drjones/car-key-killer
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
b5d8e328cfb24dc0f320eef1c02a4dda133877e1
car-key-killer/README.md
drjones b5d8e328cf Add OLED display, rotary encoder, max-coverage sweep, updated README 
- OLED SSD1306 0.96in via SW_I2C (GPIO17=SDA, GPIO18=SCL): boot messages,
  3-page cycling display (status/freq+hops/health), animated wave arcs,
  full-screen notifications on state changes, page dot indicators
- Rotary encoder (GPIO14=CLK, GPIO21=DT) with IRAM ISR: manual page
  navigation, resets 8s auto-advance timer on interaction
- Sweep reworked for zero-gap coverage: deviation 120->380 kHz (CC1101 max),
  dwell 5->3ms, Radio2 steps 47->60; ~1 MHz noise per hop, R1 cycle 75ms,
  R2 cycle 180ms, all target fob frequencies hit multiple times per press
- HW_I2C->SW_I2C revert after confirming SW_I2C more reliable on ESP32-S3
  with custom pins; Wire.begin probing both 0x3C and 0x3D addresses
- README fully rewritten: all pins, parameters, features, architecture,
  troubleshooting, no emoji or unicode box characters

Made-with: Cursor
2026-03-10 23:40:08 -07:00

14 KiB
Raw Blame History

CAR-KEY-KILLER

Dual-band RF jamming system for automotive key fob frequencies. ESP32-S3 + dual CC1101 + external amplifiers + OLED display + web interface.

WHAT IT DOES

Every car key fob on the market operates on one of two narrow sub-GHz bands. This device sweeps both bands simultaneously with continuous FM noise, leaving zero gaps between hops and zero time for a fob transmission to get through.

300 - 320 MHz   North American band
                Honda/Acura 303.825 MHz
                Chamberlain/LiftMaster 310.0 MHz
                Toyota/Lexus/Scion 314.98 MHz
                Ford/GM/Chrysler/Dodge/Jeep 315.0 MHz
                Linear Delta-3 / LiftMaster 318.0 MHz

390 - 436 MHz   European and global band
                Chamberlain/LiftMaster 390.0 MHz
                Holtek-based remotes 418.0 MHz
                Somfy RTS / SMC 5326 433.42 MHz
                BMW/VW/Audi/Mercedes/Hyundai/Kia 433.92 MHz
                Asian/Euro fobs 434.42 MHz

A fob button press generates a 200-500ms transmission window. Radio 1 completes a full sweep of 300-320 MHz every 75ms. Radio 2 completes a full sweep of 390-436 MHz every 180ms. Every target frequency gets hit multiple times per fob press. The car never receives a clean signal.

HARDWARE

[BILL OF MATERIALS]

1 x  ESP32-S3 DevKitC-1 (16MB Flash, 8MB PSRAM)
2 x  CC1101 transceiver module (Texas Instruments)
2 x  RF power amplifier module (+20 dB gain, 433/315 MHz rated)
1 x  0.96 inch SSD1306 OLED display (128x64, I2C)
1 x  Rotary encoder (KY-040 or equivalent, with detents)
2 x  Quarter-wave antenna
          315 MHz: 23.8 cm wire or tuned whip
          433 MHz: 17.3 cm wire or tuned whip
1 x  USB power supply, 5V 2A minimum

PIN MAPPING

[SPI BUS - shared between both CC1101 modules]

GPIO 11   MOSI
GPIO 12   SCK
GPIO 13   MISO

[CC1101 NUMBER 1 - 300-320 MHz sweep]

GPIO  7   CS   (chip select, dedicated)
GPIO  4   GDO0 (LEDC PWM noise output)
3V3       VCC
GND       GND

[CC1101 NUMBER 2 - 390-436 MHz sweep]

GPIO  8   CS   (chip select, dedicated)
GPIO  5   GDO0 (LEDC PWM noise output)
3V3       VCC
GND       GND

[RF AMPLIFIERS]

Inline between each CC1101 ANT pin and its antenna.
VCC from 3V3 or 5V depending on amplifier module spec.
+20 dB gain each. Default effective output: 10 + 20 = 30 dBm.

[OLED DISPLAY - 0.96 inch SSD1306]

GPIO 17   SDA
GPIO 18   SCL
3V3       VCC
GND       GND

[ROTARY ENCODER]

GPIO 14   CLK
GPIO 21   DT
GND       GND
(internal pull-ups active, no external resistors needed)

JAMMING PARAMETERS

[RF CONFIGURATION]

Modulation         FM noise (direct async TX via GDO0 LEDC PWM)
Frequency deviation  380 kHz (CC1101 hardware maximum)
Noise bandwidth      ~1010 kHz per hop (Carson rule: 2 x (380 + 125))
Bitrate              250 kbps
RX bandwidth         812 kHz (maximum)
TX power             -30 / -20 / -15 / -10 / 0 / 5 / 7 / 10 dBm (8 steps)
Default TX power     10 dBm
Amplifier gain       +20 dB (configurable in web UI)
Effective output     30 dBm / ~1 Watt (with amplifiers, at 10 dBm TX)

[SWEEP CONFIGURATION - defaults]

Radio 1 center       310.0 MHz
Radio 1 span         20.0 MHz  (300 - 320 MHz)
Radio 1 steps        25        (0.83 MHz spacing, within 1 MHz hop width)
Radio 1 cycle time   75 ms     (25 steps x 3ms dwell)

Radio 2 center       413.0 MHz
Radio 2 span         46.0 MHz  (390 - 436 MHz)
Radio 2 steps        60        (0.77 MHz spacing, within 1 MHz hop width)
Radio 2 cycle time   180 ms    (60 steps x 3ms dwell)

Dwell per hop        3 ms
Gap between hops     none (hop bandwidth > step spacing)

All sweep parameters are adjustable live from the web interface and persist across reboots via NVS (ESP32 non-volatile storage).

OLED DISPLAY

The 0.96 inch OLED runs three cycling pages. The yellow hardware zone at the top of these displays is used as the page header on every page. Pages advance automatically every 8 seconds or manually with the rotary encoder. Three dot indicators in the header show the current page.

[PAGE 0 - STATUS]  (default)

Header:  inverted bar reading JAMMING ACTIVE when running, STANDBY when not
Row 1:   ANT1 current frequency in MHz with animated radio-wave arcs
Row 2:   ANT2 current frequency in MHz with animated radio-wave arcs
Row 3:   TX power breakdown: radio dBm + amp gain = effective dBm
Row 4:   FULL DUAL-BAND TX badge when both radios active, else temp and heap
Row 5:   uptime since boot

[PAGE 1 - FREQ AND HOPS]

Header:  FREQ AND HOPS
R1 current frequency and total hop count since boot
R2 current frequency and total hop count since boot
Estimated total hops per second

[PAGE 2 - SYSTEM HEALTH]

Header:  SYS HEALTH
Temperature (ESP32-S3 internal sensor, Celsius)
Heap: current free KB and minimum recorded KB
Uptime: hours, minutes, seconds
Effective power: dBm and milliwatts
WiFi clients connected to the AP

[BOOT SEQUENCE]

The display shows synchronous status messages during boot:
SPI init, WiFi AP start, Radio 1 init, Radio 2 init, final state.

[NOTIFICATIONS]

Full-screen inverted overlay appears for 2.5 seconds on:
- Jamming started or stopped
- TX power level changed
- Radio reinitialization triggered by watchdog

WEB INTERFACE

Connect to the WiFi access point, then open the control panel in a browser.

SSID:      killer
Password:  password
IP:        192.168.4.1
mDNS:      http://killer.local
OTA port:  3232

[CONTROLS]

Start / Stop jamming toggle
TX power selector (8 levels: -30 dBm to 10 dBm)
Amplifier gain input (dB, affects displayed effective power only)
Sweep dwell time (ms per hop)
Radio 1 steps and span (MHz)
Radio 2 steps and span (MHz)
All settings persist to NVS on save

[VISUALIZATIONS]

Two canvas sweep displays, one per radio band.
Each shows the sweep range with named frequency markers:
    315 MHz band: Honda, Toyota, LiftMaster, Ford/GM markers
    433 MHz band: LiftMaster 390, Holtek 418, Somfy, BMW/VW/Audi markers
Current hop position shown with a heat trail fading over recent positions.
Canvas height 90px, updates every 1 second with telemetry.

Two sparkline charts showing 2-minute rolling history:
    Temperature (Celsius)
    Free heap (KB)

[METRICS GRID - 12 stats updated every 1 second]

Effective TX power (dBm)
Radio 1 status
Radio 2 status
ESP32 temperature (color coded: white normal, yellow warn, red critical)
Free heap KB (color coded)
Minimum heap KB recorded
Hop count Radio 1 (total since boot)
Hop count Radio 2 (total since boot)
Combined hops per second
WiFi clients on AP
Uptime
24-hour mission progress bar in the header

[LOGS]

Timestamped log ring buffer, last 50 entries.
Format: [HH:MM:SS] message
Refreshes every 5 seconds.
Covers boot events, radio status, settings changes, watchdog events,
temperature warnings, low heap warnings, and heartbeat lines.

RELIABILITY FEATURES (24-HOUR OPERATION)

The system is designed to run unattended at full power indefinitely.

Watchdog timer              Detects radio lock-up, reinitializes both CC1101s
Low heap protection         Reboots cleanly if free heap drops below 15 KB
Temperature alarm           Logs warning if internal temp exceeds 75 C
Temperature alarm rate limit  Warning logged at most once per minute
Radio status flags          Tracks per-radio TX state, triggers reinit on fail
NVS persistence             All settings survive power cycles and reboots
ArduinoOTA                  Firmware can be updated over WiFi without USB
Heap tracking               Records minimum heap ever seen since boot
Hop counting                Per-radio total hop counts logged and displayed

BUILD AND FLASH

[REQUIREMENTS]

PlatformIO Core or PlatformIO IDE (VS Code extension)
USB cable to ESP32-S3 DevKitC-1

[COMMANDS]

pio run --target upload        flash firmware
pio device monitor             serial monitor at 115200 baud
pio run --target clean         clean build artifacts

[BUILD NOTES]

The project sets build_dir to /Users/drjones/.pio_builds/car_fob_killer
to keep build artifacts outside of iCloud Drive. This prevents a known
SCons sconsign database eviction bug when the project folder is under
com~apple~CloudDocs. If you move the project, update build_dir in
platformio.ini accordingly.

[LIBRARIES]

RadioLib         patched fork (CC1101 direct async TX support)
U8g2             OLED display driver
Preferences      NVS storage wrapper
ArduinoOTA       over-the-air firmware updates
Wire             I2C bus for OLED
WebServer        HTTP server for control panel
WiFi             SoftAP mode
ESPmDNS          killer.local hostname

SOFTWARE ARCHITECTURE

[FILE STRUCTURE]

src/main.cpp        all firmware logic
include/config.h    pin definitions, frequency and RF parameters, defaults
platformio.ini      build config, library dependencies, build_dir override

[KEY FUNCTIONS IN MAIN.CPP]

startJamming()          initializes both CC1101s, sets power, starts async TX
tickSweep()             advances one radio by one hop step
oledTick()              OLED update loop, handles pages and notifications
oledDrawStatus()        page 0 renderer
oledDrawFreq()          page 1 renderer
oledDrawHealth()        page 2 renderer
oledNotify()            queues a full-screen notification
oledBootMsg()           synchronous boot status message
encISR()                rotary encoder interrupt service routine
handleToggle()          HTTP handler: start/stop jamming
handleSettings()        HTTP handler: update sweep and power parameters
handleTelemetry()       HTTP handler: JSON status for web UI polling
handleLogs()            HTTP handler: timestamped log ring buffer
handleRoot()            HTTP handler: serves embedded web UI HTML
logLine()               timestamped log entry to ring buffer and Serial
loop()                  sweeps both radios, runs OLED, runs OTA, watchdog

[SWEEP LOOP TIMING]

Both radios are swept independently in the same loop() pass.
tickSweep() is a no-op if less than sweepDwellMs have elapsed.
There are no blocking delays in the main loop.
OLED and web server run interleaved with no impact on sweep timing.

CONFIGURATION REFERENCE

Key defines in include/config.h:

CC1101_1_CS             GPIO 7    chip select, Radio 1
CC1101_1_GDO0           GPIO 4    data pin, Radio 1
CC1101_2_CS             GPIO 8    chip select, Radio 2
CC1101_2_GDO0           GPIO 5    data pin, Radio 2
SPI_MOSI_PIN            GPIO 11
SPI_SCK_PIN             GPIO 12
SPI_MISO_PIN            GPIO 13
OLED_SDA_PIN            GPIO 17
OLED_SCL_PIN            GPIO 18
ENC_CLK_PIN             GPIO 14
ENC_DT_PIN              GPIO 21

WIFI_AP_SSID            killer
WIFI_AP_PASS            password
WEB_PORT                80

JAM_BITRATE_KBPS        250.0
JAM_FREQ_DEV_KHZ        380.0     (CC1101 maximum)
JAM_RX_BW_KHZ           812.0     (CC1101 maximum)
SWEEP_DWELL_MS          3
SWEEP_1_CENTER_MHZ      310.0
SWEEP_1_SPAN_MHZ        20.0
SWEEP_1_STEPS           25
SWEEP_2_CENTER_MHZ      413.0
SWEEP_2_SPAN_MHZ        46.0
SWEEP_2_STEPS           60
DEFAULT_JAM_POWER_IDX   7         (index into CC1101 power table, 7 = 10 dBm)
DEFAULT_AMP_GAIN_DB     20
JAMMING_ENABLED         true      (start transmitting immediately on boot)

TROUBLESHOOTING

[Radios not initializing]
Check SPI wiring: MOSI=11, SCK=12, MISO=13.
Verify CS pins: GPIO7 for Radio1, GPIO8 for Radio2.
Both CC1101s must be powered from 3V3, not 5V.
Check serial output at 115200 baud for specific RadioLib error codes.

[OLED blank after flash]
Verify wiring: SDA=GPIO17, SCL=GPIO18, VCC=3V3.
Firmware probes both 0x3C and 0x3D. Check serial for OLED found message.
Most 0.96 inch SSD1306 modules run on 3V3 VCC.

[Rotary encoder not responding]
Verify CLK=GPIO14, DT=GPIO21, and encoder GND connected.
No pull-up resistors needed, internal pull-ups are enabled in firmware.
Turn slowly - one detent at a time changes page.

[Web UI not loading]
Connect to WiFi SSID "killer", password "password".
Navigate to http://192.168.4.1 or http://killer.local.
Only one device can use the AP at a time.

[OTA update failing]
Device must be powered on and jamming (or standby).
Use PlatformIO OTA upload target, hostname "killer", port 3232.

[Build fails with sconsign error]
iCloud Drive evicts SCons temp files. Ensure build_dir in platformio.ini
points to a non-iCloud path. Current setting: /Users/drjones/.pio_builds/car_fob_killer

LEGAL

Operation of intentional radio frequency jammers is illegal in most jurisdictions without specific government authorization. This includes the United States (FCC 47 CFR 333), European Union, Canada, Australia, and the United Kingdom.

This project exists for authorized RF security research, shielded lab testing, and educational study of sub-GHz radio systems. The developer accepts no responsibility for use outside of those contexts.

REPOSITORY

https://gitea.thetempleofdoom.com/drjones/car-key-killer.git

Reference in New Issue View Git Blame Copy Permalink