v0.93

Air Survey

A modern Flock camera randomises its MAC. There is no vendor prefix left for an OUI table to match, so it scores nothing, and the app dropped it before it ever reached the detection list. Standing next to one looked exactly like standing on an empty street. That is what #25 turned out to be: ten or more cameras driven past, and an empty screen the whole time.

The survey data was already being collected and written to survey.csv. It was just never shown on the device, so the only way to use it was to pull the card and read the file afterwards.

Air Survey is on the main menu. It lists every wildcard-probe transmitter the board heard, matched or not, ranked the way you would read the file yourself:

• how persistently a device probes, measured against everything else in that capture, because ten probes is unremarkable on a busy street and damning on an empty one
• how close it is
• whether one fingerprint keeps turning up on several different addresses

~ marks a randomised address. g marks a commodity scan pattern shared with phones, which sinks to the bottom no matter how loud it is.

It is not a detection list. Nothing in it enters the hit table and no row claims to be a camera. A high rank means the device behaves the way a fixed installation behaves, and a busy access point does that too. Park where you can see a camera and the row standing well above its neighbours is the one to look at.

"I saw it" now works where it is needed

Learning a fingerprint landed in v0.91, but it hung off the detection list, which a randomised camera never reaches. So it could not be pointed at the devices it was built for. You can now open a survey row and confirm it after looking at the thing with your own eyes. A fingerprint hashes the shape of a probe request rather than the address, so it still matches after the MAC changes.

Still capped at Class?, never Confirmed, and nothing is ever transmitted.

Fixed: you could poison your own detection

Confirming a row wrote whatever fingerprint it carried, with no check on what it was. A camera and a passing phone look alike in a list, so one wrong tap put a commodity scan skeleton into learned.txt and it started flagging ordinary devices as ALPR candidates. Quietly, and permanently.

Three known-generic patterns are now refused: 96fcd1b2 (a stock ESP32 scan, which this project's own bench emitter produces), 173d7a70 (seen on four addresses across three channels on a clean bench with no camera near it), and 7c923b53 (the one that smeared across unrelated vendors in a false-positive report).

The check also runs at match time, not just when learning, so a card already carrying one of these goes inert on upgrade instead of needing the file deleted by hand.

Notes

Ranking is pure logic with host tests driven by the actual capture from #25, so it has to pick out the same row a human picked by hand. Verified on hardware against the bench emitter: at -20 dBm and 46 probes it was the loudest thing in the room and still sorted last, because its fingerprint is a stock scan.

Grab the .fap for your firmware plus the companion .bin for your board.