RF CHAOS - Chaos via BLE / BT / WiFi / NFC / Etc via Android Phones

RF CHAOS is an Android-Native WiFi, Bluetooth, BLE, and NFC scanner, logger, and explotation tool.

Created By Scramblr AKA @notdan AKA alotofnamesyoudontknow

ℹ️ If you're itching to get the APK now, compiled releases are here: RF-CHAOS .APK INSTALLERS ℹ️

INTRODUCTION & PREFACE

RF CHAOS is pretty heavily based on a bunch of tools that paved the way for Maximum Mobile Hacking over the years, including:

• WIGLE.NET
• Sniffle
• btrpa-scan
• bsniffhub
• bluez

..And many, many more tools and projects - too many to list.

I've been wanting to build a toolkit like RF-CHAOS for years now but just never got the time or opportunity. So, since I saw some motivation via X I figured might as well do it up. Since there's already a bunch of tools that exist for this on computer platforms, I figured I'd focus my effort on mobile devices, and since Android is the only one that allows low level access to WiFi/BLE/Bluetooth/etc, they were the winner!

I hope you have some fun with it. Evil fun. 😈🤘

WELL OF COURSE THERE'S SECURITY CONCERNS

It turns out, for BLE especially, there's been some developments over the years that make targeting some devices more difficult than it used to be! I'm talking about those "Private MAC Addresses" that change every 15 minutes or so.

But don't worry, this tool will give you the ability to track and hunt equipment that is using this SUPER SECURE PRIVACY FEATURE (lol) AKA Device Privacy via Resolvable Private Addresses (RPAs)!

THE "PRIVACY FEATURE" WHICH SPOOFS BLUETOOTH MAC ADDRESSES IS BULLSHIT.

🚨👮⚠️ What is BLE/Bluetooth RPA Resolution/Tracking? It's the ability to track all of those phones and devices that made you think you might have regained some of your privacy back through that feature you've likely seen by now, the one that supposedly changes your device's MAC address to a spoofed private address. Your phone or device's MAC Addres changes to a new spoofed address every 15 minutes or so.

And it's all just a fucking lie.

Sadly, but predictably, this whole idea is basically bullshit and reeks of industry collusion with Law Enforcement Agencies to decieve consumers into having a false sense of security while they (as well as other determined adversaries) are able to track each new "Private MAC Address" with just one piece of information called an IRK (Identity Resolving Key). It takes knowing your device's IRK code - obtainable through a variety of methods - to decode and track every single new spoofed MAC address, making your device(s) every single movement, usually within a resolution of centimeters.

This, all while your device's menus list this as a "Privacy Feature" and proclaim to be protecting you against this very type of attack. Are you less than excited about being tracked by anyone, including Law Enforcement, at any time? Want to see how it works first hand? You're in the right place! Yes, there's details and more to this, so keep reading. 🚨👮⚠️

TL;DR: Every single moment your Bluetooth Adapter is powered you are 100% trackable, even with Private MAC Spoofing turned on.

---

RF-CHAOS: Primary Features & Functions

• WiFi Scanning - Detect networks with SSID, BSSID, channel, security type, signal strength
• BLE Scanning - Bluetooth Low Energy device detection with manufacturer data
• BLE RPA Resolution - Resolve (and then track devices) via RPAs (Resolvable Private Addresses) by using IRK (Identity Resolving Key) values. Basically, IRKs allow you to have the magic decoder ring for finding your target even when they're using a fake MAC address.
• Signal Finder - Track specific devices by MAC address or IRK with haptic feedback - Works for WiFi as well as BLE/Bluetooth.
• GPS Logging - Record coordinates for every network observation as well as route travelled, LOCALLY on your phone.
• WiGLE Export - Export your local database to CSV format, specifically compatible with WiGLE.net's API/Systems in case you want to share with their platform!
• SQLite Database - Local-Only Storage on Android Phone Only for Paranoid Types. Uses WiGLE-compatible schema for easy sharing in case you get frisky.

RF-CHAOS: Required Stuff Needed to Build From Source

Required Libraries & Software

1. Android Studio (Hedgehog 2023.1.1 or newer)

   • Download: https://developer.android.com/studio

2. JDK 17 (usually with Android Studio)

3. Android SDK

   • API Level 34 (Android 14)
   • Build Tools 34.0.0
   • Android Studio will prompt to install these right after importing the project

Hardware & Devices That Work

• Android device running Android 8.0 (API 26) or higher. (It works with almost any phone made in the last 1,000 years)
• Android must have WiFi & Bluetooth radios that aren't broken. Do I really need to write this? Probably.
• GPS or GPS Spoofer Enabled. This is for the Mapping function and ZERO telemetry is ever sent to our servers or any servers (look at the source code)

Building Your Own RF-CHAOS APK via Source Code

Step 1: Clone or Extract from Github Repo

# If using git
git clone https://github.com/scramblr/RF-CHAOS.git
cd RF-CHAOS

# Or extract the zip file to a folder

Step 2: Open in Android Studio

1. Launch Android Studio
2. Select File → Open
3. Navigate to the RF-CHAOS folder
4. Click OK
5. Wait for Gradle sync to complete (may take several minutes on first run)

Step 3: Configure No Google Maps API Keys Because We Use OpenStreetMaps (free + unlimited) instead!

In a release coming in the next few weeks you'll have the option to switch to Google Maps SDK. I even staged the Manifest Instructions:

0. Wait for feature to actually be built and tested.
1. Get a Google Maps API key from https://console.cloud.google.com/
2. Enable "Maps SDK for Android"
3. Edit `app/src/main/AndroidManifest.xml`
4. Replace `YOUR_GOOGLE_MAPS_API_KEY` with your actual key.

Step 4: Build Debug or Production Release APKs

Testing & Debug .APK or Bundle .AAB Packages

*NOTE: Menu wording may be slightly different depending on Android Studio version installed.

Menu: Build → Generate and Build App Bundles or APKs → Generate APKs / Generate Bundles

APK Output: `app/build/outputs/apk/debug/app-debug.apk`
Bundle Output: `app/build/outputs/bundle/debug/app-debug.aab`

Production Release .APK or Bundle .AAB Packages

1. Menu: Build → Generate Signed Bundle / APK
2. Select APK (Or Bundle if needed)
3. Create or use existing keystore using prompts (Optional)
4. Select "release" build variant

APK Output: `app/release/app-release.apk`
Bundle Output: `app/release/app-release.aab`

Step 5: Installation on Your Device

• Via USB ADB Bridge:

1. Enable Developer Options on your Android device (Tap your Android Build Version number 69 times)
2. Enable USB Debugging
3. Connect device via USB
4. In Android Studio, make sure your phone is listed in the upper right window text.
5. Click the Green Run Button (Looks like Play Button)

Your phone should have RF-CHAOS installed on it within a few seconds! It'll request the 3 primary security permissions needed to search for signals and plot coordinates with GPS.

• Via APK file:

1. Copy the APK to your device (adb push filename.apk /sdcard/Download or wherever/)
2. Enable "Install from unknown sources" in settings
3. Open the APK file & install

RF-CHAOS USAGE