SubCar - portapack-mayhem/mayhem-firmware GitHub Wiki
SubCar is a receiver app for decoding automotive remote keyless entry (RKE) signals from car key fobs. It passively listens on a configurable frequency and attempts to match incoming signals against a library of known manufacturer protocols, displaying decoded results in a scrolling list.
Settings
- Frequency: Default is 433.92 MHz, the standard European RKE band. Adjustable via the encoder knob or on-screen numpad for other regional bands (e.g., 315 MHz in North America).
- RF Amp (0 or 1): Enables/disables the internal RF amplifier.
- LNA gain (0–40): Low-noise amplifier gain. See Receive Quality Issues.
- VGA gain (0–62): Variable-gain amplifier gain. See Receive Quality Issues.
- Mode: Selects the demodulation mode — AM (default) or FM. Most car key fob protocols operate with AM (OOK) modulation; FM mode may be needed for some regional or newer implementations.
- Clear: Clears the decoded signal list from the display (does not affect the log file).
- Log: When checked, decoded packets are written to a timestamped CSV file on the SD card:
LOGS/SubCarLOG_YYYYMMDD_HHMMSS.CSV. The file header is; Type; Bits; Data;.
Decoded Signal List
Each decoded packet is shown as a row with three columns: Type (protocol name), Bits (bit length of the decoded frame), and Age (seconds since last received). The list is deduplicated by signal content — repeated presses of the same fob button update the age counter rather than adding a new row.
Selecting an entry opens a detail view showing the protocol type, serial number, button code, and additional decoded fields where available for that protocol.
Supported Protocols
The following car key fob protocols are currently implemented:
| Protocol | Manufacturer |
|---|---|
| Suzuki | Suzuki |
| VW | Volkswagen (button IDs: Lock, Unlock, Trunk, Panic, combinations) |
| Subaru | Subaru |
| Kia V0–V5 | KIA |
| Ford V0 | Ford |
| Fiat V0 | Fiat |
| BMW V0 | BMW |
Note: Some protocols with full rolling-code encryption (Kia V6, PSA/Peugeot-Citroën) are recognized but not decoded, as the payload is entirely encrypted.
Settings Persistence
The modulation mode and Log checkbox state are saved to rx_subcar.ini on the SD card when App Settings is enabled in the global Settings menu