Can finally send, correctly control LEDs and return to menu when done

Author: David Lee

README.md

@@ -6,23 +6,35 @@ This app triggers restaurant pagers in a brute force manner, useful to test if d
 
 ## Supported Pagers
 - Retekess T119
-- Retekess TD157
-- Retekess TD165
-- Retekess TD174
+- Retekess TD157 (coming soon)
+- Retekess TD165 (coming soon)
+- Retekess TD174 (coming soon)
 
 ### Features
-- Select range of stations
-- Select range of pagers
+- Select range of stations (needs improving for full range)
+- Select range of pagers (needs improving for full range)
 
 ## How to install on Flipper Zero
-- If you do not have one, download a firmware<br>
+- If you do not have one, download a firmware onto your PC via git<br>
 - Plug your Flipper Zero in via USB. <br>
 - Copy the contents of this folder into the applications_user folder of your firmware. <br> 
 
+## What does the blinking mean
+
+### Yellow Blinking LED
+Means that the SubGhz Code is being generated for the configured range
+
+### Purple Blinking LED
+Means that SubGhz Signals are being sent
+
 ## Can this Brute-Force Attacks
-In Theory yes, but I wouldn't recommend trying it. Most pagers support 8191 Stations. Triggering ~30 Pagers per station would easily take over 2h. That when only sending each trigger once. It is recommended is to repeat the signal approx 10x, so that would already take all day. 
+This is a Proof-of-Concept. In Theory it could, but I wouldn't recommend trying it. Its annoying for people targeted and it could get you into trouble. Seriously, don't be that person, nobody will like your for it. 
+Appart from that, most pagers support 8191 Stations. Triggering ~30 Pagers per station would easily take a long time. That when only sending each trigger once. It is recommended is to repeat the signal approx 10x (currently not possible, but possible that stations don't react to a single call), so that would already take all day. 
 Chances are also, that your Flipper Zero will crash in that time.
 
+## Does this even work
+I don't know. It's based on intel collected from other people. The Flipper sends data, I checked that with a second flipper. But if the data actually triggers something is not sure. 
+
 Then run the command: 
  ```
 .\fbt launch APPSRC=applications_user/meal_pager

docs/changelog.md

@@ -1,3 +1,7 @@
+## v0.5
+
+Compiled .sub data is read out and sent via SubGhz. Currently only support for T119. 
+
 ## v0.1
 
 Can now generate a temporary .sub file for Retekess T119 Pager triggers. Must still be run via SubGhz App

helpers/meal_pager_custom_event.h

@@ -19,6 +19,10 @@ typedef enum {
     Meal_PagerCustomEventScene2Right,
     Meal_PagerCustomEventScene2Ok,
     Meal_PagerCustomEventScene2Back,
+    Meal_PagerCustomEventViewTransmitterBack,
+    Meal_PagerCustomEventViewTransmitterSendStart,
+    Meal_PagerCustomEventViewTransmitterSendStop,
+    Meal_PagerCustomEventViewTransmitterError,
 } Meal_PagerCustomEvent;
 
 enum Meal_PagerCustomEventType {

helpers/meal_pager_storage.c

@@ -11,6 +11,7 @@ static void meal_pager_close_storage() {
 
 static void meal_pager_close_config_file(FlipperFormat* file) {
     if (file == NULL) return;
+    flipper_format_rewind(file);
     flipper_format_file_close(file);
     flipper_format_free(file);
 }

helpers/retekess/meal_pager_retekess_t119.c

@@ -191,7 +191,7 @@ bool meal_pager_retekess_t119_generate_all(void* context) {
     bool success = meal_pager_save_subghz_buffer_file_start(app, ff, storage);
 
     if (!success) {
-        FURI_LOG_D(TAG, "failed to save buffer");
+        FURI_LOG_D(TAG, "failed to save to buffer");
         meal_pager_save_subghz_buffer_stop(app, ff);
         furi_record_close(RECORD_STORAGE);
         return success;

helpers/subghz/subghz.c

@@ -1,9 +1,11 @@
 /* Reduced variant of the Flipper Zero SubGhz Class */
 
 #include "subghz_i.h"
+#include "../../helpers/meal_pager_custom_event.h"
+#include "../../helpers/meal_pager_led.h"
 //#include "../meal_pager_storage.h"
 
-static SubGhz* subghz_alloc() {
+SubGhz* subghz_alloc() {
     SubGhz* subghz = malloc(sizeof(SubGhz));
 
     subghz->file_path = furi_string_alloc();
@@ -13,7 +15,7 @@ static SubGhz* subghz_alloc() {
     return subghz;
 }
 
-static void subghz_free(SubGhz* subghz) {
+void subghz_free(SubGhz* subghz) {
     //TxRx
     subghz_txrx_free(subghz->txrx);
 
@@ -24,11 +26,23 @@ static void subghz_free(SubGhz* subghz) {
     free(subghz);
 }
 
+
+void subghz_scene_transmit_callback_end_tx(void* context) {
+    furi_assert(context);
+    //UNUSED(context);
+    FURI_LOG_D(TAG, "callback end");
+    Meal_Pager* app = context;
+    view_dispatcher_send_custom_event(
+        app->view_dispatcher, Meal_PagerCustomEventViewTransmitterSendStop);
+}
+
 void subghz_send(void* context) {
-    UNUSED(context);
-    SubGhz* subghz = subghz_alloc();
+    //UNUSED(context);
+    Meal_Pager* app = context;
+    //SubGhz* subghz = subghz_alloc();
 
-    subghz_load_protocol_from_file(subghz);
+    FURI_LOG_D(TAG, "loading protocol from file");
+    subghz_load_protocol_from_file(app->subghz);
 
     /*Storage* storage = furi_record_open(RECORD_STORAGE);
     FlipperFormat* ff = flipper_format_file_alloc(storage);
@@ -41,7 +55,14 @@ void subghz_send(void* context) {
     }*/
 
     //subghz_txrx_tx_start(subghz->txrx, ff);
-    subghz_txrx_tx_start(subghz->txrx, subghz_txrx_get_fff_data(subghz->txrx)); //Seems like it must be done this way
+    
+    FURI_LOG_D(TAG, "Starting Transmission");
+    subghz_txrx_tx_start(app->subghz->txrx, subghz_txrx_get_fff_data(app->subghz->txrx)); //Seems like it must be done this way
+
+    FURI_LOG_D(TAG, "setting sugbhz raw file encoder worker callback");
+    subghz_txrx_set_raw_file_encoder_worker_callback_end(
+                        app->subghz->txrx, subghz_scene_transmit_callback_end_tx, app);
+    app->state_notifications = SubGhzNotificationStateTx;
 
     /*flipper_format_rewind(ff);
     flipper_format_file_close(ff);
@@ -50,5 +71,7 @@ void subghz_send(void* context) {
     furi_record_close(RECORD_STORAGE);*/
 
 
-    subghz_free(subghz);
+    //subghz_free(subghz);
+    FURI_LOG_D(TAG, "Finished Transmitting");
+    //meal_pager_blink_stop(app);
 }

helpers/subghz/subghz.h

@@ -2,6 +2,8 @@
 
 #include "subghz_i.h"
 
-//typedef struct SubGhz SubGhz;
+typedef struct SubGhz SubGhz;
 
+SubGhz* subghz_alloc();
+void subghz_free(SubGhz* subghz);
 void subghz_send(void* context);

helpers/subghz/subghz_txrx.c

@@ -556,15 +556,15 @@ SubGhzProtocolDecoderBase* subghz_txrx_get_decoder(SubGhzTxRx* instance) {
     subghz_receiver_set_rx_callback(instance->receiver, callback, context);
 }*/
 
-/*void subghz_txrx_set_raw_file_encoder_worker_callback_end(
+void subghz_txrx_set_raw_file_encoder_worker_callback_end(
     SubGhzTxRx* instance,
     SubGhzProtocolEncoderRAWCallbackEnd callback,
     void* context) {
     subghz_protocol_raw_file_encoder_worker_set_callback_end(
         (SubGhzProtocolEncoderRAW*)subghz_transmitter_get_protocol_instance(instance->transmitter),
         callback,
         context);
-}*/
+}
 
 bool subghz_txrx_radio_device_is_external_connected(SubGhzTxRx* instance, const char* name) {
     furi_assert(instance);

helpers/subghz/subghz_txrx.h

@@ -285,10 +285,10 @@ SubGhzSetting* subghz_txrx_get_setting(SubGhzTxRx* instance);
  * @param callback Callback for Raw decoder, end of data transfer 
  * @param context Context for callback
  */
-/*void subghz_txrx_set_raw_file_encoder_worker_callback_end(
+void subghz_txrx_set_raw_file_encoder_worker_callback_end(
     SubGhzTxRx* instance,
     SubGhzProtocolEncoderRAWCallbackEnd callback,
-    void* context);*/
+    void* context);
 
 /* Checking if an external radio device is connected
 * 

meal_pager.c

@@ -58,6 +58,8 @@ Meal_Pager* meal_pager_app_alloc() {
     app->dialogs = furi_record_open(RECORD_DIALOGS);
     app->file_path = furi_string_alloc();
 
+    app->subghz = subghz_alloc();
+
     // Load configs
     meal_pager_read_settings(app);
 
@@ -97,6 +99,8 @@ void meal_pager_app_free(Meal_Pager* app) {
     furi_record_close(RECORD_DIALOGS);
     furi_string_free(app->file_path);
 
+    subghz_free(app->subghz);
+
     //Remove whatever is left
     free(app);
 }