search

BastilleResearch / mousejack

MouseJack device discovery and research tools
GNU General Public License v3.0
1.28k stars 254 forks source link

HackRF #8

Closed lineasmagicas closed 8 years ago

lineasmagicas commented 8 years ago

Hi! Its Works with HackRF?

Thanks

marcnewlin commented 8 years ago

It is difficult to implement two way communication between a software defined radio and wireless mouse USB dongle due to timing constraints. There are two things to consider.

ACK Timeouts

The HackRF us a half-duplex SDR, meaning that it cannot transmit and receive at the same time. In order to effectively communicate with a wireless mouse USB dongle, it is necessary to be able to receive ACK packets.

The nRF24L series of transceivers has ACK timeouts as low as 250 microseconds. To decode ACKs in this window, a SDR would need to switch from transmit to receive in well under 250 microseconds. USB latency alone makes this impossible to do from the host computer, so an implementation would need to be done in FPGA.

Retune Time

This is not a hard constraint, but adds complexity to the research process. The nRF24L Enhanced Shockburst protocol is not inherently a frequency hopping protocol, but the transceivers are capable of fast retuning, and most vendors use a "frequency agility" mechanism to change channels to avoid interference.

The retune time on the nRF24L chips is very low compared to the HackRF, making it difficult to sniff 100% of the packets without dedicated hardware.

lineasmagicas commented 8 years ago

Thanks Marc.