Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Conversion of the Thotcon 0x4 Badge into an 802.15.4 sniffer
Ruby C
branch: master

Fetching latest commit…

Cannot retrieve the latest commit at this time

Failed to load latest commit information.


badgesniff allows you to leverage the 802.15.4 radio on the Thotcon 0x4 badge. There are two components to this project:

  • firmware that will put the badge into 'sniffer' mode.
  • badgesniff-ruby - an application that interfaces with the badge, saving captured packets to a pcap or pcapng file.
  • You can open up the pcap w/ Wireshark while badgesniff is running.
  • Exciting!

Hardware required


Seriously. You don't want exploding batteries, or chips. One power-source at a time!

Serial TTL interface

I used a buspirate for this, but any FTDI-based USB-TTL Serial interface will do.

AVR ISP programmer

Any AVR ISP programmer will do, however it's probably easiest to use a buspirate.

8x header pins

You solder them :)

  • 6 for the ICSP header
  • 2 for the TX/RX serial pins

Software Dependencies


  • avr-libc
  • avr-gcc
  • cmake
  • make


  • ruby 1.9.3
  • bundler

Using Ubuntu 12.04 LTS and buspirate

  • On my system, my buspirate shows up as /dev/ttyUSB0


sudo apt-get install build-essential cmake avrdude avr-libc gcc-avr ruby1.9.3
sudo gem1.9.3 install bundler

Hook buspirate up to badge for AVR ISP programming

Based on this doc

Hook the buspirate up to the ICSP header on the badge.

Buspirate ->  Badge
MISO      ->  MISO
MOSI      ->  MOSI
GND       ->  GND
+3.3v     ->  Vcc
CS        ->  Reset
CLK       ->  SCK

Flashing the badge with badgesniff

  • Create the build directory
mkdir firmware/build
cd firmware/build
  • Setup the build. Obviously, replace /dev/ttyUSB0 with your device.
cmake -DCMAKE_TOOLCHAIN_FILE=../avr-toolchain.cmake -DAVR_PROGRAMMER=buspirate -DAVRDUDE_OPTIONS="-P/dev/ttyUSB0" ../
  • Build the flash
  • Flash the badge. This part can take awhile with the buspirate, as it isn't the speediest AVR programmer.
sudo make install
  • Your badge is now programmed with the badgesniff flash image! If you hook directly up to the serial interface on the badge (baud at 38400), you will now be able to interact directly with the sniffer (type '?' for help). However, I make all of this easier for you with badgesniff-ruby, below!

Hook the buspirate up in serial for serial mode.

Buspirate ->  Badge
MISO      ->  TXD
MOSI      ->  RXD
GND       ->  GND
+3.3v     ->  Vcc

Running badgesniff-ruby

  • Install deps
cd badgesniff-ruby
bundle install --path .bundle
  • Start up badgesniff. Needs to be run as root.
sudo bundle exec bin/badgesniff.rb -p /dev/ttyUSB0 -w out.pcap
  • You should see something like:
channel_next      - go to next channel
channel_prev      - go to previous channel
channel_show      - show current channel
channel_set(NUM)  - Set the chanenl to NUM
channel_scan(NUM) - Scan each channel. Dwell on channel for NUM seconds (default 0.1)
help              - this text
Press <enter> to switch between monitor / console mode
Packets captured: 8
  • Packets immediately begin saving into out.pcap

  • Press enter and you'll see the console.

(ch: 25) (pkts: 31) > 
  • You can initiate a scan of all channels, dwelling on each one for 1 second:
(ch: 25) (pkts: 31) > channel_scan 1
  • In the above case, we captured ten packets on channel 25.

  • Set the channel to 25:

(ch: 15) (pkts: 1798) > channel_set 25
Setting channel to 25... 25
(ch: 25) (pkts: 1798) > 
  • type 'quit' or hit ctrl-c to exit.

Restoring the badge to its original Thotcon 0x4 behavior

  • Hook the badge up for AVR ISP programming mode.
  • Go back into the build directory for the flash image
  • The following command will restore the original flash image and fuse settings for the chip.
sudo make restore_thotcon_flash
Something went wrong with that request. Please try again.