Flipper-ARF: Automotive Research Firmware

May 18, 2026 · View on GitHub

Overview

Flipper-ARF is an independently developed firmware fork for Flipper Zero, based on Unleashed Firmware but heavily modified. Unlike standard firmware builds, it removes typical general-purpose functions and focuses exclusively on automotive research and experimentation.

The goal of this firmware is to provide a high-compatibility, protocol-focused build for personal use, academic study, and responsible security research. It focuses on automotive remote protocols, rolling code behavior, and keyfob ecosystem compatibility.

This project may incorporate, adapt, or build upon other open-source projects in accordance with their licenses, with proper attribution.

Table of Contents

Showcase

HomeSub-GHz Scanner
Home ScreenSub-GHz Scanner
Keeloq Key ManagerMod Hopping
Keeloq Key ManagerMod Hopping Config
PSA DecryptCounter BruteForce
PSA XTEA DecryptCounter BruteForce
Custom Emulation SettingsCustom Emulation Scene
Custom Emulation SettingsCustom Emulation Scene

Supported Systems

Automotive Protocols

ManufacturerProtocolFrequencyModulationEncoderDecoderCRC
VAG (VW/Audi/Skoda/Seat)VAG GROUP433 MHzAMYesYesNo
PorschePorsche AG433/868 MHzAMYesYesNo
PSA (Peugeot/Citroën/DS)PSA GROUP433 MHzAM/FMYesYesYes
FordFord V0315/433 MHzAMYesYesYes
FordFord V1315/433 MHzFMYesYesYes
FiatFiat SpA433 MHzAMYesYesYes
FiatMarelli/Delphi433 MHzAMNoYesYes
Renault (old models)Marelli433 MHzAMNoYesNo
MazdaSiemens (5WK49365D)315/433 MHzAM/FMYesYesYes
Kia/HyundaiKIA/HYU V0433 MHzFMYesYesYes
Kia/HyundaiKIA/HYU V1315/433 MHzAMYesYesYes
Kia/HyundaiKIA/HYU V2315/433 MHzAM/FMYesYesYes
Kia/HyundaiKIA/HYU V3/V4315/433 MHzAM/FMYesYesYes
Kia/HyundaiKIA/HYU V5433 MHzFMYesYesYes
Kia/HyundaiKIA/HYU V6433 MHzFMYesYesYes
Kia/HyundaiKIA V7433 MHzFMYesYesYes
SubaruSubaru433 MHzAMYesYesNo
SuzukiSuzuki433 MHzFMYesYesYes
MitsubishiMitsubishi V0868 MHzFMYesYesNo
HondaHonda Type A/B433 MHzFM (custom)YesYesNo
StarlineStar Line433 MHzAMYesYesNo
Scher-KhanScher-Khan433 MHzFMYesYesNo
Scher-KhanMagic Code PRO1/PRO2433 MHzFMYesYesYes
SheriffSheriff CFM (ZX-750/930)433 MHzAMYesYesNo
Chrysler/Dodge/JeepFOBIK GQ43VT315/433 MHzAMYesYesNo
HondaHonda Static433 MHzAMYesYesNo

Gate / Access Protocols

ProtocolFrequencyModulationEncoderDecoderCRC
Keeloq433/868/315 MHzAMYesYesNo
Nice FLO433 MHzAMYesYesNo
Nice FloR-S433 MHzAMYesYesYes
CAME433/315 MHzAMYesYesNo
CAME TWEE433 MHzAMYesYesNo
CAME Atomo433 MHzAMYesYesNo
Faac SLH433/868 MHzAMYesYesNo
Holtek433 MHzAMYesYesNo
Holtek-Ht12x433 MHzAMYesYesNo
Somfy Telis433 MHzAMYesYesYes
Somfy Keytis433 MHzAMYesYesYes
Alutech AT-4N433 MHzAMYesYesYes
Keyfinder433 MHzAMYesYesNo
KingGates Stylo4k433 MHzAMYesYesNo
Beninca ARC433 MHzAMYesYesNo
Hormann HSM433/868 MHzAMYesYesNo
Marantec433 MHzAMYesYesYes
Marantec24433 MHzAMYesYesYes

General Protocols

ProtocolFrequencyModulationEncoderDecoderCRC
Princeton433/315 MHzAMYesYesNo
Linear315 MHzAMYesYesNo
LinearDelta3315 MHzAMYesYesNo
GateTX433 MHzAMYesYesNo
Security+ 1.0315 MHzAMYesYesNo
Security+ 2.0315 MHzAMYesYesNo
Chamberlain Code315 MHzAMYesYesNo
MegaCode315 MHzAMYesYesNo
Mastercode433 MHzAMYesYesNo
Dickert MAHS433 MHzAMYesYesNo
SMC5326433 MHzAMYesYesNo
Phoenix V2433 MHzAMYesYesNo
Doitrand433 MHzAMYesYesNo
Hay21433 MHzAMYesYesNo
Revers RB2433 MHzAMYesYesNo
Roger433 MHzAMYesYesNo

How to Build

Compact release build:

To build:

./fbt COMPACT=1 DEBUG=0 updater_package

To flash:

./fbt COMPACT=1 DEBUG=0 flash_usb_full

Project Scope

Flipper-ARF aims to achieve:

  • Maximum compatibility with automotive Sub-GHz rolling and static protocols
  • Accurate OEM-style remote emulation
  • Stable encoder/decoder implementations
  • Modular protocol expansion

Primary focus: Automotives/Alarm's keyfob protocols, keeloq, and keyless systems.

⚠ This is a protocol-focused research firmware, not a general-purpose firmware.

To Do / Planned Features

  • Marelli BSI encoder and encryption
  • Improve RollJam app
  • Expand and refine as many manufacturer protocols as possible

Design Philosophy

Flipper-ARF is built around:

  • Clean and accurate protocol implementation
  • Controlled rolling counter handling
  • Automotive-specific encoder accuracy
  • Minimal UI changes
  • Stability over feature bloat

All modifications remain compatible with the Flipper Zero open-source API structure where possible.

Research Direction

Future development focuses on:

  • Rolling code synchronization behavior
  • Manufacturer-specific signal modulation quirks
  • Frame validation differences between OEM and aftermarket systems
  • Encoder stability and replay consistency

Contribution Policy

Contributions are welcome if they:

  • Improve protocol stability
  • Add automotive protocol support
  • Improve parsing/encoding reliability
  • Maintain structural and modular cleanliness

Non-automotive features are considered out-of-scope for now.

This code is a mess!

Talk is cheap, submit patches

Citations & References

The following academic publications have been invaluable to the development and understanding of the protocols implemented in this firmware.

Automotive RKE Security

  • Lock It and Still Lose It — On the (In)Security of Automotive Remote Keyless Entry Systems Flavio D. Garcia, David Oswald, Timo Kasper, Pierre Pavlidès USENIX Security 2016, pp. 929–944 DOI: 10.5555/3241094.3241166 https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_garcia.pdf

  • Clonable Key Fobs: Analyzing and Breaking RKE Protocols Roberto Gesteira-Miñarro, Gregorio López, Rafael Palacios International Journal of Information Security, Springer, May 2025, 24(3) DOI: 10.1007/s10207-025-01063-7

  • The Role of Cryptographic Techniques in Remote Keyless Entry (RKE) Systems Jananga Chiran — Sri Lanka Institute of Information Technology November 2023 DOI: 10.5281/zenodo.14677864

  • SoK: Stealing Cars Since Remote Keyless Entry Introduction and How to Defend From It Tommaso Bianchi, Alessandro Brighente, Mauro Conti, Edoardo Pavan — University of Padova / Delft University of Technology arXiv, 2025 https://arxiv.org/pdf/2505.02713

  • Security of Automotive Systems Lennert Wouters, Benedikt Gierlichs, Bart Preneel Wiley, February 2025 DOI: 10.1002/9781394351930.ch11

DST Cipher Family (DST40 / DST80)

KeeLoq Cryptanalysis

Immobiliser & Transponder Cipher Attacks

RFID & Protocol Analysis Tooling

  • A Toolbox for RFID Protocol Analysis Flavio D. Garcia IEEE International Conference on RFID, 2012 DOI: 10.1109/rfid.2012.19

Relay & Replay Attacks

Disclaimer

This project is provided solely for educational, research, and interoperability purposes.

Flipper-ARF is an independently developed firmware platform for studying and experimenting with automotive and embedded systems. It supports academic research, security experimentation, and exploration of vehicle technologies in a responsible and ethical manner.

This project may incorporate, adapt, or build upon code from other open-source projects, following their respective licenses. Proper credit is given where necessary, and all included code remains under its original license terms.

References to other publicly available firmware, technical materials, or research resources are included only for academic comparison, compatibility testing, and responsible security research. This project does not include proprietary, confidential, or closed-source code from third parties.

The maintainers and contributors of this project do not support, promote, or enable any illegal activity, including unauthorized access to devices, vehicles, systems, infrastructure, or other property.

By accessing, using, modifying, compiling, or distributing this software, you agree that:

  • You are fully responsible for your use of this code.
  • You will follow all relevant local, national, and international laws.
  • You will use this software only for lawful, ethical, and research purposes.
  • You will not use this software to harm others, breach security, or compromise property without explicit permission.

The authors, maintainers, and contributors bear no responsibility or liability for any misuse, damages, legal consequences, or violations that result from the use, modification, or distribution of this code.

THIS SOFTWARE IS PROVIDED "AS IS," WITHOUT ANY WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.

IN NO EVENT SHALL THE AUTHORS, COPYRIGHT HOLDERS, OR CONTRIBUTORS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR ITS USE.

ALL RISKS FROM THE USE OR PERFORMANCE OF THIS SOFTWARE REMAIN WITH THE USER.

Special thanks to everyone who contributes to this project:

Contributors (GitHub)

Special Thanks

whatthefxck zero-mega

Special thanks to everyone who contributed code, testing, reversing, research, ideas, captures and documentation.