Passive Honda Remote Keyless Entry (RKE) threat-detection companion for the Flipper Zero.

Car Breaker 19 is a research-only, receive-only application that samples Honda RKE transmissions and flags risky behaviours such as Rolling-Pwn, RollBack, or static-code regressions. It shares the same UX philosophy as uid_brute_smarter: clear feedback, conservative defaults, and safeguards that keep the Flipper in passive sniffing mode at all times.

⚠️ IMPORTANT: This tool exists solely to help owners and authorized researchers validate the security posture of vehicles they control. It does not transmit, jam, replay, or brute-force any signals and must never be used against systems without explicit, written authorization.

• Use only on vehicles you own or are contractually permitted to assess.
• Respect local RF regulations—Car Breaker 19 never transmits, but many jurisdictions still restrict passive capture without consent.
• Follow the disclosure guidelines in RESEARCH.md when reporting findings to OEMs or regulators.
• Momentum Firmware and the authors disclaim liability for misuse; you accept all risk when deploying this app.

• Pre-loaded CC1101 presets (433.92 MHz & 315 MHz, wide/narrow) derived from Honda HND_1 and HND_2 register maps.
• Channel hopping mode for unattended scans plus manual frequency/filter overrides.
• Watchdog timers and mutex-protected buffers prevent UI freezes while processing dense pulse trains.

• Rolling-Pwn heuristic – requires ≥5 unique frames within 2.5 s, each 3–14 ms long (≈40–160 Manchester bits) and waveform-consistent before raising an alert.
• RollBack suspicion – triggers when an identical frame reappears after ≥8 s, signalling counter reset or resynchronization abuse.
• Static-code detection – flags repeated hashes that are still within the nominal sliding window, indicating CVE-2022-27254-style fixed commands.
• Status dialog shows the active preset, running frame count, and live alert state without interrupting capture.

• Splash screen reminds users that this is a defensive research tool.
• Capture dialog is one button (Stop) to avoid accidental mode switches.
• Detection logic tolerates RF noise by rejecting frames outside expected Honda RKE timing envelopes before computing hashes.

• Flipper Zero running Momentum Firmware (latest build recommended).
• GNU build tooling available via the ./fbt helper script.
• This repository cloned into Momentum-Firmware/applications_user/car_breaker19.

git clone https://github.com/Next-Flip/Momentum-Firmware.git
cd Momentum-Firmware
git clone https://github.com/fbettag/car_breaker_19.git applications_user/car_breaker19
./fbt launch APPSRC=applications_user/car_breaker19

git clone https://github.com/Next-Flip/Momentum-Firmware.git
cd Momentum-Firmware
git clone https://github.com/fbettag/car_breaker_19.git applications_user/car_breaker19
./fbt fap_car_breaker19
# Copy dist/f7-C/apps/Research/car_breaker19.fap to /ext/apps/Research/ on the Flipper.

1. Open Apps → Sub-GHz → Car Breaker 19.
2. Select Start Capture. The app begins in hopping mode; switch to 433 MHz or 315 MHz manually if you already know the fob region.
3. Leave the Flipper near the target vehicle/fob. Alerts appear inline on the scan screen; press Stop to exit and reset the session.

All thresholds are derived from the timing, baud-rate, and FSK deviation analysis documented in RESEARCH.md; they are intentionally conservative so that a warning implies a meaningful follow-up investigation.

• RESEARCH.md aggregates the Honda RKE background, preset math, and external references (Rolling-Pwn, RollBack, static code CVEs).
• The app never bundles exploit payloads—only detection baselines aligned with the documented physics layer.

• File firmware issues or detection false-positives via the main Momentum Firmware issue tracker.
• Pull requests that improve detection accuracy, documentation, or presets are welcome—please keep the receive-only design.

• Honda Rolling-Pwn/RollBack researchers: Kevin2600, Wesley Li, Levente Csikor.
• Momentum Firmware maintainers and the broader Flipper Zero community for Sub-GHz tooling inspiration.

Car Breaker 19 ships as part of Momentum Firmware and inherits the project’s GPLv3 license.