,
6 tweets,
2 min read
Read on Twitter
1/n
Working in progress ESB promiscous mode for nRF52840
@travisgoodspeed
- output of captured RF frames grepped for target address bb0adc
- rf payload starts at 2nd byte
- first byte shows pipe no in lower nibble, higher nibble is 4 if crc match
Working in progress ESB promiscous mode for nRF52840
@travisgoodspeed
- output of captured RF frames grepped for target address bb0adc
- rf payload starts at 2nd byte
- first byte shows pipe no in lower nibble, higher nibble is 4 if crc match
2/n
- utilizing all pipes for capture (adresses 0xa8aa, aa1f, aa9f, aaa8, aaa9, aa8f, aaaa)
- most hits on aaaa, but real rf frame occurs very late in rx buffer
- rx buffer stores 60 bytes after address match (more than 200 possible on nRF52)
- utilizing all pipes for capture (adresses 0xa8aa, aa1f, aa9f, aaa8, aaa9, aa8f, aaaa)
- most hits on aaaa, but real rf frame occurs very late in rx buffer
- rx buffer stores 60 bytes after address match (more than 200 possible on nRF52)
3/n
- as most hits are on 0xaaaa, the rx ISR skips full 0xaa bytes on received buffer
- next step is to check crc (accounting for length in assumed PCF)
- if CRC check fails, whole rx buffer is left shifted 1 bit and crc check repeated
- as most hits are on 0xaaaa, the rx ISR skips full 0xaa bytes on received buffer
- next step is to check crc (accounting for length in assumed PCF)
- if CRC check fails, whole rx buffer is left shifted 1 bit and crc check repeated
4/n
- 16 bit shifts could be done reliably, doing more would take too much time in an ISR (next IRQ from RF arrives rapidly)
- bitwise crc checking with 16 bit shifting succeeds for about 50% of raw frames which contain the target address
- the ptx sends only once, but with ...
- 16 bit shifts could be done reliably, doing more would take too much time in an ISR (next IRQ from RF arrives rapidly)
- bitwise crc checking with 16 bit shifting succeeds for about 50% of raw frames which contain the target address
- the ptx sends only once, but with ...
5/5
... 3 or 4 retransmits. Thus results are slightly biased, as the PTX never receives an ack.
- will push the test code to github, once working
- haven't implemented channel change for "promiscuous", though
... 3 or 4 retransmits. Thus results are slightly biased, as the PTX never receives an ack.
- will push the test code to github, once working
- haven't implemented channel change for "promiscuous", though
Cc:
@marcnewlin
@RoganDawes
@makerdiary couldn't test mdk dongle, as I'm still waiting for debug probe to arrive (2 dongles flashed with GPIO_RESET enabled, bootloader not accessible)
@marcnewlin
@RoganDawes
@makerdiary couldn't test mdk dongle, as I'm still waiting for debug probe to arrive (2 dongles flashed with GPIO_RESET enabled, bootloader not accessible)
