[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-3560":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":13,"stars7d":15,"stars30d":16,"stars90d":14,"forks30d":14,"starsTrendScore":17,"compositeScore":18,"rankGlobal":9,"rankLanguage":9,"license":19,"archived":20,"fork":20,"defaultBranch":21,"hasWiki":22,"hasPages":22,"topics":23,"createdAt":9,"pushedAt":9,"updatedAt":24,"readmeContent":25,"aiSummary":26,"trendingCount":14,"starSnapshotCount":14,"syncStatus":13,"lastSyncTime":27,"discoverSource":28},3560,"wmbuster","i12bp8\u002Fwmbuster","i12bp8","Passive Wireless M-Bus listener for the Flipper Zero — T1\u002FC1\u002FT+C\u002FS1, AES-128 mode 5, OMS DIF\u002FVIF, manufacturer drivers. RX-only.",null,"C",129,4,2,0,3,11,6,48.7,"GNU General Public License v3.0",false,"main",true,[],"2026-06-12 04:00:18","\u003Cdiv align=\"center\">\n\n\u003Cimg src=\"docs\u002Fbanner.png\" alt=\"wM-Buster — wM-Bus smart-meter analyser for Flipper Zero\" width=\"100%\"\u002F>\n\n**Passive wireless M-Bus listener for the Flipper Zero**\n\nRead EU utility meters (heat, water, gas, electricity, heat-cost allocators)\non the 868 MHz band using only the CC1101 — internal or external module.\n\n[![CI](https:\u002F\u002Fgithub.com\u002Fi12bp8\u002Fwmbuster\u002Factions\u002Fworkflows\u002Fci.yml\u002Fbadge.svg)](https:\u002F\u002Fgithub.com\u002Fi12bp8\u002Fwmbuster\u002Factions\u002Fworkflows\u002Fci.yml)\n[![Latest release](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Fv\u002Frelease\u002Fi12bp8\u002Fwmbuster?include_prereleases&sort=semver)](https:\u002F\u002Fgithub.com\u002Fi12bp8\u002Fwmbuster\u002Freleases\u002Flatest)\n[![License: GPL v3](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FLicense-GPLv3-blue.svg)](LICENSE)\n[![Flipper Zero](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FFlipper%20Zero-firmware%20API%2087.1-orange?logo=flipper)](https:\u002F\u002Fflipperzero.one)\n[![GitHub Pages](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fdocs-GitHub%20Pages-222?logo=github)](https:\u002F\u002Fi12bp8.github.io\u002Fwmbuster\u002F)\n[![RX only](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fradio-RX%20only-success)](#what-it-does-not-do)\n\n[**Project page**](https:\u002F\u002Fi12bp8.github.io\u002Fwmbuster\u002F)  · \n[**Releases**](https:\u002F\u002Fgithub.com\u002Fi12bp8\u002Fwmbuster\u002Freleases)  · \n[**Changelog**](CHANGELOG.md)  · \n[**Disclaimer**](DISCLAIMER.md)  · \n[**Contributing**](drivers\u002FCONTRIBUTING.md)\n\n\u003Cbr\u002F>\n\n\u003Cimg src=\"docs\u002Fdemoscan.png\"    alt=\"Live meter scan\"  width=\"45%\"\u002F>\n  \n\u003Cimg src=\"docs\u002Fdemodetails.png\" alt=\"Per-meter detail\" width=\"45%\"\u002F>\n\n\u003C\u002Fdiv>\n\n---\n\n> [!CAUTION]\n> **Only use this on meters you own.** Decrypting someone else's meter\n> is illegal in most jurisdictions. The author does not condone unlawful use\n> and is not responsible for what you do with this tool. Read the full\n> [**Legal Disclaimer**](DISCLAIMER.md) before installing.\n\n> [!IMPORTANT]\n> **wM-Buster is receive-only.** It never transmits, jams, replays, or\n> spoofs. It is a passive analyser, by design.\n\n---\n\n## Features\n\n- **All four EU modes** — T1, C1, T+C combined, S1.\n  T+C is the default and decodes both T-mode (3-of-6) and C-mode (NRZ\n  Format A & B) on a single chip configuration via post-sync byte detection\n  (`0xCD` \u002F `0x3D` \u002F fall-through).\n- **EN 13757-3 application layer** — DIF\u002FVIF walker covering Energy,\n  Volume, Mass, Power, Volume flow, Mass flow, Flow \u002F Return \u002F External\n  temperatures, Temperature difference, Pressure, On-time, Operating time,\n  Date, DateTime, HCA units, Fabrication number, Bus address.\n- **AES-128 mode 5 decryption** — drop a `keys.csv` on the SD card and\n  encrypted meters automatically decrypt to readable rows.\n- **Manufacturer drivers** — Techem (HCA \u002F heat \u002F water \u002F smoke), Kamstrup,\n  Diehl \u002F Hydrometer \u002F Sappel \u002F IZAR, Qundis \u002F ista \u002F Brunata, BMeters,\n  Engelmann, Sontex, Zenner, Apator, GWF, BFW, and more.\n- **Custom canvas UI** — meter list with RSSI bar, packet counts, and a\n  per-meter detail page with the parsed values, raw hex, and frame stats.\n- **SD logging** — raw + parsed telegrams to `\u002Fext\u002Fapps_data\u002Fwmbuster\u002F` for\n  offline analysis with `rtl_433` or `wmbusmeters`.\n\n> [!TIP]\n> Don't see your meter? Most unknown meters still produce useful output via\n> the OMS DIF\u002FVIF fall-through walker. If yours doesn't, see\n> [**Adding a driver**](#adding-a-driver) — porting from `wmbusmeters` is\n> usually a 50-line job.\n\n## What it does not do\n\n- **No transmit.** Ever. T2 \u002F C2 bidirectional exchanges and meter wake-up\n  requests are out of scope by design.\n- **No N-mode** (169 MHz narrowband) — the Flipper's CC1101 is hardware-\n  locked to the 300 \u002F 430 \u002F 868 MHz SRD subbands.\n- **No US protocols** — Itron ERT, Sensus FlexNet, Neptune R900 are\n  separate radio stacks and not currently supported. See the\n  [project page](https:\u002F\u002Fi12bp8.github.io\u002Fwmbuster\u002F) for the rationale.\n- **No key cracking, no replay, no spoofing.** This is a viewer.\n\n## Install\n\n> [!TIP]\n> Pre-built `.fap` files for every release are attached to the\n> [**Releases**](https:\u002F\u002Fgithub.com\u002Fi12bp8\u002Fwmbuster\u002Freleases) page. Drop\n> `wmbuster.fap` into `\u002Fext\u002Fapps\u002FSub-GHz\u002F` on your Flipper's SD card and\n> launch from `Apps → Sub-GHz → wM-Buster`.\n\n### Build from source\n\n```sh\n# Install ufbt (Flipper's build tool)\npip install --upgrade ufbt\nufbt update --channel=release\n\n# Clone & build\ngit clone https:\u002F\u002Fgithub.com\u002Fi12bp8\u002Fwmbuster.git\ncd wmbuster\nufbt                # produces dist\u002Fwmbuster.fap\nufbt launch         # flash + start on a connected Flipper\n```\n\nHost-side regression tests (no Flipper required):\n\n```sh\nmake -C tests check\n```\n\n## Decryption (AES-128 mode 5)\n\nNewer EU meters (Techem v0x6A, Kamstrup MULTICAL, etc.) ship with AES-128\nenabled. Drop a CSV on the SD card at:\n\n```\n\u002Fext\u002Fapps_data\u002Fwmbuster\u002Fkeys.csv\n```\n\nOne line per meter, `#` comments allowed:\n\n```csv\n# Manufacturer (3 chars), 8-digit hex ID, 32-hex AES-128 key\nTCH,27404216,0123456789ABCDEF0123456789ABCDEF\nKAM,12345678,FEDCBA9876543210FEDCBA9876543210\n```\n\nRestart the app to reload the file. Open **Keys** from the root menu to\nconfirm the loaded entries (only a fingerprint of each key is shown). When\na matching key is on file the meter row flips from `ENC` to `DEC` and the\ndecoded reading appears.\n\n> [!WARNING]\n> **Never publish AES keys.** They identify a real customer's meter and\n> their disclosure can enable billing fraud. The maintainers will delete\n> any issue or PR that includes real keys, real IDs, or decrypted\n> captures. See [DISCLAIMER §5](DISCLAIMER.md#5-aes-keys).\n\n## Mode selection\n\n| Mode  | Frequency  | Bit rate          | Encoding              | Notes                       |\n|-------|------------|-------------------|-----------------------|-----------------------------|\n| T1    | 868.95 MHz | 100 kchip\u002Fs       | 3-of-6                | Older Techem firmware       |\n| C1    | 868.95 MHz | 100 kbit\u002Fs        | NRZ, Format A\u002FB auto  | Newer Techem, most Kamstrup |\n| T+C   | 868.95 MHz | 100 kbit\u002Fs        | T1 or C1, auto-detect | **Default** — broadest      |\n| S1    | 868.30 MHz | 32.768 kbit\u002Fs     | Manchester            | Legacy water \u002F gas          |\n\n## External CC1101\n\nIf you have a GPIO-attached CC1101 module wired to the standard Flipper\npin-out, switch **Settings → Module → External**. If no module is\ndetected the app falls back to the internal radio.\n\n## Documentation\n\n- **[Project page](https:\u002F\u002Fi12bp8.github.io\u002Fwmbuster\u002F)** — landing page,\n  screenshots, install steps.\n- **[CHANGELOG](CHANGELOG.md)** — release notes, version-by-version.\n- **[DISCLAIMER](DISCLAIMER.md)** — full legal terms, prohibited use,\n  spectrum \u002F AES policy.\n- **[drivers\u002FCONTRIBUTING.md](drivers\u002FCONTRIBUTING.md)** — how to add a\n  new manufacturer driver in one C file.\n- **[drivers\u002FREADME.md](drivers\u002FREADME.md)** — driver layout reference.\n\n## Project layout\n\n```\nwmbuster\u002F\n├── application.fam          # ufbt manifest\n├── wmbus_app.[ch]           # entry point, scene wiring, settings\n├── meters_db.[ch]           # bounded in-RAM meter table\n├── key_store.[ch]           # AES-key CSV loader\n├── logger.[ch]              # SD logging (raw + parsed)\n├── protocol\u002F\n│   ├── wmbus_3of6.[ch]      # EN 13757-4 §6.2.1.1 chip decoder (T1)\n│   ├── wmbus_manchester.[ch]# Manchester decoder (S1)\n│   ├── wmbus_crc.[ch]       # CRC-16\u002FEN-13757 + Format A\u002FB verifiers\n│   ├── wmbus_link.[ch]      # L\u002FC\u002FM\u002FA\u002FCI parsing, encryption-mode tag\n│   ├── wmbus_app_layer.[ch] # DIF\u002FVIF walker + renderer\n│   ├── wmbus_aes.[ch]       # AES-CBC over furi_hal_crypto\n│   ├── wmbus_manuf.[ch]     # 16-bit manuf code \u003C-> 3-letter ASCII\n│   └── wmbus_medium.[ch]    # device-type code -> human string\n├── subghz\u002F\n│   ├── wmbus_worker.[ch]    # CC1101 worker, slicer, CRC, dispatch\n│   ├── wmbus_hal_rx.c       # FIFO drain via SPI (int + ext handles)\n│   └── wmbus_radio.[ch]     # int\u002Fext device selector (ProtoPirate-style)\n├── drivers\u002F\n│   ├── engine\u002F              # registry + uniform driver interface\n│   ├── _oms_split.h         # shared \"OMS prefix -> mfct trailer\" helper\n│   ├── CONTRIBUTING.md      # how to add a new driver\n│   └── europe\u002F\n│       ├── techem\u002F          # FHKV-3\u002F4 HCA, heat, water, smoke, MK-Radio\n│       ├── kamstrup\u002F        # MULTICAL family\n│       ├── diehl\u002F           # Hydrometer \u002F Sappel \u002F IZAR\n│       ├── qundis\u002F          # Qundis \u002F ista \u002F Brunata HCAs\n│       ├── bmeters\u002F         # Hydrodigit\n│       ├── engelmann\u002F       # Hydroclima HCA\n│       ├── sontex\u002F          # RFM-TX1 water (legacy + OMS firmwares)\n│       ├── zenner\u002F          # Zenner B.One\n│       ├── apator\u002F          # NA-1\n│       ├── misc\u002F            # GWF water, BFW 240-Radio\n│       └── ...              # see drivers\u002FREADME.md\n├── views\u002F                   # canvas widgets + scenes\n└── tests\u002F                   # host-side regression tests (no Flipper)\n```\n\n## Adding a driver\n\nWe've made adding a manufacturer driver as small a job as we could. The\ncommon case is **one C file, ~50 lines**: drop it in\n`drivers\u002Feurope\u002F\u003Cvendor>\u002F\u003Cname>.c`, add it to `application.fam` and the\nregistry.\n\nA worked example for porting from `wmbusmeters` is in\n[**drivers\u002FCONTRIBUTING.md**](drivers\u002FCONTRIBUTING.md). Pull requests with\na regression test in `tests\u002Ftest_ports.c` are merged the fastest.\n\n> [!TIP]\n> **Don't include real telegrams from real meters.** Use the public\n> wmbusmeters reference telegrams (their repo is GPLv3-licensed,\n> compatible with this project) or synthesise a frame.\n\n## Testing\n\nThe host test-suite covers every manufacturer driver against the public\n`wmbusmeters` reference telegrams:\n\n```sh\nmake -C tests check\n```\n\nFor ground-truth validation against an SDR, capture the same air with\n`rtl_433`:\n\n```sh\nrtl_433 -f 868.95M -s 1.6M -Y minmax -R 104 -R 105 -F json > capture.jsonl\n```\n\n(`-R 104` is rtl_433's wM-Bus T+C decoder, `-R 105` is S-mode.)\n\n## Standards & references\n\n- **EN 13757-4** — wM-Bus PHY \u002F link layer.\n- **EN 13757-3** — application layer (DIF\u002FVIF).\n- **OMS Specification Vol. 2** — profile + encryption.\n- **TI SWRA522** — CC1101 wM-Bus implementation note.\n\nThe decoders were cross-checked against:\n\n- **Your own meter** — typically legal under EU Directive 2018\u002F2002\n  Art. 9-11, which gives consumers a statutory right of access to\n  their own consumption data. However, operators are not legally required \n  to provide the AES-128 key for the RF interface, as the symmetric key \n  often poses a security and configuration risk. Some providers may hand \n  it over upon request, but acquiring the key is your responsibility. \n  Equivalent rules exist in non-EU jurisdictions.\n- **Other meters** — can constitute unlawful interception of private\n  communications and unlawful processing of personal data under GDPR\n  (or equivalents). Check your national statutes before pointing this\n  app at a meter that isn't yours.\n\n## Contributing\n\nContributions welcome — bug reports, driver ports, UI polish, docs.\n\n1. **Open an issue first** for non-trivial changes so we can sanity-check\n   the approach.\n2. **Stick to the existing style**: tabs in `Makefile`, 4-space indent in\n   C, no Doxygen, comments explain *why* not *what*.\n3. **Add a test** in `tests\u002Ftest_ports.c` for any new driver — telegrams\n   from `wmbusmeters\u002Ftests\u002Ftest_*.txt` are fair game.\n4. **Run** `make -C tests check && ufbt` locally and make sure both pass.\n5. **Don't commit real keys, real meter IDs in clear, or decrypted\n   captures of meters that aren't yours.** PRs containing those will be\n   force-pushed clean.\n\nSee [drivers\u002FCONTRIBUTING.md](drivers\u002FCONTRIBUTING.md) for the driver\nwalkthrough and [DISCLAIMER §5](DISCLAIMER.md#5-aes-keys) for the data\nhygiene policy.\n\n## Roadmap\n\n- Driver ports for the long tail of EU water meters still missing\n  (Maddalena, Aquametro, Sensus iConA, Itron Cyble, Elster v200H).\n- In-app key-fingerprint search (paste a hex, find which meter uses it).\n- RSSI history sparkline per meter on the detail page.\n- Translations.\n\nUS protocols (Itron ERT, Neptune R900, etc.) are **out of scope** — they\nare different radio stacks. A separate sister-app would be the right\nvehicle if anyone wants to write one.\n\n## Acknowledgements\n\nStanding on the shoulders of giants — see [Standards & references](#standards--references)\nabove. Special thanks to the wmbusmeters maintainers for keeping every EU\nmeter quirk documented in plain code, and to the Flipper Zero open-source\ncommunity for the SubGHz device-plugin abstraction that makes external\nCC1101 support a dozen-line job.\n\n## License\n\nReleased under the **GNU General Public License v3.0 or later** — see\n[`LICENSE`](LICENSE) for the full text. In short: you may use, study,\nmodify, and redistribute this software, but any redistributed copy or\nderivative work must remain under GPLv3 and ship its complete\ncorresponding source. The `_refs\u002F` directory used during development is\nnot shipped in the `.fap` and remains under its upstream licences.\n","wM-Buster 是一个为 Flipper Zero 设计的被动无线 M-Bus 监听工具，用于读取 868 MHz 频段上的欧盟公用事业计量表（如热、水、气、电等）。项目支持 T1\u002FC1\u002FT+C\u002FS1 四种模式及 AES-128 模式 5 解密，能够解析多种制造商设备的数据。其核心功能包括自动解密已知密钥的加密数据、全面覆盖 EN 13757-3 应用层协议中的 DIF\u002FVIF 数据项，并提供了一个用户友好的自定义界面来展示信号强度、包数量和详细解析结果。此工具仅限接收，不进行任何传输或干扰操作，适用于合法拥有者对自己设备的监测分析场景中。","2026-06-11 02:54:42","CREATED_QUERY"]