Android Fragment RF Brute Force De Bruijn
The De Bruijn sequence is an algorithm used to efficiently produce every possible code in as few bits as possible. It is very effective against old receivers that contain shift registers. Using the De Bruijn mathematical algorithm, PandwaRF Rogue Gov is able to brute force a 12 bit code in 1.2 s instead of a normal brute forced duration of 8mn. Besides classical RF parameters such as frequency, data rate and modulation, the only parameter needed is the length of the codeword to Brute force. Old receivers usually use from 8 bit to 12 bit codewords.
Note on De Bruijn attack: this attack only works on some old receivers.
The De Bruijn Brute Force can also be made using Symbols Encoding. While normal De Bruijn brute force is made using binary symbols, using Symbol Encoding allows the translation of symbols onto a byte instead of a bit.
- symbol 0 => bit ‘0’
- symbol 1 => bit ‘1’
- symbol 0 => bit ‘0x88’
- symbol 1 => bit ‘0x8E’
Of course in the example above, encoding onto bytes ‘88’ and ‘8E’ is arbitrary and can be changed by user.
For more information about the De Bruijn attack and vulnerable devices, refer to http://samy.pl/opensesame/