Setting up Crazyradio PA #2

gyaresu · 2016-02-25T01:47:25Z

Just documenting the process getting started with the Crazyradio PA and MouseJack.

If you're using http://macports.org then you'll want to edit the Makefile on line 7 to gobjcopy because FSF software names a lot of their tools with a leading g.

You may also need to run make bin/ first before just running make. Or at least I needed to on OS X & Ubuntu.

Builds fine though.

Then make install.... hmmm....

OS X

gyaresu@zaphod:~/programming/mousejack|master⚡
⇒  make install
./prog/usb-flasher/usb-flash.py bin/dongle.bin
[2016-02-25 12:01:37.841]  Looking for a compatible device that can jump to the Nordic bootloader
[2016-02-25 12:01:37.878]  Device found, jumping to the Nordic bootloader
[2016-02-25 12:01:37.879]  Looking for a device running the Nordic bootloader
[2016-02-25 12:01:39.155]  No compatbile device found
Traceback (most recent call last):
  File "./prog/usb-flasher/usb-flash.py", line 90, in <module>
    raise Exception('No compatible device found.')
Exception: No compatible device found.
make: *** [install] Error 1

Debian:

user@nuc:~$ make install
./prog/usb-flasher/usb-flash.py bin/dongle.bin
[2016-02-25 12:07:57.652]  Looking for a compatible device that can jump to the Nordic bootloader
[2016-02-25 12:07:57.672]  Looking for a device running the Nordic bootloader
[2016-02-25 12:07:58.673]  No compatbile device found
Traceback (most recent call last):
  File "./prog/usb-flasher/usb-flash.py", line 90, in <module>
    raise Exception('No compatible device found.')
Exception: No compatible device found.
Makefile:21: recipe for target 'install' failed
make: *** [install] Error 1

It's there though right?
$ lsusb:
Bus 001 Device 007: ID 1915:7777 Nordic Semiconductor ASA

So maybe the PA doesn't come with firmware installed?

https://github.com/bitcraze/crazyradio-firmware/releases

Ah...

So download the correct firmware:
https://github.com/bitcraze/crazyradio-firmware/releases/ (lastest is currently: cradio-pa-0.53.bin)

Then follow the instructions to USB firmware upgrade:
https://wiki.bitcraze.io/projects:crazyradio:programming

And you should be on a winner.

sudo make install
./prog/usb-flasher/usb-flash.py bin/dongle.bin
[2016-02-25 12:30:21.961]  Looking for a compatible device that can jump to the Nordic bootloader
[2016-02-25 12:30:21.981]  Looking for a device running the Nordic bootloader
[2016-02-25 12:30:21.984]  Writing image to flash
[2016-02-25 12:30:22.404]  Verifying write
[2016-02-25 12:30:22.440]  Firmware programming completed successfully
[2016-02-25 12:30:22.440]  Please unplug your dongle or breakout board and plug it back in.

The text was updated successfully, but these errors were encountered:

marcnewlin · 2016-02-25T02:27:34Z

@gyaresu thanks for documenting this.

I see that the failed make install attempts were run without sudo, and one possibility is that the script was silently failing with a permission issue.

https://github.com/RFStorm/mousejack/blob/master/prog/usb-flasher/usb-flash.py#L85

gyaresu · 2016-02-25T02:31:04Z

hah. of course. I may have way overthought the issue ><

Thanks @marcnewlin

… throw permission exceptions instead of failing silently. Per #2.

cucrisis · 2016-03-30T04:34:03Z

Hi, the flashing process completed successfully but after plugin in the CrazyPA i could not see it. The dongle is showing a continues red light ?! any idea what this might be ?

notsoevilweasel · 2016-04-22T10:14:27Z

Wierd, getting the same fail during a make install i.e "no compatible device"...same fail when using sudo make install

./prog/usb-flasher/usb-flash.py bin/dongle.bin [2016-04-22 22:00:36.620] Looking for a compatible device that can jump to the Nordic bootloader [2016-04-22 22:00:36.706] Device found, jumping to the Nordic bootloader [2016-04-22 22:00:36.752] Looking for a device running the Nordic bootloader [2016-04-22 22:00:37.969] No compatbile device found Traceback (most recent call last): File "./prog/usb-flasher/usb-flash.py", line 92, in <module> raise Exception('No compatible device found.') Exception: No compatible device found. make: *** [install] Error 1

Even after successfully flashing the latest firmware

boaty-MBP:crazyradio-firmware boaty$ python usbtools/nrfbootload.py flash cradio-pa-0.53.bin ('Found nRF24LU1 bootloader version', '18.0') Flashing: Flashing 5810 bytes... Flashing done! Verifying: Reading cradio-pa-0.53.bin... Reading 5810 bytes from the flash... Verification succeded!

marcnewlin · 2016-04-22T13:33:08Z

After the Device found, jumping to the Nordic bootloader step, the flashing script sends a USB command to the dongle instructing it to run the Nordic bootloader, which exposes the firmware flashing functionality. It would appear that this doesn't complete for some reason, so the flashing script fails.

Can you try running ./prog/usb-flasher/usb-flash.py bin/dongle.bin again, and see what the USB IDs are for the dongle after it fails? That will tell us if it succeeded in entering the Nordic bootloader or not.

Debugging this problem aside, it sounds like the CrazyRadio flashing utility will work in your case to flash the RFStorm firmware onto the dongle. Have you tried this?

notsoevilweasel · 2016-04-22T21:13:08Z

Cheers for the reply! (unexpected)
Ran the script directly and it seemed to do the job. Unsure if I'm going insane at this point, sudo make install failed directly before the below attempt succeeded

boaty-MBP:mousejack boaty$ ./prog/usb-flasher/usb-flash.py bin/dongle.bin [2016-04-23 08:20:54.394] Looking for a compatible device that can jump to the Nordic bootloader [2016-04-23 08:20:54.500] Device found, jumping to the Nordic bootloader [2016-04-23 08:20:54.703] Looking for a device running the Nordic bootloader [2016-04-23 08:20:56.428] Writing image to flash [2016-04-23 08:20:56.915] Verifying write [2016-04-23 08:20:56.955] Firmware programming completed successfully [2016-04-23 08:20:56.955] Please unplug your dongle or breakout board and plug it back in.

marcnewlin · 2016-04-23T15:22:02Z

It could be a timeout problem. The usb-flash.py script will report No compatible device found after 1000ms if it doesn't see the Nordic bootloader show up.

It would be interesting to see if it works reliably for you if you increase the timeout value here:

https://github.com/RFStorm/mousejack/blob/master/prog/usb-flasher/usb-flash.py#L79

Are you working in a VM by chance?

notsoevilweasel · 2016-04-25T05:00:17Z

Changed it up to 10 and ran through from scratch. No issues. Seemed to do the trick.
Experienced it on both Host and Guest.

sw1337 · 2016-09-15T11:25:06Z

It seems i'm having an issue: The red LED of my Crazyradio PA is constantly on. Is that normal?

Flashing outputted the following:

[2016-09-15 13:17:49.080] Looking for a compatible device that can jump to the Nordic bootloader
[2016-09-15 13:17:49.188] Device found, jumping to the Nordic bootloader
[2016-09-15 13:17:49.609] Looking for a device running the Nordic bootloader
[2016-09-15 13:17:49.619] Writing image to flash
[2016-09-15 13:17:50.253] Verifying write
[2016-09-15 13:17:50.333] Firmware programming completed successfully
[2016-09-15 13:17:50.333] Please unplug your dongle or breakout board and plug it back in.

Any ideas?

yweiss0 · 2016-10-29T20:55:11Z

Hi, just got my Crazyradio PA but i cant get it to work.. Same error as above, I tried with two different Crazyradio PA but not working, also flashed the 0.53 firmware but not working. Please help me

yweiss0 · 2016-10-29T22:27:04Z

Try to reflash the 0.53 crazyradio PA firmware and now i get message "Error, cant find the Crazyradio USB Dongle.
Can you please help me? Same error fro both NEW crazyradio PA

evilsocket · 2019-03-17T17:23:32Z

similar issue on this repo bettercap/bettercap#497

juliocesarfort · 2019-06-09T10:05:47Z

Hi,

I am having the same issues described by @sw1337 and @yweiss0.

I bought a brand new Crazyradio PA from Bitcraze directly and when it arrived it blinked
red and green LEDs. Shortly after that, I followed all instructions to flash the firmware
with the latest nrf-research-firmware.

Flashing seemed to be successful, no error messages:

$ sudo make install
./prog/usb-flasher/usb-flash.py bin/dongle.bin
[2019-06-09 11:59:29.925] Looking for a compatible device that can jump to the Nordic bootloader
[2019-06-09 11:59:29.943] Device found, jumping to the Nordic bootloader
[2019-06-09 11:59:30.507] Looking for a device running the Nordic bootloader
[2019-06-09 11:59:30.778] Writing image to flash
[2019-06-09 11:59:31.414] Verifying write
[2019-06-09 11:59:31.465] Firmware programming completed successfully
[2019-06-09 11:59:31.465] Please unplug your dongle or breakout board and plug it back in.

Chipset info written in the dongle: nrf24lu1p 1829DN

Sample from lsusb (now after flashed firmware):

Bus 002 Device 004: ID 1915:0102 Nordic Semiconductor ASA
...
idVendor 0x1915 Nordic Semiconductor ASA
idProduct 0x0102
bcdDevice 0.01
iManufacturer 1 (error)
iProduct 2 (error)

Sample from dmesg (now after flashed firmware):

[ 1363.321290] usb 2-1: USB disconnect, device number 5
[ 1366.164076] usb 2-1: new full-speed USB device number 6 using xhci_hcd
[ 1366.314780] usb 2-1: New USB device found, idVendor=1915, idProduct=0102
[ 1366.314789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 1366.314795] usb 2-1: Product: Research Firmware
[ 1366.314801] usb 2-1: Manufacturer: RFStorm

Despite the successful flashing, my dongle now displays a solid red LED and
I am unable to reflash via USB the original Crazyradio firmware.

Reflashing one more time with prog/usb-flasher/usb-flash.py works and I get the same successful
message as above, as it seems to look for RFStorm firmwares with product ID 0x0102 like the one
I have now:

--
logging.info("Looking for a compatible device that can jump to the Nordic bootloader")
product_ids = [0x0102, 0x7777]

Is the red LED supposed to be on all the time?

HachimanSec · 2019-08-06T14:16:08Z

Hey everyone,
I truly hope there is still someone on this thread. It seems like certain people have similar issues.

I was able to patch the Bitcraze PA dongle, at least according to the command line output.
It is even recognised as (taken from my Mac OS host):

+-o Research Firmware@14100000  <class AppleUSBDevice, id 0x10000169e, registered, matched, active, busy 0 (2 ms), retain 9>
        {
          "sessionID" = 9746251445209
          "iManufacturer" = 1
          "bNumConfigurations" = 1
          "idProduct" = 258
          "bcdDevice" = 1
          "Bus Power Available" = 250
          "USB Address" = 7
          "bMaxPacketSize0" = 64
          "iProduct" = 2
          "iSerialNumber" = 0
          "bDeviceClass" = 255
          "Built-In" = No
          "locationID" = 336592896
          "bDeviceSubClass" = 255
          "bcdUSB" = 512
          "USB Product Name" = "Research Firmware"
          "PortNum" = 1
          "non-removable" = "no"
          "IOCFPlugInTypes" = {"9dc7b780-9ec0-11d4-a54f-000a27052861"="IOUSBFamily.kext/Contents/PlugIns/IOUSBLib.bundle"}
          "bDeviceProtocol" = 255
          "IOUserClientClass" = "IOUSBDeviceUserClientV2"
          "IOPowerManagement" = {"DevicePowerState"=0,"CurrentPowerState"=3,"CapabilityFlags"=65536,"MaxPowerState"=4,"DriverPowerState"=3}
          "Device Speed" = 1
          "USB Vendor Name" = "RFStorm"
          "idVendor" = 6421
          "IOGeneralInterest" = "IOCommand is not serializable"
          "IOClassNameOverride" = "IOUSBDevice"
        }

I can start various tools, including Jackit, nrf24-playset from SSyS Consulting, but I don't receive any data at all. The presenter is a Logitech R400 R0008, known to be vulnerable.

The Bitcraze is displaying a solid red LED.

Anyone any idea? Is it bricked/dead?

HachimanSec · 2019-08-06T14:55:05Z

@juliocesarfort have you been able to succeed here?

I have a similar issue, after apparently successful flashing, the LED is constantly red and I am not able to scan any traffic etc.

Hi guys,

not sure if this thread is still active, however I have the same issue.

I was able to flash the FW successfully, according to term output.

I also tried to flash again via the Bitcraze firmware nrfbootload script "sudo python2 ../../crazyradio-firmware/usbtools/nrfbootload.py flash bin/dongle.bin"
I receive an error like
"Error: cannot found the nRF24LU1 bootloader!"
So is there probably an issue and I need a SPI board to flash the bootloader (like a Teensy 2.0 I guess?)

Anyone any ideas?

protopyte · 2021-01-06T14:50:36Z

Just some more troubleshooting information. lsusb will give you the following identifiers depending on the state the Crazyradio PA dongle is in:

1915:7777: regular Crazyradio firmware
1915:0101: bootloader mode
1915:0102: mousejacked
nothing: fix with SPI

For SPI related stuff, I went the RPi way, see the Bitcraze github and a picture of the setup from the author of the script is here. See as well the support provided here. In case it is not clear enough, the dongle is powered over the USB connection.

After flashing, not much happens. I unplugged/replugged, had a solid red LED, checked lsusb. The main difference between "bricked" and properly flashed was USB enumeration (it would stall when bricked, or the dongle would not show up in the lsusb output, and I had some device descriptor read/64, error -110 in syslog).

For permission issues, you are likely already a member of the plugdev group, it is a matter of adding some rules upon plugging the dongle.

I probably bricked mine while fixing some scripts for python3 support, you might want to python -V first.

gyaresu closed this as completed Feb 25, 2016

marcnewlin added a commit that referenced this issue Feb 25, 2016

Fixed Makefile to correctly make bin directory. Fixed usb-flash.py to…

cdcd730

… throw permission exceptions instead of failing silently. Per #2.

marcnewlin reopened this Apr 22, 2016

johnmatczak mentioned this issue Sep 21, 2018

It seems i'm having an issue: The red LED of my Crazyradio PA is constantly on. Is that normal? #39

Open

evilsocket mentioned this issue Mar 17, 2019

HID: usb device 1915:0102 not found on mac bettercap/bettercap#497

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Setting up Crazyradio PA #2

Setting up Crazyradio PA #2

gyaresu commented Feb 25, 2016

marcnewlin commented Feb 25, 2016

gyaresu commented Feb 25, 2016

cucrisis commented Mar 30, 2016

notsoevilweasel commented Apr 22, 2016

marcnewlin commented Apr 22, 2016

notsoevilweasel commented Apr 22, 2016

marcnewlin commented Apr 23, 2016

notsoevilweasel commented Apr 25, 2016 •

edited

Loading

sw1337 commented Sep 15, 2016

yweiss0 commented Oct 29, 2016

yweiss0 commented Oct 29, 2016

evilsocket commented Mar 17, 2019

juliocesarfort commented Jun 9, 2019 •

edited

Loading

HachimanSec commented Aug 6, 2019

HachimanSec commented Aug 6, 2019 •

edited

Loading

protopyte commented Jan 6, 2021

Setting up Crazyradio PA #2

Setting up Crazyradio PA #2

Comments

gyaresu commented Feb 25, 2016

marcnewlin commented Feb 25, 2016

gyaresu commented Feb 25, 2016

cucrisis commented Mar 30, 2016

notsoevilweasel commented Apr 22, 2016

marcnewlin commented Apr 22, 2016

notsoevilweasel commented Apr 22, 2016

marcnewlin commented Apr 23, 2016

notsoevilweasel commented Apr 25, 2016 • edited Loading

sw1337 commented Sep 15, 2016

yweiss0 commented Oct 29, 2016

yweiss0 commented Oct 29, 2016

evilsocket commented Mar 17, 2019

juliocesarfort commented Jun 9, 2019 • edited Loading

Bus 002 Device 004: ID 1915:0102 Nordic Semiconductor ASA ... idVendor 0x1915 Nordic Semiconductor ASA idProduct 0x0102 bcdDevice 0.01 iManufacturer 1 (error) iProduct 2 (error)

-- logging.info("Looking for a compatible device that can jump to the Nordic bootloader") product_ids = [0x0102, 0x7777]

HachimanSec commented Aug 6, 2019

HachimanSec commented Aug 6, 2019 • edited Loading

protopyte commented Jan 6, 2021

notsoevilweasel commented Apr 25, 2016 •

edited

Loading

juliocesarfort commented Jun 9, 2019 •

edited

Loading

Bus 002 Device 004: ID 1915:0102 Nordic Semiconductor ASA
...
idVendor 0x1915 Nordic Semiconductor ASA
idProduct 0x0102
bcdDevice 0.01
iManufacturer 1 (error)
iProduct 2 (error)

--
logging.info("Looking for a compatible device that can jump to the Nordic bootloader")
product_ids = [0x0102, 0x7777]

HachimanSec commented Aug 6, 2019 •

edited

Loading