Bug fixes & safety improvements: MAC randomization, GPS validation, button timeouts, WiFi cleanup, hardware detection#179
Open
RadDad87 wants to merge 5 commits into
Open
Conversation
Adds hardware_detect.h with SPI/I2C/UART probes for NRF24, CC1101, GPS, PCF8574. Displays detected hardware on TFT during boot. Guard function warns before launching features that need missing hardware. Prevents confusing failures when peripherals are disconnected.
- OPSEC FIX: Apply random MAC to BLE stack via esp_ble_gap_set_rand_addr (was generated but never applied) - Fix Betas_Fit_Pro typo and add missing attack_state=1 - Fix SourApple using unseeded rand() instead of hardware random() - Fix BLE address mask from 0xF0 to 0xC0 (valid random static address per BT spec)
- New validateAndStripChecksum() computes XOR checksum between $ and * - Rejects sentences with missing or mismatched checksums - Legacy stripChecksum() wrapper preserved for backward compat - Logs warnings on checksum failures via Serial for debugging
…, WifiScan Added exit() cleanup functions to WiFi namespaces that were missing them. - PacketMonitor::exit() disables promiscuous mode, clears rx callback - BeaconSpammer::exit() stops beacon transmission - WifiScan::exit() deletes scan results All reset WiFi radio to STA mode on exit.
All while(isButtonPressed()){} loops (36 total) replaced with
waitForButtonRelease() which adds 5s timeout + FreeRTOS yield.
Prevents permanent device hang if button gets stuck.
Added waitForButtonRelease() and waitForButtonRelease2() helpers.
Owner
|
Hi @RadDad87, thanks for the detailed PR. the MAC randomization and GPS validation changes look really useful. I'm hitting a compile error though: bluetooth.cpp:710 — 'esp_ble_gap_set_rand_addr' was not declared in this scopeDid this compile and upload successfully on your end? Which ESP32 core version and board config are you using? That function is part of the Bluedroid stack and may need a specific core version or |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security audit and improvement pass for ESP32-DIV v1.7.0. Fixes critical OPSEC bugs, adds safety mechanisms, and introduces a hardware detection module. All changes are backward-compatible drop-in replacements — no library changes required.
Bug Fixes
1. MAC Randomization Actually Applied (bluetooth.cpp) — HIGH severity
BLE Spoofer and SourApple generated random MAC addresses but never applied them to the BLE stack. The device was broadcasting attacks using its real, permanent MAC. Fixed by adding
esp_ble_gap_set_rand_addr()+BLEDevice::setOwnAddrType(BLE_ADDR_TYPE_RANDOM). Also corrected the address mask from0xF0to0xC0(proper BLE random static address per Bluetooth spec).2. Beats Fit Pro Typo + Missing Flag (bluetooth.cpp)
Betas_Fit_Pro→Beats_Fit_Proattack_state = 1;so the spoof actually triggers advertising3. SourApple Uses True Random (bluetooth.cpp)
Replaced unseeded
rand()with Arduinorandom()(hardware entropy on ESP32). Previously produced identical attack type sequences on every reboot.4. NMEA Checksum Validation (gps.cpp)
Added
validateAndStripChecksum()that computes XOR checksum before accepting GPS sentences. Previously, corrupted data was silently accepted, potentially logging wrong wardriving coordinates.5. Button Release Timeout (ESP32-DIV.ino)
All 36 bare
while(isButtonPressed()){}busy-wait loops replaced withwaitForButtonRelease()— adds 5-second timeout + 10ms FreeRTOS yield. Prevents permanent device hang from stuck buttons.New Features
WiFi Exit Cleanup Handlers (wifi.cpp)
Added
exit()functions to PacketMonitor, BeaconSpammer, and WifiScan namespaces. Disables promiscuous mode, clears callbacks, and resets WiFi radio when leaving features.Hardware Detection Module (hardware_detect.h — NEW FILE)
Boot-time SPI/I2C/Serial probes for NRF24, CC1101, GPS, and PCF8574. Shows hardware summary on TFT during boot. Guard function prevents launching features without required hardware.
Files Changed
bluetooth.cppgps.cppESP32-DIV.inowifi.cpphardware_detect.hTesting