1;
+        }
+    }
+    return cs;
+}
+
+static void scher_khan_pro_decrypt(
+    const uint8_t* encrypted,
+    uint8_t* decrypted,
+    const uint8_t* key_table) {
+    memset(decrypted, 0, 7);
+    decrypted[0] = encrypted[0];
+    uint8_t pkt_cnt = encrypted[0] & 0x0F;
+
+    for(int i = 1; i < 6; i++) {
+        for(int j = 0; j < 4; j++) {
+            uint8_t cr = key_table[(pkt_cnt << 2) + j];
+            uint8_t s = encrypted[i];
+
+            uint8_t bit = 0x80 >> (cr >> 4);
+            if((s & bit) == bit) decrypted[i] |= 0x80 >> (j << 1);
+
+            bit = 0x80 >> (cr & 0x0F);
+            if((s & bit) == bit) decrypted[i] |= 0x80 >> ((j << 1) + 1);
+        }
+        pkt_cnt = (pkt_cnt + 1) & 0x0F;
+        decrypted[i] ^= encrypted[i - 1];
+    }
+}
+
+static void scher_khan_pro_encrypt(
+    const uint8_t* plain,
+    uint8_t* encrypted,
+    const uint8_t* key_table) {
+    uint8_t src[7];
+    memcpy(src, plain, 7);
+    memset(encrypted, 0, 7);
+    encrypted[0] = src[0];
+    uint8_t pkt_cnt = src[0] & 0x0F;
+
+    for(int i = 1; i < 6; i++) {
+        src[i] ^= encrypted[i - 1];
+
+        for(int j = 0; j < 4; j++) {
+            uint8_t cr = key_table[(pkt_cnt << 2) + j];
+            uint8_t s = src[i];
+
+            uint8_t bit = 0x80 >> (j << 1);
+            if((s & bit) == bit) encrypted[i] |= 0x80 >> (cr >> 4);
+
+            bit = 0x80 >> ((j << 1) + 1);
+            if((s & bit) == bit) encrypted[i] |= 0x80 >> (cr & 0x0F);
+        }
+        pkt_cnt = (pkt_cnt + 1) & 0x0F;
+    }
+}
+
 static const char* scher_khan_btn_name(uint8_t btn) {
     switch(btn) {
     case 0x1: return "Lock";
@@ -59,6 +180,8 @@ struct SubGhzProtocolEncoderScherKhan {
 
     SubGhzProtocolBlockEncoder encoder;
     SubGhzBlockGeneric generic;
+
+    const char* protocol_name;
 };
 
 typedef enum {
@@ -68,6 +191,10 @@ typedef enum {
     ScherKhanDecoderStepCheckDuration,
 } ScherKhanDecoderStep;
 
+static void subghz_protocol_scher_khan_check_remote_controller(
+    SubGhzBlockGeneric* instance,
+    const char** protocol_name);
+
 const SubGhzProtocolDecoder subghz_protocol_scher_khan_decoder = {
     .alloc = subghz_protocol_decoder_scher_khan_alloc,
     .free = subghz_protocol_decoder_scher_khan_free,
@@ -82,23 +209,391 @@ const SubGhzProtocolDecoder subghz_protocol_scher_khan_decoder = {
 };
 
 const SubGhzProtocolEncoder subghz_protocol_scher_khan_encoder = {
-    .alloc = NULL,
-    .free = NULL,
+    .alloc = subghz_protocol_encoder_scher_khan_alloc,
+    .free = subghz_protocol_encoder_scher_khan_free,
 
-    .deserialize = NULL,
-    .stop = NULL,
-    .yield = NULL,
+    .deserialize = subghz_protocol_encoder_scher_khan_deserialize,
+    .stop = subghz_protocol_encoder_scher_khan_stop,
+    .yield = subghz_protocol_encoder_scher_khan_yield,
 };
 
 const SubGhzProtocol subghz_protocol_scher_khan = {
     .name = SUBGHZ_PROTOCOL_SCHER_KHAN_NAME,
     .type = SubGhzProtocolTypeDynamic,
-    .flag = SubGhzProtocolFlag_433 | SubGhzProtocolFlag_FM | SubGhzProtocolFlag_Decodable,
+    .flag = SubGhzProtocolFlag_433 | SubGhzProtocolFlag_FM | SubGhzProtocolFlag_AM |
+            SubGhzProtocolFlag_Decodable |
+            SubGhzProtocolFlag_Load | SubGhzProtocolFlag_Save | SubGhzProtocolFlag_Send,
 
     .decoder = &subghz_protocol_scher_khan_decoder,
     .encoder = &subghz_protocol_scher_khan_encoder,
 };
 
+// ======================== ENCODER ========================
+
+void* subghz_protocol_encoder_scher_khan_alloc(SubGhzEnvironment* environment) {
+    UNUSED(environment);
+    SubGhzProtocolEncoderScherKhan* instance = malloc(sizeof(SubGhzProtocolEncoderScherKhan));
+
+    instance->base.protocol = &subghz_protocol_scher_khan;
+    instance->generic.protocol_name = instance->base.protocol->name;
+
+    instance->encoder.repeat = 7;
+    instance->encoder.size_upload = 256;
+    instance->encoder.upload = malloc(instance->encoder.size_upload * sizeof(LevelDuration));
+    instance->encoder.is_running = false;
+    instance->encoder.front = 0;
+
+    return instance;
+}
+
+void subghz_protocol_encoder_scher_khan_free(void* context) {
+    furi_check(context);
+    SubGhzProtocolEncoderScherKhan* instance = context;
+    free(instance->encoder.upload);
+    free(instance);
+}
+
+/**
+ * Build the RF upload buffer matching the real Scher-Khan waveform.
+ *
+ * Real signal structure (from Boot_sh5.sub / Trunk_sh5.sub analysis):
+ *
+ *   Preamble:  6x pairs of ~750µs high / ~750µs low
+ *   Header:    3x pairs of ~1500µs high / ~1500µs low
+ *   Start bit: 1x pair  of ~750µs high / ~750µs low
+ *   Data:      bit 0 = ~750µs  high / ~750µs  low
+ *              bit 1 = ~1100µs high / ~1100µs low
+ *   End:       ~1500µs high (marks frame end for decoder)
+ */
+static bool subghz_protocol_encoder_scher_khan_get_upload(
+    SubGhzProtocolEncoderScherKhan* instance,
+    uint8_t btn) {
+    furi_check(instance);
+
+    // For 51-bit dynamic: rebuild data with new button and incremented counter
+    if(instance->generic.data_count_bit == 51) {
+        if((instance->generic.cnt + 1) > 0xFFFF) {
+            instance->generic.cnt = 0;
+        } else {
+            instance->generic.cnt += 1;
+        }
+
+        uint64_t upper = instance->generic.data & 0x7FFFFFFF0000ULL;
+        upper = (upper & ~(0x0FULL << 24)) | ((uint64_t)(btn & 0x0F) << 24);
+        instance->generic.data = upper | (instance->generic.cnt & 0xFFFF);
+        instance->generic.btn = btn;
+    }
+
+    if(instance->generic.data_count_bit == 57) {
+        if((instance->generic.cnt + 1) > 0xFFFF) {
+            instance->generic.cnt = 0;
+        } else {
+            instance->generic.cnt += 1;
+        }
+
+        uint8_t kb[7];
+        for(int i = 0; i < 7; i++) {
+            kb[i] = (uint8_t)((instance->generic.data >> (48 - i * 8)) & 0xFF);
+        }
+
+        uint8_t crc_polys[2];
+        sk_pi_decode(crc_polys, sk_pro_crc_encoded, 144, 2);
+
+        uint8_t key_table[64];
+        uint8_t poly;
+        uint8_t crc1 = scher_khan_pro_checksum(kb, crc_polys[0]);
+        if(crc1 == kb[6]) {
+            sk_pi_decode(key_table, sk_pro1_encoded, 0, 64);
+            poly = crc_polys[0];
+        } else {
+            sk_pi_decode(key_table, sk_pro2_encoded, 64, 64);
+            poly = crc_polys[1];
+        }
+
+        uint8_t decrypted[7];
+        scher_khan_pro_decrypt(kb, decrypted, key_table);
+
+        decrypted[3] = (decrypted[3] & 0xE0) | (btn & 0x0F);
+        decrypted[4] = (uint8_t)(instance->generic.cnt >> 8);
+        decrypted[5] = (uint8_t)(instance->generic.cnt & 0xFF);
+
+        uint8_t encrypted[7];
+        scher_khan_pro_encrypt(decrypted, encrypted, key_table);
+
+        encrypted[6] = scher_khan_pro_checksum(encrypted, poly);
+
+        instance->generic.data = 0;
+        for(int i = 0; i < 7; i++) {
+            instance->generic.data |= ((uint64_t)encrypted[i] << (48 - i * 8));
+        }
+        instance->generic.data &= 0x01FFFFFFFFFFFFFFULL;
+        instance->generic.btn = btn;
+    }
+
+    size_t index = 0;
+    size_t needed = (6 * 2) + (3 * 2) + (1 * 2) + (instance->generic.data_count_bit * 2) + 1;
+    if(needed > instance->encoder.size_upload) {
+        FURI_LOG_E(TAG, "Upload buffer too small: need %zu, have %zu",
+            needed, instance->encoder.size_upload);
+        return false;
+    }
+
+    for(uint8_t i = 0; i < 6; i++) {
+        instance->encoder.upload[index++] =
+            level_duration_make(true, (uint32_t)subghz_protocol_scher_khan_const.te_short);
+        instance->encoder.upload[index++] =
+            level_duration_make(false, (uint32_t)subghz_protocol_scher_khan_const.te_short);
+    }
+
+    for(uint8_t i = 0; i < 3; i++) {
+        instance->encoder.upload[index++] =
+            level_duration_make(true, (uint32_t)subghz_protocol_scher_khan_const.te_short * 2);
+        instance->encoder.upload[index++] =
+            level_duration_make(false, (uint32_t)subghz_protocol_scher_khan_const.te_short * 2);
+    }
+
+    instance->encoder.upload[index++] =
+        level_duration_make(true, (uint32_t)subghz_protocol_scher_khan_const.te_short);
+    instance->encoder.upload[index++] =
+        level_duration_make(false, (uint32_t)subghz_protocol_scher_khan_const.te_short);
+
+    for(uint8_t i = instance->generic.data_count_bit; i > 0; i--) {
+        if(bit_read(instance->generic.data, i - 1)) {
+            instance->encoder.upload[index++] =
+                level_duration_make(true, (uint32_t)subghz_protocol_scher_khan_const.te_long);
+            instance->encoder.upload[index++] =
+                level_duration_make(false, (uint32_t)subghz_protocol_scher_khan_const.te_long);
+        } else {
+            instance->encoder.upload[index++] =
+                level_duration_make(true, (uint32_t)subghz_protocol_scher_khan_const.te_short);
+            instance->encoder.upload[index++] =
+                level_duration_make(false, (uint32_t)subghz_protocol_scher_khan_const.te_short);
+        }
+    }
+
+    instance->encoder.upload[index++] =
+        level_duration_make(true, (uint32_t)subghz_protocol_scher_khan_const.te_short * 2);
+
+    instance->encoder.size_upload = index;
+
+    FURI_LOG_I(TAG, "Upload built: %zu entries, %d bits, btn=0x%02X, cnt=0x%04lX, data=0x%016llX",
+        index, instance->generic.data_count_bit, instance->generic.btn,
+        (unsigned long)instance->generic.cnt, instance->generic.data);
+
+    return true;
+}
+
+static SubGhzProtocolStatus subghz_protocol_encoder_scher_khan_serialize_internal(
+    SubGhzProtocolEncoderScherKhan* instance,
+    FlipperFormat* flipper_format) {
+
+    const char* pname = NULL;
+    subghz_protocol_scher_khan_check_remote_controller(&instance->generic, &pname);
+
+    SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
+
+    do {
+        if(!flipper_format_insert_or_update_string_cstr(
+               flipper_format, "Protocol", instance->generic.protocol_name)) {
+            break;
+        }
+
+        uint32_t bits = instance->generic.data_count_bit;
+        if(!flipper_format_insert_or_update_uint32(flipper_format, "Bit", &bits, 1)) {
+            break;
+        }
+
+        char key_str[20];
+        snprintf(key_str, sizeof(key_str), "%016llX", instance->generic.data);
+        if(!flipper_format_insert_or_update_string_cstr(flipper_format, "Key", key_str)) {
+            break;
+        }
+
+        if(!flipper_format_insert_or_update_uint32(
+               flipper_format, "Serial", &instance->generic.serial, 1)) {
+            break;
+        }
+
+        uint32_t temp = instance->generic.btn;
+        if(!flipper_format_insert_or_update_uint32(flipper_format, "Btn", &temp, 1)) {
+            break;
+        }
+
+        if(!flipper_format_insert_or_update_uint32(
+               flipper_format, "Cnt", &instance->generic.cnt, 1)) {
+            break;
+        }
+
+        ret = SubGhzProtocolStatusOk;
+    } while(false);
+
+    return ret;
+}
+
+SubGhzProtocolStatus
+    subghz_protocol_encoder_scher_khan_deserialize(void* context, FlipperFormat* flipper_format) {
+    furi_check(context);
+    SubGhzProtocolEncoderScherKhan* instance = context;
+    SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
+
+    flipper_format_rewind(flipper_format);
+
+    do {
+        FuriString* temp_str = furi_string_alloc();
+        if(!flipper_format_read_string(flipper_format, "Protocol", temp_str)) {
+            FURI_LOG_E(TAG, "Missing Protocol");
+            furi_string_free(temp_str);
+            break;
+        }
+
+        if(!furi_string_equal(temp_str, instance->base.protocol->name)) {
+            FURI_LOG_E(TAG, "Wrong protocol %s != %s",
+                furi_string_get_cstr(temp_str), instance->base.protocol->name);
+            furi_string_free(temp_str);
+            break;
+        }
+        furi_string_free(temp_str);
+
+        uint32_t bit_count_temp;
+        if(!flipper_format_read_uint32(flipper_format, "Bit", &bit_count_temp, 1)) {
+            FURI_LOG_E(TAG, "Missing Bit");
+            break;
+        }
+        instance->generic.data_count_bit = (uint8_t)bit_count_temp;
+
+        temp_str = furi_string_alloc();
+        if(!flipper_format_read_string(flipper_format, "Key", temp_str)) {
+            FURI_LOG_E(TAG, "Missing Key");
+            furi_string_free(temp_str);
+            break;
+        }
+
+        const char* key_str = furi_string_get_cstr(temp_str);
+        uint64_t key = 0;
+        size_t str_len = strlen(key_str);
+        size_t hex_pos = 0;
+        for(size_t i = 0; i < str_len && hex_pos < 16; i++) {
+            char c = key_str[i];
+            if(c == ' ') continue;
+
+            uint8_t nibble;
+            if(c >= '0' && c <= '9') {
+                nibble = c - '0';
+            } else if(c >= 'A' && c <= 'F') {
+                nibble = c - 'A' + 10;
+            } else if(c >= 'a' && c <= 'f') {
+                nibble = c - 'a' + 10;
+            } else {
+                FURI_LOG_E(TAG, "Invalid hex character: %c", c);
+                furi_string_free(temp_str);
+                break;
+            }
+            key = (key << 4) | nibble;
+            hex_pos++;
+        }
+        furi_string_free(temp_str);
+
+        if(hex_pos == 0) {
+            FURI_LOG_E(TAG, "Invalid key length");
+            break;
+        }
+
+        instance->generic.data = key;
+        FURI_LOG_I(TAG, "Parsed key: 0x%016llX", instance->generic.data);
+
+        if(instance->generic.data == 0) {
+            FURI_LOG_E(TAG, "Key is zero after parsing!");
+            break;
+        }
+
+        if(!flipper_format_read_uint32(flipper_format, "Serial", &instance->generic.serial, 1)) {
+            instance->generic.serial = 0;
+            FURI_LOG_I(TAG, "Serial not found, defaulting to 0");
+        } else {
+            FURI_LOG_I(TAG, "Read serial: 0x%08lX", instance->generic.serial);
+        }
+
+        uint32_t btn_temp;
+        if(flipper_format_read_uint32(flipper_format, "Btn", &btn_temp, 1)) {
+            instance->generic.btn = (uint8_t)btn_temp;
+            FURI_LOG_I(TAG, "Read button: 0x%02X", instance->generic.btn);
+        } else {
+            instance->generic.btn = 0;
+            FURI_LOG_I(TAG, "Button not found, defaulting to 0");
+        }
+
+        subghz_custom_btn_set_original(scher_khan_btn_to_custom(instance->generic.btn));
+        subghz_custom_btn_set_max(4);
+
+        uint32_t cnt_temp;
+        if(flipper_format_read_uint32(flipper_format, "Cnt", &cnt_temp, 1)) {
+            instance->generic.cnt = (uint16_t)cnt_temp;
+            FURI_LOG_I(TAG, "Read counter: 0x%04lX", (unsigned long)instance->generic.cnt);
+        } else {
+            instance->generic.cnt = 0;
+        }
+
+        if(!flipper_format_read_uint32(
+               flipper_format, "Repeat", (uint32_t*)&instance->encoder.repeat, 1)) {
+            instance->encoder.repeat = 7;
+            FURI_LOG_D(TAG, "Repeat not found, using default 7");
+        }
+
+        const char* pname = NULL;
+        subghz_protocol_scher_khan_check_remote_controller(&instance->generic, &pname);
+        instance->protocol_name = pname;
+
+        uint8_t selected_btn = scher_khan_get_btn_code(instance->generic.btn);
+
+        FURI_LOG_I(TAG,
+            "Building upload: original_btn=0x%02X, selected_btn=0x%02X, bits=%d",
+            instance->generic.btn, selected_btn, instance->generic.data_count_bit);
+
+        if(!subghz_protocol_encoder_scher_khan_get_upload(instance, selected_btn)) {
+            FURI_LOG_E(TAG, "Failed to generate upload");
+            break;
+        }
+
+        subghz_protocol_encoder_scher_khan_serialize_internal(instance, flipper_format);
+
+        instance->encoder.is_running = true;
+        instance->encoder.front = 0;
+
+        FURI_LOG_I(TAG, "Encoder ready: repeat=%u, size_upload=%zu",
+            instance->encoder.repeat, instance->encoder.size_upload);
+
+        ret = SubGhzProtocolStatusOk;
+    } while(false);
+
+    return ret;
+}
+
+void subghz_protocol_encoder_scher_khan_stop(void* context) {
+    furi_check(context);
+    SubGhzProtocolEncoderScherKhan* instance = context;
+    instance->encoder.is_running = false;
+}
+
+LevelDuration subghz_protocol_encoder_scher_khan_yield(void* context) {
+    SubGhzProtocolEncoderScherKhan* instance = context;
+
+    if(instance->encoder.repeat == 0 || !instance->encoder.is_running) {
+        instance->encoder.is_running = false;
+        return level_duration_reset();
+    }
+
+    LevelDuration ret = instance->encoder.upload[instance->encoder.front];
+
+    if(++instance->encoder.front == instance->encoder.size_upload) {
+        instance->encoder.repeat--;
+        instance->encoder.front = 0;
+    }
+
+    return ret;
+}
+
+// ======================== DECODER ========================
+
 void* subghz_protocol_decoder_scher_khan_alloc(SubGhzEnvironment* environment) {
     UNUSED(environment);
     SubGhzProtocolDecoderScherKhan* instance = malloc(sizeof(SubGhzProtocolDecoderScherKhan));
@@ -239,12 +734,53 @@ static void subghz_protocol_scher_khan_check_remote_controller(
         instance->btn = (instance->data >> 24) & 0x0F;
         instance->cnt = instance->data & 0xFFFF;
         break;
-    case 57:
-        *protocol_name = "MAGIC CODE PRO/PRO2";
-        instance->serial = 0;
-        instance->btn = 0;
-        instance->cnt = 0;
+    case 57: {
+        uint8_t kb[7];
+        for(int i = 0; i < 7; i++) {
+            kb[i] = (uint8_t)((instance->data >> (48 - i * 8)) & 0xFF);
+        }
+
+        uint8_t crc_polys[2];
+        sk_pi_decode(crc_polys, sk_pro_crc_encoded, 144, 2);
+
+        uint8_t key_table[64];
+        uint8_t decrypted[7];
+        bool found = false;
+
+        uint8_t computed_crc = scher_khan_pro_checksum(kb, crc_polys[0]);
+        if(computed_crc == kb[6]) {
+            sk_pi_decode(key_table, sk_pro1_encoded, 0, 64);
+            scher_khan_pro_decrypt(kb, decrypted, key_table);
+            *protocol_name = "MAGIC CODE PRO1";
+            found = true;
+        }
+
+        if(!found) {
+            computed_crc = scher_khan_pro_checksum(kb, crc_polys[1]);
+            if(computed_crc == kb[6]) {
+                sk_pi_decode(key_table, sk_pro2_encoded, 64, 64);
+                scher_khan_pro_decrypt(kb, decrypted, key_table);
+                *protocol_name = "MAGIC CODE PRO2";
+                found = true;
+            }
+        }
+
+        if(found) {
+            instance->serial =
+                ((uint32_t)decrypted[0] << 16) |
+                ((uint32_t)decrypted[1] << 8) |
+                (uint32_t)decrypted[2];
+            instance->btn = decrypted[3] & 0x0F;
+            instance->cnt =
+                ((uint16_t)decrypted[4] << 8) | decrypted[5];
+        } else {
+            *protocol_name = "MAGIC CODE PRO/PRO2";
+            instance->serial = 0;
+            instance->btn = 0;
+            instance->cnt = 0;
+        }
         break;
+    }
     case 63:
         *protocol_name = "MAGIC CODE, Response";
         instance->serial = 0;
@@ -264,7 +800,6 @@ static void subghz_protocol_scher_khan_check_remote_controller(
         instance->btn = 0;
         instance->cnt = 0;
         break;
-
     default:
         *protocol_name = "Unknown";
         instance->serial = 0;
@@ -287,6 +822,10 @@ SubGhzProtocolStatus subghz_protocol_decoder_scher_khan_serialize(
     SubGhzRadioPreset* preset) {
     furi_check(context);
     SubGhzProtocolDecoderScherKhan* instance = context;
+
+    const char* pname = NULL;
+    subghz_protocol_scher_khan_check_remote_controller(&instance->generic, &pname);
+
     SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
 
     do {
@@ -351,7 +890,91 @@ SubGhzProtocolStatus
     subghz_protocol_decoder_scher_khan_deserialize(void* context, FlipperFormat* flipper_format) {
     furi_check(context);
     SubGhzProtocolDecoderScherKhan* instance = context;
-    return subghz_block_generic_deserialize(&instance->generic, flipper_format);
+    SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
+
+    flipper_format_rewind(flipper_format);
+
+    do {
+        FuriString* temp_str = furi_string_alloc();
+        if(!flipper_format_read_string(flipper_format, "Protocol", temp_str)) {
+            FURI_LOG_E(TAG, "Missing Protocol");
+            furi_string_free(temp_str);
+            break;
+        }
+
+        if(!furi_string_equal(temp_str, instance->base.protocol->name)) {
+            FURI_LOG_E(TAG, "Wrong protocol %s != %s",
+                furi_string_get_cstr(temp_str), instance->base.protocol->name);
+            furi_string_free(temp_str);
+            break;
+        }
+        furi_string_free(temp_str);
+
+        uint32_t bit_count_temp;
+        if(!flipper_format_read_uint32(flipper_format, "Bit", &bit_count_temp, 1)) {
+            FURI_LOG_E(TAG, "Missing Bit");
+            break;
+        }
+        instance->generic.data_count_bit = (uint8_t)bit_count_temp;
+
+        temp_str = furi_string_alloc();
+        if(!flipper_format_read_string(flipper_format, "Key", temp_str)) {
+            FURI_LOG_E(TAG, "Missing Key");
+            furi_string_free(temp_str);
+            break;
+        }
+
+        const char* key_str = furi_string_get_cstr(temp_str);
+        uint64_t key = 0;
+        size_t str_len = strlen(key_str);
+        size_t hex_pos = 0;
+        for(size_t i = 0; i < str_len && hex_pos < 16; i++) {
+            char c = key_str[i];
+            if(c == ' ') continue;
+            uint8_t nibble;
+            if(c >= '0' && c <= '9') nibble = c - '0';
+            else if(c >= 'A' && c <= 'F') nibble = c - 'A' + 10;
+            else if(c >= 'a' && c <= 'f') nibble = c - 'a' + 10;
+            else {
+                FURI_LOG_E(TAG, "Invalid hex character: %c", c);
+                furi_string_free(temp_str);
+                break;
+            }
+            key = (key << 4) | nibble;
+            hex_pos++;
+        }
+        furi_string_free(temp_str);
+
+        if(hex_pos == 0) {
+            FURI_LOG_E(TAG, "Invalid key length");
+            break;
+        }
+
+        instance->generic.data = key;
+
+        if(!flipper_format_read_uint32(flipper_format, "Serial", &instance->generic.serial, 1)) {
+            instance->generic.serial = 0;
+        }
+
+        uint32_t btn_temp;
+        if(flipper_format_read_uint32(flipper_format, "Btn", &btn_temp, 1)) {
+            instance->generic.btn = (uint8_t)btn_temp;
+        } else {
+            instance->generic.btn = 0;
+        }
+
+        uint32_t cnt_temp;
+        if(flipper_format_read_uint32(flipper_format, "Cnt", &cnt_temp, 1)) {
+            instance->generic.cnt = (uint16_t)cnt_temp;
+        } else {
+            instance->generic.cnt = 0;
+        }
+
+        FURI_LOG_I(TAG, "Decoder deserialized");
+        ret = SubGhzProtocolStatusOk;
+    } while(false);
+
+    return ret;
 }
 
 void subghz_protocol_decoder_scher_khan_get_string(void* context, FuriString* output) {

lib/subghz/protocols/scher_khan.h

@@ -35,3 +35,10 @@ SubGhzProtocolStatus
     subghz_protocol_decoder_scher_khan_deserialize(void* context, FlipperFormat* flipper_format);
 
 void subghz_protocol_decoder_scher_khan_get_string(void* context, FuriString* output);
+
+void* subghz_protocol_encoder_scher_khan_alloc(SubGhzEnvironment* environment);
+void subghz_protocol_encoder_scher_khan_free(void* context);
+SubGhzProtocolStatus
+    subghz_protocol_encoder_scher_khan_deserialize(void* context, FlipperFormat* flipper_format);
+void subghz_protocol_encoder_scher_khan_stop(void* context);
+LevelDuration subghz_protocol_encoder_scher_khan_yield(void* context);

lib/subghz/protocols/sheriff_cfm.c

@@ -0,0 +1,634 @@
+#include "sheriff_cfm.h"
+#include "keeloq_common.h"
+#include "../blocks/custom_btn_i.h"
+#include "../blocks/generic.h"
+
+#include <string.h>
+
+#define TAG "SubGhzProtocolSheriffCfm"
+
+static const uint8_t cfm_pi_bytes[] = {
+    0xA4, 0x58, 0xFE, 0xA3, 0xF4, 0x93, 0x3D, 0x7E,
+    0x0D, 0x95, 0x74, 0x8F, 0x72, 0x8E, 0xB6, 0x58,
+};
+
+static const uint8_t cfm_zx750_encoded[8] = {
+    0x32, 0x4D, 0xCB, 0x84, 0x5F, 0xE9, 0x27, 0xCB,
+};
+
+static const uint8_t cfm_zx930_encoded[8] = {
+    0x94, 0x3B, 0x63, 0xA5, 0xE8, 0xF3, 0xAB, 0x60,
+};
+
+static void cfm_pi_decode(uint8_t* out, const uint8_t* encoded, size_t pi_offset, size_t len) {
+    for(size_t i = 0; i < len; i++) {
+        out[i] = encoded[i] ^ cfm_pi_bytes[pi_offset + i];
+    }
+}
+
+static uint8_t cfm_rlf(uint8_t in) {
+    return (uint8_t)((in << 1) | (in >> 7));
+}
+
+static uint8_t cfm_rrf(uint8_t in) {
+    return (uint8_t)((in >> 1) | (in << 7));
+}
+
+static uint8_t cfm_swap(uint8_t in) {
+    return (uint8_t)((in << 4) | (in >> 4));
+}
+
+typedef enum {
+    SheriffCfmModelZX750 = 0,
+    SheriffCfmModelZX930 = 1,
+    SheriffCfmModelCount = 2,
+} SheriffCfmModel;
+
+static const char* cfm_model_name(SheriffCfmModel model) {
+    switch(model) {
+    case SheriffCfmModelZX750: return "ZX-750";
+    case SheriffCfmModelZX930: return "ZX-930";
+    default: return "?";
+    }
+}
+
+static void cfm_decrypt_transform(uint8_t* hop, SheriffCfmModel model) {
+    uint8_t temp;
+    switch(model) {
+    case SheriffCfmModelZX750:
+        hop[0] = cfm_swap(hop[0]);
+        hop[2] = cfm_swap(hop[2]);
+        break;
+
+    case SheriffCfmModelZX930:
+        hop[0] = ~hop[0];
+        temp = hop[1];
+        hop[1] = hop[2];
+        hop[2] = temp;
+        hop[0] = cfm_rrf(hop[0]);
+        hop[1] = cfm_swap(hop[1]);
+        hop[1] = cfm_rlf(hop[1]);
+        hop[1] = cfm_rlf(hop[1]);
+        break;
+
+    default:
+        break;
+    }
+}
+
+static void cfm_encrypt_transform(uint8_t* hop, SheriffCfmModel model) {
+    uint8_t temp;
+    switch(model) {
+    case SheriffCfmModelZX750:
+        hop[0] = cfm_swap(hop[0]);
+        hop[2] = cfm_swap(hop[2]);
+        break;
+
+    case SheriffCfmModelZX930:
+        hop[1] = cfm_rrf(hop[1]);
+        hop[1] = cfm_rrf(hop[1]);
+        hop[1] = cfm_swap(hop[1]);
+        hop[0] = cfm_rlf(hop[0]);
+        hop[0] = ~hop[0];
+        temp = hop[1];
+        hop[1] = hop[2];
+        hop[2] = temp;
+        break;
+
+    default:
+        break;
+    }
+}
+
+static const char* cfm_btn_name(uint8_t btn) {
+    switch(btn) {
+    case 0x10: return "Lock";
+    case 0x20: return "Unlock";
+    case 0x40: return "Trunk";
+    case 0x80: return "Panic";
+    default: return "?";
+    }
+}
+
+static uint8_t cfm_btn_to_custom(uint8_t btn) {
+    switch(btn) {
+    case 0x10: return SUBGHZ_CUSTOM_BTN_UP;
+    case 0x20: return SUBGHZ_CUSTOM_BTN_DOWN;
+    case 0x40: return SUBGHZ_CUSTOM_BTN_LEFT;
+    case 0x80: return SUBGHZ_CUSTOM_BTN_RIGHT;
+    default: return SUBGHZ_CUSTOM_BTN_OK;
+    }
+}
+
+static uint8_t cfm_custom_to_btn(uint8_t custom, uint8_t original_btn) {
+    if(custom == SUBGHZ_CUSTOM_BTN_OK) return original_btn;
+    if(custom == SUBGHZ_CUSTOM_BTN_UP) return 0x10;
+    if(custom == SUBGHZ_CUSTOM_BTN_DOWN) return 0x20;
+    if(custom == SUBGHZ_CUSTOM_BTN_LEFT) return 0x40;
+    if(custom == SUBGHZ_CUSTOM_BTN_RIGHT) return 0x80;
+    return original_btn;
+}
+
+static uint8_t cfm_get_btn_code(uint8_t original_btn) {
+    return cfm_custom_to_btn(subghz_custom_btn_get(), original_btn);
+}
+
+static const SubGhzBlockConst subghz_protocol_sheriff_cfm_const = {
+    .te_short = 400,
+    .te_long = 800,
+    .te_delta = 140,
+    .min_count_bit_for_found = 64,
+};
+
+struct SubGhzProtocolDecoderSheriffCfm {
+    SubGhzProtocolDecoderBase base;
+    SubGhzBlockDecoder decoder;
+    SubGhzBlockGeneric generic;
+    uint16_t header_count;
+    SheriffCfmModel model;
+};
+
+struct SubGhzProtocolEncoderSheriffCfm {
+    SubGhzProtocolEncoderBase base;
+    SubGhzProtocolBlockEncoder encoder;
+    SubGhzBlockGeneric generic;
+    SheriffCfmModel model;
+};
+
+typedef enum {
+    SheriffCfmDecoderStepReset = 0,
+    SheriffCfmDecoderStepCheckPreambula,
+    SheriffCfmDecoderStepSaveDuration,
+    SheriffCfmDecoderStepCheckDuration,
+} SheriffCfmDecoderStep;
+
+const SubGhzProtocolDecoder subghz_protocol_sheriff_cfm_decoder = {
+    .alloc = subghz_protocol_decoder_sheriff_cfm_alloc,
+    .free = subghz_protocol_decoder_sheriff_cfm_free,
+    .feed = subghz_protocol_decoder_sheriff_cfm_feed,
+    .reset = subghz_protocol_decoder_sheriff_cfm_reset,
+    .get_hash_data = subghz_protocol_decoder_sheriff_cfm_get_hash_data,
+    .serialize = subghz_protocol_decoder_sheriff_cfm_serialize,
+    .deserialize = subghz_protocol_decoder_sheriff_cfm_deserialize,
+    .get_string = subghz_protocol_decoder_sheriff_cfm_get_string,
+};
+
+const SubGhzProtocolEncoder subghz_protocol_sheriff_cfm_encoder = {
+    .alloc = subghz_protocol_encoder_sheriff_cfm_alloc,
+    .free = subghz_protocol_encoder_sheriff_cfm_free,
+    .deserialize = subghz_protocol_encoder_sheriff_cfm_deserialize,
+    .stop = subghz_protocol_encoder_sheriff_cfm_stop,
+    .yield = subghz_protocol_encoder_sheriff_cfm_yield,
+};
+
+const SubGhzProtocol subghz_protocol_sheriff_cfm = {
+    .name = SUBGHZ_PROTOCOL_SHERIFF_CFM_NAME,
+    .type = SubGhzProtocolTypeDynamic,
+    .flag = SubGhzProtocolFlag_433 | SubGhzProtocolFlag_AM |
+            SubGhzProtocolFlag_Decodable |
+            SubGhzProtocolFlag_Load | SubGhzProtocolFlag_Save | SubGhzProtocolFlag_Send,
+    .decoder = &subghz_protocol_sheriff_cfm_decoder,
+    .encoder = &subghz_protocol_sheriff_cfm_encoder,
+};
+
+static uint64_t cfm_get_mfkey(SheriffCfmModel model) {
+    uint8_t dkey[8];
+    switch(model) {
+    case SheriffCfmModelZX750:
+        cfm_pi_decode(dkey, cfm_zx750_encoded, 0, 8);
+        break;
+    case SheriffCfmModelZX930:
+        cfm_pi_decode(dkey, cfm_zx930_encoded, 8, 8);
+        break;
+    default:
+        return 0;
+    }
+    uint64_t key = 0;
+    for(int i = 7; i >= 0; i--) {
+        key = (key << 8) | dkey[i];
+    }
+    return key;
+}
+
+static bool cfm_try_decrypt(
+    uint64_t data,
+    SheriffCfmModel* out_model,
+    uint8_t* out_btn,
+    uint32_t* out_serial,
+    uint16_t* out_cnt) {
+
+    uint32_t hop_encrypted = (uint32_t)(data & 0xFFFFFFFF);
+    uint32_t fix = (uint32_t)(data >> 32);
+
+    for(SheriffCfmModel model = 0; model < SheriffCfmModelCount; model++) {
+        uint8_t hop_bytes[4];
+        hop_bytes[0] = (uint8_t)(hop_encrypted & 0xFF);
+        hop_bytes[1] = (uint8_t)((hop_encrypted >> 8) & 0xFF);
+        hop_bytes[2] = (uint8_t)((hop_encrypted >> 16) & 0xFF);
+        hop_bytes[3] = (uint8_t)((hop_encrypted >> 24) & 0xFF);
+
+        cfm_decrypt_transform(hop_bytes, model);
+
+        uint32_t hop_transformed =
+            (uint32_t)hop_bytes[0] |
+            ((uint32_t)hop_bytes[1] << 8) |
+            ((uint32_t)hop_bytes[2] << 16) |
+            ((uint32_t)hop_bytes[3] << 24);
+
+        uint64_t mfkey = cfm_get_mfkey(model);
+        uint32_t decrypted = subghz_protocol_keeloq_common_decrypt(hop_transformed, mfkey);
+
+        uint16_t dec_serial_lo = (uint16_t)((decrypted >> 16) & 0x3FF);
+        uint16_t fix_serial_lo = (uint16_t)(fix & 0x3FF);
+
+        uint8_t btn_byte = (uint8_t)((decrypted >> 24) & 0xFF);
+        bool valid_btn = (btn_byte == 0x10 || btn_byte == 0x20 ||
+                          btn_byte == 0x40 || btn_byte == 0x80);
+
+        if(valid_btn && (dec_serial_lo == fix_serial_lo)) {
+            *out_model = model;
+            *out_btn = btn_byte;
+            *out_serial = fix;
+            *out_cnt = (uint16_t)(decrypted & 0xFFFF);
+            return true;
+        }
+    }
+    return false;
+}
+
+void* subghz_protocol_encoder_sheriff_cfm_alloc(SubGhzEnvironment* environment) {
+    UNUSED(environment);
+    SubGhzProtocolEncoderSheriffCfm* instance = malloc(sizeof(SubGhzProtocolEncoderSheriffCfm));
+    instance->base.protocol = &subghz_protocol_sheriff_cfm;
+    instance->generic.protocol_name = instance->base.protocol->name;
+    instance->encoder.repeat = 3;
+    instance->encoder.size_upload = 256;
+    instance->encoder.upload = malloc(instance->encoder.size_upload * sizeof(LevelDuration));
+    instance->encoder.is_running = false;
+    instance->encoder.front = 0;
+    instance->model = SheriffCfmModelZX750;
+    return instance;
+}
+
+void subghz_protocol_encoder_sheriff_cfm_free(void* context) {
+    furi_check(context);
+    SubGhzProtocolEncoderSheriffCfm* instance = context;
+    free(instance->encoder.upload);
+    free(instance);
+}
+
+static bool subghz_protocol_encoder_sheriff_cfm_get_upload(
+    SubGhzProtocolEncoderSheriffCfm* instance,
+    uint8_t btn) {
+    furi_check(instance);
+
+    if((instance->generic.cnt + 1) > 0xFFFF) {
+        instance->generic.cnt = 0;
+    } else {
+        instance->generic.cnt += 1;
+    }
+
+    uint32_t fix = (uint32_t)(instance->generic.data >> 32);
+    uint16_t serial_lo = (uint16_t)(fix & 0x3FF);
+    uint32_t hop_plain =
+        ((uint32_t)btn << 24) |
+        ((uint32_t)serial_lo << 16) |
+        (instance->generic.cnt & 0xFFFF);
+
+    uint64_t mfkey = cfm_get_mfkey(instance->model);
+    uint32_t hop_encrypted = subghz_protocol_keeloq_common_encrypt(hop_plain, mfkey);
+
+    uint8_t hop_bytes[4];
+    hop_bytes[0] = (uint8_t)(hop_encrypted & 0xFF);
+    hop_bytes[1] = (uint8_t)((hop_encrypted >> 8) & 0xFF);
+    hop_bytes[2] = (uint8_t)((hop_encrypted >> 16) & 0xFF);
+    hop_bytes[3] = (uint8_t)((hop_encrypted >> 24) & 0xFF);
+    cfm_encrypt_transform(hop_bytes, instance->model);
+
+    hop_encrypted =
+        (uint32_t)hop_bytes[0] |
+        ((uint32_t)hop_bytes[1] << 8) |
+        ((uint32_t)hop_bytes[2] << 16) |
+        ((uint32_t)hop_bytes[3] << 24);
+
+    instance->generic.data = ((uint64_t)fix << 32) | hop_encrypted;
+    instance->generic.btn = btn;
+
+    size_t index = 0;
+
+    for(uint8_t i = 11; i > 0; i--) {
+        instance->encoder.upload[index++] =
+            level_duration_make(true, (uint32_t)subghz_protocol_sheriff_cfm_const.te_short);
+        instance->encoder.upload[index++] =
+            level_duration_make(false, (uint32_t)subghz_protocol_sheriff_cfm_const.te_short);
+    }
+    instance->encoder.upload[index++] =
+        level_duration_make(true, (uint32_t)subghz_protocol_sheriff_cfm_const.te_short);
+    instance->encoder.upload[index++] =
+        level_duration_make(false, (uint32_t)subghz_protocol_sheriff_cfm_const.te_short * 10);
+
+    for(uint8_t i = instance->generic.data_count_bit; i > 0; i--) {
+        if(bit_read(instance->generic.data, i - 1)) {
+            instance->encoder.upload[index++] =
+                level_duration_make(true, (uint32_t)subghz_protocol_sheriff_cfm_const.te_short);
+            instance->encoder.upload[index++] =
+                level_duration_make(false, (uint32_t)subghz_protocol_sheriff_cfm_const.te_long);
+        } else {
+            instance->encoder.upload[index++] =
+                level_duration_make(true, (uint32_t)subghz_protocol_sheriff_cfm_const.te_long);
+            instance->encoder.upload[index++] =
+                level_duration_make(false, (uint32_t)subghz_protocol_sheriff_cfm_const.te_short);
+        }
+    }
+
+    instance->encoder.upload[index++] =
+        level_duration_make(true, (uint32_t)subghz_protocol_sheriff_cfm_const.te_short);
+    instance->encoder.upload[index++] =
+        level_duration_make(false, (uint32_t)subghz_protocol_sheriff_cfm_const.te_short * 40);
+
+    instance->encoder.size_upload = index;
+    return true;
+}
+
+SubGhzProtocolStatus
+    subghz_protocol_encoder_sheriff_cfm_deserialize(void* context, FlipperFormat* flipper_format) {
+    furi_check(context);
+    SubGhzProtocolEncoderSheriffCfm* instance = context;
+    SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
+
+    do {
+        ret = subghz_block_generic_deserialize_check_count_bit(
+            &instance->generic,
+            flipper_format,
+            subghz_protocol_sheriff_cfm_const.min_count_bit_for_found);
+        if(ret != SubGhzProtocolStatusOk) break;
+
+        uint32_t model_temp = 0;
+        if(flipper_format_read_uint32(flipper_format, "Model", &model_temp, 1)) {
+            instance->model = (SheriffCfmModel)model_temp;
+        } else {
+            SheriffCfmModel detected;
+            uint8_t det_btn;
+            uint32_t det_serial;
+            uint16_t det_cnt;
+            if(cfm_try_decrypt(instance->generic.data, &detected, &det_btn, &det_serial, &det_cnt)) {
+                instance->model = detected;
+                instance->generic.btn = det_btn;
+                instance->generic.serial = det_serial;
+                instance->generic.cnt = det_cnt;
+            }
+        }
+
+        if(!flipper_format_read_uint32(
+               flipper_format, "Repeat", (uint32_t*)&instance->encoder.repeat, 1)) {
+            instance->encoder.repeat = 3;
+        }
+
+        subghz_custom_btn_set_original(cfm_btn_to_custom(instance->generic.btn));
+        subghz_custom_btn_set_max(4);
+
+        uint8_t selected_btn = cfm_get_btn_code(instance->generic.btn);
+
+        if(!subghz_protocol_encoder_sheriff_cfm_get_upload(instance, selected_btn)) {
+            break;
+        }
+
+        instance->encoder.is_running = true;
+        instance->encoder.front = 0;
+        ret = SubGhzProtocolStatusOk;
+    } while(false);
+
+    return ret;
+}
+
+void subghz_protocol_encoder_sheriff_cfm_stop(void* context) {
+    furi_check(context);
+    SubGhzProtocolEncoderSheriffCfm* instance = context;
+    instance->encoder.is_running = false;
+}
+
+LevelDuration subghz_protocol_encoder_sheriff_cfm_yield(void* context) {
+    SubGhzProtocolEncoderSheriffCfm* instance = context;
+
+    if(instance->encoder.repeat == 0 || !instance->encoder.is_running) {
+        instance->encoder.is_running = false;
+        return level_duration_reset();
+    }
+
+    LevelDuration ret = instance->encoder.upload[instance->encoder.front];
+
+    if(++instance->encoder.front == instance->encoder.size_upload) {
+        instance->encoder.repeat--;
+        instance->encoder.front = 0;
+    }
+
+    return ret;
+}
+
+void* subghz_protocol_decoder_sheriff_cfm_alloc(SubGhzEnvironment* environment) {
+    UNUSED(environment);
+    SubGhzProtocolDecoderSheriffCfm* instance = malloc(sizeof(SubGhzProtocolDecoderSheriffCfm));
+    instance->base.protocol = &subghz_protocol_sheriff_cfm;
+    instance->generic.protocol_name = instance->base.protocol->name;
+    return instance;
+}
+
+void subghz_protocol_decoder_sheriff_cfm_free(void* context) {
+    furi_check(context);
+    SubGhzProtocolDecoderSheriffCfm* instance = context;
+    free(instance);
+}
+
+void subghz_protocol_decoder_sheriff_cfm_reset(void* context) {
+    furi_check(context);
+    SubGhzProtocolDecoderSheriffCfm* instance = context;
+    instance->decoder.parser_step = SheriffCfmDecoderStepReset;
+    instance->header_count = 0;
+}
+
+void subghz_protocol_decoder_sheriff_cfm_feed(void* context, bool level, uint32_t duration) {
+    furi_check(context);
+    SubGhzProtocolDecoderSheriffCfm* instance = context;
+
+    switch(instance->decoder.parser_step) {
+    case SheriffCfmDecoderStepReset:
+        if((level) && DURATION_DIFF(duration, subghz_protocol_sheriff_cfm_const.te_short) <
+                          subghz_protocol_sheriff_cfm_const.te_delta) {
+            instance->decoder.parser_step = SheriffCfmDecoderStepCheckPreambula;
+            instance->header_count++;
+        }
+        break;
+
+    case SheriffCfmDecoderStepCheckPreambula:
+        if((!level) && (DURATION_DIFF(duration, subghz_protocol_sheriff_cfm_const.te_short) <
+                        subghz_protocol_sheriff_cfm_const.te_delta)) {
+            instance->decoder.parser_step = SheriffCfmDecoderStepReset;
+            break;
+        }
+        if((instance->header_count > 2) &&
+           (DURATION_DIFF(duration, subghz_protocol_sheriff_cfm_const.te_short * 10) <
+            subghz_protocol_sheriff_cfm_const.te_delta * 10)) {
+            instance->decoder.parser_step = SheriffCfmDecoderStepSaveDuration;
+            instance->decoder.decode_data = 0;
+            instance->decoder.decode_count_bit = 0;
+        } else {
+            instance->decoder.parser_step = SheriffCfmDecoderStepReset;
+            instance->header_count = 0;
+        }
+        break;
+
+    case SheriffCfmDecoderStepSaveDuration:
+        if(level) {
+            instance->decoder.te_last = duration;
+            instance->decoder.parser_step = SheriffCfmDecoderStepCheckDuration;
+        }
+        break;
+
+    case SheriffCfmDecoderStepCheckDuration:
+        if(!level) {
+            if(duration >= ((uint32_t)subghz_protocol_sheriff_cfm_const.te_short * 2 +
+                            subghz_protocol_sheriff_cfm_const.te_delta)) {
+                instance->decoder.parser_step = SheriffCfmDecoderStepReset;
+                if((instance->decoder.decode_count_bit >=
+                    subghz_protocol_sheriff_cfm_const.min_count_bit_for_found) &&
+                   (instance->decoder.decode_count_bit <=
+                    subghz_protocol_sheriff_cfm_const.min_count_bit_for_found + 2)) {
+                    SheriffCfmModel model;
+                    uint8_t btn;
+                    uint32_t serial;
+                    uint16_t cnt;
+                    if(cfm_try_decrypt(
+                           instance->decoder.decode_data, &model, &btn, &serial, &cnt)) {
+                        instance->generic.data = instance->decoder.decode_data;
+                        instance->generic.data_count_bit =
+                            subghz_protocol_sheriff_cfm_const.min_count_bit_for_found;
+                        instance->model = model;
+                        instance->generic.btn = btn;
+                        instance->generic.serial = serial;
+                        instance->generic.cnt = cnt;
+                        if(instance->base.callback)
+                            instance->base.callback(&instance->base, instance->base.context);
+                    }
+                }
+                instance->decoder.decode_data = 0;
+                instance->decoder.decode_count_bit = 0;
+                instance->header_count = 0;
+                break;
+            } else if(
+                (DURATION_DIFF(
+                     instance->decoder.te_last, subghz_protocol_sheriff_cfm_const.te_short) <
+                 subghz_protocol_sheriff_cfm_const.te_delta) &&
+                (DURATION_DIFF(duration, subghz_protocol_sheriff_cfm_const.te_long) <
+                 subghz_protocol_sheriff_cfm_const.te_delta * 2)) {
+                if(instance->decoder.decode_count_bit <
+                   subghz_protocol_sheriff_cfm_const.min_count_bit_for_found) {
+                    subghz_protocol_blocks_add_bit(&instance->decoder, 1);
+                } else {
+                    instance->decoder.decode_count_bit++;
+                }
+                instance->decoder.parser_step = SheriffCfmDecoderStepSaveDuration;
+            } else if(
+                (DURATION_DIFF(
+                     instance->decoder.te_last, subghz_protocol_sheriff_cfm_const.te_long) <
+                 subghz_protocol_sheriff_cfm_const.te_delta * 2) &&
+                (DURATION_DIFF(duration, subghz_protocol_sheriff_cfm_const.te_short) <
+                 subghz_protocol_sheriff_cfm_const.te_delta)) {
+                if(instance->decoder.decode_count_bit <
+                   subghz_protocol_sheriff_cfm_const.min_count_bit_for_found) {
+                    subghz_protocol_blocks_add_bit(&instance->decoder, 0);
+                } else {
+                    instance->decoder.decode_count_bit++;
+                }
+                instance->decoder.parser_step = SheriffCfmDecoderStepSaveDuration;
+            } else {
+                instance->decoder.parser_step = SheriffCfmDecoderStepReset;
+                instance->header_count = 0;
+            }
+        } else {
+            instance->decoder.parser_step = SheriffCfmDecoderStepReset;
+            instance->header_count = 0;
+        }
+        break;
+    }
+}
+
+uint8_t subghz_protocol_decoder_sheriff_cfm_get_hash_data(void* context) {
+    furi_check(context);
+    SubGhzProtocolDecoderSheriffCfm* instance = context;
+    return subghz_protocol_blocks_get_hash_data(
+        &instance->decoder, (instance->decoder.decode_count_bit / 8) + 1);
+}
+
+SubGhzProtocolStatus subghz_protocol_decoder_sheriff_cfm_serialize(
+    void* context,
+    FlipperFormat* flipper_format,
+    SubGhzRadioPreset* preset) {
+    furi_check(context);
+    SubGhzProtocolDecoderSheriffCfm* instance = context;
+    SubGhzProtocolStatus ret =
+        subghz_block_generic_serialize(&instance->generic, flipper_format, preset);
+
+    if(ret == SubGhzProtocolStatusOk) {
+        uint32_t model = (uint32_t)instance->model;
+        flipper_format_insert_or_update_uint32(flipper_format, "Model", &model, 1);
+    }
+    return ret;
+}
+
+SubGhzProtocolStatus
+    subghz_protocol_decoder_sheriff_cfm_deserialize(void* context, FlipperFormat* flipper_format) {
+    furi_check(context);
+    SubGhzProtocolDecoderSheriffCfm* instance = context;
+    SubGhzProtocolStatus ret = SubGhzProtocolStatusError;
+
+    do {
+        ret = subghz_block_generic_deserialize_check_count_bit(
+            &instance->generic,
+            flipper_format,
+            subghz_protocol_sheriff_cfm_const.min_count_bit_for_found);
+        if(ret != SubGhzProtocolStatusOk) break;
+
+        uint32_t model_temp = 0;
+        if(flipper_format_read_uint32(flipper_format, "Model", &model_temp, 1)) {
+            instance->model = (SheriffCfmModel)model_temp;
+        }
+
+        SheriffCfmModel detected;
+        uint8_t btn;
+        uint32_t serial;
+        uint16_t cnt;
+        if(cfm_try_decrypt(instance->generic.data, &detected, &btn, &serial, &cnt)) {
+            instance->model = detected;
+            instance->generic.btn = btn;
+            instance->generic.serial = serial;
+            instance->generic.cnt = cnt;
+        }
+    } while(false);
+
+    return ret;
+}
+
+void subghz_protocol_decoder_sheriff_cfm_get_string(void* context, FuriString* output) {
+    furi_check(context);
+    SubGhzProtocolDecoderSheriffCfm* instance = context;
+
+    subghz_custom_btn_set_original(cfm_btn_to_custom(instance->generic.btn));
+    subghz_custom_btn_set_max(4);
+
+    uint8_t selected_btn = cfm_get_btn_code(instance->generic.btn);
+
+    furi_string_cat_printf(
+        output,
+        "%s %dbit\r\n"
+        "Key:0x%lX%08lX\r\n"
+        "Sn:%08lX Btn:[%s]\r\n"
+        "Cnt:%04lX Model:%s\r\n",
+        instance->generic.protocol_name,
+        instance->generic.data_count_bit,
+        (uint32_t)(instance->generic.data >> 32),
+        (uint32_t)instance->generic.data,
+        instance->generic.serial,
+        cfm_btn_name(selected_btn),
+        (uint32_t)instance->generic.cnt,
+        cfm_model_name(instance->model));
+}

lib/subghz/protocols/sheriff_cfm.h

@@ -0,0 +1,43 @@
+#pragma once
+#include <furi.h>
+#include <lib/subghz/protocols/base.h>
+#include <lib/subghz/types.h>
+#include <lib/subghz/blocks/const.h>
+#include <lib/subghz/blocks/decoder.h>
+#include <lib/subghz/blocks/encoder.h>
+#include <lib/subghz/blocks/generic.h>
+#include <lib/subghz/blocks/math.h>
+#include <flipper_format/flipper_format.h>
+
+#define SUBGHZ_PROTOCOL_SHERIFF_CFM_NAME "Sheriff CFM"
+
+typedef struct SubGhzProtocolDecoderSheriffCfm SubGhzProtocolDecoderSheriffCfm;
+typedef struct SubGhzProtocolEncoderSheriffCfm SubGhzProtocolEncoderSheriffCfm;
+
+extern const SubGhzProtocolDecoder subghz_protocol_sheriff_cfm_decoder;
+extern const SubGhzProtocolEncoder subghz_protocol_sheriff_cfm_encoder;
+extern const SubGhzProtocol subghz_protocol_sheriff_cfm;
+
+void* subghz_protocol_decoder_sheriff_cfm_alloc(SubGhzEnvironment* environment);
+void subghz_protocol_decoder_sheriff_cfm_free(void* context);
+void subghz_protocol_decoder_sheriff_cfm_reset(void* context);
+void subghz_protocol_decoder_sheriff_cfm_feed(void* context, bool level, uint32_t duration);
+
+uint8_t subghz_protocol_decoder_sheriff_cfm_get_hash_data(void* context);
+
+SubGhzProtocolStatus subghz_protocol_decoder_sheriff_cfm_serialize(
+    void* context,
+    FlipperFormat* flipper_format,
+    SubGhzRadioPreset* preset);
+
+SubGhzProtocolStatus
+    subghz_protocol_decoder_sheriff_cfm_deserialize(void* context, FlipperFormat* flipper_format);
+
+void subghz_protocol_decoder_sheriff_cfm_get_string(void* context, FuriString* output);
+
+void* subghz_protocol_encoder_sheriff_cfm_alloc(SubGhzEnvironment* environment);
+void subghz_protocol_encoder_sheriff_cfm_free(void* context);
+SubGhzProtocolStatus
+    subghz_protocol_encoder_sheriff_cfm_deserialize(void* context, FlipperFormat* flipper_format);
+void subghz_protocol_encoder_sheriff_cfm_stop(void* context);
+LevelDuration subghz_protocol_encoder_sheriff_cfm_yield(void* context);

lib/subghz/protocols/star_line.c

@@ -10,33 +10,69 @@ static const char* star_line_btn_name(uint8_t btn) {
     switch(btn) {
     case 0x01: return "Lock";
     case 0x02: return "Unlock";
-    case 0x04: return "Trunk";
-    case 0x08: return "Aux";
-    default:   return "?";
+    case 0x03: return "Trunk";
+    case 0x04: return "Panic";
+    case 0x21: return "Lock";
+    case 0x22: return "Unlock";
+    case 0x23: return "Trunk";
+    case 0x24: return "Start";
+    case 0x25: return "Stop";
+    case 0x26: return "Extra";
+    default:   return "Unknown";
     }
 }
 
 static uint8_t star_line_btn_to_custom(uint8_t btn) {
     switch(btn) {
-    case 0x01: return SUBGHZ_CUSTOM_BTN_UP;
-    case 0x02: return SUBGHZ_CUSTOM_BTN_DOWN;
-    case 0x04: return SUBGHZ_CUSTOM_BTN_LEFT;
-    case 0x08: return SUBGHZ_CUSTOM_BTN_RIGHT;
+    case 0x01:
+    case 0x21: return SUBGHZ_CUSTOM_BTN_UP;      // 1 = Lock
+    case 0x02:
+    case 0x22: return SUBGHZ_CUSTOM_BTN_DOWN;    // 2 = Unlock
+    case 0x03:
+    case 0x23: return SUBGHZ_CUSTOM_BTN_LEFT;    // 3 = Trunk
+    case 0x04:
+    case 0x24: return SUBGHZ_CUSTOM_BTN_RIGHT;   // 4 = Start/Panic
     default:   return SUBGHZ_CUSTOM_BTN_OK;
     }
 }
 
 static uint8_t star_line_custom_to_btn(uint8_t custom, uint8_t original_btn) {
-    if(custom == SUBGHZ_CUSTOM_BTN_OK)    return original_btn;
-    if(custom == SUBGHZ_CUSTOM_BTN_UP)    return 0x01;
-    if(custom == SUBGHZ_CUSTOM_BTN_DOWN)  return 0x02;
-    if(custom == SUBGHZ_CUSTOM_BTN_LEFT)  return 0x04;
-    if(custom == SUBGHZ_CUSTOM_BTN_RIGHT) return 0x08;
-    return original_btn;
+    if(custom == SUBGHZ_CUSTOM_BTN_OK) return original_btn;
+
+    bool is_twage = (original_btn & 0x20) != 0;
+
+    switch(custom) {
+    case SUBGHZ_CUSTOM_BTN_UP:    return is_twage ? 0x21 : 0x01;  // Lock
+    case SUBGHZ_CUSTOM_BTN_DOWN:  return is_twage ? 0x22 : 0x02;  // Unlock
+    case SUBGHZ_CUSTOM_BTN_LEFT:  return is_twage ? 0x23 : 0x03;  // Trunk
+    case SUBGHZ_CUSTOM_BTN_RIGHT: return is_twage ? 0x24 : 0x04;  // Start/Panic
+    default: return original_btn;
+    }
 }
 
+//static uint8_t star_line_get_btn_code(uint8_t original_btn) {
+//    uint8_t custom = subghz_custom_btn_get();
+//    if(custom == SUBGHZ_CUSTOM_BTN_OK) return original_btn;
+//    return star_line_custom_to_btn(custom, original_btn);
+//}
+
 static uint8_t star_line_get_btn_code(uint8_t original_btn) {
     uint8_t custom = subghz_custom_btn_get();
+    bool is_twage = (original_btn & 0x20) != 0;
+
+    if(subghz_custom_btn_get_long()) {
+        subghz_custom_btn_set_long(false);
+
+        switch(custom) {
+        case SUBGHZ_CUSTOM_BTN_UP:    return is_twage ? 0x25 : 0x01;  // Stop / Lock
+        case SUBGHZ_CUSTOM_BTN_DOWN:  return is_twage ? 0x26 : 0x02;  // Extra / Unlock
+        case SUBGHZ_CUSTOM_BTN_LEFT:  return is_twage ? 0x21 : 0x03;  // Lock / Trunk
+        case SUBGHZ_CUSTOM_BTN_RIGHT: return is_twage ? 0x22 : 0x04;  // Unlock / Panic
+        default: return original_btn;
+        }
+    }
+
+    if(custom == SUBGHZ_CUSTOM_BTN_OK) return original_btn;
     return star_line_custom_to_btn(custom, original_btn);
 }
 
@@ -958,6 +994,53 @@ SubGhzProtocolStatus
     return ret;
 }
 
+//void subghz_protocol_decoder_star_line_get_string(void* context, FuriString* output) {
+//    furi_check(context);
+//    SubGhzProtocolDecoderStarLine* instance = context;
+
+//    subghz_protocol_star_line_check_remote_controller(
+//        &instance->generic, instance->keystore, &instance->manufacture_name);
+
+//    subghz_custom_btn_set_original(star_line_btn_to_custom(instance->generic.btn));
+//    subghz_custom_btn_set_max(4);
+
+//    uint32_t code_found_hi = instance->generic.data >> 32;
+//    uint32_t code_found_lo = instance->generic.data & 0x00000000ffffffff;
+
+//    uint64_t code_found_reverse = subghz_protocol_blocks_reverse_key(
+//        instance->generic.data, instance->generic.data_count_bit);
+//    uint32_t code_found_reverse_hi = code_found_reverse >> 32;
+//    uint32_t code_found_reverse_lo = code_found_reverse & 0x00000000ffffffff;
+
+//    uint8_t display_btn;
+//    uint8_t custom = subghz_custom_btn_get();
+//    if(custom == SUBGHZ_CUSTOM_BTN_OK) {
+//        display_btn = instance->generic.btn;
+//    } else {
+//        display_btn = star_line_custom_to_btn(custom, instance->generic.btn);
+//    }
+
+//    furi_string_cat_printf(
+//        output,
+//        "%s %dbit\r\n"
+//        "Key:%08lX%08lX\r\n"
+//        "Fix:0x%08lX\r\n"
+//        "Hop:0x%08lX\r\n"
+//        "Btn:[%s] Cnt:%04lX\r\n",
+        //"MF:%s\r\n",
+//        instance->generic.protocol_name,
+//        instance->generic.data_count_bit,
+//        code_found_hi,
+//        code_found_lo,
+//        code_found_reverse_hi,
+//        code_found_reverse_lo,
+//        star_line_btn_name(display_btn),
+//        instance->generic.cnt);
+        //instance->manufacture_name);
+
+//}
+
+
 void subghz_protocol_decoder_star_line_get_string(void* context, FuriString* output) {
     furi_check(context);
     SubGhzProtocolDecoderStarLine* instance = context;
@@ -976,20 +1059,48 @@ void subghz_protocol_decoder_star_line_get_string(void* context, FuriString* out
     uint32_t code_found_reverse_hi = code_found_reverse >> 32;
     uint32_t code_found_reverse_lo = code_found_reverse & 0x00000000ffffffff;
 
-    furi_string_cat_printf(
-        output,
-        "%s %dbit\r\n"
-        "Key:%08lX%08lX\r\n"
-        "Fix:0x%08lX    Cnt:%04lX\r\n"
-        "Hop:0x%08lX    Btn:[%s]\r\n"
-        "MF:%s\r\n",
-        instance->generic.protocol_name,
-        instance->generic.data_count_bit,
-        code_found_hi,
-        code_found_lo,
-        code_found_reverse_hi,
-        instance->generic.cnt,
-        code_found_reverse_lo,
-        star_line_btn_name(star_line_get_btn_code(instance->generic.btn)),
-        instance->manufacture_name);
+    uint8_t display_btn;
+    uint8_t custom = subghz_custom_btn_get();
+    if(custom == SUBGHZ_CUSTOM_BTN_OK) {
+        display_btn = instance->generic.btn;
+    } else {
+        display_btn = star_line_custom_to_btn(custom, instance->generic.btn);
+    }
+
+    bool is_twage = (instance->generic.btn & 0x20) != 0;
+
+    if(is_twage) {
+        furi_string_cat_printf(
+            output,
+            "%s %dbit\r\n"
+            "Key:%08lX%08lX\r\n"
+            "Fix:0x%08lX\r\n"
+            "Hop:0x%08lX\r\n"
+            "Btn:[%s] Cnt:%04lX\r\n",
+            instance->generic.protocol_name,
+            instance->generic.data_count_bit,
+            code_found_hi,
+            code_found_lo,
+            code_found_reverse_hi,
+            code_found_reverse_lo,
+            star_line_btn_name(display_btn),
+            instance->generic.cnt);
+    } else {
+        // Classic: only 4 buttons
+        furi_string_cat_printf(
+            output,
+            "%s %dbit\r\n"
+            "Key:%08lX%08lX\r\n"
+            "Fix:0x%08lX\r\n"
+            "Hop:0x%08lX\r\n"
+            "Btn:[%s] Cnt:%04lX\r\n",
+            instance->generic.protocol_name,
+            instance->generic.data_count_bit,
+            code_found_hi,
+            code_found_lo,
+            code_found_reverse_hi,
+            code_found_reverse_lo,
+            star_line_btn_name(display_btn),
+            instance->generic.cnt);
+    }
 }

targets/f7/api_symbols.csv

@@ -1,5 +1,5 @@
 entry,status,name,type,params
-Version,+,88.0,,
+Version,+,89.0,,
 Header,+,applications/drivers/subghz/cc1101_ext/cc1101_ext_interconnect.h,,
 Header,+,applications/services/applications.h,,
 Header,+,applications/services/bt/bt_service/bt.h,,
@@ -1447,6 +1447,8 @@ Function,+,furi_hal_cortex_instructions_per_microsecond,uint32_t,
 Function,+,furi_hal_cortex_timer_get,FuriHalCortexTimer,uint32_t
 Function,+,furi_hal_cortex_timer_is_expired,_Bool,FuriHalCortexTimer
 Function,+,furi_hal_cortex_timer_wait,void,FuriHalCortexTimer
+Function,+,furi_hal_crypto_aes128_ecb_decrypt,_Bool,"const uint8_t*, const uint8_t*, uint8_t*"
+Function,+,furi_hal_crypto_aes128_ecb_encrypt,_Bool,"const uint8_t*, const uint8_t*, uint8_t*"
 Function,+,furi_hal_crypto_ctr,_Bool,"const uint8_t*, const uint8_t*, const uint8_t*, uint8_t*, size_t"
 Function,+,furi_hal_crypto_decrypt,_Bool,"const uint8_t*, uint8_t*, size_t"
 Function,+,furi_hal_crypto_enclave_ensure_key,_Bool,uint8_t
@@ -1454,8 +1456,6 @@ Function,+,furi_hal_crypto_enclave_load_key,_Bool,"uint8_t, const uint8_t*"
 Function,+,furi_hal_crypto_enclave_store_key,_Bool,"FuriHalCryptoKey*, uint8_t*"
 Function,+,furi_hal_crypto_enclave_unload_key,_Bool,uint8_t
 Function,+,furi_hal_crypto_enclave_verify,_Bool,"uint8_t*, uint8_t*"
-Function,+,furi_hal_crypto_aes128_ecb_decrypt,_Bool,"const uint8_t*, const uint8_t*, uint8_t*"
-Function,+,furi_hal_crypto_aes128_ecb_encrypt,_Bool,"const uint8_t*, const uint8_t*, uint8_t*"
 Function,+,furi_hal_crypto_encrypt,_Bool,"const uint8_t*, uint8_t*, size_t"
 Function,+,furi_hal_crypto_gcm,_Bool,"const uint8_t*, const uint8_t*, const uint8_t*, size_t, const uint8_t*, uint8_t*, size_t, uint8_t*, _Bool"
 Function,+,furi_hal_crypto_gcm_decrypt_and_verify,FuriHalCryptoGCMState,"const uint8_t*, const uint8_t*, const uint8_t*, size_t, const uint8_t*, uint8_t*, size_t, const uint8_t*"
@@ -3461,9 +3461,11 @@ Function,+,subghz_block_generic_global_counter_override_set,void,uint32_t
 Function,+,subghz_block_generic_global_reset,void,void*
 Function,+,subghz_block_generic_serialize,SubGhzProtocolStatus,"SubGhzBlockGeneric*, FlipperFormat*, SubGhzRadioPreset*"
 Function,+,subghz_custom_btn_get,uint8_t,
+Function,-,subghz_custom_btn_get_long,_Bool,
 Function,+,subghz_custom_btn_get_original,uint8_t,
 Function,+,subghz_custom_btn_is_allowed,_Bool,
 Function,+,subghz_custom_btn_set,_Bool,uint8_t
+Function,-,subghz_custom_btn_set_long,void,_Bool
 Function,+,subghz_custom_btns_reset,void,
 Function,-,subghz_device_cc1101_ext_ep,const FlipperAppPluginDescriptor*,
 Function,+,subghz_devices_begin,_Bool,const SubGhzDevice*