nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Joakim Andersson — Tue, 09 Nov 2021 13:01:55 GMT

Sorry for the late reply. Version 4.1.0 is out and fixes the nrf51 issue.

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Thinner — Mon, 18 Oct 2021 21:22:53 GMT

Hi,

bsniffhub was updated lately.

Are there any news about a fixed firmware working on nRF51822 based boards?

wbr
Thinner

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Joakim Andersson — Mon, 30 Aug 2021 11:31:15 GMT

No, I don't think there will be updates to the 3.x, not with the changes you need anyway.

I can't say if we will follow up on updating bsniffhub or not for sniffer version 4.x.
Let's first see if they take in the current patch.

It works to some degree though, so maybe updating is not even required. I only tested decrypting the legacy pin trace.

If we don't (or you want to do it yourself) the follow changes are needed:
When protocol version >= 3
Time field is a timestamp, not a delta.
Packet with ID 0x02 = Advertising PDUs, 0x06 = Connection Data PDUs.
When PHY is LE Coded the Coding Indicator is included in the packet.

For reference look here:
gitlab.com/.../packet-nordic_ble.c

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Thinner — Sun, 29 Aug 2021 20:41:50 GMT

Hi,

thanks for clarification. I was unsure if i had described the problem good enough. I was confused about the statement bsniffhub has support for v3.x now. Because you will never release a v3.x version again, aren't you? Please allow the humble question, would you add support for new v4.x release when it's out, too? That would be awesome.

wbr
Thinner

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Thinner — Sun, 29 Aug 2021 20:19:10 GMT

Hi,

thanks for the background informations. I've asked Adafruit to add support for the board in Zephyr. They will have a look at this topic, they said.

wbr
Thinner

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Joakim Andersson — Fri, 27 Aug 2021 07:25:57 GMT

Hi. Sorry for the confusion, I understood the problem from your first post but didn't clear it up in my last post.

The sniffer firmware does require an update. As you say the encrypted payload is not sent, and the MIC field is not included in the packet, hence the 4 bytes less.
Updating the sniffer firmware to include the encrypted payload and the MIC and using the patches for the tools both of them can decrypt a connection.

This update will be include in the next release.

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Thinner — Thu, 26 Aug 2021 18:24:49 GMT

Hi,

thank you very much for the patches for both tools. They may improve the handling of Nordic pcap-files, but IMHO they don't solve the problem.

As i wrote in my first post, i've recorded the same session simultaneously with nRF sniffer v.3.0.0 and btlejack. The encrypted payload should be the same in both pcap-files, but are not.

nRF sniffer firmware is writing 4 bytes less to pcap per packet than btlejack and the encrypted payload is completely different.

Maybe you could look at that again.

wbr
Thinner

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Joakim Andersson — Thu, 26 Aug 2021 08:24:51 GMT

Yes, by including the encrypted payload and the MIC (was excluded hence the 4 byte difference) it now works.
Although updates to crackle and bsniffhub both are needed, I'll submit those changes.

Although it works I think bsniffhub requires further updates for version 4.x sniffer, it now has version 3.x support.

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Kenneth — Wed, 25 Aug 2021 11:38:53 GMT

[quote user="Thinner"]Let me sum up to make sure i got it right:[/quote]

All 1-3 are correct. Hopefully 3 will be fixed soon.

Kenneth

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Joakim Andersson — Wed, 25 Aug 2021 11:00:17 GMT

2. It sets the LF Clock source as default to external XTAL. Since we build for the nrf51dk as the build target. We can change the LF Clock source to an internal one in order to support the firmware being flashed to the Adafruit board.
It would however be best if there was support for the board in NCS/Zephyr build system.

3. Yes unfortunately. The issue is an unaligned memory access. So it is not the PAN notice. But you are right. The build system did not include the PAN workarounds. The issue is being addressed here: github.com/.../37925

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Thinner — Tue, 24 Aug 2021 21:24:22 GMT

Hi,

does that mean you are having a look at this and trying to fix? That would be great.

wbr
Thinner

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Thinner — Tue, 24 Aug 2021 14:57:25 GMT

Hi Kenneth,

this is an answer i can work with, many thanks.

Let me sum up to make sure i got it right:

1. you have switched from nRF5 SDK to nRF Connect SDK with v3.1.0 -> this explains grow up of code size

2. nRF Connect SDK (target nRF51DK-board) requires an external 32kHz crystal -> this explains why Adafruit board does work after soldering a crystal

3. there is an issue with v4.0.0 so it doesn't work on nRF51822 in general -> does that mean it will even not work on nRF51DK right now?

I came across this post: github.com/.../26256

and this pdf: infocenter.nordicsemi.com/.../nRF51822-pan_v2.1.pdf

"The following instructions shall be executed before any peripheral can be used.
*(uint32_t *)0x40000504 = 0xC007FFDF;
*(uint32_t *)0x40006C18 = 0x00008000;"

DWord 0xC007FFDF can be found in v3.0.0 binary at offset 0x0790, but can't be found in v3.1.0 or v4.0.0 binary.

Maybe there are other silicon errata not considered in Zephyr/nRF Connect SDK.

wbr
Thinner

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Joakim Andersson — Tue, 24 Aug 2021 09:14:37 GMT

Hey thinner. Your another topic *1 is an interesting one. Thank you for bringing these tools to our attention, and what is needed to make them work together.

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Kenneth — Mon, 23 Aug 2021 13:01:59 GMT

Looks like v4.0.0 does not work with nRF51822 at the moment. I have reported it internally. For now you would need to use the nRF52-DK or an older release of nRF sniffer (v3.1.0 or older).

Edit: Some backround to the issue:

The reason for the switch of LFCLK source is that we updated from nRF5 SDK based to nRF Connect SDK based, hence the change in firmware size. Since the build target is nRF51 DK which has the external LFCLK that is the one selected. In order to build for the Adafruit Dongle we need a board definition for it in NCS first.

Sorry for the inconvenience,
Kenneth

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Thinner — Fri, 20 Aug 2021 13:26:32 GMT

Hi,

thanks for the answer again. But as i've wrote in my first post firmware v3.0.0 does work on the board without the crystal (beside the packet corruption problem). So saying the only version that does work without the crystal is v2.0.0beta1 isn't true. See also https://forums.adafruit.com/viewtopic.php?f=53&t=166600&p=837478&hilit=sniffer#p816574

Even if the poster asks for v3.1, the flashed file was sniffer_pca10028_129d2b3.hex and this is v3.0.0.

As i've wrote before i've soldered a crystal to the board, requirement met.

The hardware hasn't changed, not on the Adafruit board and not on the nRF51DK board. I can't imagine a change in firmware that will break compatibility with one of the boards only, except the one i don't want to assume.

Sorry, but i'm a little bit disappointed by your answers.

wbr
Thinner

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Hung Bui — Fri, 20 Aug 2021 12:29:18 GMT

Yes, you do need a 32kHz crystal on the board. The only firmware that doesn't need the 32kHz crystal is the v2.0.0beta1 that provided to you by Adafruit.

The module list you pointed to is a list of module that we approved for hardware in general. It doesn't guarantee that a firmware made for nRF51 DK would work on all of the modules (for example GPIO configuration for UART, 32kHz crystal etc).

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Thinner — Fri, 20 Aug 2021 12:13:53 GMT

Hi Hung Bui,

thanks for the answer. Buying another board is my 3rd and last option. :-)

What about the other question? Is an external 32khz crystal needed for firmware > v3.0.0? If not, i don't need to pay attention to the missing 12pF caps. If yes, buying and soldering these would be my next step.

I know you can't test the firmware against all boards available on the market, but the Adafruit board is using a Raytac MDBT40-256RV3 module and this is on the list of "Pre-approved modules" ( www.nordicsemi.com/.../3rd-party-modules ).

"By using these modules you can leverage all the strengths of Nordic's SoC Hardware and Software architecture and make a 'single module product' without the need for an additional microcontroller to run your application."

The other components on the board are a standard CP2104 USB chip, some resistors, leds, caps and switches ( learn.adafruit.com/.../40687 ), so nothing that should interfere with the firmware. Even the 16MHz crystal is already inside the Raytac module.

Something was changed in the firmware > v3.0.0 that breaks compatibility. Looking at the size of the .hex files there is a big step between v3.0.0 and v3.1.0.

v2.0.0   sniffer_pca10028_c87e17d.hex -> 38518 bytes
v3.0.0   sniffer_pca10028_129d2b3.hex -> 38661 bytes
v3.1.0   sniffer_nrf51dk_nrf51422_7cc811f.hex -> 70773 bytes
v4.0.0   sniffer_nrf51dk_nrf51422_4.0.0.hex -> 85742 bytes

But the code size should be small enough to look for the cause of the problem, isn't it?

wbr
Thinner

RE: nRF Sniffer Firmware > v3.0.0 doesn't work on nRF51822 based board

Hung Bui — Fri, 20 Aug 2021 10:53:19 GMT

Hi Thinner,

I would suggest to get hold of a nRF52 DK or nRF52 Dongle to use as the sniffer backend. They cost around €10 and would save you from lots of headache and time. The new sniffer firmware is not tested against the Adafruit board so we can't really tell what could be wrong here.

You can find the distributor list here: https://www.nordicsemi.com/About-us/FindDistributor

You can order online from stores as well, such as digikey or mouser.