ProtoPirate reads automotive rolling codes on a Flipper Zero

A key fob analyzer built for the Flipper Zero

Automotive key fobs are a good target for radio analysis because they talk in the clear, at predictable frequencies, using modulation schemes that a cheap receiver can pick up. ProtoPirate is an experimental rolling code analysis toolkit built for the Flipper Zero by members of The Pirates' Plunder, and its goal is stated plainly: to be a drop-in Flipper app in the .fap format, free and open source, and usable on any Flipper Zero firmware.

That gives it a defined audience. Someone with a Flipper Zero and a suspicious signal on 315.00 or 433.92 MHz wants to know which family of fob produced it. Someone building a replacement fob or a garage receiver wants the encoder side. The README is explicit that the app is intended for educational and security purposes, and that signal transmission is not enabled by default, which the project frames as a safety measure: without transmission, a captured fob cannot be desynced by accident, which makes the tool usable by people who are not specialists.

The protocols named in the documentation cover Kia, Ford, Subaru, Suzuki and VW among others. The README calls the project experimental, and that word does real work here, because protocol support differs sharply between decoding and encoding.

The repository layout shows a scene based Flipper app

The source tree follows the standard shape of a Flipper application. The entry point is protopirate_app.c, paired with a header protopirate_app_i.h, alongside defines.h for shared constants. A protopirate_history.c and its header implement capture history, and the user interface is split into a scenes directory for screen logic and a views directory for widgets. The actual protocol work lives in its own protocols directory, with helper routines in helpers.

That division matters for a reader deciding whether to fork the project. Protocol knowledge is separated from the interface, so adding a decoder means working inside the protocols tree rather than touching the screens. The assets and images directories hold the radar and icon resources, application.fam describes the build target for the Flipper build system, and .clang-format plus .gitattributes show that formatting is pinned for a C codebase.

The development host is Gitea rather than GitHub, judging from the .gitea directory in the tree, and the project also points at a self-hosted site. The C sources are the whole implementation; there is no scripting layer and no companion host application in this tree.

AM and FM registries are selected by the receiver preset

Protocols are split into two registries, and the active registry is not something you pick in a menu. The README states that it is chosen from the receiver selected preset, so the hardware preset dictates which family of protocols the decoder will try to interpret.

The AM registry lists entries such as Chrysler V0, Fiat V0, Fiat V1, Fiat V2, Ford V0, Ford V3, Honda V1, Kia V1, Mazda V0, PSA (Peugeot/Citroen), Renault V0, Renault V1, StarLine, Subaru and VAG (VW/Audi/Seat/Skoda). Their signal encodings vary between PWM, Manchester and PPM, and their encryption layers run the usual range of rolling codes, HITAG2, KeeLoq, XTEA/XOR and AUT64/XTEA.

The FM registry holds a different set: Ford V1, Ford V2, Ford V3, Honda Static, Kia V0 through V7, Honda V2, Mazda V0, PSA and Scher-Khan. Kia is the deepest family here, with V6 using AES128 and the V3 and V4 entries using KeeLoq with CRC4 in a bit-flipped form. Frequencies sit mostly at 315.00 and 433.92 MHz, with outliers such as Ford V3 at 434.25, VAG at 434.42 and Honda Static at 433.65.

Decoder coverage is wider than encoder coverage

Two columns in each protocol table carry the most practical information. The decoder column says whether the app can interpret a captured signal, and the encoder column says whether it can produce one. The gap between them is where a user gets disappointed.

Fiat V2, Ford V3 and Scher-Khan all have a decoder but no encoder. Fiat V0 can encode, but its encryption column reads Rolling Code (static emu only), which narrows what its encoder can do. The rest of the AM registry is fully covered in both directions, as are most FM entries. Ford V2 is described as a simple replay rather than a full rolling code implementation.

Encryption handling also varies in ways that affect analysis rather than just transmission. Fiat V1 and Renault V1 use HITAG2 with an XOR8 check, Kia V6 uses AES128 with CRC8, PSA entries use XTEA/XOR with CRC8, and StarLine uses KeeLoq. Several entries carry no check value at all, which means a decoded frame there may not have any integrity marker you can rely on when comparing repeats.

Getting the app means following the project to its own site

This repository does not contain installation steps, and the README does not pretend otherwise. It opens with a security and project update notice, gives the address of that notice, and states that the main repository has moved, with all other copies treated as read-only mirrors.

https://protopirate.net/ProtoPirate
https://protopirate.net/ProtoPirate/ProtoPirate

The first line is where the project asks readers to read the update message. The second is the location it gives for the main repository. If you are reading this on GitHub, you are looking at a mirror, and the README states that all others are read only.

What the documentation does say about running the software is that the goal is a drop-in Flipper app in the .fap format usable on any Flipper Zero firmware, with no build command, no toolchain version and no sideload procedure given in the README. The presence of application.fam tells you the project builds with the Flipper SDK build system, but the README does not spell out the commands, so the build step has to come from the main repository or the project's own documentation.

Three ways in: live receiver, saved .sub files, timing analysis

The feature set splits into three tools that share the protocol registry.

The protocol receiver captures and decodes signals in real time with an animated radar display, and the README notes that it supports frequency hopping. The sub decode screen loads existing .sub files from the SD card, and the documented path to browse is /ext/subghz/, which is where the Flipper keeps its saved Sub-GHz captures. Loading a file rather than hitting the air is the slower, more reproducible path, and it works on any signal you already recorded.

The timing tuner is the tool with the narrowest audience and the most specific purpose. It is for protocol developers who want to compare real fob signal timing against protocol definitions. The documentation lists what it reports: the expected short and long pulse durations with a tolerance on one side, measured timing from a real fob on the other with average, minimum, maximum and sample count, then the analysis with the difference from expected and jitter measurements, ending in a conclusion about whether the timing matches or needs adjustment with specific recommendations. That last layer is what turns it from a display into a diagnostic.

Maturity signals from the repository itself

This copy of the project has no GitHub releases, so there is no published version to pin and no changelog to read here. The last push to the main branch was on 2026-10-15, and the README calls the toolkit experimental while listing the contributors by name across app development and protocol work, which suggests the project is spread across several people rather than maintained by one person.

Because the primary repository is elsewhere and this one is a read-only mirror, the upgrade path runs through that primary site rather than through GitHub releases or tags. Anyone who installs a .fap built from this mirror should expect to check the main repository for the current build instead of relying on release notes.

The project is published under the GPL-3.0 licence. That is a copyleft grant, so derived works and redistributed builds carry the same obligations. It is worth noting alongside the fact that this repository's own primary location has moved away from GitHub, since the licence applies to the source, not to the hosting arrangement.

Editorial conclusion

ProtoPirate suits a security researcher or hobbyist with a Flipper Zero who needs to identify key fob protocols and compare real signal timing against a protocol definition. It is the wrong tool for a garage door or access badge workflow, since the encoding side is uneven across protocols and this repository carries no build instructions. Before building, open the main repository at protopirate.net/ProtoPirate, because the GitHub copy here is read-only, and confirm that your protocol appears in the decoder column rather than assuming the encoder side is complete.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. README
4. RocketGod-git/ProtoPirate on GitHub