Secure Mobile Networking Lab ORG

Build your own 'AirTags' 🏷 today! Framework for tracking personal Bluetooth devices via Apple's massive Find My network.

A research tool that lets you build DIY Bluetooth tracking tags and locate them using Apple's Find My network, the same system that powers AirTags, without needing Apple-branded hardware for the tag.

An open Apple AirDrop implementation written in Python

The C-based Firmware Patching Framework for Broadcom/Cypress WiFi Chips that enables Monitor Mode, Frame Injection and much more

Protect yourself from being tracked 🌍 by AirTags 🏷 and Find My accessories 📍

An open Apple Wireless Direct Link (AWDL) implementation written in C

An open source implementation of Apple's Wi-Fi Password Sharing protocol in Python.

Proof of concept project for operating Broadcom Wi-Fi chips as arbitrary signal transmitters similar to software-defined radios (SDRs)

Bluetooth experimentation framework for Broadcom and Cypress chips.

Broadcom and Cypress firmware emulation for fuzzing and further full-stack debugging

Channel State Information Extraction on Various Broadcom Wi-Fi Chips

CellGuard is a research project that analyzes how cellular networks are operated and possibly surveilled

No description.

Practical Privacy-Preserving Authentication for Apple AirDrop

No description.

Nmap for Bluetooth Low Energy

AirTag instrumentation including AirTechno and firmware downgrades.

DEPRECATED: Monitor Mode and Firmware patching framework for the Raspberry Pi 3, development moved to: https://github.com/seemoo-lab/nexmon

Wireshark Dissector for Apple Wireless Direct Link (AWDL) and Apple's CoreCapture logging framework. Note: the AWDL dissector is part of Wireshark 3.0!

VirtFuzz is a Linux Kernel Fuzzer that uses VirtIO to provide inputs into the kernels subsystem. It is built with LibAFL.

No description.

Extracting Apple ID Validation Record, Certificate, and Key for AirDrop

Example project for extracting channel state information of up to 80 MHz wide 802.11ac Wi-Fi transmissions using the BCM4339 Wi-Fi chip of Nexus 5 smartphones.

Android Interoperability for the Apple Watch

Protect yourself from being tracked 📍by AirTags, SmartTags, Chipolo, Google, and Tile Trackers

Reverse engineering toolkit for Apple's wireless ecosystem

DEPRECATED: Monitor Mode and Firmware patching framework for the Google Nexus 5, development moved to: https://github.com/seemoo-lab/nexmon

A free satellite messenger for iPhone 14

A framework for researching the interface between the iPhone's application processor and its baseband

No description.

Helping groups securely exchange contact information.

A Wireshark dissector for the Apple Remote Invocation (ARI) protocol, used between Intel base band chips and the iOS CommCenter for various management purposes, SMS, telephony and much more.

This project contains the nexmon-based source code required to repeat the experiments of our WiSec 2017 paper.

Debugger with hardware breakpoints and memory watchpoints for BCM4339 Wi-Fi chips

mmTrace: Millimeter Wave Propagation Simulation

No description.

A LoRaWAN Security Evaluation Framework

pyshimmer provides a Python API to work with the wearable sensor devices produced by Shimmer.

Talon Tools: The Framework for Practical IEEE 802.11ad Research

No description.

Tunnels a regular TCP connection through an AWDL link by exploiting the NetService API

A UWB Sniffer with accurate timestamps

No description.

LEDE environment ported to support TP-Link TALON AD7200 devices.

Wi-Fi based covert channel that hides information in hand crafted acknowledgement frames imitating additional channel effects that can be extracted from channel state information at the intended receiver.

Applications for the Raspberry Pi Pico W related to Nexmon the C-based firmware patching framework for Broadcom/Cypress WiFi chips.

Wireshark dissector for Broadcom specific H4 diagnostic commands

No description.

BTLEmap's Bluetooth Low Energy framework that powers the app

Opening up Apple's wireless ecosystem around the Apple Wireless Direct Link (AWDL) protocol

The nexmon C-based firmware patching framework adapted for the ARC architecture.

Wireshark dissectors for Apple Watch protocols (Magnet, NRLP, NWSC, Alloy, Shoes)

Sensor data collector for Android devices

OpenNAN - An open source NAN stack for Linux

No description.

This project contains source code of our Nexmon-based jammer app presented as a demo at WiSec 2017.

An open source implementation of Apple's Wi-Fi Password Sharing protocol in Swift.

Bring Your Own FIDO2 Extensions!

Sensor data collector for Samsung Gear S3

Antenna Sector Patterns as obtained by Measurements in the CoNEXT'17 paper

Tool support for the proprietary Apple Watch protocol stack

Lost and Found: Stopping Bluetooth Finders from Leaking Private Information

Scheduled frame transmission on Broadcom Wi-Fi Chips

No description.

This project contains the nexmon-based source code of the jammer used in our WiSec 2017 demo Android app.

Physical Layer Privacy against Adversarial Wireless Sensing :ghost: Inject arbitrary IEEE 802.11 VHT Compressed Beamforming Report values on Broadcom BCM43-based 802.11ac FullMAC chips. :dancer:

Quantitative analysis of location reports from Apple's offline finding (OF) location tracking system

No description.

D11emu: A BCM43 D11 Emulation Framework

Natural Disaster Mobility Model and Scenarios in the ONE

Code for "My(o) Armband Leaks Passwords: An EMG and IMU Based Keylogging Side-Channel Attack" paper

snipeit-it based asset management app

Source code for experiments and evaluation of five zero-interaction security schemes, for our Ubicomp 2019 paper "Perils of Zero-Interaction Security in the Internet of Things"

Proof of concept implementation of Acoustic Integrity Codes (AICs) for Android smartphones

The artifacts for the 'On the Effectiveness of CFI in Practice' paper to be published at WOOT'24.

No description.

Source code for experiments and evaluation of Next2You copresence detection scheme, for our TIOT 2021 paper "Next2You: Robust Copresence Detection Based on Channel State Information".

This repository contains patched Linux kernel sources to run energy measurements on the Wi-Fi chip of a Nexus 5 smartphone.

This project contains all measured data and scripts to recreate the plots used in our WiSec 2017 paper.

This repository contains the artifacts for the PETS 2025 paper "Okay Google, Where’s My Tracker? Security, Privacy, and Performance Evaluation of Google’s Find My Device Network"

Artifact for our Ad Personalization and Transparency in Mobile Ecosystems: A Comparative Analysis of Google’s and Apple’s EU App Stores paper published in Proceedings on Privacy Enhancing Technologies 2026 (Issue 1).

CARET: The Crisis and Resilience Evaluation Tool

User Data and Online Survey results

Decrypt and show the content of BLE advertising packets sent by your iPhone when using Handoff

Source code for experiments and evaluation of FastZIP zero-interaction pairing scheme, for our Mobisys 2021 paper "FastZIP: Faster and More Secure Zero-Interaction Pairing".

The framework that powers PrivateDrop

No description.

No description.

A Lightweight Framework for Agile Distributed Network Experiments

No description.

Shimmer3 applications for Code Composer Studio

No description.

No description.

Click implementation of LIDOR/SEMUD (based on the Castor routing protocol)

Source code for experiments and evaluation of HardZiPA system for our EWSN 2023 paper "Hardening and Speeding UpZero-interaction Pairing and Authentication".

Artifact for the paper P-Box: Preventing Unwanted Data Flows using Permission Sandboxes on Android

Docker files to run open5gs + IMS + eNB + gNB + NR-UE in a docker

Pair-Fi: Integrity Code Protected Secure Device Pairing via SDR-Enabled Wi-Fi Chips on Smartphones

Software repository for our WiSec '23 demo: Secure Bootstrapping of Smart Speakers Using Acoustic Communication

This project contains the nexmon-based source code of the ping offloading application used in our WiNTECH 2017 paper.

No description.

This is a fork of the original python-msp430-tools repository on Launchpad. It features a patchset that is required to use the tools with the Shimmer3 devices.

No description.

No description.

Large-Scale Talon Measurements at Library

Mockup Website for FIDO2 Platform and Roaming Authentication on Smartphones

No description.

No description.

No description.

No description.

ClickOS toolstack