Skip to content

NodeMCU ESP8266 CC1101 Sub1GHz OOK transmitter & brute forcer w/ pre-saved signals (e.g. TouchTunes Jukebox)

Notifications You must be signed in to change notification settings

Offensive-Wireless/RFmoggy

 
 

Repository files navigation

NodeMCU ESP8266/ESP32 wifi version of RfCat RfKitten using inexpensive CC1101

The code is not memory efficient, but it runs fine (didn't pass any variables e.g. String by reference, etc.)

I tried to keep the INO code simple so users & beginners can easily understand, mod, create your own personalized version of RFmoggy

ESP32 support

RFMoggy is now compatible with ESP32

It uses an ESP32 + CC1101 module with the following connections:

sck = 18 miso = 19 mosi = 23 csn = 5 gdo0 = 2 gdo2 = 4

You can use the hola.ino sketch with the following configuration:

  • Board - "ESP32 Dev Module".
  • Flash Size - "4MB (32Mb)".
  • CPU Frequency - "240MHz (WiFi/BT)".
  • Flash Frequency - "80MHz"
  • Flash Mode - "DIO"

Information

CC1101 Registers set to transmit OOK signals only

ELECHOUSE_CC1101_SRC_DRV.cpp ******************************

Modified version of LSatan CC1101 library

Added set_rxbw function (copied from LSatan debug tool)

Added set_drate

Added split_mdmcgf4

Added set_mhz (repetitive, for testing)

Added setPktLen (not needed even though rfcat examples always use it in fixed length mode)

Added setIdle (for testing. MCSM1 register sets to idle automatically)

Added all registers to Init function. Got register values for ASK/OOK from docs&smartrf studio, space teddy, rfkitten

Modded setMHz to change TEST0 register

Modded setCCMode. Changed serial mode to TX FIFO, packet has no address, length, or crc bytes

Modded SendData. Removed SFTX (tx fifo flush). Not needed if no Underflow, make sure packet sizes equal PKTLEN register!

Modded SendData. Don't send length byte as first byte in TX FIFO.

rfmoggy_minimal_wifiClient.ino **********************************

Connects to your wifi network. Simple web interface

Touchtunes Jukebox Menu - Signals for controlling jukeboxes commonly found in US bars

Garage Door Menu - Signals for brute forcing DIP Switch remote controls. Protocols extracted from KLIK3U Universal Garage Door Remote

De Bruijn Menu - Generates De Bruijn sequences for garage door models. From Samy Kamkar Open Sesame

RfPwnOn Menu - Creates an OOK binary signal for brute forcing and/or transmitting

About

NodeMCU ESP8266 CC1101 Sub1GHz OOK transmitter & brute forcer w/ pre-saved signals (e.g. TouchTunes Jukebox)

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • C++ 100.0%