Porsche Touareg Protocol

Rust module: src/protocols/porsche_touareg.rs Reference: REFERENCES/ProtoPirate/protocols/porsche_touareg.c

Overview

Porsche Touareg uses PWM encoding with very long timing (1680/3370 us). 64-bit frame with a sync preamble (at least 15 sync pulses at 3370 us). Counter is recovered via brute-force using a 24-bit rotation cipher. Originally designed for the Porsche Cayenne.

Timing

Parameter	Value	Notes
Short	1680 us	+/-500 us
Long	3370 us	+/-500 us
Sync	3370 us	Same as long
Gap	5930 us	+/-500 us
Sync min	15 pulses
Min bits	64

PWM Bit Encoding

Pair (LOW, HIGH)	Bit
Short LOW + Long HIGH	0
Long LOW + Short HIGH	1

Frame Layout (64 bits = 8 bytes)

Byte	Content
pkt[0]	(button « 4) | (frame_type & 0x07)
pkt[1]	serial bits [23:16]
pkt[2]	serial bits [15:8]
pkt[3]	serial bits [7:0]
pkt[4..7]	Encrypted counter/rolling code

• Serial: 24 bits from pkt[1..3]
• Button: 4 bits (pkt[0] » 4)
• Frame type: 3 bits (pkt[0] & 0x07): 0x02=First, 0x01=Cont, 0x04=Final

Counter Recovery (Brute-Force)

Counter is not in plaintext. The decoder tries counter values 1-256, calling compute_frame() for each, and checks if computed bytes [4..7] match received bytes [4..7].

Compute Frame Algorithm (24-bit Rotate Cipher)

1. Initialize 24-bit rotate register from serial bytes: r_h=b3, r_m=b1, r_l=b2.
2. ROTATE24: circular left shift across 3 bytes (h<-m, m<-l, l<-h).
3. Rotate 4 times + counter_low more times.
4. Compute encrypted bytes a9a/a9b/a9c from rotated values XOR’d with inverted counter bits.
5. Assemble pkt[4..7] using bitfield packing.

Decoder Steps

1. Reset – Wait for LOW pulse matching sync (3370 us).
2. Sync – Count sync pulses (both HIGH and LOW). When count >= 15 and gap detected (5930 us), transition to GapHigh or GapLow.
3. GapHigh – Expect HIGH gap (5930 us); init data on match.
4. GapLow – Expect LOW gap (5930 us); init data on match.
5. Data – Decode bit pairs (LOW saved, HIGH completes). At 64 bits, parse data and brute-force counter.

Encoder

Not supported (decode-only).

Frequencies

433.92 MHz, 868.35 MHz.