Meet PandwaRF Rogue
PandwaRF Rogue Pro
The PandwaRF Rogue Pro is ideal for physical pentesters and cybersecurity professionals. It provides several additional features to the PandwaRF, making it the perfect tool for advanced brute forcing.
PandwaRF Rogue Pro integrates with Kaiju to analyze the captured data and generate rolling code information directly from the Android Application. Captured data can also be viewed directly on Kaiju web application. PandwaRF Rogue Pro includes support for garage/gate openers rolling codes. Optional support for cars can be purchased separately.
De Bruijn Brute Force (aka OpenSesame attack)
The De Bruijn sequence is an algorithm used to efficiently produce every possible code in as few bits as possible. It is very effective against old receivers that contain shift registers. Using the De Bruijn mathematical algorithm, PandwaRF Rogue Pro is able to brute force a 12 bit code in 1.2 s instead of a normal brute force duration of 8 min.
Reduced duration
The embedded Brute Force engine has been reworked to reduce the brute force duration. You don’t have to worry about codes being sent multiple times. This allows a brute force session to be up to 30x faster than the PandwaRF.
Task splitting
PandwaRF Rogue Pro also allows Brute Force task splitting. You can resume a Brute Force operation from where you stopped it. This allows splitting a long Brute Force session into several shorter sessions.
32-bit codeword support
While the PandwaRF can brute force a codeword length of up to 16 bits (65K different codes), the Rogue Pro supports 32-bit brute force (4 billion different codewords).
Including predefined coding patterns
PandwaRF Rogue Pro also includes several predefined coding patterns (aka Function masks) corresponding to common wireless devices available on the market. Once you have a RF capture of the target device, you just need to set up the Function Mask. PandwaRF Rogue Pro will optimize the brute force duration for you.
Demo Video
Logic symbols on multiple bytes
Many wireless devices on the market have complex symbol encoding, and their symbols are generally mapped onto multiple bits or even bytes. While the PandwaRF can only map one symbol to one byte, the PandwaRF Rogue Pro can map one symbol to up to 5 bytes, allowing much complex devices to be brute forced.
Synchro & tail bits support
PandwaRF Rogue Pro can automatically: prepend fixed synchronization bits before the codeword, and append fixed tail bits after the codeword. This allows complex codes to be sent when brute forcing, without any latency, as this feature is directly integrated inside the HW. Up to 40 bits for the synchronization and tail part can be set up.
Autonomous Brute Force
Once started by the smartphone, the brute force will continue even if the phone is disconnected. The user can reconnect later, even from another phone, and see the brute force progress. If PandwaRF Rogue Pro ran out of battery while brute forcing, it will resume as soon as powered again from a USB source.
Protocols
Many generic encoder chipsets and protocols are natively supported and allow the user to emulate a remote control.
Supported chipsets: EV1527, HT12E, PT2260, PT2262, PT2270, PT2272, UM3578. Supported protocols: Somfy, Evology, Chacon, Dio, KaKu, HomeEasy, Extel, IDK, SimpliSafe, Meiantech, Atlantic, Adebaio, DX Linear etc.
Session save/load
With Rogue Pro, the user can resume a previously interrupted brute force session. The session includes the full Brute force configuration, and the current progress. Brute Force sessions can be saved in the phone in the JSON format.
RX/TX improvements
Bigger RX/TX memory
While regular PandwaRF cannot capture or transmit more than 512 bytes of data, the Rogue Pro has a greater amount of memory and can capture/transmit up to 2048 bytes. As the amount of collected data can grow significantly with the increase of the sampling rate, increasing the max number of captured/transmitted bytes allows better RF data analysis.
Higher sampling rate
Rogue Pro can sample up to 100kbits/s, instead of the 10kbits/s of regular PandwaRF. The captured data’s precision is consequently much better. Coupled with the post process error correction, this increases the quality of data when analyzing the type of chipset encoder used by the target device.
Frame compression
When sampling at high data rates, the amount of data to be transferred from PandwaRF to the smartphone can be significant. The Rogue family includes a real time frame compression, where all the data sent from the Rogue is compressed before the BLE transmission, reducing the risk of saturating the BLE connection. The PandwaRF Android application automatically unzips the data seamlessly for the user.
Data rate computation
Frequency detection
Automatic frequency detection can be used when you don’t know the frequency the target device is using. The PandwaRF Rogue Pro will scan for all the commonly worldwide used bands (315/433/868/915 MHz) and report the exact frequency used.
Data analysis (Chipset database)
After capturing any data from the target’s remote control, Rogue Pro can automatically analyze the data and find what chipset is used to encode the data. This allows the attacker to clone and impersonate the target’s remote control faster than using the brute force. This feature relies on the Rogue Pro integrated chipset database.
Function inversion (Chipset database)
The function inversion feature allows an attacker to capture a single RF message from a keyfob (using a known chipset) when the target presses the keyfob button. The attacker then applies an inversion function to transform the captured message into another message. The attacker can then impersonate the target’s device by sending the transformed message to the receiver. This feature relies on the Rogue Pro integrated chipset database.
- The PandwaRF Rogue Pro contains the chipset database (only available in the Rogue variants).
- The PandwaRF Rogue Pro does NOT contain the home alarm database (only available in the Rogue Gov variant).
| Product | PandwaRF | Rogue Pro | Rogue Gov |
|---|---|---|---|
| Ideal for | Public | Security companies, penetration testers etc. | Police & law enforcement agencies. Cf notes on variant availability. |
| RX/TX | X | X | X |
| Spectrum Analyzer | X | X | X |
| JavaScript Support | X | X | X |
| RfCat Support | X | X | X |
| Advanced RX/TX | X | X | |
| Max number of bytes for RX/TX | 512 | 2048 | Infinite |
| Data rate | 10 kbits/s | 100 kbits/s | 100 kbits/s |
| Frame compression | X | X | |
| No delay between RF packets | X | X | |
| RF Analysis | |||
| Frequency detection | X | X | |
| Data rate computation | X | X | |
| Data rate measurement | X | X | |
| Auto Frequency detection before SpecAn | X | X | |
| Auto Frequency detection before RX | X | X | |
| Auto Data rate meas before RX | X | X | |
| Device database | |||
| Rolling code support | X | X | |
| Standard encoders | X | X | |
| Home alarms | X | ||
| Brute Force | |||
| Frame repetition | X | X | X |
| Max Base | 4 | 4 | 4 |
| De Bruijn attack (OpenSesame) | X | X | |
| Function mask | X | X | X |
| Function mask bit skipping (time optimization) | X | X | |
| Zero Delay between attempts | X | X | |
| Logic symbols on multiple bytes | X | X | |
| More brute force patterns | X | X | |
| Split BF in several steps (saving last status) | X | X | |
| Codeword support | 16 bits | 32 bits | 32 bits |
| Synchro / tail support (bytes) | 8/8 | 40/40 | 40/40 |
| Autonomous Brute Force | X | X | |
| Protocols | X | X | |
| Session save/session load | X | X | |
| Customizable device name | X | ||
| Scan without Android Location permission | X | ||
| Not connected to Cloud | X | ||
| Function inversion (Arm <-> Disarm) | X | ||
| Transferable sessions | X | ||
| Technical support | X | X | |
| Price (excluding VAT) | 160€ | 550€ | Contact us for price information |
* Rogue Gov includes support for garage/gate openers rolling codes. Optional support for other systems (cars, …) can be purchased separately.
- Basic RF knowledge (symbols, data rate etc) is required in order to use Rogue Pro’s Android application. To get started with the Brute Force feature in the application, please check the RF Brute Force section of our wiki. Please make sure that you are familiar with the terms used in this section before considering ordering the Rogue Pro.
- For PandwaRF Rogue orders we also accept payments by bank transfer. Please contact us if you prefer this payment method.