From a3e8ca9a558edf287f57cef2f400b4582d383d5c Mon Sep 17 00:00:00 2001 From: Zachery Aaron Shores-Chmielewski Date: Fri, 21 Aug 2026 22:42:28 +0400 Subject: [PATCH] =?UTF-8?q?docs:=20capability=20directions=20=E2=80=94=20w?= =?UTF-8?q?hat=20full=20firmware=20access=20buys=20(sense/identify/encrypt?= =?UTF-8?q?/reach)=20and=20the=20RE=20targeting=20consequence?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/directions.md | 77 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100644 docs/directions.md diff --git a/docs/directions.md b/docs/directions.md new file mode 100644 index 0000000..9b7569f --- /dev/null +++ b/docs/directions.md @@ -0,0 +1,77 @@ +# What full firmware access buys: capability directions + +Why this project exists, in plain terms. The radio's sound stays WiFi-shaped +(fixed silicon), but everything about how the radio *behaves* — measures, +steers, times, chooses — is firmware, and we're writing the manual for it. +These are the directions that manual unlocks, ordered by what they take +rather than what they politely yield. + +## Sense — the router as an instrument + +- **Motion through walls.** WiFi passes through drywall; people don't. The + router hears the difference: presence, counting, tracking in rooms it + can't see into. +- **Fine enough to see breathing.** Chest-scale motion measurably shifts the + signal. Firmware-grade measurement = continuous presence at that scale — + sleep monitoring, "is grandma moving today." +- **A camera made of radio.** Several boxes on different sides of a space, + each reading signal fade through it; combined, a live occupancy map. No + lens, no light, works through smoke and dark (radio tomography — nobody + sells it). +- **Perimeter radar.** The AP illuminates; moving reflectors — drones, + vehicles, people — return Doppler fingerprints. Private motion-sensing + perimeter from commodity WiFi. +- **Indoor GPS.** Timing accurate enough to place devices (and reflecting + people) within a room. + +## Identify — physics as a lie detector + +- **Evil-twin detection that works.** A rogue AP clones name and MAC, but + not its transmitter's RF voiceprint (manufacturing imperfections no + software fakes). Detect forgery by physics, not by trusting packets. +- **Countersurveillance.** Always-on full-spectrum ear: every nearby + transmitter fingerprinted, logged, flagged when a new voice appears. + Bug-sweeping as a background service. +- **Spectrum observatory.** Who transmits, when, how strong, from where, + at what signal quality — the whole radio neighborhood, instrumented. + +## Encrypt — physics as an uncopyable key + +- **Keys from thin air.** Two radios that talked measured a channel + slightly different from what any third radio sees; that difference is + shared secret material. Two of our devices derive encryption keys from + the fading of the air between them, in real time. The eavesdropper two + meters away reads a different channel and gets different bits + (information-theoretic key agreement — real research field, needs exactly + the low-level channel control we're building). +- **Aim silence at the snooper.** Antenna steering puts full signal on our + client and a deliberate null — a cone of near-silence — exactly where the + eavesdropper sits. +- **Vanishing links.** Per-frame frequency hopping + power control: the + link looks like background noise unless you know the dance. Hard to + intercept, hard to jam. + +## Reach — the far end of the menu + +- **Farthest link this silicon can legally make.** Slowest mode, full + calibrated power, narrowest channel, dish antennas — multi-km + experimental links on commodity hardware. Same trade LoRa makes (speed + for distance), less of it on offer. +- **Per-device brute optimization.** Stock firmware is conservative for a + million strangers; ours knows its clients and pushes each to its true + physical limit every transmission. + +## Hard walls (unchanged) + +Waveform is fixed (no arbitrary signals, no chirps); the receiver locks +only on WiFi preambles; power ceilings are regulatory; sensing items are +research-grade — but researchers are starving for exactly the measurement +control this platform can have. + +## RE targeting consequence + +Sensing, fingerprinting, channel-keys, and null-steering all consume the +same primitive: **rich per-packet channel measurement** (CSI/RX-vector +capture and control). That makes the RX measurement path — how the firmware +collects and reports channel state — the highest-value first reverse +engineering target beyond the dispatch layer already mapped.