Android Marauder Fragment Captured Data

Once your Marauder has captured data, it is time to retrieve this data and upload it to your phone.

Once your connected to your PandwaRF Marauder, jump to the Captured data page.

This page is where you have information about every captured slot like data/time of captured data (for Marauder Standard & Ultimate only), number of bytes captured, etc...

Terms used in this page

• Capture: 1 second of RF data captured at a given time. Usually contains one press of a key fob. Captures are saved on sectors.

• Sector: the memory area where one capture is stored. Marauder contains 256 or 512 sectors depending on variant.

• Fetch captures: the action of retrieving captures summary

• Download (all|sector) data: the action of retrieving (all or specific sector) captured RF data

• Data rate: the speed at which target device sends RF data

• Sampling rate: the speed at which Marauder records RF data. Must be greater than Data rate

Typical use

1. Start capture (Cf. Android Marauder Fragment Config)

2. Fetch captures to have a short summary of what was captured

3. Locate a sector containing an interesting capture and expand this sector

4. Replay capture and check if replay has performed the expected action (gate opened, alarm de-activated, ...)

   • In case of success, Download sector data to transfer sector captured data to phone

   • If not, try another sector

Summary of captures

When you connect to your Marauder and want to have an insight on what captures have been made, jump to Captured Data page.

Press Fetch captures button to start downloading a short summary of Marauder memory content. This will not download the full Marauder memory, which can be quite long (from few seconds to few minutes), but will only display the following information:

• number of sector used

• data and time of capture

• number of bytes used for each capture (one sector equals one capture)

Note: If you want to automatically fetch memory status upon BLE connection, enable the Auto fetch option from Settings menu.

Press Restart to start fetching data from sector 0. If a fetch was made previously and there are already some sectors displayed in the app, the Resume button will be enabled to allow user to not re-download all data from zero.

Note: you can always choose to restart the full download from 0 without loosing any data, the transfer will only be a few seconds longer.

According to your phone model (all models have different BLE performances) and number of sector used, fetching a memory summary from Marauder shall not last more than 60s.

In the example below, we have fetched the summary of 20 sectors in about 5s (Nexus 5X, Android 8.1.0).

You can scroll through all captured sectors to find the one of interest to you.

Note: at this step, the sector data has not yet been downloaded yet.

There are 2 options to retrieve sector data:

• The easiest way is to download all sectors data at once by pressing Download data button. This may takes a few minutes depending on sector usage and BLE connection.

• The other way is to expand each sector and only download the data of the sector you want. For this:

  • Expand sector with the ▼

  • Press Download

Sector content

To display more details about a specific sector, just expand the sector with the ▼.

Detailed sector information contains:

• Capture frequency, in Hz

• Modulation: (OOK/FSK, ...)

• Sampling rate used to capture the data

• Data compression mode:

  • Raw: data was captured and stored uncompressed

  • Compressed: data was captured and stored compressed

• Data rate: data rate is computed automatically once data is downloaded (Cf. Download single sector data)

• Power amplifier usage

• Sector data download status: Downloaded/Not downloaded

A set of actions to perform on this sector data is now available:

• Replay once : Send captured sector data once (as captured)

• Replay 10x: Send the same sector data 10 times, in case capture was too short

• Erase sector: Erase a sector from Marauder memory. Cf. Erase sector data

• Download: Transfer sector data from Marauder to app

• Show Data: Display captured data in JSON format. Requires Download first.

• Export data: Save sector data to disk in JSON format. JSON file is saved in /sdcard/Documents/Gollum/Marauder/Captures

When testing sector data, it is recommended to replay once and check if there is any reaction of the target system. If replaying the data once didn't work, try Replay 10x.

Download single sector data

Once you have found a sector of interest and replayed the data successfully, you can download the complete sector data from Marauder to the app by pressing the Download button.

Once sector data has been downloaded:

• the Show data button is enabled and you can display the captured data in JSON format.

• the download icon is displayed in the sector status bar to remind the user this sector data has already been downloaded.

Note: the sector data has not yet been saved to a file. Press **Export ** to save data for this specific sector to a JSON file.

Note: you can also save data from all sectors at the same time by pressing Save captures button at the top of the screen.

Download all sectors data

At any time you can choose to save information from all sectors at the same time by pressing Save captures button at the top of the screen. This will allow you to make a quick backup into a JSON file in /sdcard/Documents/Gollum/Marauder/Captures.

Note: the JSON file will only contain what is known from the app at the moment of the capture. If data has not been downloaded from a sector, this data is not saved into the JSON.

Note: Saving to JSON doesn't erase the data on the Marauder.

Show sector data

Once a sector data has been downloaded (either globally with Download data or individually with Download), the Show data button is enabled and you can view the resulting JSON file in a text viewer.

Once a data has been viewed once, the icon is displayed in the sector status bar to remind the user this sector data has already been viewed. This is to ease sector triage and classification.

Cf. Triage and classification

Erase sector data

After sector analysis, user can decide to remove a sector that contain useless data.

Usually, sectors with few amount of data (less than 50 bytes) are garbage from previous transmissions or false detection that can be removed.

Removing a sector make it available for storing data in a subsequent capture.

Note: you have the option to hide empty sectors from the **Settings **menu. Uncheck Show empty sectors if you want to hide empty sectors.

Triage and classification

Each time you perform an action on a sector for the first time, an icon is displayed in the sector status bar

• : Capture has been played at least once
• : Capture has been played in 10x repeat mode at least once
• : Capture data has been downloaded to phone
• : Capture data has been saved to file
• : Capture JSON data has been viewed at least once