_ _
.k$$$$$g, ,g$$$$$k.
.k$$$$$$$$$$$a. .a$$$$$$$$$$$k.
.J$$$$$?' `?$?^?, ,?^?$?` `?$$$$$L.
JS$$SI!a, _.JS$ ?, ,? $SL._ ,a$!IS$$SL
k$$$SI!:?$$$$$$$$$xu$$j j$$ux$$$$$$$$$?:!IS$$$k
:I$$SI:J$$?*"$$$$4^?*?: :?*?^4$$$$"*?$$L:iIS$$I:
:IS$$SiJ?` _.'$?`/' ': :' '/'?$'._ `?LiS$$SI:
?ISSik? _ ', ` . ,' _ ?kiSSI?
?i$?` _ k$ . :. $k _ `?$i?
'?I:-?z$$I _._.' ._._ I$$z?-:I?'
'*?- '?$$a louSxuS? ?xuSxuol a$$?' -?*'
i$$$$$$$$$$$S S$$$$$$$$$$$i
?$$$?- -?$$$?
██░ ██ ▄▄▄ ██▓ ▓█████ ██░ ██ ▒█████ █ ██ ███▄ █ ▓█████▄
▓██░ ██▒▒████▄ ▓██▒ ▓█ ▀ ▓██░ ██▒▒██▒ ██▒ ██ ▓██▒ ██ ▀█ █ ▒██▀ ██▌
▒██▀▀██░▒██ ▀█▄ ▒██░ ▒███ ▒██▀▀██░▒██░ ██▒▓██ ▒██░▓██ ▀█ ██▒░██ █▌
░▓█ ░██ ░██▄▄▄▄██ ▒██░ ▒▓█ ▄ ░▓█ ░██ ▒██ ██░▓▓█ ░██░▓██▒ ▐▌██▒░▓█▄ ▌
░▓█▒░██▓ ▓█ ▓██▒░██████▒░▒████▒░▓█▒░██▓░ ████▓▒░▒▒█████▓ ▒██░ ▓██░░▒████▓
▒ ░░▒░▒ ▒▒ ▓▒█░░ ▒░▓ ░░░ ▒░ ░ ▒ ░░▒░▒░ ▒░▒░▒░ ░▒▓▒ ▒ ▒ ░ ▒░ ▒ ▒ ▒▒▓ ▒
▒ ░▒░ ░ ▒ ▒▒ ░░ ░ ▒ ░ ░ ░ ░ ▒ ░▒░ ░ ░ ▒ ▒░ ░░▒░ ░ ░ ░ ░░ ░ ▒░ ░ ▒ ▒
░ ░░ ░ ░ ▒ ░ ░ ░ ░ ░░ ░░ ░ ░ ▒ ░░░ ░ ░ ░ ░ ░ ░ ░ ░
░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░
HaleHound-CYD v3.9.5
KARR module landed, and Replay capture got rebuilt.
What's New
KARR — detection and vulnerability assessment. SouthWest Dealer Services BLE car alarms, the "QT" and "DR" units riding in roughly 2.85 million 2017-and-newer Kia, Honda, Toyota, Mazda and Ford vehicles.
Scan until a unit shows up, tap it, and the module figures out on its own what generation it is and whether it's exploitable. You get a straight verdict — VULNERABLE, PATCHED, or needs a key — and it sends no commands to reach it.
Replay capture, rebuilt. The module used to open on a blind all-band sweep. Now it opens on a target picker — seven curated hunts (Rolling Code, RF600/FM, Gate/Garage, Car/Alarm, 315, Fixed, Wide Recon), each carrying its own tuning and its own playbook you can read right on the device. Pick a hunt and it stays in that band instead of spraying across all fourteen frequencies.
Capture got fixed where it counted. FSK and FM fobs were being thrown out by checks written for OOK, so real presses vanished. A short press now catches on the first frame. KeeLoq reads on one press — a field tool does not get a second press on a target.
Saved signals moved off EEPROM onto the card: four slots became sixty-four, in a scrolling paged menu. A color-coded banner tells you what the radio is doing at arm's length — LISTENING, SCANNING, CAPTURED, TRANSMITTING. Once you have something, the bar turns into three labeled buttons: REPLAY, SAVE, CLEAR. The back arrow returns you to the hunt picker instead of dumping you out of the module, and the skull is a real exit. Raw OOK pulse dumps write to the card for reversing a fob at your desk.
A proper KeeLoq reader for RF600E and FM fobs. Reads serial and button on a single press.
Vendor names in the station scanner. Put the IEEE registry on the SD card and the WiFi station scanner names the hardware it finds instead of showing you bare MAC addresses. Forty thousand entries, searched straight off the card, so it costs nothing in memory. No card, no file — it falls back to the built-in list exactly as before.
Bluetooth tools used to get unreliable once you had opened a few of them in a row. Open them back to back now and they hold.
Full GATT dumps to the card. SkeletonKey and Predator write out every service, characteristic, descriptor and value they find. Pull the SD and read the whole tree.
Chameleon tells you when a read came up short. Partial NTAG reads get flagged, and crack progress reports honestly as N of 16 instead of implying it finished.
Fixes
Replay opens straight away. Coming back into Replay after another radio module used to click, sit for a few seconds, then open. That stall is gone.
Dead SubGHz bands are gone. The 868, 915 and 925 entries are off the list — the radio in these units cannot hear up there, and leaving them in only produced silence that looked like a bug.
The card mounts after radio work. Coming out of a radio module and into Loot no longer reads an empty card.
Long wardriving sessions stay steady. Every logged row used to chew through memory a piece at a time — a ten-thousand-row drive did roughly a hundred and fifty thousand tiny allocations. Now it's one buffer and no churn.
Jammers take up less room. The skull artwork on the jammer screens were eating a large block of memory every time you opened one. Same look, a quarter of the footprint.
Predator's honeypot says where it is. On-screen status through each stage instead of a screen that just sits there.
Boards
E32R35T (3.5"), CYD (2.8"), E32R28T (2.8"), and the NM-RF Hat.
⣀⡀⣀⢀⡀⢀⡀⣀ ⣀⢀⡀ ⡀⢀ ⣀⢀⡀⢀⡀
⢀⡀⣛⠘⠿⢦⠤⣽⢟⣿⢻⡟⣾⡏⣹⣿⣿⢻⡟⣿⣾⣿⣿⡿⣿⢿⣿⣌⣿⢸⡷⢤⡄⢚⢀⡀
⣀⢀⣀⣀⣀⢀⣀⣈⣁⣉⣀⣀⣀⣀⣉⣈⣁⣀⣀⣀⣀⣉⣀⣁⣀⣁⣉⣉⣀⣈⣀⣀⣀⣉⣈⣉⣀⣀⣀⣀⣈⣈⣁⣀⣀⣀ ⣀
⣤⠐⢶⢻⡟⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⢠⡇
⢀⣀⣠⣄⣤⣀⣤⣤⣤⣤⣤⣤⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣍⣭⣭⣭⣭⣥⣭⣭⣭⣭⣥⣭⣭⣭⣬⣭⣭⣥⣤⣤⣤⣤⣤⣤⣄⣤⣀⣄⣀⡀
⣴⠸⠟⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⢿⠿⠿⠉⠉
⢀⡀⣶⣦⣶⣴⣶⣴⣤⣴⣶⣶⣼⣦⣿⣶⣾⣶⣶⣾⣧⣿⣾⣷⣾⣷⣿⣶⣶⣶⣶⣶⣦⣶⣶⣶⣶⣷⣿⣶⣶⣶⣶⣶⣶⣿⣾⣷⣴⣦⣶⣦⣤⣤⣦⣴⣦⣴⢠⣦⣤⡆⣴⣤⣤⣤⣤⣤⣄
⠸⠇⠿⠻⢿⠿⠿⠿⠿⡿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠟⠛⠃
⡤⢰⣶⣶⣶⣾⣷⣿⣶⣿⣾⣷⣿⣶⣿⣶⣷⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⣷⣿⣿⣿⣾⣿⣿⣷⣿⣾⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣾⣷⣿⣧⣶⣰⣶⣤⣤⣤⣴⣶⣴⣶⣶⣶⣤⣶⣶
⠛⠘⠛⠛⠛⢿⠿⣿⠿⠿⠿⠿⠿⠿⠿⠿⠿⢿⠿⠿⠿⠿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⢿⣿⣿⡿⣿⠿⠿⠛⠛⠛⠛⠛⠛⠛⠛⠋⠛⠛⠛⠛⠛⠛⠁⠛⠘⠃⠐⠂
⢠⠶⣾⣶⣶⣶⣶⣶⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣾⣿⣿⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣾⣿⣿⣾⣿⣿⣷⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣶⣿⣾⣷⣿⣷⣾⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⠶⣶⣶⣦⣤⣀
⠉⠉⠛⠈⠛⠙⠋⠙⠛⠛⠛⠛⣿⠿⢿⣻⣿⢿⡟⢿⠿⠿⠿⠿⢿⡿⣿⠿⠿⢿⡿⣿⠿⣿⢿⡿⢿⡟⠿⠿⣿⣿⡿⣿⠿⣿⢿⡟⠿⠿⠿⠻⡿⢿⡟⠛⠛⠛⠛⠛⠛⠛⠋⠙⠋⠛⠋⠛⠉⠛⠋ ⠘⠁⠉ ⠋⠉⠁⠈⠉⠉
⢰⢿⣷⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⢿⡿⣿⣿⡾⢻⡟⣿⠿⣿ ⡆
⣀⢀⡀⣀⡘⢋⣀ ⣉⣉⣉⣈⣁⣙⡛⣁⣉⣉⣉⣉⣛⢛⣛⣛⣋⣛⣛⣛⣻⣿⣿⡟⣿⣿⣿⣿⡟⣿⣿⣿⣻⣟⣻⣛⣛⢛⣻⣿⣟⣛⣿⣿⣻⡟⣿⣟⣿⢛⣛⢛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣉⡋⣛⡙⣛⠉⡀⠘⠁⠉⡈⠁⣈⡁⢉ ⠁⠈⠃
⠋⠠⠏⠘⠁⡿⢹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⣿⡿⣿⢻⡿⣹⡇⣿ ⣓ ⡀
⢀⣀⣀⣈⣉⣩⣅⣄⣀⣭⣉⣍⣁⣈⣉⣩⣍⣩⣉⣭⣭⣿⣩⣍⣽⣭⣩⣭⣭⣭⣍⣭⣉⣍⣩⣍⣭⣉⣭⣩⣍⣩⣉⣭⣩⣍⣩⣍⣩⣉⣉⣉⣍⣉⣉⣭⣉⣉⣉⣍⣉⣉⣉⣩⣁⣉⢉⣉⢈⡁⣉⣀⣉⣉⣉⣁⣀⣈⣀⣈⣀⣁⣉⡁⠈ ⠁ ⠁
⠂⠚⠉⠛⠩⠟⠟⠻⣿⢿⣿⢿⣿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⢿⣿⡿⠿⣿⢿⣿⣿⡿⣿⣿⣿⢹⣿⠿⠏⣿⢩⣿⣿⣿⣿⣿⣿⢿⡟⢹⡟⣤
⣠⣤⣤⣤⣤⣤⣤⣴⣤⣤⣤⣤⣤⣤⣤⣤⣤⣤⣤⣭⣼⣿⣿⣿⣿⣭⣭⣭⣭⣭⣭⣭⣤⣤⣤⣤⣤⣬⣥⣤⣄⣬⣭⣥⣬⣥⣭⣅⣤⣤⣬⣤⣄⣠⣄⣤ ⣤⣠⣤⣤⣴⣮⣤⣤⣤⣤⣤⣤⣤⣤⣤⣄⡀⣠⢀⣄⣤⣤⣤⣠⣤⣤⣀
⠈⠉⠛⠛⠿⠿⠛⠿⠿⠿⠿⠿⢿⠿⣿⠟⠿⠸⠟⢹⡇⢿⠘⠿⠻⠿⠟⠻⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⣿⢿⡿⢿⠿⠿⠿⠿⠿⠿⠿⠿⠿⢻⡟⠛⠃⠛ ⠚⠘⠏⠛⠙⠛⠻⠿⠿⠿⠛⠹⠟⠙⠃⣿⠰⡾⠛⠋⠿⠣⣿⠻⡿⠻⠇⠰
⢴⣤⣶⣶⣶⣶⣦⣶⣤⣤⣴⣤⢤⡄ ⣤⢠⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣦⣶⣤⣤⣴⣶⣶⣶⣶⣶⣶⣦⣤⣠⣄ ⣤⠠⡆⠠⣤⣤⢠⣶⣶⡶⣤⡤⢤ ⣠⡄⣀
⠘⠋⠛⠛⠉⠋⠉⠿⠉⠿ ⠁ ⠉⠈⠁⠉⠉⠉⠉⠉⠉⠉⠋⠹⠿⠻⠏⠻⠿⠿⠻⠿⠿⠿⠟⠛⠛⠃ ⠈⠁⠘⠁⠉⠉⠛⠙⠃⠛ ⠋ ⠰⠆⠈ ⠴
⢀⡶⣶⡐⢶ ⠆ ⠠⠤⣦ ⣤⢲⣶⣶⣶⣶⣤⣤⢴⣦⢶⣶⣤⣶⣶ ⡴⢐⡆⢶⣰⣶
⠈⠁⠋ ⠂ ⠛ ⠋⠘⠛⠘⠋⠛⠛⠋⠙⠛⠛⠋⠚⠋⠛⠘⠃ ⠈⠁⠈⠁ ⠚
⢰⣷⣦⣴⣿⣾⣷⣶⣦ ⢰⡆⢲⡆
⠛ ⠉⠁⠉⠉⠋⠙⠋⠁ ⠈⠁⠈⠁ ⠛
⣀ ⣀ ⢀ ⣸⠹⣿⣿⡟⣿⢿⣿⢿⡽⠿⠞⢿⠃ ⣹⡟⣿⠇⣀ ⢀⡀⣀
⣉ ⠉ ⢀ ⡀⢀⣀⢈⡁⣉ ⠉⠈⠁ ⢀ ⡀ ⠉ ⠈ ⡉ ⡀ ⠈⠁⢉
⢘⡃⣿ ⣛⢀⡀ ⠈⣧⢸⡿⢿⣷⣹⡇ ⠘⠈⠃ ⠠⠶⢶⡿⢹⡟⣀ ⢀⡀⢘⡇⣿ ⣟⢀⡀⢀⡀
⣀⣀⣀⣀⣁⢈⠁ ⢠⣄⣀⣀⣉⣈⣀⣈⣁⠉ ⡀ ⡀ ⢀⡀⣈⣀⣄⢀⡀⢀⡀ ⢀⣁⣀⣁⣈⣀⣁ ⡁⠈
⢠⡤⢼⣿⣿⣯⡿⠸⡇⣤⠄⢤ ⣤⢠⡄⢿⠶⠿⢾⡟⣿⡏⣿⢫⣿⠹⡏⣤ ⠐⠃⠠ ⣤⠐⠶⠸⡇⢿⠻⠿⠸⡇⠙⠃⣤⠠⡤ ⢤⡄⣤⠈⠛⢽⠏⢿⠛⠿⠠⡇⢤⠄
⣠⣄⣤⣤⣤⣤⣤⣤⣄ ⣠⡄⣤⣀⣤⢀⣄⣠⣤⣄⢀⣄⡀ ⡀ ⢀ ⣠⡄⢀ ⣤⣀⣤ ⡀⢀ ⡀ ⡀⣠⣤⣤⣤⣤⣤⣤⣀⣤⣤
⠐ ⠒ ⣶⠰⠦⠉⠹⠟⢹⡿⠿⠋⠾⠛⠿⠛⠿⠉⠉⠉⠉⠉⠙⠛⢿⠟⢿⠸⡟⠻⠟⠛⠿⠟⠘⠇ ⠉⠁⠈ ⠈ ⠂ ⠶ ⠆⠘⠏⠉⠉⠉⠰⠆⠰⠆⠴⠈⠇⠘⠇⠿ ⡿⠘⠇⠉⠁⠿⠹⡿⠿⠋⠿⠉⠉⠰⠆⠰⠂
⣶⣴⣶⢶⡄⣀ ⢀⡀ ⢀⡀ ⢤⢠⣦⣤⡴⠲⡦⢤ ⣀ ⢀ ⣤⢀⡄⣠⡄⣠ ⡄ ⠴⠄⣶⣦⡴⢦ ⢠⣦⣶⣦⣴⣄⣀ ⣀⡀
⠉⠛⠛⠿⠆⠿⠰⠇⠰⠟⠛⠛⠛⠰⠆⠶⠆ ⠛⠈⠁⠘⠃⠈ ⠰⠆⠴ ⠦⠰⠆ ⠈ ⠉⠈⠁ ⠉⠰⠷⠰⠇⠶ ⠶ ⠁ ⠾ ⠁⠸⠏ ⠶⠰⠆⠰ ⠶
⠰⢶⣶⣿⣷⣶⣶⢶⣶⣶⣄⣀⡠⠦⠰⠦⠶⠄⠄ ⣀⡀ ⠠⡄⣤ ⠰⠦⠶⢤⣶⣤⡤⠠⡄⢤ ⠠⠶⣺⡷⣶⣶⣶⢶⡶⠶⠄ ⠠⣤⡤
⠉⠉⠙⠛⠛⠚⠛⠉⠈⠛ ⠘⠃⠘⠃⠛⠐⠓⠘⠃⠛ ⠙⠛⠘⠃⠛ ⠛⠘⠃ ⠈ ⠘⠉⠁ ⠁ ⠐⠛ ⠛⠂
⠤⠤⢤⠄ ⢀⠰⣶⠴⠦⣶⡆⣶⢠⡄ ⢀ ⡀ ⣀ ⡀⣶⡆⣶⣦⣤⢰⡦⢶⠆⣠ ⣒⢂⣶⢐⡒⠂
⠘⠁⠉ ⠉ ⠉⠈⠁⠈⠁⠉⠈⠉⠈⠃ ⠙⠈⠃⠈⠃⠉ ⠉⠈⠁ ⠉ ⠉⠈⠛⠈⠃
⢀⡀⢀⡀⣀ ⢀⡀⣿⢈⣿⠸⣇⣴⣴⣦⣴⣦⣹⡇⣶ ⣶⠆⣿⣶⣦⣶⡄⣿⢈⣿⣿⡿⢿⡿⠿ ⢀⡀
⠈⠁⠈⠁⠉ ⣀ ⢀⢀⡀⢈⡁⣈⣈⣁⣈⣁⣀ ⠉ ⢉ ⡀⣉ ⢉ ⢀⣀⠉⢈⣁⣈⡀⣉⠁⣀ ⠈⠁
⢀⡀⢀⡀ ⠉⠃⠉⠘⠋⢻⣿⣿⣿⣿⣻⡟⣿⠰⠶⠶⠶⣶⡶⠿⢻⣄⢀⡟⠿⠿⠿⠾⠷⣿⡟⣿⢻⡿⣿⣿⣿⣟⣿⢀⡄
⠈⠁ ⡀⣠⡄⣠⢀⡀⣀⡅⣈⣩⣭⢀⡀⢀ ⠠⡀ ⠈⠉ ⡅⢠⣤⣤⣠⡄⣈⡀⣀ ⣄⣈⡀⣈⡉⠁ ⡁
⠁⠿⠁⠼⢸⡿⠻⡿⢿⢿⠟⠛⠛⣿⠤⣤ ⠁⠚⠛⠓ ⠁⠛⠹⣿⢩⡗⢤⡜⠋⠻⠟⢽⠇⢼⠟⠻⠺⡇
⣤⣄⢠⡄⣤⢀⡄ ⠄ ⢠⡄ ⢀⡀⣤⣴⣦⣤⣤⣴⣆⢰⡄ ⢀⡀
⠛⠛⠚⠳⣿⠸⡇⠺⠏⠈⠁ ⠰⠆ ⠻⠏⢿⠈⠁⠈⠋⠛⠙⢿⠻⡿⠒⠁⠶⠈⠻⠠⠆ ⠶ ⠰⠆
⢰⡆⣴⡆⠤ ⢰⣦⣴⡶⣶⢶⡦⣄ ⣀
⠈⠁ ⠸⠇⠺⠇⠾ ⠿ ⠉ ⠛⠘⠋⠈⠁⠿ ⠶ ⠶ ⠶
⣀⡀
⡀⢀⡀
⠈⠉⠈⠁
⢀⡀⢀⡀ ⡶⢰⡆
⠈⠁⠈⠁ ⠈⠉⠈⠁
⠠⡤ ⠠⡤⠠⡄⢤
⠰⠆⠰⠆⠶⠐⠶⠰⠆⠶
⣄
⠺⠐⠇⠐⠆⠲ ⠶⠐⠇⠰⠂⠲ ⠇⠐⠇⠲ ⠲⠐⠆⠸⠂⠾ ⠖
⠘⠛⠘⠃⠛ ⠛⠘⠃⠘⠃⠛⠐⠓⠘⠃⠛ ⠛⠘⠃⠘⠃⠛⠐⠛⠐⠃