bluekitchen / raccoon Goto Github PK

Hi,

Thanks for providing such a great tool :-)

I'm using the makerdiary nRF52840 MDK USB dongle, replaced the UF2 bootloader
with the Open bootloader, and wrote nrf52840_xxaa.hex to it using nRF Connect.

My config.py:

   { 'port':'/dev/ttyACM0', 'baud':1000000, 'rtscts':1 }
]

Some sample output (addresses edited a bit):

[+] Config: output trace.pcap (pcap), min rssi -80 dBm- filter: f3:ca:88:12:34:56
[-] Sniffer #0: port /dev/ttyACM0, baud 1000000, rtscts 1, channel 37, version 
[+]  1. 5a:96:8b:00:00:00         ADV_IND  -49 dBm, 
[+]  2. f3:ca:88:12:34:56         ADV_IND  -54 dBm, Name: 'KL-TNS-88123456'
[+]  3. 54:a2:0a:00:00:00         ADV_IND  -53 dBm, 
[+]  4. f3:ca:88:12:34:56        SCAN_RSP  -53 dBm, UUID16: 0001
[+]  5. 54:a2:0a:00:00:00        SCAN_RSP  -53 dBm, 
[+]  6. 5a:96:8b:00:00:00        SCAN_RSP  -41 dBm, 
[+]  7. 74:34:34:00:00:00    ADV_SCAN_IND  -80 dBm, UUID16: FE9F
[+]  8. 74:34:34:00:00:00        SCAN_RSP  -80 dBm, 
[+] 
Thanks for using raccoon.

The f3:ca:88 device is a motion sensor. I connect to it using an iPhone app,
but the connection is not captured. Do you have any idea what could be the issue?

Thanks :-)

Hi!

I followed your guides with no problem at all until I try to actually sniff packets, moment in which I get nothing.

My config at pyclient/config.py

# Raccoon BLE Sniffer Config

# Output format
# pick one of the following logging formats by uncommenting the format line

# PKLG format minimics HCI data to/from a Bluetooth Controller. It can be opened with Wireshark and Apple's PacketLogger
# format  = 'pklg'

# PCAP format uses Bluetooth BLE Trace format defined by libbt/Ubertooth for use with CrackLE. It can be opened with Wireshark
# format = 'crackle'

# PCAP format uses Bluetooth BLE Trace format defined by Nordic. It can be opened with Wireshark.
format = 'pcap'


# Available Sniffer devices
# List of detected serial ports, please uncomment your Raccoon BLE Sniffer devices
sniffers = [
#   { 'port':'/dev/ttyS0', 'baud':1000000, 'rtscts':1 },  # ttyS0 - PNP0501}
   { 'port':'/dev/ttyACM0', 'baud':1000000, 'rtscts':1 },  # raccoon nrf52840 dongle - USB VID:PID=1915:520F SER=000000000000 LOCATION=2-4.2:1.0}

]

Commands log

If I run raccoon just after plugging the board, I get this:

> 1 $ ./pyclient/raccoon.py 
[+] Config: output trace.pcap (pcap), min rssi -80 dBm
[!] Failed to connect to sniffer at port /dev/ttyACM0 with 1000000 baud
[!] No working sniffer found. Please connect sniffer and/or update config.py

And as soon as I wait just a little, I can connect with no more errors ... but also with no more information:

> 1 $ ./pyclient/raccoon.py 
[+] Config: output trace.pcap (pcap), min rssi -80 dBm

After seeing the commit flow, I will reference both @mringwal and @xiongyihui, as I think they may be the right two to be asked hehehe

Do you have some idea on how to continue? Tell me whatever you need to debug it :)

Thanks a lot in advance

hi, is it possible to install your firmware on an nRF52840 Dongle to sniff ble tags nearby?
after uploading your firmware is it possible to use the nRF52840 Dongle via the linux hcitool command?

Hi there,
I've flashed the hex file successfully following the README using nrfConnect but the dongle still loads the bootloader (pulsing red LED), not the application, although it reports that the programmer found an application after reseting the dongle by replugging it. Also I can see that there is an application present via the GUI.
Any idea what is going on here?
Thx

After following a connection, the LED on the pca10059 doesn't start flashing again.

Looking at raccoon.py, the restart CMD_SNIFF_CHANNEL only sends a 19 byte payload, compared to the 20 byte payload during initial setup. It omits the min RSSI value. Increasing this packet to 20 bytes and providing the same min RSSI value results in happy LEDs and, by the look of things, ongoing packet capture.

Hi,
I have a NRF52832 Sparkfun breakout board and a NRF52832 MDK. Would like to add support for either of these so that I can use it to sniff the other (maybe the breakout is easier). Could you give me a few pointers on how to port the firmware to these? I have looked at the files for each board and it seem there's some autogenerated header files.

Thanks!

When using multiple raccoon devices, it happens that read time on a device result in a negative timestamp.

For that, pack function of struct is bad formatted

The generic CJMCU-8223 board uses an nRF51822, the same as the Adafruit blefriend32 boards. The Nordic sniffer firmware used on the pre-flashed Adafruit sniffer dongle works fine on the 8223 (both v1 and v2) but unfortunately, some of the UART flow control pins set up by the official firmware aren't broken out on the 8223, so I decided to give Raccoon a shot.

I thought it would be as simple as modifying firmware/nrf/blefriend32/config/custom_board.h to set the LED and UART pins I'd like, compile, flash, everything would work (considering it's the same chip) but Raccoon firmware immediately traps in a HardFault when building and flashing unmodified from git:

> halt
target halted due to debug-request, current mode: Handler HardFault
xPSR: 0x21000003 pc: 0x0000097e msp: 0x20007fe0

Flashing with openocd -f flash_blefriend32.cfg:

Open On-Chip Debugger 0.11.0
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
WARNING: interface/stlink-v2.cfg is deprecated, please switch to interface/stlink.cfg
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
Info : clock speed 1000 kHz
Info : STLINK V2J29S7 (API v2) VID:PID 0483:3748
Info : Target voltage: 3.304653
Info : nrf51.cpu: hardware has 4 breakpoints, 2 watchpoints
Info : starting gdb server for nrf51.cpu on 3333
Info : Listening on port 3333 for gdb connections
target halted due to debug-request, current mode: Thread 
xPSR: 0xc1000000 pc: 0x0000093c msp: 0x20008000
Info : nRF51822-QFAA(build code: H2) 256kB Flash, 16kB RAM
Info : Mass erase completed.
Info : A reset or power cycle is required if the flash was protected before.
target halted due to debug-request, current mode: Thread 
xPSR: 0xc1000000 pc: 0xfffffffe msp: 0xfffffffc
** Programming Started **
Warn : Adding extra erase range, 0x00007d6c .. 0x00007fff
** Programming Finished **
** Verify Started **
** Verified OK **

Please let me know what additional information you need, or additional things I should try. I'm not very experienced with the arm toolchain (and on-chip debugging) so any help would be greatly appreciated.

Fedora 36
arm-none-eabi-binutils-cs-1:2.37-4.fc36.x86_64
arm-none-eabi-gcc-cs-1:11.1.0-2.fc36.x86_64
arm-none-eabi-gcc-cs-c++-1:11.1.0-2.fc36.x86_64
arm-none-eabi-newlib-4.1.0-4.fc36.noarch