How to confirm i'm sniffing properly

[maxdd]

Hello,
I started to look at this project because i wanted to re a communication protocol running on a PL51WT020.
The datasheet reports a 2.4Ghz radio with up to 1Mbit rate so i felt like an esp32 and a nrf24l01+ would be a good starting point.

I took inspiration from the youtube video sniffing 2.4ghz but apparently i can't even sniff my M580 mouse (although it was connected via bluetooth and not via the dongle so it might be that)

I'm seeking support to understand why i can't see much.
I simply did

$ > import time
$ > q.radioA.set_modem_config(bitRate=1000, isPromiscuous=True)
$ > q.radioA.rx()
            for f in range(2400, 2483):
                 q.radioA.set_modem_config(carrierFreq=f)
                 time.sleep(0.15)
            q.radioA.idle()

My wiring is

GND    GND
CE     G27
SCK    G18
MISO   G19
3.3V   3.3V
CSN    G13
MOSI   G23
IRQ    G33

platformio.ini has esp32devkit enabled and build.env has the example esp32 nrf24 configuration.

I can only see one message every scan (that feels strange) apparently on different frequencies irrespective whether i spam the remote controller buttons or move my mouse.
Does that mean my HW is at least properly sniffing?

The messages seems to appear always at 2400 or 2483
I'm under the impression that those are garbage
Regards,

[Crsarmv7l]

See here #44 (comment)

I have upstreamed quite a few things to radiolib, but rfquack seems fairly abandoned and it's not in line with upstream. Likewise I have moved on and I'm developing my own hw/fw (which is why I'm upstreaming).

[maxdd]

Would you mine share your tools? I'm on nrf24 though and i was looking for something quite plug and play to focus on the RE part

[phretor]

If you folks have changes, I'm happy to merge them.

[maxdd]

@phretor Hello Federico, would you mind sharing the code to sniff the RadioLib example? I'm struggling a bit to understand what to set. The example is this and it is sending "Hello World!" with the following param:

freq – Carrier frequency in MHz. Defaults to 2400 MHz.
dr – Data rate to be used in kbps. Defaults to 1000 kbps.
byte addr[] = {0x01, 0x23, 0x45, 0x67, 0x89}; //width 5

If i swipe from 2.4 to 2.483 i see nothing

[phretor]

Is this related to RFQuack?

[maxdd]

Yes with RFQuack I can't pick up any packets, not even those packets that are sent using pure radiolib example which are definitely working since I can transmit and receive just fine when I flash 2 Esp32 with 2 nrf24. My question is related to the lack of an example in RFQuack that shows how to receive or send a 2.4ghz packet

[phretor]

Have you watched the mousejacking attack demo with RFQuack on YouTube?

[maxdd]

As I've mentioned in initial post I took inspiration from the youtube video sniffing 2.4ghz where you move the mouse and show packets coming in.
The same approach doesn't work for me (maybe because your preamble is 0xAA00 and I might need 0x5500, I haven't tried) but I wanted to narrow a bit the scope and check whether my setup can send or receive single packets, unfortunately the one I'm sending with RadioLib with the default parameters above is not captured by RFQuack

[Crsarmv7l]

A summary of my changes are in the linked post and already upstreamed. The major takeaway is that PQT needs to be set to 0 with promiscuous. Aside from that I have ported a few rfcat features, and working on a few other s for upstream.

…

On Sat, Nov 2, 2024, 5:33 PM Federico Maggi ***@***.***> wrote: If you folks have changes, I'm happy to merge them. — Reply to this email directly, view it on GitHub <#52 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AULD4G2FJBP2L7LNXB75V4DZ6T5FXAVCNFSM6AAAAABRB2QESKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCMJTGAZTENY> . You are receiving this because you commented.Message ID: ***@***.***>

[maxdd]

Are they relevant for nrf24?

[Crsarmv7l]

That's on you to figure out. If it isn't set with a cc1101 you get nothing.

[maxdd]

I would say no since we are talking about 2.4ghz nrf24l01 device. Thank you anyway