D4C1-Labs / Flipper-ARF

Flipper-ARF: Automotive Research Firmware Overview **Flipper-ARF** is an independently developed firmware fork for Flipper Zero, based on **Unleashed Firmware** but heavily modified. Unlike standard firmware builds, it removes typical general-purpose functions and focuses exclusively on **automotive research and experimentation**. The goal of this firmware is to provide a **high-compatibility, protocol-focused build** for personal use, academic study, and responsible security research. It focuses on **automotive remote protocols, rolling code behavior, and keyfob ecosystem compatibility**. This project may incorporate, adapt, or build upon **other open-source projects** in accordance with their licenses, with proper attribution. --- Table of Contents • Showcase • Supported Systems • How to Build • Project Scope • To Do / Planned Features • Design Philosophy • Research Direction • Contribution Policy • Citations & References • Disclaimer --- Showcase | | | |:---:|:---:| | | | | Home Screen | Sub-GHz Scanner | | | | | Keeloq Key Manager | Mod Hopping Config | | | | | PSA XTEA Decrypt | Counter BruteForce | --- Supported Systems Automotive Protocols | Manufacturer | Protocol | Frequency | Modulation | Encoder | Decoder | CRC | |:---|:---|:---:|:---:|:---:|:---:|:---:| | VAG (VW/Audi/Skoda/Seat) | VAG GROUP | 433 MHz | AM | Yes | Yes | No | | Porsche | Cayenne | 433/868 MHz | AM | Yes | Yes | No | | PSA (Peugeot/Citroën/DS) | PSA GROUP | 433 MHz | AM/FM | Yes | Yes | Yes | | Ford | Ford V0 | 315/433 MHz | AM | Yes | Yes | Yes | | Fiat | Fiat SpA | 433 MHz | AM | Yes | Yes | Yes | | Fiat | Fiat Marelli/Delphi | 433 MHz | AM | No | Yes | No | | Subaru | Subaru | 433 MHz | AM | Yes | Yes | No | | Mazda | Siemens (5WK49365D) | 315/433 MHz | FM | Yes | Yes | Yes | | Kia/Hyundai | Kia V0 | 433 MHz | FM | Yes | Yes | Yes | | Kia/Hyundai | Kia V1 | 315/433 MHz | AM | Yes | Yes | Yes | | Kia/Hyundai | Kia V2 | 315/433 MHz | FM | Yes | Yes | Yes | | Kia/Hyundai | Kia V3/V4 | 315/433 MHz | AM/FM | Yes | Yes | Yes | | Kia/Hyundai | Kia V5 | 433 MHz | FM | Yes | Yes | Yes | | Kia/Hyundai | Kia V6 | 433 MHz | FM | Yes | Yes | Yes | | Suzuki | Suzuki | 433 MHz | FM | Yes | Yes | Yes | | Mitsubishi | Mitsubishi V0 | 868 MHz | FM | Yes | Yes | No | Gate / Access Protocols | Protocol | Frequency | Modulation | Encoder | Decoder | CRC | |:---|:---:|:---:|:---:|:---:|:---:| | Keeloq | 433/868/315 MHz | AM | Yes | Yes | No | | Nice FLO | 433 MHz | AM | Yes | Yes | No | | Nice FloR-S | 433 MHz | AM | Yes | Yes | Yes | | CAME | 433/315 MHz | AM | Yes | Yes | No | | CAME TWEE | 433 MHz | AM | Yes | Yes | No | | CAME Atomo | 433 MHz | AM | Yes | Yes | No | | Faac SLH | 433/868 MHz | AM | Yes | Yes | No | | Somfy Telis | 433 MHz | AM | Yes | Yes | Yes | | Somfy Keytis | 433 MHz | AM | Yes | Yes | Yes | | Alutech AT-4N | 433 MHz | AM | Yes | Yes | Yes | | KingGates Stylo4k | 433 MHz | AM | Yes | Yes | No | | Beninca ARC | 433 MHz | AM | Yes | Yes | No | | Hormann HSM | 433/868 MHz | AM | Yes | Yes | No | | Marantec | 433 MHz | AM | Yes | Yes | Yes | | Marantec24 | 433 MHz | AM | Yes | Yes | Yes | General Static Protocols | Protocol | Frequency | Modulation | Encoder | Decoder | CRC | |:---|:---:|:---:|:---:|:---:|:---:| | Princeton | 433/315 MHz | AM | Yes | Yes | No | | Linear | 315 MHz | AM | Yes | Yes | No | | LinearDelta3 | 315 MHz | AM | Yes | Yes | No | | GateTX | 433 MHz | AM | Yes | Yes | No | | Security+ 1.0 | 315 MHz | AM | Yes | Yes | No | | Security+ 2.0 | 315 MHz | AM | Yes | Yes | No | | Chamberlain Code | 315 MHz | AM | Yes | Yes | No | | MegaCode | 315 MHz | AM | Yes | Yes | No | | Mastercode | 433 MHz | AM | Yes | Yes | No | | Dickert MAHS | 433 MHz | AM | Yes | Yes | No | | SMC5326 | 433 MHz | AM | Yes | Yes | No | | Phoenix V2 | 433 MHz | AM | Yes | Yes | No | | Doitrand | 433 MHz | AM | Yes | Yes | No | | Hay21 | 433 MHz | AM | Yes | Yes | No | | Revers RB2 | 433 MHz | AM | Yes | Yes | No | | Roger | 433 MHz | AM | Yes | Yes | No | | BinRAW | 433/315/868 MHz | AM/FM | Yes | Yes | No | | RAW | All | All | Yes | Yes | No | --- How to Build Compact release build: --- Project Scope Flipper-ARF aims to achieve: • Maximum compatibility with automotive Sub-GHz rolling and static protocols • Accurate OEM-style remote emulation • Stable encoder/decoder implementations • Modular protocol expansion **Primary focus:** VAG, PSA, Fiat, Ford, Asian platforms, and aftermarket alarm systems. > ⚠ This is a protocol-focused research firmware, not a general-purpose firmware. --- To Do / Planned Features • [ ] Add Scher Khan & Starline protocols • [ ] Marelli BSI encoder and encryption • [ ] Improve RollJam app • [ ] Expand and refine Subaru, Kia, PSA, and other manufacturer protocols --- Design Philosophy Flipper-ARF is built around: • Clean and accurate protocol implementation • Controlled rolling counter handling • Automotive-specific encoder accuracy • Minimal UI changes • Stability over feature bloat All modifications remain compatible with the **Flipper Zero open-source API structure** where possible. --- Research Direction Future development focuses on: • Rolling code synchronization behavior • Manufacturer-specific signal modulation quirks • Frame validation differences between OEM and aftermarket systems • Encoder stability and replay consistency --- Contribution Policy Contributions are welcome if they: • Improve protocol stability • Add automotive protocol support • Improve parsing/encoding reliability • Maintain structural and modular cleanliness > Non-automotive features are considered out-of-scope for now. This code is a mess! --- Citations & References The following academic publications have been invaluable to the development and understanding of the protocols implemented in this firmware. Automotive RKE Security • **Lock It and Still Lose It — On the (In)Security of Automotive Remote Keyless Entry Systems** Flavio D. Garcia, David Oswald, Timo Kasper, Pierre…