Improve BLE Spam module - #37
Closed
bmorcelli wants to merge 99 commits into
Closed
Conversation
Greatly Improved UI Add Delay selector (10ms-10000ms) Add Individual advertisement selecting Add Mac Address Randomisation frequency selector
Fix rectangle being drawn over the lower Bruce border.
Also added random/all selection for more sub-menus
Add Galaxy Buds, more effective Continuity packet crafting (Made by @MarlinSchuck) Also added a few Swift Pair and BLE beacon packet names
Also modifed BLE Beacon presets to be correct character count to fit
Fix for the esp32-c5
Changes the App Store download URL from http:// to https:// to prevent MITM injection of malicious JavaScript code. Without TLS, anyone on the same network, ISP, or DNS path can intercept the App Store response and inject arbitrary code that executes in the MJS interpreter with full hardware access. Fixes AV-001 from the forensic audit (issue BruceDevices#2511)
fix(HeavyButter): upgrade App Store from HTTP to HTTPS (AV-001)
New board: ESP32-S3-WROOM-1-N16R8, ILI9488 480x320 SPI display, GT911 capacitive touch. Self-contained in boards/elecrow_advance_s3/ (its own .ini, GT911 interface.cpp, pins_arduino.h). platformio.ini only gains the env in the commented default_envs reference list. Tested on physical hardware: boots to menu, display and capacitive touch working, 8MB OPI PSRAM + 16MB QIO flash detected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…dvance-35-s3 Add Elecrow CrowPanel Advance 3.5 inch (ESP32-S3) board support
Pressing NEXT to open the options menu after a capture in RF Scan/Copy crashed and rebooted CC1101 devices (e.g. M5Stack Cardputer), preceded by "gpio_isr_handler_remove ... GPIO number error" and "gpio_wakeup_disable ... GPIO number error". RFScan::RCSwitch_Enable_Receive() took its RCSwitch by value, so enableReceive() ran on a temporary copy and the RFScan::rcswitch member was never enabled (nReceiverInterrupt stays -1). On NEXT, select_menu_option() calls rcswitch.disableReceive() on that member, and RCSwitch::disableReceive() runs detachInterrupt(nReceiverInterrupt) unconditionally, so detachInterrupt(-1) indexes the GPIO table out of bounds and free()s an invalid pointer. Pass the RCSwitch by reference so enable and disable act on the same object. Fixes BruceDevices#2477
Additionally: Patch for previous commit, NRF24 Not found after exiting. Track whether the SPI bus is already initialized and skip NRFSPI->begin() on re-entry, and add a proper reset pulse on NRFradio before begin() Two changes in nrf_common.cpp: 1. static bool nrfSpiInitialized = false — guards NRFSPI->begin() so it only runs once per power cycle, no matter how many times you enter/exit the jammer menu. 2. Added delay(5) after asserting CE LOW / CS HIGH before any SPI traffic — gives the pin state time to settle on the chip side, especially important on the E01-ML01DP5 with its PA+LNA adding propagation delay.
Fix NRF24 channel hopping and mode switching
…an-rcswitch-lifecycle fix(rf): Scan/Copy crash when opening options menu on CC1101 (BruceDevices#2477)
Greatly Improved BLE Spam Module(s)
* re-enable workflows * fix(webui): responsive layout for narrow screens The web UI had several fixed pixel widths (dialog inputs 300px, upload rows 350px, drop overlay 300px, header buttons 100px) that overflow or overlap below ~phone width. Add an additive @media (max-width: 600px) block that makes those fluid and lets the header / free-space blocks wrap+stack. Desktop layout is unchanged. Compile-verified on esp32-s3-devkitc-1 (web assets re-embedded). --------- Co-authored-by: Pirata <104320209+bmorcelli@users.noreply.github.com> Co-authored-by: modabucksmain-pixel <bahooo.60bir@gmail.com>
…nect The Host Info port scan only checked for ESC between ports, and the WiFi client connect had no timeout, so a filtered port could block the loop and ESC felt unresponsive. Poll ESC inside the per-port wait too, and pass the scan timeout to the connect so no single port can stall it. Fixes BruceDevices#2553
- Fix variable shadowing bug in keyStroke::Clear() (globals.h) The alt/ctrl/gui boolean members were being shadowed by local declarations in the Clear() function, preventing them from being properly reset. - Remove duplicate tft.setCursor() call in displayScrollingText() (display.cpp) - Implement text wrapping for toast messages (display.cpp) Added wrapText() helper function and updated displayRedStripe() to support multi-line text with dynamic box height. Also cleaned up displayInfo(), displaySuccess(), and displayTextLine() functions. - Implement validateImgFile() stub (theme.cpp) Added proper validation logic to check file existence and reasonable size (64 bytes min, 500KB max) for theme images. - Add visual polish to menu selection (display.cpp) Added selection highlight bar behind currently selected menu item with inverted colors for better visual feedback. Co-authored-by: Pirata <104320209+bmorcelli@users.noreply.github.com>
…eDevices#2647) Adds RotaryNetSteps, a signed counter tracking pending encoder detents independent from the single-shot NextPress/PrevPress bools. Consumers (loopOptions() menu navigation and the on-screen keyboard) drain the full pending count in one pass before redrawing, instead of applying at most one step per redraw pass. This means a fast spin applies its true net movement immediately, and turning N steps one way then N back always lands on the exact same item/key, since the underlying findNextEnabled()/step functions are exact inverses of each other. Falls back to a single step when NextPress/PrevPress/UpPress/DownPress is set by a non-encoder source (T-Lora-Pager's physical keyboard, the WaveSentry touchscreen), so those input paths are unaffected. Also fixes a race in the on-screen keyboard: its input loop had no pacing delay, so it could occasionally observe RotaryNetSteps and the NextPress/PrevPress bools torn across two loop iterations (since InputHandler() writes them in separate, non-atomic steps), causing an occasional double-step. Pacing the loop the same as the menu list closes that window. All changes are gated behind #ifdef HAS_ENCODER; no other input path or non-encoder board is affected.
…s#2320) * fix(keyboard): force redraw after shortcut opens submenu When a keyboard shortcut (e.g. 'f' for Files) opens a submenu from the main menu, the submenu draws over the screen. On exit, the main menu loop didn't know it needed to redraw, causing ESC to appear broken and navigation to produce font-size overlay glitches. Change checkShortcutPress() to return bool, and force a full redraw when it executed a shortcut command. Closes BruceDevices#2156 * fix(menu): give each menu its own SEL grace-period timer menuOpenTs was a function-level static in loopOptions, so it was shared across nested/recursive menu invocations. Opening a submenu (itself a loopOptions call) overwrote the parent's timestamp on firstRender; on return the parent inherited the submenu's later timestamp and silently ignored the next SEL press within the 600ms grace window. Make menuOpenTs a per-invocation local so each menu tracks its own open time. Surfaced alongside the shortcut redraw fix, since the shortcut path opens submenus via recursive loopOptions. * fix(keyboard): rebuild main menu after shortcut instead of repainting The force-redraw approach could not work: options is a shared global that the main-menu loop holds by reference, and a shortcut runs an app via optionsMenu() which clears and refills that global with the app's own items (which lack the main-menu hover lambda). Repainting in place therefore drew the stale options as a boxed overlay list instead of the main-menu carousel. Instead, break out of loopOptions when a shortcut fires on the main menu, so MainMenu::begin (re-invoked every loop()) rebuilds options from scratch and repaints cleanly - exactly what selecting an option already does. Also gate checkShortcutPress() behind the menuType check so it is not called inside the submenu the shortcut just opened. Without this, while the key is still held the shortcut re-fired and opened a second nested copy of the menu, forcing the user to press ESC twice to back out. Supersedes the redraw logic added in a770691. * docs(keyboard): simplify shortcut-handling comment
* Update sd_functions.cpp * Add scrollableTextArea support & Fix compile error
Updated platform and package URLs for Arduino support.
…rames (BruceDevices#2659) generateRandomWiFiMac() only randomized bytes 1-5 of the MAC, leaving mac[0] as whatever was left on the stack. Force a valid locally-administered, unicast first byte instead. prepareBeaconPacket() wrote the real SSID length into the SSID IE but still padded the SSID field to a fixed 32 bytes before the following tags (Rates, channel, RSN), which desynced every IE after the SSID for anything shorter than 32 chars. Most spammed SSIDs ended up parsed as WEP-only, or dropped entirely by stricter clients. Build the frame at its real length and send that instead of the fixed BEACON_PKT_LEN. randomSeed(1) in beaconAttack() reseeded with a constant every run, and as a side effect also disabled the ESP32 hardware RNG for the rest of the session (Arduino's randomSeed() flips WMath.cpp's s_useRandomHW). Seed rand() directly with millis() instead, so random() keeps using the hardware RNG. Verified on a T-Embed CC1101 Plus with airodump-ng/tshark and a phone WiFi scan: MACs vary per packet and across reboots, spammed SSIDs all show as WPA2 and show up in scans, and channel is read back correctly again.
…enu UX improvements (BruceDevices#2663) * Merge upstream BruceDevices, add Reaper env, handshake dedup, keep forks Squash of 6 commits rebasing Mysteriza/fork on upstream/dev: - Enable Reaper build env, refactor Brucegotchi module - Merge all upstream changes up to Enhanced NDEF emulation (37216c3) - Revert platform to 55.03.36, fix USBHID ENDPOINT_SIZE - Consolidate handshake .pcap by SSID (append mode, no BSSID prefix) - Keep capture engine enhancements: APSTA mode, RAM storage, 3-phase capture, auto-deauth burst, enhancedDeauthMenu - Keep Enhanced AP Info, firmware customizations - Ignore compile_commands.json build artifact 215 files changed, +6257/-1961 * Improve handshake readiness check and fix macro alias - Add thread-safe wrapper sniffer_is_handshake_ready(uint64_t) to query handshake readiness. - Use wrapper in brucegotchi_start instead of direct handshakeReadyBssids lookup. - Expose prototype in sniffer.h and implement with a mutex-protected lookup. - Remove extern handshakeReadyBssids; rely on the wrapper for access. - Track didDeauth state in brucegotchi_start and reset on recon. - Fix ESP32 macro alias: alias CFG_TUD_ENDPOINT_SIZE only if CFG_TUD_ENDOINT_SIZE exists. * revert platform.io
…o the BLE scan mechanism and other compatibility issues additional credits to @Pedro-Jesus-Fuentes-Morcillo for extra critical fixes (BruceDevices#2649) * Fix height calculation and improve task handling Adjust height calculation and replace vTaskDelay with yield for better task management. * Update debounce method in ble_common.cpp Changed debounce method to use yield instead of vTaskDelay. * Refactor UI text and layout in BLE_Suite.cpp Updated user interface text and layout for better clarity. Adjusted text positions and added new messages for device selection. * Reorder and add includes in BLE_Suite.h * Remove TFT color definitions Removed redundant TFT color definitions from BLE_Suite.h as they are now defined in VectorDisplay.h. * Fix String to const char* conversion for text width Refactor text width checks to use c_str() for String conversion. * Update BLE service start comment for NimBLE v2 Updated comments to reflect changes in NimBLE v2 regarding service start behavior. * Fix missing newline at end of file Add missing newline at the end of scrollableTextArea.cpp * Refactor BLE_Suite.h for include and comment clarity Updated include order and comments regarding TFT color definitions. * Update BLE Suite version and improve scanning logic Updated BLE Suite version and fixed target selection logic with callback-based scanning. Improved title handling for display and optimized device data collection. * Fix title truncation and NimBLE compatibility Updated title truncation logic and added 'const' for compatibility. * Update BLE Suite version and scan time settings Updated BLE Suite version and adjusted scan times. * Update last updated date in BLE_Suite.cpp * Refactor TargetSelectionCallbacks for better clarity Updated callback class to use enum for compile-time constant and improved comment clarity. * Refactor BLE scanning to unify active and passive methods Updated BLE scanning process to use a unified approach for both active and passive scans, improving code clarity and functionality. * Reduce active and passive scan time to 10 seconds * Enhance BLE Suite with snapshot support and refactor Added snapshot support for device scanning. Modified semaphore timeout values and refactored several functions to use the new SelectedDevice structure for better data handling. * Enhance BLE_Suite with device info structures and updates Added new structures for device information and snapshots, updated ScannerData with new methods, and modified attack functions to accept SelectedDevice parameters. * Refactor BLE_Suite: Remove unused structs and update scan methods Removed unused structures and updated scanning methods to use new API calls for active and passive scanning. * Implement cleanup function for BLE state management Added cleanupBLESuiteState function to reset BLE state and clear selected device cache. Updated selectTargetFromScan and parseAddress functions to utilize cleanup function for better state management. * Refactor cleanupBLESuiteState to avoid BLE deinit * Enhance comments in ble_common.h for clarity Added comments to clarify BLE scan setup and display functions. * Implement bounds checking for BLE device display Added bounds checking to BLE device display and improved memory management during scanning. * Update BLE scan methods for NimBLE 2.x compatibility * Add compatibility note for NimBLE versions * Refactor BLE scan logic and device management Refactor BLE scanning logic and improve device handling. * Refactor BLE scan logic and remove device limit Removed MAX_DISPLAY_DEVICES limit and updated BLE scan handling. * Fix header guard in ble_common.h * Refactor BLE_Suite.cpp for better state handling Refactor BLE scanning functions to improve state management and remove unnecessary comments. * Clean up comments in BLE_Suite.cpp Removed unnecessary comments related to MAC address validation and scan state cleanup. * Simplify BLE stack management and improve readability Removed conditional checks for LITE_VERSION to simplify BLE stack management. Updated comments for clarity and improved code readability. * Downgrade NimBLE-Arduino library version Downgraded NimBLE-Arduino library version from 2.5 to 2.3.7 in platformio.ini. * Update BLE_Suite.cpp * Fix preprocessor directive closing in BLE_Suite.cpp * Refactor BLE handling for NimBLE 2.3.7 compatibility * Clean up ble_common.h by removing comments Removed commented-out includes and unnecessary comments from ble_common.h. * Refactor BLE_Suite.h with new device structures Updated BLE_Suite.h to include new structures and methods for device information and scanning, while commenting out legacy code for NimBLEExtAdvertising. * Enhance BLE support for NimBLE 2.x Refactor BLE scanning and advertising callbacks for NimBLE 2.x compatibility. Adjusted BLE stack initialization and scanning logic based on NimBLE version. * Update BLE_Suite.cpp * Clean up comments and fix preprocessor directive Removed comment about not clearing scannerData and fixed preprocessor directive formatting. * Implement NimBLE version detection and API adjustments Added version detection for NimBLE and adjusted API usage based on version. Updated scan methods to support both NimBLE 1.x and 2.x. * Enhance BLE common functionality for NimBLE 2.x Refactor BLE handling for NimBLE 2.x compatibility and improve error handling during scanning. * Enhance BLE common header with version detection Added version detection for NimBLE and defined constants for BLE scanning. * Enhance NimBLE version detection and scanning Refactor NimBLE version detection and scanning logic to improve compatibility with different NimBLE versions. Adjust scan time based on available memory. * Refactor NimBLE version detection in BLE_Suite.h Updated NimBLE version detection logic and removed obsolete code. * Refactor BLE scanning memory checks and scan times Refactor memory checks for BLE scanning to use heap size instead of RAM checks. Simplify scan time determination based on available memory. * Refactor BLE initialization by removing radio memory check Removed unnecessary radio memory check for BLE initialization. * Refactor BLE button press enum definition * Fix header guard in BLE_Suite.h * Fix header guard in BLE_Suite.h * Update BLE_Suite.cpp * Check RAM availability before BLE initialization Added a check for available memory before initializing BLE. * Add AdvertisedDeviceCallbacks class for BLE scanning * Fix header guard in BLE_Suite.h * Enhance NimBLE v2 detection and improve comments Added compile-time detection for NimBLE v2 features and updated comments for clarity. * Include ble_common.h and refactor AdvertisedDeviceCallbacks Updated BLE_Suite.h to include ble_common.h and removed the forward declaration of AdvertisedDeviceCallbacks. * Update BLE_Suite.h * Simplify NimBLE version detection logic Refactor NimBLE version detection for reliability and clarity. * Refactor NimBLE version detection logic Updated NimBLE version detection logic for improved reliability and clarity. Added multiple checks for versioning based on macros and included debugging output. * Refactor NimBLE version detection macros * Simplify NimBLE version detection Removed unnecessary NimBLE version detection macros and simplified the definition of NIMBLE_V2_PLUS. * Update NimBLE version detection and callbacks * Modify AdvertisedDeviceCallbacks for NimBLE compatibility Updated AdvertisedDeviceCallbacks to reflect that onScanEnd does not exist in NimBLEScanCallbacks. * Fix include guard and update header includes * Update BLE_Suite.h * Refactor BLE scan callbacks and memory management Refactor BLE scanning and callback handling, improve memory management. * Refactor ble_common.h for NimBLE 2.x updates Updated comments and definitions for NimBLE 2.x compatibility. * Refactor AdvertisedDeviceCallbacks with inline onResult Updated AdvertisedDeviceCallbacks to define onResult inline and handle device scanning logic. * Remove AdvertisedDeviceCallbacks class and instance Removed the AdvertisedDeviceCallbacks class definition and its instance. * Refactor BLE handling and optimize memory usage Refactor BLE code by removing unnecessary comments and optimizing BLE scan setup. Adjust BLE server initialization and callbacks for improved memory management. * Refactor NimBLE version detection and clean includes Updated NimBLE version detection logic and removed dependency on ble_common.h. * Update BLE_Suite.cpp for memory checks Made various adjustments to BLE scanning logic, including memory checks and error handling. * Update NimBLE-Arduino version to 2.5 * Refactor NimBLE version checks and clean up code Refactor NimBLE version detection and remove unused AdvertisedDeviceCallbacks class.
…ruceDevices#2667) allowing users to manually send a deauth without waiting for the 15-second interval.
- Use all_wifi_channels[ch] for beacon.channel in registerBeacon - Iterate registeredBeacons by const reference in sniffer_setup - Compare against all_wifi_channels[ch] instead of ch - Use pdMS_TO_TICKS(2) for the two-millisecond delay
…on on the remote is not available. (BruceDevices#2671)
…BruceDevices#2679) * Display CAPTURED status even without beacons Remove the hasBeacons guard in capture_handshake so CAPTURED status prints whenever phase is CAPTURED. * Implement 4-way EAPOL buffering and flush on M4 - Buffer M1, M2, M3 and M4 in a per-AP 4-way buffer and flush on M4 - Replace M1 buffer with eapol4WayBuffer and track M1..M4 per handshake - Require all four messages (M1–M4) to be considered usable - On M4, write M1–M4 to the PCAP file and clear the buffer - Create target directories if missing; guard against write failures - Clear eapol4WayBuffer on reset
* Implement cleanupDuckyBLE for BLE state management Added cleanup function for BLE state management in ducky_typer. * Add cleanupDuckyBLE function for BLE cleanup Added cleanup function for ducky_typer BLE operations. * Update ducky_typer.h * Refactor BLE cleanup logic in ducky_typer.cpp Removed unnecessary cleanup of BLE state on exit in multiple functions. * Add BLE common header inclusion in ducky_typer.cpp * Refactor ducky_typer.cpp for clarity and efficiency Removed unnecessary comments and cleaned up the code for better readability. Adjusted some logic for handling BLE connections and key inputs. * Fix preprocessor directive closing in ducky_typer.cpp * Update ducky_typer.h * Refactor ibeacon function for better BLE handling Refactor ibeacon function to avoid reinitializing BLE stack and improve advertising logic. * Refactor ibeacon function to use NimBLEAdvertising * Refactor iBeacon function to use existing BLE stack * Update ibeacon function for BLE initialization and advertising Refactor ibeacon function to use BLEDevice::init() and adjust advertising logic. * Fix function definition for spamMenu * Improve cleanupDuckyBLE function Refactor cleanupDuckyBLE to delete hid_ble and log the action. * Optimize memory usage in ducky_typer.cpp Refactor Ducky Typer code to optimize memory usage by storing large command structures in PROGMEM. Update command parsing and handling to improve performance and reduce heap fragmentation. * Refactor BLE cleanup and command handling functions Updated cleanupDuckyBLE and ducky_startKb functions for better RAM management and clearer logging. Refactored key_input function to improve string handling and command parsing. * Refactor BLE cleanup and initialization process * Refactor BLE stack management in ducky_typer.cpp * Refactor BLE iBeacon handling and initialization Refactored BLE iBeacon functionality to ensure proper button handling and stack initialization/deinitialization. Added necessary includes and improved readability. * Refactor BLE initialization and scanning logic Refactor BLE initialization and scanning logic for improved memory management and error handling. * Update BLE_Suite.cpp with fixes Made various fixes throughout the code to ensure proper initialization and handling of BLE state and attacks. * Refactor BLE cleanup and initialization code * Improve BLE memory check and WiFi handling Enhanced memory management for BLE by attempting to free WiFi if DMA memory is insufficient. * Refactor BLE cleanup and initialization logic Updated cleanupDuckyBLE to optionally perform a full cleanup. Enhanced BLE stack management during cleanup and initialization processes. * Improve cleanupDuckyBLE function implementation Refactor cleanupDuckyBLE function for clarity and efficiency. * Refactor BLE cleanup and initialization functions * Add functionId parameter to ducky_startKb function * Refactor BLE function IDs to use integers directly * Refactor BLE handling and update comments Updated comments for clarity and consistency regarding function IDs and BLE initialization. Improved safety checks during BLE cleanup and initialization. * Update BLE cleanup function to handle multiple HID types Refactor BLE cleanup and HID instance management. * Update ducky_typer.h * Update ducky_typer.h * Declare hid_ble for active BLE instance Added extern declaration for active BLE instance. * Introduce BLE HID instance management Added support for a BLE HID instance and updated cleanup logic. * Refactor BLE cleanup process for safety and efficiency Refactor cleanup functions for BLE HID instances to ensure proper deinitialization and safety. Implement double cleanup with delays to handle lingering instances and prevent memory leaks. * Add safeCleanupDuckyBLE function for DuckyBLE Added a new function for safe cleanup of DuckyBLE instances with a cooling delay. * Fix header guard in ducky_typer.h * Add function-specific MAC addresses for Logitech devices * Refactor MAC address setting for BLE * Remove unused Bluetooth includes Removed unused Bluetooth headers from ducky_typer.cpp * fix reconnection --------- Co-authored-by: Pirata <bmorcelli@gmail.com>
…vices#2684) Only Android's /generate_204 probe was redirected, so Windows and Linux concluded they had internet and never opened the sign-in page: - /ncsi.txt, /connecttest.txt and /success.txt returned the expected "online" bodies (Microsoft NCSI / Microsoft Connect Test / success), telling Windows and Firefox/Linux the network was up. - The Ubuntu/NetworkManager probe reaches "/" with the original domain in the Host header and was served the portal HTML as 200, which is not reliably read as a captive portal. Changes: - ncsi.txt, connecttest.txt, success.txt and the Firefox success probe now return 302 to the AP instead of 200. - portalController: requests whose Host header is a domain (not the AP IP) are treated as OS connectivity probes and get a 302 to the portal; direct page loads (Host = AP IP) still receive the HTML. - onNotFound: broaden the redirected-probe keywords (ncsi, nmcheck, gnome, ubuntu, canonical, networkcheck, hotspot). On Windows 11 the portal opens automatically on connect. On Android, iOS and Linux GNOME/Zorin a captive-portal sign-in notification appears and opens the portal once tapped. macOS could not be tested as I don't have a device to try it on. Closes BruceDevices#2646
…ait) (BruceDevices#2690) * fix(rf): keep Custom SubGhz picker in the current folder after sending The Custom SubGhz file picker always reopened at /BruceRF after each transmission, so sending several signals from the same subfolder forced the user to re-navigate the whole tree every time. Remember the folder of the last selected .sub and reopen the picker there on the next iteration. Refs BruceDevices#852 (closed as completed but the bug is still present in dev) * fix(rf): don't block on a key press after sending a Custom SubGhz file Sending a .sub was a bit confusing: after "Sent x/x" showed up there was a short wait, then it blocked waiting for a key press, and then yet another wait after pressing before the message finally went away. You couldn't really tell if pressing a button was doing anything to dismiss it. RF transmission is instant and the result is already on screen, so that manual confirmation isn't needed. Drop the key-press wait so the picker just reopens on its own.
Fixes: BruceDevices#2691 BruceDevices#2685 Removes BLE dead code
don't need it if theres a vTaskDelay in the loop, giving room to other tasks on tight loops
The 4-way handshake feature (BruceDevices#2679) made saveHandshake() require and buffer M1-M4 before flushing to file, with the beacon only appended afterwards once the handshake is already complete. wifi_recover.cpp's pcap parser stops reading as soon as it has seen M2 and M3, which now happens before the beacon record is ever reached, so hs.ssid stays empty and PBKDF2 falls back to a manual/incorrect SSID, breaking dictionary cracking (BruceDevices#2693). Cache the last raw beacon frame seen per AP and write it as the first pcap record when the handshake file is created, so the SSID is always available before the parser's early-exit condition is hit.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7236111e49
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+306
to
+312
| if (!pServer) { | ||
| if (!initBLEServer()) { | ||
| displayError("Failed to init BLE server"); | ||
| return; | ||
| } | ||
| } | ||
|
|
There was a problem hiding this comment.
This path removed the previous pService->start() call before advertising; initBLEServer() only creates the service/characteristics and then returns. In the BLE Send flow, the device can advertise without the RX/TX GATT service being started, so clients will not discover the characteristics needed to send data. Start pService before getAdvertising()->start().
Useful? React with 👍 / 👎.
Comment on lines
+4528
to
+4537
| } else if (check(NextPress)) { | ||
| delay(150); | ||
| if (currentIndex < (int)deviceCount - 1) { | ||
| currentIndex++; | ||
| if (currentIndex >= scrollOffset + maxVisibleItems) | ||
| scrollOffset = currentIndex - maxVisibleItems + 1; | ||
| } else { | ||
| currentIndex = 0; | ||
| scrollOffset = 0; | ||
| } |
There was a problem hiding this comment.
In the new multi-target selector, the UI says NEXT: Confirm, but this branch only advances currentIndex; the only code after the loop that returns selected targets is unreachable because exitMenu is set only by the Esc path, which clears the targets and returns immediately. As a result, users can toggle targets but can never confirm them, so runMultiTargetAttack() never receives any selected devices.
Useful? React with 👍 / 👎.
Comment on lines
+1190
to
+1193
| case BLE_SPAM_ATTACK_APPLE_ACTION: { | ||
| // Action modals (SetupNewPhone, AppleTV etc.) use dynamic Continuity NearbyAction | ||
| // packets (MarlinSchuck) — these trigger iOS popups more reliably than static payloads | ||
| return bleSpamBuildAppleContinuityAdvertisement(advertisementData); |
There was a problem hiding this comment.
When a user chooses a specific Apple Action modal, deviceIndex is ignored here and the builder always generates a random NearbyAction from continuity_na_actions; the per-action table's payload_name is never used. Selecting entries like HomePod Setup or Apple TV Audio Sync can therefore emit an unrelated action packet, making the per-device Apple Action menu misleading and unreliable.
Useful? React with 👍 / 👎.
Comment on lines
+250
to
254
| // heap-allocated (not stack) to keep this buffer off the task stack; freed before | ||
| // every return below | ||
| uint8_t *buff = (uint8_t *)malloc(bufSize); | ||
| // tft.drawRect(5,tftHeight-12, (tftWidth-10), 9, bruceConfig.priColor); | ||
| while ((bytesRead = source.read(buff, bufSize)) > 0) { |
There was a problem hiding this comment.
This changes the copy buffer from static storage to heap allocation, but the result is used immediately by source.read(buff, ...) without checking for nullptr. On low or fragmented heap devices, copying a file can crash instead of failing cleanly; check the allocation and close the opened files before returning an error.
Useful? React with 👍 / 👎.
…bucket sniffer() forced the SSID label to the literal string "UNKNOWN" whenever it was unresolved, and sanitizeSsid() did the same. buildHandshakePath() already had MAC-based fallback naming for an empty SSID, but it was unreachable dead code since the label was never actually empty by the time it got there. Result: every AP whose SSID hadn't been resolved yet (e.g. hidden SSID, or handshake completing before a beacon was seen) got written to the same "HS_UNKNOWN.pcap" file, mixing multiple unrelated networks' handshakes together and breaking wifi_recover.cpp's single-AP parser. Leave the SSID label empty when unresolved so the existing MAC fallback in buildHandshakePath() actually runs, giving each AP a unique filename.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
18 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Greatly Improved UI
Add Delay selector (10ms-10000ms)
Add Individual advertisement selecting
Add Mac Address Randomisation frequency selector