Discover seemoo-lab/bcm-public Open Source project

Build your own 'AirTags' 🏷 today! Framework for tracking personal Bluetooth devices via Apple's massive Find My network.

8,572

openhaystack

The C-based Firmware Patching Framework for Broadcom/Cypress WiFi Chips that enables Monitor Mode, Frame Injection and much more

8,225

nexmon

2,406

AirGuard

Protect yourself from being tracked 🌍 by AirTags 🏷 and Find My accessories 📍

Kotlin

1,904

owl

An open Apple Wireless Direct Link (AWDL) implementation written in C

1,217

openwifipass

An open source implementation of Apple's Wi-Fi Password Sharing protocol in Python.

Proof of concept project for operating Broadcom Wi-Fi chips as arbitrary signal transmitters similar to software-defined radios (SDRs)

802

mobisys2018_nexmon_software_defined_radio

Shell

763

internalblue

Bluetooth experimentation framework for Broadcom and Cypress chips.

Broadcom and Cypress firmware emulation for fuzzing and further full-stack debugging

684

frankenstein

430

nexmon_csi

Channel State Information Extraction on Various Broadcom Wi-Fi Chips

302

toothpicker

Practical Privacy-Preserving Authentication for Apple AirDrop

234

privatedrop

polypyus

BTLEmap

Nmap for Bluetooth Low Energy

DEPRECATED: Monitor Mode and Firmware patching framework for the Raspberry Pi 3, development moved to: https://github.com/seemoo-lab/nexmon

159

bcm-rpi3

157

airtag

AirTag instrumentation including AirTechno and firmware downgrades.

Wireshark Dissector for Apple Wireless Direct Link (AWDL) and Apple's CoreCapture logging framework. Note: the AWDL dissector is part of Wireshark 3.0!

138

wireshark-awdl

134

VirtFuzz

VirtFuzz is a Linux Kernel Fuzzer that uses VirtIO to provide inputs into the kernels subsystem. It is built with LibAFL.

frida-scripts

mobisys2018_nexmon_channel_state_information_extractor

Example project for extracting channel state information of up to 80 MHz wide 802.11ac Wi-Fi transmissions using the BCM4339 Wi-Fi chip of Nexus 5 smartphones.

Extracting Apple ID Validation Record, Certificate, and Key for AirDrop

airdrop-keychain-extractor

Objective-C

fitness-app

Reverse engineering toolkit for Apple's wireless ecosystem

apple-continuity-tools

Debugger with hardware breakpoints and memory watchpoints for BCM4339 Wi-Fi chips

nexmon_debugger

satellite-messenger

A free satellite messenger for iPhone 14

This project contains the nexmon-based source code required to repeat the experiments of our WiSec 2017 paper.

wisec2017_nexmon_jammer

aristoteles

A Wireshark dissector for the Apple Remote Invocation (ARI) protocol, used between Intel base band chips and the iOS CommCenter for various management purposes, SMS, telephony and much more.

Lua

talon-tools

Talon Tools: The Framework for Practical IEEE 802.11ad Research

TeX

mmTrace

mmTrace: Millimeter Wave Propagation Simulation

Protect yourself from being tracked 📍by Samsung SmartTags and Tile Trackers

fitness-firmware

HTML

AirGuard-iOS

apple_u1

A LoRaWAN Security Evaluation Framework

chirpotle

dtrace-memaccess_cve-2020-27949

Tunnels a regular TCP connection through an AWDL link by exploiting the NetService API

proxawdl

Objective-C

pyshimmer

pyshimmer provides a Python API to work with the wearable sensor devices produced by Shimmer.

Wi-Fi based covert channel that hides information in hand crafted acknowledgement frames imitating additional channel effects that can be extracted from channel state information at the intended receiver.

mobisys2018_nexmon_covert_channel

uwb-sniffer

A UWB Sniffer with accurate timestamps

h4bcm_wireshark_dissector

Wireshark dissector for Broadcom specific H4 diagnostic commands

owlink.org

Opening up Apple's wireless ecosystem around the Apple Wireless Direct Link (AWDL) protocol

HTML

wisec2017_nexmon_jammer_demo_app

This project contains source code of our Nexmon-based jammer app presented as a demo at WiSec 2017.

The nexmon C-based firmware patching framework adapted for the ARC architecture.

nexmon-arc

seemoo-mobile-sensing

Sensor data collector for Android devices

plist17lib

BTLEmap's Bluetooth Low Energy framework that powers the app

BTLEmap-Framework

csicloak

Sensor data collector for Samsung Gear S3

seemoo-wearable-sensing

Antenna Sector Patterns as obtained by Measurements in the CoNEXT'17 paper

talon-sector-patterns

Helping groups securely exchange contact information.

pairsonic

Dart

fido2ext

Bring Your Own FIDO2 Extensions!

An open source implementation of Apple's Wi-Fi Password Sharing protocol in Swift.

wifi-password-sharing

Lost and Found: Stopping Bluetooth Finders from Leaking Private Information

privatefind

nexmon_tx_task

Scheduled frame transmission on Broadcom Wi-Fi Chips

pico-nexmon

Applications for the Raspberry Pi Pico W related to Nexmon the C-based firmware patching framework for Broadcom/Cypress WiFi chips.

CMake

wisec2017_nexmon_jammer_demo_firmware

This project contains the nexmon-based source code of the jammer used in our WiSec 2017 demo Android app.

bcm_misc

opennan

OpenNAN - An open source NAN stack for Linux

Hardwhere

snipeit-it based asset management app

Kotlin

ubicomp19_zero_interaction_security

Source code for experiments and evaluation of five zero-interaction security schemes, for our Ubicomp 2019 paper "Perils of Zero-Interaction Security in the Internet of Things"

Quantitative analysis of location reports from Apple's offline finding (OF) location tracking system

offline-finding-evaluation

Code for "My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack" paper

myo-keylogging

Natural Disaster Mobility Model and Scenarios in the ONE

natural-disaster-mobility

This project contains all measured data and scripts to recreate the plots used in our WiSec 2017 paper.

wisec2017_nexmon_jammer_reproducibility

This repository contains patched Linux kernel sources to run energy measurements on the Wi-Fi chip of a Nexus 5 smartphone.

nexmon_energy_measurement

next2you

Source code for experiments and evaluation of Next2You copresence detection scheme, for our TIOT 2021 paper "Next2You: Robust Copresence Detection Based on Channel State Information".

d11-emu

D11emu: A BCM43 D11 Emulation Framework

Rust

aic-prototype

Proof of concept implementation of Acoustic Integrity Codes (AICs) for Android smartphones

Kotlin

CellGuard

CellGuard is a research project that analyzes how cellular networks are operated and possibly surveilled

powerpc-ose

The framework that powers PrivateDrop

PrivateDrop-Base

fastzip

Source code for experiments and evaluation of FastZIP zero-interaction pairing scheme, for our Mobisys 2021 paper "FastZIP: Faster and More Secure Zero-Interaction Pairing".

A Lightweight Framework for Agile Distributed Network Experiments

graphics

tpy

The artifacts for the 'On the Effectiveness of CFI in Practice' paper to be published at WOOT'24.

wintech23_nexmon_d11debug

Pawn

woot24_cfi_coverage_tools

Click implementation of LIDOR/SEMUD (based on the Castor routing protocol)

click-castor

privatedrop-evaluation

Software repository for our WiSec '23 demo: Secure Bootstrapping of Smart Speakers Using Acoustic Communication

wisec23-speaker-bootstrapping

caret

CARET: The Crisis and Resilience Evaluation Tool

Source code for experiments and evaluation of HardZiPA system for our EWSN 2023 paper "Hardening and Speeding UpZero-interaction Pairing and Authentication".

hardzipa

kardia-demod

Large-Scale Talon Measurements at Library

talon-library-measurements

handoff-authentication-swift

This project contains the nexmon-based source code of the ping offloading application used in our WiNTECH 2017 paper.

wintech2017_nexmon_ping_offloading

python-msp430-tools

This is a fork of the original python-msp430-tools repository on Launchpad. It features a patchset that is required to use the tools with the Shimmer3 devices.

User Data and Online Survey results

Please-Unstalk-Me