From 75134f6a3dd2c31b7a27c4a73298afce90f830fd Mon Sep 17 00:00:00 2001 From: Einstein2150 Date: Mon, 8 Aug 2022 14:53:19 +0200 Subject: [PATCH] Update Readme for Mouse Jacker additional practical hints in using Mouse Jack --- applications/mousejacker/README.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/applications/mousejacker/README.md b/applications/mousejacker/README.md index e6309bf2efa..ad5fdecdc19 100644 --- a/applications/mousejacker/README.md +++ b/applications/mousejacker/README.md @@ -32,3 +32,31 @@ IRQ/8 is left disconnected on nrf24l01 If the nRF module is acting a bit flakey, try adding a capacitor to the vcc/gnd lines! I've not tried the Plus model so it may have a bigger need for a cap. Otherwise, I haven't had any major issues. Anything from a 3.3 uF to 10 uF should do. (Watch your positive/negative placement! Negative to ground.) I learned if you wanna get fancy, include a 0.1 uF cap in parallel. The 3.3 uF to 10 uF will respond to slow freq changes while the 0.1 uF will respond to the high freq switching spikes that the larger one cannot. That said, a single 10 uF will likely suffice for the Mousejack attack. ¯\\\_(ツ)_/¯ ![NRF_Capacitor](https://user-images.githubusercontent.com/57457139/178169959-d030f9a6-d2ac-46af-af8b-470ff092c8a7.jpg) + +Selfmade NRF24 breakoutboard: +![NRF_soldered](https://user-images.githubusercontent.com/22019133/183419103-9c40b28b-8152-4212-98e0-9a3358f69518.jpeg) +![NRF_soldered2](https://user-images.githubusercontent.com/22019133/183419176-26c0359b-0ecb-4015-8f8b-3a75209502ba.jpeg) + +## Practical hints from einstein2150 +If you are not successfull with the NRF Sniff Plugin you can try to get the MAC of the device with the crazyradio pa USB dongle. Have a look here: https://github.com/SySS-Research/nrf24-playset + + +A sample output of the NRF-Research script could be like +``` +[2022-08-05 13:28:56.366] Found nRF24 device with address 38:24:93:C0:07 on channel 75\ +[2022-08-05 13:28:56.371] Checking communication\ +[2022-08-05 13:28:59.088] Scan for nRF24 device\ +[2022-08-05 13:28:59.097] Actively searching for address 07:C0:93:24:38\ +``` + +Be carefull with the byte-order using in mousejacker! The correct byte order is the reverse-byteorder. In my example the reversed one is ```07:C0:93:24:38``` for my Logitech R400 presenter. +The next thing which could make trouble is the datarate. In my case the Logitech-device is only responding at 2Mbit. Commands at 1Mbit are not detected. + +Now its time to write all the relevant information in the config file. In my case you are creating a file ```addresses.txt``` in the SD directory of ```/nrfsniff```. The file content corresponding to the results of the research is ```07C0932438,2``` representing the reversed byte order of the MAC and the comma-separated datarate. + +Start the Mouse Jacker plugin and select the prepared ```addresses.txt```. If everything is alright you are starting with your MAC ready for attack: + +![mousejacker start-screen](https://user-images.githubusercontent.com/22019133/183419533-ef5c8df1-e328-45e3-b85d-376513d69c82.jpeg) + +If you have troube you can check if a datarate of 1 Mbit will help. Change ```07C0932438,2``` to ```07C0932438,1``` in this case. Another problem in the practical use is electromagnetical noise. In my case the external USB-3.1-Hub creating massive noise in the 2,4 Ghz-Frequency around a distance of 5 cm. Try using a long USB connection-cable for the receiver. In my case the response of the attack raises significant because the signals of the NRF-breakoutboard is no more covered with noise. +