77 lines
3.8 KiB
Markdown
77 lines
3.8 KiB
Markdown
# What full firmware access buys: capability directions
|
|
|
|
Why this project exists, in plain terms. The radio's sound stays WiFi-shaped
|
|
(fixed silicon), but everything about how the radio *behaves* — measures,
|
|
steers, times, chooses — is firmware, and we're writing the manual for it.
|
|
These are the directions that manual unlocks, ordered by what they take
|
|
rather than what they politely yield.
|
|
|
|
## Sense — the router as an instrument
|
|
|
|
- **Motion through walls.** WiFi passes through drywall; people don't. The
|
|
router hears the difference: presence, counting, tracking in rooms it
|
|
can't see into.
|
|
- **Fine enough to see breathing.** Chest-scale motion measurably shifts the
|
|
signal. Firmware-grade measurement = continuous presence at that scale —
|
|
sleep monitoring, "is grandma moving today."
|
|
- **A camera made of radio.** Several boxes on different sides of a space,
|
|
each reading signal fade through it; combined, a live occupancy map. No
|
|
lens, no light, works through smoke and dark (radio tomography — nobody
|
|
sells it).
|
|
- **Perimeter radar.** The AP illuminates; moving reflectors — drones,
|
|
vehicles, people — return Doppler fingerprints. Private motion-sensing
|
|
perimeter from commodity WiFi.
|
|
- **Indoor GPS.** Timing accurate enough to place devices (and reflecting
|
|
people) within a room.
|
|
|
|
## Identify — physics as a lie detector
|
|
|
|
- **Evil-twin detection that works.** A rogue AP clones name and MAC, but
|
|
not its transmitter's RF voiceprint (manufacturing imperfections no
|
|
software fakes). Detect forgery by physics, not by trusting packets.
|
|
- **Countersurveillance.** Always-on full-spectrum ear: every nearby
|
|
transmitter fingerprinted, logged, flagged when a new voice appears.
|
|
Bug-sweeping as a background service.
|
|
- **Spectrum observatory.** Who transmits, when, how strong, from where,
|
|
at what signal quality — the whole radio neighborhood, instrumented.
|
|
|
|
## Encrypt — physics as an uncopyable key
|
|
|
|
- **Keys from thin air.** Two radios that talked measured a channel
|
|
slightly different from what any third radio sees; that difference is
|
|
shared secret material. Two of our devices derive encryption keys from
|
|
the fading of the air between them, in real time. The eavesdropper two
|
|
meters away reads a different channel and gets different bits
|
|
(information-theoretic key agreement — real research field, needs exactly
|
|
the low-level channel control we're building).
|
|
- **Aim silence at the snooper.** Antenna steering puts full signal on our
|
|
client and a deliberate null — a cone of near-silence — exactly where the
|
|
eavesdropper sits.
|
|
- **Vanishing links.** Per-frame frequency hopping + power control: the
|
|
link looks like background noise unless you know the dance. Hard to
|
|
intercept, hard to jam.
|
|
|
|
## Reach — the far end of the menu
|
|
|
|
- **Farthest link this silicon can legally make.** Slowest mode, full
|
|
calibrated power, narrowest channel, dish antennas — multi-km
|
|
experimental links on commodity hardware. Same trade LoRa makes (speed
|
|
for distance), less of it on offer.
|
|
- **Per-device brute optimization.** Stock firmware is conservative for a
|
|
million strangers; ours knows its clients and pushes each to its true
|
|
physical limit every transmission.
|
|
|
|
## Hard walls (unchanged)
|
|
|
|
Waveform is fixed (no arbitrary signals, no chirps); the receiver locks
|
|
only on WiFi preambles; power ceilings are regulatory; sensing items are
|
|
research-grade — but researchers are starving for exactly the measurement
|
|
control this platform can have.
|
|
|
|
## RE targeting consequence
|
|
|
|
Sensing, fingerprinting, channel-keys, and null-steering all consume the
|
|
same primitive: **rich per-packet channel measurement** (CSI/RX-vector
|
|
capture and control). That makes the RX measurement path — how the firmware
|
|
collects and reports channel state — the highest-value first reverse
|
|
engineering target beyond the dispatch layer already mapped.
|