docs(wiki): v2.14.00 multi-board release - Classic CYD and WS-C5-28 promoted to fully supported Home.md: new "Supported Hardware" section (NM-CYD-C5 primary/preferred, Classic CYD supported, Waveshare WS-C5-28 supported/new), updated intro, "What's New" bumped to v2.14.00 with a multi-board-support headline. New page: Waveshare-WS-C5-28-Support.md - hardware differences from NM-CYD-C5, the CH32V003 IO expander architecture, RF-HAT wiring, flash instructions, known issues. Where-To-Get-It.md: board selector mention, corrected + expanded manual flash instructions for all three boards (was NM-CYD-C5-only, and had a stale wrong bootloader offset), purchase info for Classic CYD and WS-C5-28. Getting-Started.md: board selector mention, flagged the resistive-touch section (Sec 3) and RF-HAT enablement (Sec 4) as NM-CYD-C5/Classic-CYD- specific where WS-C5-28 differs (capacitive touch, no calibration; RF-HAT needs manual wiring not plug-and-play).
docs(wiki): refresh OT Air Survey page with today's reliability fixes Added a "While It's Running" section documenting the live Obs/W/B/EN/OT counter breakdown shown on the survey screen (not previously documented at all). Expanded the counting-accuracy note into a fuller history covering four separate bugs, all now fixed: the original double-counting-re-sightings issue (already documented), a phantom-device flood from WiFi/802.15.4 records with no real address (one field session logged 97% phantom entries), WiFi APs occasionally missed or double-logged from a radio- switch race, and EN (ESP-NOW) reading zero even with real ESP-NOW traffic present because the survey's ESP-NOW slot never actually turned on detection. Also documented the obs.jsonl export-reliability fix: the "nothing is lost, written as discovered" claim in "How It Works" had a real gap in some builds — export could silently stop working partway through a long survey with no visible sign anything was wrong. Noted as fixed.
docs(wiki): document ESP-NOW device labels via profiles.json Wasn't documented anywhere - added a "Device labels (profiles.json)" section under ESP-NOW Scout with the exact file path, JSON shape, and reload behavior, plus a cross-reference from OT Air Survey's field table (profiles.json now also applies to ESP-NOW devices logged during a survey, not just the dedicated Scout screen).
docs(wiki): add full obs.jsonl field list to OT Air Survey page
Merge branch 'master' of github.com:JimGat/CYM.wiki
docs(wiki): add OT/IoT Air Survey page, document geo_start/geo_end + addr_sub New page covering the passive multi-radio survey feature end to end: radio profiles, output file layout, and the actual metadata.json/obs.jsonl JSON shapes — including geo_start/geo_end (survey start/end GPS stamp) and the BLE addr_sub address-type field, both new this cycle. Also explains why addr_sub isn't device identity resolution (requires bonding/IRK, which this firmware doesn't implement) and notes the obs_count uniqueness fix. Linked from Home.md's Wireless Security Research index. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PBETSgn4bPhRTmBGE6ah2a
fix: correct RF-HAT availability on Classic CYD — works via SD Card Shim Previous version wrongly listed CC1101, nRF24, PN532, IR, and RF433 as absent on Classic CYD. The NM-RF-HAT connects via SD Card Shim (HSPI SPI bus routed through SD slot; SD relocated to RF-HAT onboard socket). Halehound is the reference implementation. Updated sections: - Hardware overview: RF expansion row corrected to SD Card Shim - Removed RF-HAT features from 'What Is Not Available' - New 'SD Card Shim' section explaining the mechanism - RF-HAT features listed under 'What Is Available' - Boot disclaimer note clarified (amber notice refers to 5 GHz/vibrator/PSRAM limitations, not RF-HAT availability)
feat: Classic CYD support page + Hardware Variants section on Home Documents all restrictions when running CYM on ESP32-2432S028R (Classic CYD): absent hardware (RF-HAT, GPS, vibrator, 5 GHz, 802.15.4), reduced buffer sizes with practical impact per feature, WiFi IRAM trade-off, dual-core advantage, flash instructions, and SD layout. Boot notice references the splash disclaimer added in firmware v2.13.49.
docs: update What's New to v2.13.43 (was v2.12.2) Replaces the three v2.12.x release tables with the current v2.13.43 feature summary: Tracker Scanner, Passive OBS, Go Dark full-screen wake, WiFi/BLE PCAP, wardrive patches (@birolt29), GPS debug toggle, nRF24 Jammer, BLE Blaster, GATT Walker fingerprint fix. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UnCgHkB4s4cfvtaXjQWK14
docs: add LAB5 Discord invite + Dexter-first layout on Home - Home.md: move Dexter logo + description to top (before What's New); add LAB5 Discord link with unofficial-support note - Support-and-Community.md: add direct Discord invite (https://discord.gg/Vuq2SmCbk5) and unofficially-supported language Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UnCgHkB4s4cfvtaXjQWK14
docs: clarify nRF24 jammer — inconsistent across BT implementations, not non-functional The jammer works and produces real RF interference. Effectiveness varies by target Bluetooth implementation — some stacks/devices are disrupted, others are not. BLE advertising disruption is consistently effective (no AFH on advertising channels). BT Classic disruption depends on target AFH aggressiveness; dual-core ESP32 is more consistent than single-core C5. Updated: effectiveness callout, Practical Effect section, conclusion.
docs: correct nRF24 jammer root cause — ESP32-C5 single-core, not SPI sharing Root cause is the ESP32-C5's single-core RISC-V architecture: the jammer task competes with LVGL, WiFi, BLE coex, and all other firmware on one core and cannot maintain tight sweep timing. Dual-core ESP32 (D0WDQ6/D0WD) in standard CYD / Bruce / Halehound pins the jammer to a dedicated core and achieves disruption of active BT audio. Confirmed by field testing across both platforms (raised by @eiswolf). SPI bus sharing adds per-hop latency but is a secondary factor. Updated hardware limitation note and conclusion section accordingly.
docs(wiki): v2.13.43 comprehensive feature documentation BLE-Research.md: - Add BLE Tracker Detection section (AirTag/SmartTag/Tile protocol details, GATT-confirmed ring auth, cross-session tracking) - Add Passive Observation System (OBS) section: 8 classifiers, Passive Log UI, recurrence detection, JSONL at /sdcard/lab/obs/ WiFi-Security-Research.md: - Add WiFi Frame Capture + BLE Targeted PCAP (v2.12.3) Wardriving.md: - Add Radio Mode NVS Persistence (v2.12.1) - Add GPS Serial Debug Toggle (v2.13.5) Getting-Started.md: - Add Go Dark covert operating mode section (full-screen 5s touch-to-wake) Contributors.md, Support-and-Community.md: - Fix @birolt29 attribution (remove bare name, fix capitalisation) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs: add Yellow Purple CYM installation video
fix(2.4ghz-research): correct RPD/RSSI claims, sweep rate, Fox Hunt wording - Ch Scan intro: "RSSI-equivalent carrier-detect signal" -> one-bit threshold detector (~-64 dBm floor); bar tap shows detection hit count, not signal level - Interference survey: add RPD -64 dBm threshold note (presence indicator, not power map) - Fox Hunt: haptic rate reflects detection frequency, not signal amplitude; "RSSI/carrier display" -> "carrier-detect display" - Keystroke scenario: raw nRF24 frames on SD; MouseJack tools decode HID reports - Jammer sweep rate: ~25 sweeps/sec -> ~20 sweeps/sec (79 ch x 502us + 10ms yield) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs: Phase 1 truth pass — wiki accuracy corrections Use-Cases.md: - BLE Cross-Location: "not a coincidence" → static-MAC intersection is strong corroborating evidence, not conclusive proof on its own - BLE Honeypot: "CYM clones it" → "CYM creates a matching advertisement" - nRF24 Sniffer: "packet log has the keystroke data" → "raw nRF24 frames; MouseJack tools decode unencrypted protocols" - WPA2 Handshake: "Cracks in four minutes" → "cracked in minutes in this case" - Deauth + PMF: "definitive per-device PMF audit" → behavioral test; note that RSN IE inspection is needed for a complete audit - Evil Twin: "usernames and passwords in plaintext" → "captive portal log records submitted credentials" WiFi-Security-Research.md: - PMF field scenario: same behavioral-test qualification - Handshake scenario: "cracks in four minutes" → conditional phrasing - Evil Twin scenario: same credential wording fix Wardriving.md: - GPS baud heading: v2.12.0 → v2.13.x - CSV example: appRelease=v2.12.0 → v2.13.23 - Time-sliced BLE section rewritten: documents hardware coexistence (CONFIG_ESP_COEX_SW_COEXIST_ENABLE + CONFIG_SOC_COEX_HW_PTI), 12.5% BLE duty cycle (320 ms / 40 ms), BLE always-on (toggle removed v2.13.x) BLE-Research.md: - Top blockquote: add 12.5% BLE duty cycle detail for wardrive coexistence; clarify all other screens use exclusive radio access - BLE Blaster CONT_WAVE table: remove "devices cannot decode any BLE PDU" absolute claim; qualify disruption depends on proximity and device resilience - BLE Honeypot scenario: "CYM clones it" → "CYM creates a matching advertisement" - GATT Clone section: renamed "GATT Profile Snapshot — Companion App Interaction Testing"; added scope note (static snapshot, not live device state) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs: update SD Assets repo URL after rename CYM-NM28C5-SD-Assets → CYM-SD-Assets Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs: update GitHub URLs after repo rename CYM-NM28C5 → CYM Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs(2.4ghz): add Nyan Box hardware specs (3x NRF24L01+ GTmini PA+LNA) Confirm Nyan Box uses 3 amplified nRF24 modules (same +20 dBm GTmini as NM-RF-HAT) — the advantage is parallel coverage, not higher power. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs(2.4ghz): add multi-radio architecture note + Nyan Box reference Reliable BT disruption requires simultaneous per-channel coverage (e.g. Nyan Box with multiple nRF24 modules) not sequential sweep — AFH cannot be overwhelmed by a single radio regardless of power or tuning. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs(2.4ghz): add hardware limitation disclaimer to nRF24 Jammer section Note that NM-RF-HAT is less effective at disrupting BLE/BT Classic than standalone nRF24 boards despite higher output power. Links to field findings section for details. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs(2.4ghz): update nRF24 jammer section + add BT disruption research findings - Replace old 4-mode UI description with current 10-mode UI (matching Bruce firmware) - Document CE-toggle requirement: nRF24 CONT_WAVE does not retune PLL from RF_CH writes while CE stays HIGH; confirmed empirically (single spike vs multi-channel) - Correct AT2401C description: linear PA, not PLL; follows nRF24 with no power-cycle - Document 500 us minimum dwell (PLL lock ~130 us + AT2401C TX engagement) - Add SEQ/FHSS toggle explanation (Fisher-Yates shuffle between sweeps) - Add BLE_ADV channel correction note (nRF24 ch37/38/39 are NOT BLE adv channels) - Add full Bluetooth disruption research findings section with hardware comparison: * CYM + Bruce on NM-CYD-C5 + NM-RF-HAT: no disruption despite +20 dBm * Bruce on CardPuter + Pineapple CAP (no PA): minor disruption * Root cause: CE-toggle + PLL lock + SPI mutex latency limits sweep rate; BT Classic AFH adapts faster than the sweep - Update effectiveness table to reflect actual measured results - Clarify TinySA artifact near 2417 MHz is background WiFi, not jammer fault Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
docs: update nRF24 Jammer (4-mode selector) + add BLE Blaster section nRF24 Jammer: document 4-mode band selector (BLE Only / BT Classic / WiFi 2.4G / All Bands) with sweep rates and per-mode effectiveness. Add cross-reference tip to BLE Blaster dual-layer attack. Update TinySA image captions to correctly identify BT Classic mode. Fix note that prior docs claimed 126 channels (actual BT mode sweep is 82 channels). BLE Blaster: new section covering 4-instance BLE adv flood, 500ms MAC rotation, NM-RF-HAT DIP 2 dual-layer mode (native BLE + nRF24 CONT_WAVE on same 3 adv channels simultaneously), comparison table of attack layers, and field scenario. Note NimBLE v1.6.0 (BT 5.4) as the stack. Also update NimBLE version reference in page header.
docs(nrf24): add TinySA waveform photos for nRF24 jammer CONT_WAVE mode Two TinySA MAXH captures showing the 1 MHz-spaced CW spike comb across 2402-2480 MHz during nRF24 Jammer operation (+20 dBm AT2401C output). Updated captions to correctly reflect both images are max-hold mode.
docs(nrf24): update jammer section with CONT_WAVE technique, SA waveform, effectiveness table
docs: update What's New to v2.12.2 (v2.12.1 + v2.12.2 changes)
docs: add Valleytech video thumbnail to wiki home page
docs: add Valleytech Custom Solutions v2.12.0 review video
docs: fix GPS VCC voltage guidance — ATGM336H accepts 3.3V or 5V via onboard LDO
docs: Valleytech review first-run UX docs pass (YT-001/003/006/E002/E003) New: Getting-Started.md — comprehensive first-run guide covering: - Resistive touch behavior and the red dot (YT-001/002) - SD card provision: full folder layout, what the Validate & Provision action creates, SD Asset Repository pointer (YT-003/004) - RF-HAT enablement checklist: how to enable, DIP switch map, module status table for all 5 modules in v2.12.x (YT-007/008) - GPS wiring: LP-UART pin map, serial settings, baud auto-detect, troubleshooting table (YT-E002/E003) - WiFi tool naming explainer: Channel Analyzer vs WiFi Band Scope (YT-006) - Wardrive categorization note (YT-005) Updated: Home.md - Add Getting Started link at top of the getting-started section with "First-time setup" descriptor so it is the most visible entry point. Updated: WiFi-Security-Research.md - Rename "Chanalizer" to "Channel Analyzer" throughout. - Add WiFi Band Scope section: description, feature comparison table vs Channel Analyzer, and two research use cases. (YT-006) Updated: Where-To-Get-It.md - Expand GPS module section with full wiring table (TX/RX/VCC/GND), voltage warning, baud default, and link to Getting-Started GPS guide. (YT-E002)