keeloq.c 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681
  1. #include "keeloq.h"
  2. #include "keeloq_common.h"
  3. #include "../subghz_keystore.h"
  4. #include <m-string.h>
  5. #include <m-array.h>
  6. #include "../blocks/const.h"
  7. #include "../blocks/decoder.h"
  8. #include "../blocks/encoder.h"
  9. #include "../blocks/generic.h"
  10. #include "../blocks/math.h"
  11. #define TAG "SubGhzProtocolkeeloq"
  12. static const SubGhzBlockConst subghz_protocol_keeloq_const = {
  13. .te_short = 400,
  14. .te_long = 800,
  15. .te_delta = 140,
  16. .min_count_bit_for_found = 64,
  17. };
  18. struct SubGhzProtocolDecoderKeeloq {
  19. SubGhzProtocolDecoderBase base;
  20. SubGhzBlockDecoder decoder;
  21. SubGhzBlockGeneric generic;
  22. uint16_t header_count;
  23. SubGhzKeystore* keystore;
  24. const char* manufacture_name;
  25. };
  26. struct SubGhzProtocolEncoderKeeloq {
  27. SubGhzProtocolEncoderBase base;
  28. SubGhzProtocolBlockEncoder encoder;
  29. SubGhzBlockGeneric generic;
  30. SubGhzKeystore* keystore;
  31. const char* manufacture_name;
  32. };
  33. typedef enum {
  34. KeeloqDecoderStepReset = 0,
  35. KeeloqDecoderStepCheckPreambula,
  36. KeeloqDecoderStepSaveDuration,
  37. KeeloqDecoderStepCheckDuration,
  38. } KeeloqDecoderStep;
  39. const SubGhzProtocolDecoder subghz_protocol_keeloq_decoder = {
  40. .alloc = subghz_protocol_decoder_keeloq_alloc,
  41. .free = subghz_protocol_decoder_keeloq_free,
  42. .feed = subghz_protocol_decoder_keeloq_feed,
  43. .reset = subghz_protocol_decoder_keeloq_reset,
  44. .get_hash_data = subghz_protocol_decoder_keeloq_get_hash_data,
  45. .serialize = subghz_protocol_decoder_keeloq_serialize,
  46. .deserialize = subghz_protocol_decoder_keeloq_deserialize,
  47. .get_string = subghz_protocol_decoder_keeloq_get_string,
  48. };
  49. const SubGhzProtocolEncoder subghz_protocol_keeloq_encoder = {
  50. .alloc = subghz_protocol_encoder_keeloq_alloc,
  51. .free = subghz_protocol_encoder_keeloq_free,
  52. .deserialize = subghz_protocol_encoder_keeloq_deserialize,
  53. .stop = subghz_protocol_encoder_keeloq_stop,
  54. .yield = subghz_protocol_encoder_keeloq_yield,
  55. };
  56. const SubGhzProtocol subghz_protocol_keeloq = {
  57. .name = SUBGHZ_PROTOCOL_KEELOQ_NAME,
  58. .type = SubGhzProtocolTypeDynamic,
  59. .flag = SubGhzProtocolFlag_433 | SubGhzProtocolFlag_868 | SubGhzProtocolFlag_315 |
  60. SubGhzProtocolFlag_AM | SubGhzProtocolFlag_Decodable | SubGhzProtocolFlag_Load |
  61. SubGhzProtocolFlag_Send,
  62. .decoder = &subghz_protocol_keeloq_decoder,
  63. .encoder = &subghz_protocol_keeloq_encoder,
  64. };
  65. static void subghz_protocol_keeloq_check_remote_controller(
  66. SubGhzBlockGeneric* instance,
  67. SubGhzKeystore* keystore,
  68. const char** manufacture_name);
  69. void* subghz_protocol_encoder_keeloq_alloc(SubGhzEnvironment* environment) {
  70. SubGhzProtocolEncoderKeeloq* instance = malloc(sizeof(SubGhzProtocolEncoderKeeloq));
  71. instance->base.protocol = &subghz_protocol_keeloq;
  72. instance->generic.protocol_name = instance->base.protocol->name;
  73. instance->keystore = subghz_environment_get_keystore(environment);
  74. instance->encoder.repeat = 10;
  75. instance->encoder.size_upload = 256;
  76. instance->encoder.upload = malloc(instance->encoder.size_upload * sizeof(LevelDuration));
  77. instance->encoder.is_runing = false;
  78. return instance;
  79. }
  80. void subghz_protocol_encoder_keeloq_free(void* context) {
  81. furi_assert(context);
  82. SubGhzProtocolEncoderKeeloq* instance = context;
  83. free(instance->encoder.upload);
  84. free(instance);
  85. }
  86. static bool subghz_protocol_keeloq_gen_data(SubGhzProtocolEncoderKeeloq* instance, uint8_t btn) {
  87. instance->generic.cnt++;
  88. uint32_t fix = btn << 28 | instance->generic.serial;
  89. uint32_t decrypt = btn << 28 |
  90. (instance->generic.serial & 0x3FF)
  91. << 16 | //ToDo in some protocols the discriminator is 0
  92. instance->generic.cnt;
  93. uint32_t hop = 0;
  94. uint64_t man = 0;
  95. int res = 0;
  96. for
  97. M_EACH(manufacture_code, *subghz_keystore_get_data(instance->keystore), SubGhzKeyArray_t) {
  98. res = strcmp(string_get_cstr(manufacture_code->name), instance->manufacture_name);
  99. if(res == 0) {
  100. switch(manufacture_code->type) {
  101. case KEELOQ_LEARNING_SIMPLE:
  102. //Simple Learning
  103. hop = subghz_protocol_keeloq_common_encrypt(decrypt, manufacture_code->key);
  104. break;
  105. case KEELOQ_LEARNING_NORMAL:
  106. //Simple Learning
  107. man =
  108. subghz_protocol_keeloq_common_normal_learning(fix, manufacture_code->key);
  109. hop = subghz_protocol_keeloq_common_encrypt(decrypt, man);
  110. break;
  111. case KEELOQ_LEARNING_MAGIC_XOR_TYPE_1:
  112. man = subghz_protocol_keeloq_common_magic_xor_type1_learning(
  113. instance->generic.serial, manufacture_code->key);
  114. hop = subghz_protocol_keeloq_common_encrypt(decrypt, man);
  115. break;
  116. case KEELOQ_LEARNING_UNKNOWN:
  117. hop = 0; //todo
  118. break;
  119. }
  120. break;
  121. }
  122. }
  123. if(hop) {
  124. uint64_t yek = (uint64_t)fix << 32 | hop;
  125. instance->generic.data =
  126. subghz_protocol_blocks_reverse_key(yek, instance->generic.data_count_bit);
  127. return true;
  128. } else {
  129. instance->manufacture_name = "Unknown";
  130. return false;
  131. }
  132. }
  133. bool subghz_protocol_keeloq_create_data(
  134. void* context,
  135. FlipperFormat* flipper_format,
  136. uint32_t serial,
  137. uint8_t btn,
  138. uint16_t cnt,
  139. const char* manufacture_name,
  140. uint32_t frequency,
  141. FuriHalSubGhzPreset preset) {
  142. furi_assert(context);
  143. SubGhzProtocolEncoderKeeloq* instance = context;
  144. instance->generic.serial = serial;
  145. instance->generic.cnt = cnt;
  146. instance->manufacture_name = manufacture_name;
  147. instance->generic.data_count_bit = 64;
  148. bool res = subghz_protocol_keeloq_gen_data(instance, btn);
  149. if(res) {
  150. res =
  151. subghz_block_generic_serialize(&instance->generic, flipper_format, frequency, preset);
  152. }
  153. return res;
  154. }
  155. static bool
  156. subghz_protocol_encoder_keeloq_get_upload(SubGhzProtocolEncoderKeeloq* instance, uint8_t btn) {
  157. furi_assert(instance);
  158. //gen new key
  159. if(subghz_protocol_keeloq_gen_data(instance, btn)) {
  160. //ToDo Update display data
  161. // if(instance->common.callback)
  162. // instance->common.callback((SubGhzProtocolCommon*)instance, instance->common.context);
  163. } else {
  164. return false;
  165. }
  166. size_t index = 0;
  167. size_t size_upload = 11 * 2 + 2 + (instance->generic.data_count_bit * 2) + 4;
  168. if(size_upload > instance->encoder.size_upload) {
  169. FURI_LOG_E(TAG, "Size upload exceeds allocated encoder buffer.");
  170. return false;
  171. } else {
  172. instance->encoder.size_upload = size_upload;
  173. }
  174. //Send header
  175. for(uint8_t i = 11; i > 0; i--) {
  176. instance->encoder.upload[index++] =
  177. level_duration_make(true, (uint32_t)subghz_protocol_keeloq_const.te_short);
  178. instance->encoder.upload[index++] =
  179. level_duration_make(false, (uint32_t)subghz_protocol_keeloq_const.te_short);
  180. }
  181. instance->encoder.upload[index++] =
  182. level_duration_make(true, (uint32_t)subghz_protocol_keeloq_const.te_short);
  183. instance->encoder.upload[index++] =
  184. level_duration_make(false, (uint32_t)subghz_protocol_keeloq_const.te_short * 10);
  185. //Send key data
  186. for(uint8_t i = instance->generic.data_count_bit; i > 0; i--) {
  187. if(bit_read(instance->generic.data, i - 1)) {
  188. //send bit 1
  189. instance->encoder.upload[index++] =
  190. level_duration_make(true, (uint32_t)subghz_protocol_keeloq_const.te_short);
  191. instance->encoder.upload[index++] =
  192. level_duration_make(false, (uint32_t)subghz_protocol_keeloq_const.te_long);
  193. } else {
  194. //send bit 0
  195. instance->encoder.upload[index++] =
  196. level_duration_make(true, (uint32_t)subghz_protocol_keeloq_const.te_long);
  197. instance->encoder.upload[index++] =
  198. level_duration_make(false, (uint32_t)subghz_protocol_keeloq_const.te_short);
  199. }
  200. }
  201. // +send 2 status bit
  202. instance->encoder.upload[index++] =
  203. level_duration_make(true, (uint32_t)subghz_protocol_keeloq_const.te_short);
  204. instance->encoder.upload[index++] =
  205. level_duration_make(false, (uint32_t)subghz_protocol_keeloq_const.te_long);
  206. // send end
  207. instance->encoder.upload[index++] =
  208. level_duration_make(true, (uint32_t)subghz_protocol_keeloq_const.te_short);
  209. instance->encoder.upload[index++] =
  210. level_duration_make(false, (uint32_t)subghz_protocol_keeloq_const.te_short * 40);
  211. return true;
  212. }
  213. bool subghz_protocol_encoder_keeloq_deserialize(void* context, FlipperFormat* flipper_format) {
  214. furi_assert(context);
  215. SubGhzProtocolEncoderKeeloq* instance = context;
  216. bool res = false;
  217. do {
  218. if(!subghz_block_generic_deserialize(&instance->generic, flipper_format)) {
  219. FURI_LOG_E(TAG, "Deserialize error");
  220. break;
  221. }
  222. subghz_protocol_keeloq_check_remote_controller(
  223. &instance->generic, instance->keystore, &instance->manufacture_name);
  224. if(strcmp(instance->manufacture_name, "DoorHan")) {
  225. break;
  226. }
  227. //optional parameter parameter
  228. flipper_format_read_uint32(
  229. flipper_format, "Repeat", (uint32_t*)&instance->encoder.repeat, 1);
  230. subghz_protocol_encoder_keeloq_get_upload(instance, instance->generic.btn);
  231. if(!flipper_format_rewind(flipper_format)) {
  232. FURI_LOG_E(TAG, "Rewind error");
  233. break;
  234. }
  235. uint8_t key_data[sizeof(uint64_t)] = {0};
  236. for(size_t i = 0; i < sizeof(uint64_t); i++) {
  237. key_data[sizeof(uint64_t) - i - 1] = (instance->generic.data >> i * 8) & 0xFF;
  238. }
  239. if(!flipper_format_update_hex(flipper_format, "Key", key_data, sizeof(uint64_t))) {
  240. FURI_LOG_E(TAG, "Unable to add Key");
  241. break;
  242. }
  243. instance->encoder.is_runing = true;
  244. res = true;
  245. } while(false);
  246. return res;
  247. }
  248. void subghz_protocol_encoder_keeloq_stop(void* context) {
  249. SubGhzProtocolEncoderKeeloq* instance = context;
  250. instance->encoder.is_runing = false;
  251. }
  252. LevelDuration subghz_protocol_encoder_keeloq_yield(void* context) {
  253. SubGhzProtocolEncoderKeeloq* instance = context;
  254. if(instance->encoder.repeat == 0 || !instance->encoder.is_runing) {
  255. instance->encoder.is_runing = false;
  256. return level_duration_reset();
  257. }
  258. LevelDuration ret = instance->encoder.upload[instance->encoder.front];
  259. if(++instance->encoder.front == instance->encoder.size_upload) {
  260. instance->encoder.repeat--;
  261. instance->encoder.front = 0;
  262. }
  263. return ret;
  264. }
  265. void* subghz_protocol_decoder_keeloq_alloc(SubGhzEnvironment* environment) {
  266. SubGhzProtocolDecoderKeeloq* instance = malloc(sizeof(SubGhzProtocolDecoderKeeloq));
  267. instance->base.protocol = &subghz_protocol_keeloq;
  268. instance->generic.protocol_name = instance->base.protocol->name;
  269. instance->keystore = subghz_environment_get_keystore(environment);
  270. return instance;
  271. }
  272. void subghz_protocol_decoder_keeloq_free(void* context) {
  273. furi_assert(context);
  274. SubGhzProtocolDecoderKeeloq* instance = context;
  275. free(instance);
  276. }
  277. void subghz_protocol_decoder_keeloq_reset(void* context) {
  278. furi_assert(context);
  279. SubGhzProtocolDecoderKeeloq* instance = context;
  280. instance->decoder.parser_step = KeeloqDecoderStepReset;
  281. }
  282. void subghz_protocol_decoder_keeloq_feed(void* context, bool level, uint32_t duration) {
  283. furi_assert(context);
  284. SubGhzProtocolDecoderKeeloq* instance = context;
  285. switch(instance->decoder.parser_step) {
  286. case KeeloqDecoderStepReset:
  287. if((level) && DURATION_DIFF(duration, subghz_protocol_keeloq_const.te_short) <
  288. subghz_protocol_keeloq_const.te_delta) {
  289. instance->decoder.parser_step = KeeloqDecoderStepCheckPreambula;
  290. instance->header_count++;
  291. }
  292. break;
  293. case KeeloqDecoderStepCheckPreambula:
  294. if((!level) && (DURATION_DIFF(duration, subghz_protocol_keeloq_const.te_short) <
  295. subghz_protocol_keeloq_const.te_delta)) {
  296. instance->decoder.parser_step = KeeloqDecoderStepReset;
  297. break;
  298. }
  299. if((instance->header_count > 2) &&
  300. (DURATION_DIFF(duration, subghz_protocol_keeloq_const.te_short * 10) <
  301. subghz_protocol_keeloq_const.te_delta * 10)) {
  302. // Found header
  303. instance->decoder.parser_step = KeeloqDecoderStepSaveDuration;
  304. instance->decoder.decode_data = 0;
  305. instance->decoder.decode_count_bit = 0;
  306. } else {
  307. instance->decoder.parser_step = KeeloqDecoderStepReset;
  308. instance->header_count = 0;
  309. }
  310. break;
  311. case KeeloqDecoderStepSaveDuration:
  312. if(level) {
  313. instance->decoder.te_last = duration;
  314. instance->decoder.parser_step = KeeloqDecoderStepCheckDuration;
  315. }
  316. break;
  317. case KeeloqDecoderStepCheckDuration:
  318. if(!level) {
  319. if(duration >= (subghz_protocol_keeloq_const.te_short * 2 +
  320. subghz_protocol_keeloq_const.te_delta)) {
  321. // Found end TX
  322. instance->decoder.parser_step = KeeloqDecoderStepReset;
  323. if(instance->decoder.decode_count_bit >=
  324. subghz_protocol_keeloq_const.min_count_bit_for_found) {
  325. if(instance->generic.data != instance->decoder.decode_data) {
  326. instance->generic.data = instance->decoder.decode_data;
  327. instance->generic.data_count_bit = instance->decoder.decode_count_bit;
  328. if(instance->base.callback)
  329. instance->base.callback(&instance->base, instance->base.context);
  330. }
  331. instance->decoder.decode_data = 0;
  332. instance->decoder.decode_count_bit = 0;
  333. instance->header_count = 0;
  334. }
  335. break;
  336. } else if(
  337. (DURATION_DIFF(instance->decoder.te_last, subghz_protocol_keeloq_const.te_short) <
  338. subghz_protocol_keeloq_const.te_delta) &&
  339. (DURATION_DIFF(duration, subghz_protocol_keeloq_const.te_long) <
  340. subghz_protocol_keeloq_const.te_delta)) {
  341. if(instance->decoder.decode_count_bit <
  342. subghz_protocol_keeloq_const.min_count_bit_for_found) {
  343. subghz_protocol_blocks_add_bit(&instance->decoder, 1);
  344. }
  345. instance->decoder.parser_step = KeeloqDecoderStepSaveDuration;
  346. } else if(
  347. (DURATION_DIFF(instance->decoder.te_last, subghz_protocol_keeloq_const.te_long) <
  348. subghz_protocol_keeloq_const.te_delta) &&
  349. (DURATION_DIFF(duration, subghz_protocol_keeloq_const.te_short) <
  350. subghz_protocol_keeloq_const.te_delta)) {
  351. if(instance->decoder.decode_count_bit <
  352. subghz_protocol_keeloq_const.min_count_bit_for_found) {
  353. subghz_protocol_blocks_add_bit(&instance->decoder, 0);
  354. }
  355. instance->decoder.parser_step = KeeloqDecoderStepSaveDuration;
  356. } else {
  357. instance->decoder.parser_step = KeeloqDecoderStepReset;
  358. instance->header_count = 0;
  359. }
  360. } else {
  361. instance->decoder.parser_step = KeeloqDecoderStepReset;
  362. instance->header_count = 0;
  363. }
  364. break;
  365. }
  366. }
  367. static inline bool subghz_protocol_keeloq_check_decrypt(
  368. SubGhzBlockGeneric* instance,
  369. uint32_t decrypt,
  370. uint8_t btn,
  371. uint32_t end_serial) {
  372. furi_assert(instance);
  373. if((decrypt >> 28 == btn) && (((((uint16_t)(decrypt >> 16)) & 0xFF) == end_serial) ||
  374. ((((uint16_t)(decrypt >> 16)) & 0xFF) == 0))) {
  375. instance->cnt = decrypt & 0x0000FFFF;
  376. return true;
  377. }
  378. return false;
  379. }
  380. /** Checking the accepted code against the database manafacture key
  381. *
  382. * @param instance SubGhzProtocolKeeloq instance
  383. * @param fix fix part of the parcel
  384. * @param hop hop encrypted part of the parcel
  385. * @return true on successful search
  386. */
  387. static uint8_t subghz_protocol_keeloq_check_remote_controller_selector(
  388. SubGhzBlockGeneric* instance,
  389. uint32_t fix,
  390. uint32_t hop,
  391. SubGhzKeystore* keystore,
  392. const char** manufacture_name) {
  393. // protocol HCS300 uses 10 bits in discriminator, HCS200 uses 8 bits, for backward compatibility, we are looking for the 8-bit pattern
  394. // HCS300 -> uint16_t end_serial = (uint16_t)(fix & 0x3FF);
  395. // HCS200 -> uint16_t end_serial = (uint16_t)(fix & 0xFF);
  396. uint16_t end_serial = (uint16_t)(fix & 0xFF);
  397. uint8_t btn = (uint8_t)(fix >> 28);
  398. uint32_t decrypt = 0;
  399. uint64_t man;
  400. uint32_t seed = 0;
  401. for
  402. M_EACH(manufacture_code, *subghz_keystore_get_data(keystore), SubGhzKeyArray_t) {
  403. switch(manufacture_code->type) {
  404. case KEELOQ_LEARNING_SIMPLE:
  405. // Simple Learning
  406. decrypt = subghz_protocol_keeloq_common_decrypt(hop, manufacture_code->key);
  407. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  408. *manufacture_name = string_get_cstr(manufacture_code->name);
  409. return 1;
  410. }
  411. break;
  412. case KEELOQ_LEARNING_NORMAL:
  413. // Normal Learning
  414. // https://phreakerclub.com/forum/showpost.php?p=43557&postcount=37
  415. man = subghz_protocol_keeloq_common_normal_learning(fix, manufacture_code->key);
  416. decrypt = subghz_protocol_keeloq_common_decrypt(hop, man);
  417. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  418. *manufacture_name = string_get_cstr(manufacture_code->name);
  419. return 1;
  420. }
  421. break;
  422. case KEELOQ_LEARNING_SECURE:
  423. man = subghz_protocol_keeloq_common_secure_learning(
  424. fix, seed, manufacture_code->key);
  425. decrypt = subghz_protocol_keeloq_common_decrypt(hop, man);
  426. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  427. *manufacture_name = string_get_cstr(manufacture_code->name);
  428. return 1;
  429. }
  430. break;
  431. case KEELOQ_LEARNING_MAGIC_XOR_TYPE_1:
  432. man = subghz_protocol_keeloq_common_magic_xor_type1_learning(
  433. fix, manufacture_code->key);
  434. decrypt = subghz_protocol_keeloq_common_decrypt(hop, man);
  435. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  436. *manufacture_name = string_get_cstr(manufacture_code->name);
  437. return 1;
  438. }
  439. break;
  440. case KEELOQ_LEARNING_UNKNOWN:
  441. // Simple Learning
  442. decrypt = subghz_protocol_keeloq_common_decrypt(hop, manufacture_code->key);
  443. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  444. *manufacture_name = string_get_cstr(manufacture_code->name);
  445. return 1;
  446. }
  447. // Check for mirrored man
  448. uint64_t man_rev = 0;
  449. uint64_t man_rev_byte = 0;
  450. for(uint8_t i = 0; i < 64; i += 8) {
  451. man_rev_byte = (uint8_t)(manufacture_code->key >> i);
  452. man_rev = man_rev | man_rev_byte << (56 - i);
  453. }
  454. decrypt = subghz_protocol_keeloq_common_decrypt(hop, man_rev);
  455. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  456. *manufacture_name = string_get_cstr(manufacture_code->name);
  457. return 1;
  458. }
  459. //###########################
  460. // Normal Learning
  461. // https://phreakerclub.com/forum/showpost.php?p=43557&postcount=37
  462. man = subghz_protocol_keeloq_common_normal_learning(fix, manufacture_code->key);
  463. decrypt = subghz_protocol_keeloq_common_decrypt(hop, man);
  464. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  465. *manufacture_name = string_get_cstr(manufacture_code->name);
  466. return 1;
  467. }
  468. // Check for mirrored man
  469. man = subghz_protocol_keeloq_common_normal_learning(fix, man_rev);
  470. decrypt = subghz_protocol_keeloq_common_decrypt(hop, man);
  471. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  472. *manufacture_name = string_get_cstr(manufacture_code->name);
  473. return 1;
  474. }
  475. // Secure Learning
  476. man = subghz_protocol_keeloq_common_secure_learning(
  477. fix, seed, manufacture_code->key);
  478. decrypt = subghz_protocol_keeloq_common_decrypt(hop, man);
  479. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  480. *manufacture_name = string_get_cstr(manufacture_code->name);
  481. return 1;
  482. }
  483. // Check for mirrored man
  484. man = subghz_protocol_keeloq_common_secure_learning(fix, seed, man_rev);
  485. decrypt = subghz_protocol_keeloq_common_decrypt(hop, man);
  486. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  487. *manufacture_name = string_get_cstr(manufacture_code->name);
  488. return 1;
  489. }
  490. // Magic xor type1 learning
  491. man = subghz_protocol_keeloq_common_magic_xor_type1_learning(
  492. fix, manufacture_code->key);
  493. decrypt = subghz_protocol_keeloq_common_decrypt(hop, man);
  494. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  495. *manufacture_name = string_get_cstr(manufacture_code->name);
  496. return 1;
  497. }
  498. // Check for mirrored man
  499. man = subghz_protocol_keeloq_common_magic_xor_type1_learning(fix, man_rev);
  500. decrypt = subghz_protocol_keeloq_common_decrypt(hop, man);
  501. if(subghz_protocol_keeloq_check_decrypt(instance, decrypt, btn, end_serial)) {
  502. *manufacture_name = string_get_cstr(manufacture_code->name);
  503. return 1;
  504. }
  505. break;
  506. }
  507. }
  508. *manufacture_name = "Unknown";
  509. instance->cnt = 0;
  510. return 0;
  511. }
  512. /** Analysis of received data
  513. *
  514. * @param instance SubGhzProtocolKeeloq instance
  515. */
  516. static void subghz_protocol_keeloq_check_remote_controller(
  517. SubGhzBlockGeneric* instance,
  518. SubGhzKeystore* keystore,
  519. const char** manufacture_name) {
  520. uint64_t key = subghz_protocol_blocks_reverse_key(instance->data, instance->data_count_bit);
  521. uint32_t key_fix = key >> 32;
  522. uint32_t key_hop = key & 0x00000000ffffffff;
  523. // Check key AN-Motors
  524. if((key_hop >> 24) == ((key_hop >> 16) & 0x00ff) &&
  525. (key_fix >> 28) == ((key_hop >> 12) & 0x0f) && (key_hop & 0xFFF) == 0x404) {
  526. *manufacture_name = "AN-Motors";
  527. instance->cnt = key_hop >> 16;
  528. } else if((key_hop & 0xFFF) == (0x000) && (key_fix >> 28) == ((key_hop >> 12) & 0x0f)) {
  529. *manufacture_name = "HCS101";
  530. instance->cnt = key_hop >> 16;
  531. } else {
  532. subghz_protocol_keeloq_check_remote_controller_selector(
  533. instance, key_fix, key_hop, keystore, manufacture_name);
  534. }
  535. instance->serial = key_fix & 0x0FFFFFFF;
  536. instance->btn = key_fix >> 28;
  537. }
  538. uint8_t subghz_protocol_decoder_keeloq_get_hash_data(void* context) {
  539. furi_assert(context);
  540. SubGhzProtocolDecoderKeeloq* instance = context;
  541. return subghz_protocol_blocks_get_hash_data(
  542. &instance->decoder, (instance->decoder.decode_count_bit / 8) + 1);
  543. }
  544. bool subghz_protocol_decoder_keeloq_serialize(
  545. void* context,
  546. FlipperFormat* flipper_format,
  547. uint32_t frequency,
  548. FuriHalSubGhzPreset preset) {
  549. furi_assert(context);
  550. SubGhzProtocolDecoderKeeloq* instance = context;
  551. subghz_protocol_keeloq_check_remote_controller(
  552. &instance->generic, instance->keystore, &instance->manufacture_name);
  553. bool res =
  554. subghz_block_generic_serialize(&instance->generic, flipper_format, frequency, preset);
  555. if(res && !flipper_format_write_string_cstr(
  556. flipper_format, "Manufacture", instance->manufacture_name)) {
  557. FURI_LOG_E(TAG, "Unable to add manufacture name");
  558. res = false;
  559. }
  560. return res;
  561. }
  562. bool subghz_protocol_decoder_keeloq_deserialize(void* context, FlipperFormat* flipper_format) {
  563. furi_assert(context);
  564. SubGhzProtocolDecoderKeeloq* instance = context;
  565. bool res = false;
  566. do {
  567. if(!subghz_block_generic_deserialize(&instance->generic, flipper_format)) {
  568. FURI_LOG_E(TAG, "Deserialize error");
  569. break;
  570. }
  571. res = true;
  572. } while(false);
  573. return res;
  574. }
  575. void subghz_protocol_decoder_keeloq_get_string(void* context, string_t output) {
  576. furi_assert(context);
  577. SubGhzProtocolDecoderKeeloq* instance = context;
  578. subghz_protocol_keeloq_check_remote_controller(
  579. &instance->generic, instance->keystore, &instance->manufacture_name);
  580. uint32_t code_found_hi = instance->generic.data >> 32;
  581. uint32_t code_found_lo = instance->generic.data & 0x00000000ffffffff;
  582. uint64_t code_found_reverse = subghz_protocol_blocks_reverse_key(
  583. instance->generic.data, instance->generic.data_count_bit);
  584. uint32_t code_found_reverse_hi = code_found_reverse >> 32;
  585. uint32_t code_found_reverse_lo = code_found_reverse & 0x00000000ffffffff;
  586. string_cat_printf(
  587. output,
  588. "%s %dbit\r\n"
  589. "Key:%08lX%08lX\r\n"
  590. "Fix:0x%08lX Cnt:%04X\r\n"
  591. "Hop:0x%08lX Btn:%01lX\r\n"
  592. "MF:%s\r\n"
  593. "Sn:0x%07lX \r\n",
  594. instance->generic.protocol_name,
  595. instance->generic.data_count_bit,
  596. code_found_hi,
  597. code_found_lo,
  598. code_found_reverse_hi,
  599. instance->generic.cnt,
  600. code_found_reverse_lo,
  601. instance->generic.btn,
  602. instance->manufacture_name,
  603. instance->generic.serial);
  604. }