drjones/car-key-killer
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Revert to a44462e (pre-frequency-change state)

Browse Source 
Made-with: Cursor
This commit is contained in:
drjones
2026-04-02 20:07:48 -07:00
parent 112e03c2a9
commit 9ed90ab4ae
2 changed files with 29 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
include/config.h
View File

@@ -6,7 +6,7 @@
#define CC1101_1_GDO0 4
#define CC1101_1_FREQ_MHZ 315.0f
// CC1101 #2 (433 MHz band — jam center 433.46 MHz, midpoint of 433–433.92 MHz)
// CC1101 #2 (433.92 MHz band)
#define CC1101_2_CS 8
#define CC1101_2_GDO0 5
#define CC1101_2_FREQ_MHZ 433.92f
@@ -35,27 +35,19 @@
#define JAM_BITRATE_KBPS 250.0f // baseband / channel filter context for RadioLib begin()
#define JAM_FREQ_DEV_KHZ 380.0f // default passed to begin(); per-radio deviation applied after init
#define JAM_RX_BW_KHZ 812.0f // wide RX BW for begin()
// GDO0 toggle rate during jam.
// 500 kHz (2 µs period = 480 ESP32-S3 cycles) leaves ~60% headroom over ISR overhead (~200 cycles),
// preventing the interrupt storm / WDT boot-loop that 1 MHz caused (240 cycles < ISR overhead).
// OOK on R1: ±500 kHz main lobe around 315 MHz + strong sidebands covering 314–316 MHz.
// 2-FSK 380 kHz dev on R2: tone pair 433.08/433.84 MHz + 250 kHz sideband spread → 432.8–434.1 MHz,
// fully covering the 433–433.92 MHz band.
#define JAM_LFSR_KEY_HZ 500000
// GDO0 toggle rate during jam (1 MHz timer tick). Higher → wider AM/FM splatter on both carriers; 100 kHz typical.
#define JAM_LFSR_KEY_HZ 100000
// Fixed dual-carrier jamming: each radio holds one frequency at full TX power (TI CC1101 freq + deviation).
// Many NA ~315 MHz RKE remotes are ASK/OOK (see TI CC1101 datasheet MDMCFG2.MOD_FORMAT). Jam path uses OOK on
// R1 so LFSR on GDO0 keys the PA (broad AM sidebands). Set JAM_R1_USE_OOK 0 for 2-FSK only at JAM_DEV_KHZ_R1_WIDE.
// Fobs may sit on 314.8–315.2 MHz — measure with an SDR and retune JAM_LOCK_FREQ_1_MHZ if needed.
// R1: 315.0 MHz center — OOK+LFSR main lobe covers 314–316 MHz (full 2 MHz span of NA fob band).
// R2: 433.46 MHz center — midpoint of 433–433.92 MHz; with 380 kHz dev + 1 MHz LFSR sidebands
// the noise covers 432.1–434.8 MHz, blanketing the entire 433–433.92 MHz EU/world fob band.
#define JAM_LOCK_FREQ_1_MHZ 315.0f
#define JAM_LOCK_FREQ_2_MHZ 433.46f
#define JAM_LOCK_FREQ_2_MHZ 433.92f
#define JAM_DEV_KHZ_R2_WIDE 380.0f
#define JAM_DEV_KHZ_R1_NARROW 25.0f // probe / RadioLib begin() only
#define JAM_DEV_KHZ_R1_WIDE 380.0f // max CC1101 2-FSK deviation on R1 when OOK fails or JAM_R1_USE_OOK=0
#define JAM_R1_USE_OOK 1 // 1 = R1 jam ASK/OOK (direct LFSR main lobe = 314–316 MHz); 0 = 2-FSK
#define JAM_DEV_KHZ_R1_WIDE 200.0f // FSK jam spread when JAM_R1_USE_OOK is 0 (or OOK setup fails)
#define JAM_R1_USE_OOK 1 // 1 = R1 jam ASK/OOK (typical NA); 0 = wide 2-FSK on R1
// Precision jam: narrow 2-FSK on both + slower LFSR (energy in a smaller RF slice).
#define JAM_PRECISION_DEV_R1_KHZ 28.0f
@@ -72,11 +64,7 @@
#define JAM_FLOOD_DEV_R1_KHZ 140.0f
#define JAM_FLOOD_DEV_R2_KHZ 200.0f
// Special/Flood jam timing: CC1101 at 250 kbps takes 2.59ms to send a 61-byte packet (preamble+sync+data).
// 3ms restart gap allows each packet to complete naturally before startTransmit() is called again.
// Duty cycle: ~85%. 10ms (original cypher-pulse) only achieves 26% — too many gaps for rolling-code fobs.
#define JAM_SPECIAL_DELAY_MS 3
#define JAM_FLOOD_DELAY_MS 3
// Special jam: 60-byte random payloads with 10ms delay (cypher-pulse exact clone).
// SmartRF-style dump: config space only (TI SWRS061); PATABLE/ strobes not included.
#define CC1101_CFG_REG_LAST 0x2E