Multi-channel frequency hopping interference system for 2.4GHz ISM band research, built on the ESP32-S3 platform.

A portable, multi-node system that uses coordinated 802.11 packet injection to study RF interference patterns in the 2.4GHz band. The system employs three complementary techniques — broadcast deauthentication, CTS-to-Self NAV reservation, and noise floor saturation — across a pseudo-random frequency hopping sequence synchronized via ESP-NOW.

• Architecture Overview
• Project Structure
• Bill of Materials
• Prerequisites
• Setup & Installation
• Configuration
• Flashing
• Usage
• Deployment Configurations
• DJI OcuSync Calibration
• Serial Monitor Output
• Troubleshooting
• Technical Reference
• Version History

┌──────────────────────────────────────────────────────────────┐
│                    ESP32-S3 Dual-Core                        │
│                                                              │
│  ┌─────────────────────┐    ┌──────────────────────────────┐ │
│  │      CORE 0         │    │          CORE 1              │ │
│  │                     │    │                              │ │
│  │  ┌───────────────┐  │    │  ┌────────────────────────┐  │ │
│  │  │  TX Task      │  │    │  │  Hop Task              │  │ │
│  │  │  Priority: 15 │  │    │  │  Priority: 10          │  │ │
│  │  │  WDT: OFF     │◄─┼─┬──┼─►│  LFSR Channel Hopping  │  │ │
│  │  │               │  │ │  │  │  MAC Rotation          │  │ │
│  │  │  • Deauth TX  │  │ │  │  │  ESP-NOW Sync          │  │ │
│  │  │  • CTS TX     │  │ │  │  └────────────────────────┘  │ │
│  │  │  • Noise TX   │  │ │  │                              │ │
│  │  └───────────────┘  │ │  │  ┌────────────────────────┐  │ │
│  │                     │ │  │  │  Orchestrator Task     │  │ │
│  └─────────────────────┘ │  │  │  Priority: 8           │  │ │
│                          │  │  │  (if ROLE_ORCHESTRATOR)│  │ │
│              Binary      │  │  └────────────────────────┘  │ │
│              Semaphore ──┘  │                              │ │
│              (tx_gate)      │  ┌────────────────────────┐  │ │
│                             │  │  Arduino loop()        │  │ │
│                             │  │  Priority: 1           │  │ │
│                             │  │  Stats / LED / Health  │  │ │
│                             │  └────────────────────────┘  │ │
│                             └──────────────────────────────┘ │
└──────────────────────────────────────────────────────────────┘

Core 0 is dedicated entirely to packet transmission — a tight busy-loop with the Task Watchdog Timer disabled for maximum duty cycle. Core 1 handles all logic: frequency hopping, ESP-NOW fleet coordination, LED status, and serial diagnostics.

FrequencyJammer/
├── README.md                 ← You are here
├── jammerv1/
│   └── jammer.ino            ← v1: Basic single-channel jammer (legacy)
├── jammerv2/
│   └── jammerv2.ino          ← v2: Optimized single-channel jammer (legacy)
└── jammerv3/
    └── jammerv3.ino          ← v3: Multi-channel frequency hopping system ★

Use jammerv3/jammerv3.ino — the v1 and v2 sketches are retained for reference only.

1. Open Arduino IDE → File → Preferences
2. Add to Additional Board Manager URLs:

   https://espressif.github.io/arduino-esp32/package_esp32_index.json
   

3. Open Tools → Board → Boards Manager
4. Search for "esp32" and install "esp32 by Espressif Systems"

git clone https://github.com/Lawlez/FrequencyJammer.git
cd FrequencyJammer

Open jammerv3/jammerv3.ino in Arduino IDE.

Edit the #define configuration block at the top of jammerv3.ino (lines 58–161). See Configuration below.

Click Upload (or Ctrl+U / Cmd+U). The sketch compiles with zero external library dependencies.

All parameters are compile-time #define constants. No runtime configuration or dynamic memory allocation.

#define DEVICE_ROLE  ROLE_BUBBLE        // Choose one:
//                   ROLE_ORCHESTRATOR  — Master sync beacon broadcaster
//                   ROLE_SNIPER        — Focused single-target interference
//                   ROLE_BUBBLE        — Area saturation, follows hop pattern

#define HOP_DWELL_US     10000   // Microseconds per channel (10ms = 100 hops/sec)
#define HOP_CHANNELS     13      // 802.11 channels 1-13
#define LFSR_SEED        0xACE1  // Hop sequence seed (non-zero, 16-bit)

#define ENABLE_DEAUTH    true    // Broadcast deauthentication frames
#define ENABLE_CTS       true    // CTS-to-Self NAV reservation frames
#define ENABLE_NOISE     true    // Random noise payload frames

#define TX_POWER_DBM     20      // Max: 20 dBm (~100mW) on ESP32-S3

#define ESPNOW_ENABLED          true    // Enable/disable fleet coordination
#define ESPNOW_RENDEZVOUS_CH    1       // Fixed channel for sync beacons
#define ESPNOW_SYNC_INTERVAL_MS 50      // Beacon broadcast interval
#define ESPNOW_MISS_THRESHOLD   10      // Missed beacons before autonomous fallback

#define LED_PIN          2        // GPIO for status LED (0 = disabled)
#define SERIAL_BAUD      115200   // Serial monitor baud rate (0 = disabled)
#define STATS_INTERVAL_MS 2000    // Stats print interval in milliseconds

#define TX_BATCH_SIZE    8        // Frames per batch before yielding to hop task
#define NOISE_BUF_SIZE   512      // Random noise frame size in bytes
#define MAC_ROTATE_HOPS  5        // Rotate spoofed MAC every N hops

1. Connect ESP32-S3 via USB-C
2. Select the correct Port under Tools → Port
3. Hold the BOOT button on the dev board (if required by your board)
4. Click Upload
5. Release BOOT after "Connecting..." appears
6. Wait for "Hard resetting via RTS pin..." — done

# Compile
arduino-cli compile --fqbn esp32:esp32:esp32s3 jammerv3/jammerv3.ino

# Upload (replace /dev/cu.usbmodem* with your port)
arduino-cli upload --fqbn esp32:esp32:esp32s3 -p /dev/cu.usbmodem14101 jammerv3/jammerv3.ino

# Monitor serial output
arduino-cli monitor -p /dev/cu.usbmodem14101 -c baudrate=115200

1. Flash jammerv3.ino with DEVICE_ROLE set to ROLE_BUBBLE
2. Power on the ESP32-S3
3. The LED blinks once (Bubble role indicator), then goes solid
4. The device immediately begins:
   • Hopping across all 13 channels at the configured dwell rate
   • Transmitting deauth + CTS + noise frames on each channel
   • Rotating spoofed MAC addresses every 5 hops
5. Open Serial Monitor at 115200 baud to see live stats

1. Flash the Orchestrator — set DEVICE_ROLE to ROLE_ORCHESTRATOR on one node
2. Flash the Bubble nodes — set DEVICE_ROLE to ROLE_BUBBLE on 1-2 nodes
3. Flash the Sniper — set DEVICE_ROLE to ROLE_SNIPER on one node (optional)
4. Power on all nodes — they auto-discover via ESP-NOW broadcast on the rendezvous channel
5. The Orchestrator broadcasts sync beacons every 50ms containing:
   • Current epoch timestamp
   • LFSR hop seed
   • Active channel bitmask
   • Total node count
6. Each node applies a MAC-derived offset to the hop sequence, ensuring different channel assignments across the fleet

If a Bubble/Sniper node loses sync (misses 10 consecutive beacons), it automatically falls back to autonomous hopping and will re-sync when beacons are heard again.

1× ESP32-S3 + Yagi Antenna (15-18 dBi directional)
├── DEVICE_ROLE = ROLE_SNIPER
├── Point antenna at target for focused interference
└── Maximum range, minimum beam width

2× ESP32-S3 + Omni Antennas (9 dBi rubber ducky)
├── DEVICE_ROLE = ROLE_BUBBLE
├── Close-proximity area saturation
└── 360° coverage, follows orchestrated sweep pattern

1× ESP32-S3 (antenna optional — primarily coordinates)
├── DEVICE_ROLE = ROLE_ORCHESTRATOR
├── Broadcasts hop schedule to all fleet nodes via ESP-NOW
└── Also performs TX (can be disabled by setting all ENABLE_* to false)

                    ┌──────────────────────┐
                    │    ORCHESTRATOR      │
                    │    (ESP-NOW Sync)    │
                    └──────────┬───────────┘
                               │ ESP-NOW Beacons
              ┌────────────────┼────────────────┐
              ▼                ▼                ▼
     ┌─────────────┐  ┌─────────────┐  ┌─────────────┐
     │   SNIPER    │  │   BUBBLE    │  │   BUBBLE    │
     │   (Yagi)    │  │   (Omni)    │  │   (Omni)    │
     │   ═══►      │  │   ◉         │  │   ◉         │
     │  Focused    │  │  360° Area  │  │  360° Area  │
     └─────────────┘  └─────────────┘  └─────────────┘

DJI OcuSync uses FHSS (Frequency Hopping Spread Spectrum) for control/telemetry links. To calibrate the system against specific OcuSync versions:

1. Capture — Use an SDR (HackRF, RTL-SDR v4, etc.) with GNU Radio, SigDigger, or Inspectrum to record the target's 2.4GHz spectrogram
2. Measure — Count the frequency transitions per second visible in the waterfall display
3. Calculate — HOP_DWELL_US = 1,000,000 / observed_hop_rate
4. Lead-hop — Subtract 500–1000µs from the calculated dwell to arrive on each channel before the target
5. Cover all channels — OcuSync uses dynamic channel selection. Setting HOP_CHANNELS = 13 covers all possible escape channels

Note: OcuSync's hopping algorithm uses AES-256 encrypted seeds — the exact sequence is proprietary. These calibration values are empirical approximations from published SDR research.

Connect at 115200 baud. Example output:

╔══════════════════════════════════════════════════╗
║  JAMMERV3 — Frequency Hopping Interference Sys   ║
║  Target: ESP32-S3 | Channels: 1-13               ║
║  Role: BUBBLE      | Dwell: 10000µs              ║
╚══════════════════════════════════════════════════╝
[INIT] WiFi initialized. MAC: A0:B7:65:4C:D2:1F
[INIT] Node ID: 31 (0x1F)
[INIT] Packets built. Deauth: ON, CTS: ON, Noise: ON
[INIT] Spoofed MAC: 8A:3E:F1:6B:22:D0
[ESPNOW] Initialized. Role: BUBBLE
[INIT] ══════════════════════════════════════
[INIT] System ARMED. TX on Core 0, HOP on Core 1.
[INIT] Hop dwell: 10000 µs (100 hops/sec)
[INIT] ══════════════════════════════════════

[STAT] Ch: 7 | Hops:   200 | Frames:    4800 | 2400 fps | Sync:NO
[STAT] Ch:11 | Hops:   400 | Frames:    9600 | 2400 fps | Sync:YES
[STAT] Ch: 3 | Hops:   600 | Frames:   14400 | 2400 fps | Sync:YES

• MAC rotation: Spoofed source MACs change every 5 hops using hardware RNG
• Locally-administered bit: Always set in spoofed MACs to avoid OUI collisions
• No String class: All output uses printf() to prevent heap fragmentation
• Bounds-checked channels: Index always computed as (value % 13) + 1
• Version guards: ESP-IDF 4.x/5.x callback signatures handled automatically

1. ESP32-S3 radio is half-duplex — cannot TX and RX simultaneously
2. esp_wifi_80211_tx() transmits at ~1 Mbps DSSS for raw frames
3. Maximum native TX power is 20.5 dBm (~100mW) without external PA
4. CTS-to-Self is less effective against Wi-Fi 6 (802.11ax) devices with BSS Color
5. Deauth frames are rejected by WPA3/PMF (802.11w) enabled networks
6. OcuSync timing values are empirical estimates from SDR research, not official specs

RF Research Project — Indoor Laboratory Use Only