Skip to content

v3.3.0 — NRF Sniffer, MouseJack, BLE Ducky

Choose a tag to compare

View all tags
@JesseCHale JesseCHale released this 12 Mar 03:11
· 25 commits to main since this release
v3.3.0
3b8633f

What's New

NRF Promiscuous Sniffer

  • Travis Goodspeed promiscuous receive mode on NRF24L01+PA+LNA
  • Captures raw 2.4GHz packets from wireless keyboards, mice, drones, IoT sensors
  • Channel hopping across all 126 channels (Core 0 task)
  • Tap any captured device address to auto-populate MouseJack target
  • Nosifer UI with animated skull row, scrollable packet list, hex dump detail view

MouseJack Keystroke Injection

  • Inject keystrokes into Logitech Unifying, Dell, Microsoft wireless keyboards
  • Fixed Logitech HID++ packet format: 0xC1 frame type, LRC checksum, 16-bit CRC
  • Full HID scancode keymap: a-z, 0-9, symbols, F1-F12, arrows, modifiers
  • Pre-built payloads: reverse shell (PowerShell/bash), WiFi exfil, custom string
  • Core 0 injection task with 10ms inter-keystroke timing

BLE Ducky — BLE HID Keyboard Injection

  • ESP32 acts as BLE HID keyboard via ESP32-BLE-Keyboard library
  • Target pairs with "HaleHound KB", then receives injected keystrokes
  • Pre-built payloads: reverse shell, Rick Roll, custom string entry
  • 50ms BLE keystroke timing, progress display, pairing status

AirTag Attack Suite (AirTag Hub)

  • Phantom Flood — FindMy OF advertisement flood with random public keys
  • AirTag Replay — Sniff & replay real AirTag BLE identity
  • Find You — Stealth AirTag clone with P-224 EC key rotation (15-120s key rotation below Apple anti-stalking threshold)

WhisperPair — CVE-2025-36911 Exploit Chain

  • Full attack phase added: scan, probe, and exploit Google Fast Pair devices
  • GATT-based Key-Based Pairing characteristic probe for unauthorized pairing
  • Loot Viewer for browsing discovered vulnerable devices

Unified Loot Manager

  • Centralized loot storage and browsing across all attack modules
  • WhisperPair Loot Viewer with full device detail display
  • GPS coordinate tagging for wardriving loot

E32R28T Board Support

  • Full support for QDtech E32R28T 2.8" board
  • VALHALLA protocol for board identification
  • Custom skull art and per-board skull watermarks (240x320 and 320x480 variants)
  • GPIO 0 fix for E32R28T boot behavior
  • Pre-compiled binaries now included in flash_package

BLE Database Integration

  • 94 company IDs, 73 service UUIDs, 52 GAP appearances — all PROGMEM binary search
  • Source: Nordic Semiconductor bluetooth-numbers-database v1.0.4
  • BLE Sniffer now shows manufacturer names and device types

Dual-Core 2.4GHz Scanner + Analyzer

  • NRF24 Scanner and Spectrum Analyzer now run scan on Core 0, draw on Core 1
  • Significantly faster scan rates with smooth UI updates

CC1101 E07-PA Module Support

  • PA module control added to all SubGHz operations
  • E07-PA wiring diagram added to Radio Test pages
  • Proper power amplifier enable/disable for E07 modules

EAPOL Capture — AP List Pagination

  • Scrollable AP list for networks with many access points
  • No more truncated scan results on busy networks

Bug Fixes

  • Fixed WiFi/BLE radio handoff — proper teardown for cross-module transitions
  • Fixed residual touch exits + GPIO0 bug across all modules
  • Fixed BLE Sniffer instant-exit on E32R28T + Classic BT memory release
  • Fixed NRF24 SETUP_AW register persistence across ESP32 reset (promiscuous sniffer cleanup)
  • Fixed boot NRF24 detection false positive after sniffer use
  • Fixed 3.5" CYD bugs: attack popup touch zones, RFID brute crash, wardriving layout
  • SubGHz analyzer speed improvements + replay noise filter
  • DRAM optimization: reduced BLE sniffer device array, const-qualified icon arrays

UI Polish

  • NRF Sniffer and MouseJack screens: Nosifer headers, rounded frames, skull rows
  • Per-board skull watermarks for CYD 2.8", CYD 3.5", and E32R28T
  • E07-PA wiring diagram in Radio Test
  • Improved boot mismatch warning — mentions E32R28T and HAT by name

Supported Boards

Board Build Target
CYD 2.8" (ESP32-2432S028) esp32-cyd
QDtech E32R28T esp32-e32r28t
NM-RF-Hat esp32-cyd-hat

Note: CYD 3.5" (ESP32-3248S035C) is temporarily excluded from this release due to a DRAM overflow caused by the GT911 touch driver. Will be fixed in a follow-up release.

Pre-Compiled Binaries

File Board Flash Address
HaleHound-CYD-FULL.bin CYD 2.8" 0x0 (single file)
HaleHound-CYD.bin CYD 2.8" 0x10000 (4-file method)
HaleHound-CYD-HAT-FULL.bin NM-RF-Hat 0x0
HaleHound-CYD-HAT.bin NM-RF-Hat 0x10000
HaleHound-E32R28T-FULL.bin QDtech E32R28T 0x0
HaleHound-E32R28T.bin QDtech E32R28T 0x10000

Flash instructions: see FLASH_INSTRUCTIONS.txt in the release.

Requirements

  • NRF24L01+PA+LNA module required for NRF Sniffer, MouseJack, WLAN Jammer, Proto Kill
  • CC1101 module required for SubGHz attacks (standard HW-863 or E07-PA supported)
  • BLE Ducky uses ESP32's built-in Bluetooth — no external hardware needed
  • GPS module on GPIO 3 (P1 connector) required for wardriving
Assets 2
Loading