KAT — Keyfob Analysis Toolkit

Terminal-based RF signal analysis for automotive keyfobs

View the Project on GitHub KaraZajac/KAT

Kia V0 Protocol

Rust module: src/protocols/kia_v0.rs
Reference: REFERENCES/ProtoPirate/protocols/kia_v0.c

Overview

Kia V0 is a PWM keyfob protocol: short pulse = 0, long pulse = 1. No Manchester encoding. 61 bits per frame (1 sync bit + 60 data bits). CRC8 over bits 8–55; polynomial 0x7F, init 0x00.

Timing

Parameter Value Notes
Short (0) 250 µs ±100 µs (te_delta)
Long (1) 500 µs ±100 µs
Min bits 61  

Frame Layout (61 bits)

Decoder Steps

  1. Reset — Wait for short HIGH (250 µs ±100).
  2. CheckPreamble — Count preamble: alternating short pulses; on LOW, if short–short pair then header_count++; if long–long and header_count > 15 → go to SaveDuration, add first bit 1.
  3. SaveDuration — On HIGH: if duration ≥ 500 + 200 µs (end marker), check decode_count_bit == 61 and return decode; else store duration and go to CheckDuration. On LOW → Reset.
  4. CheckDuration — On LOW: short–short → add bit 0, back to SaveDuration; long–long → add bit 1, back to SaveDuration; else Reset.

Encoder

Frequencies

433.92 MHz.