Crowd Supply Campaign

FOBtool — 18 RF Security Utilities. One Pocket-Sized Device.

Sub-GHz · UWB · NFC · LF · BLE · CAN — no laptop required.

A purpose-built research platform for automotive wireless security. Launching on Crowd Supply.

Back this project View on Crowd Supply

Built for the Field

Security researchers need tools that work where the targets are. FOBtool puts 18 specialized utilities in your jacket pocket.

  • Complete RF Coverage — Sub-GHz, UWB, NFC, LF, and BLE — every wireless attack surface in modern vehicles, covered by dedicated hardware.
  • Dual-MCU Architecture — ESP32-S3 handles protocols while RP2350 PIO delivers sub-microsecond edge timing for precision captures.
  • Standalone Operation — No laptop required. All 18 utilities run on-device via rotary encoder interface. Field-ready from power-on.
  • Live CAN Analysis — Hardware CAN transceiver with PIO-based can2040 stack. Scan, fuzz, and log vehicle bus traffic in real-time.
  • Automotive-Specialized — Built for the exact attack surfaces researchers encounter: key fobs, digital keys, proximity tags, and bus protocols.
  • Secure Storage — ATECC608B secure element protects captured credentials. GPS tagging with NMEA + 1PPS for field logging.
  • Detachable Anchor — Deploy it at the car to jam and replay, while the main unit captures at a distance and streams the code over the link.

18 Utilities On-Device

Every tool runs standalone. No laptop. No GUI. Just rotary encoder, display, and execution.

  • FOBscan — Sub-GHz scanner
  • FOBclone — Key fob capture & replay
  • FOBcatch — Rolljam capture
  • FOBback — Rolling code resync
  • FOBscanBLE — BLE scanner
  • CANscan — CAN bus analysis
  • UWBscan — Ultra-wideband ranging
  • NFCscan — NFC/RFID capture
  • LFscan — Low-frequency RFID
  • FOBrelay — Two-device relay attack
  • FOBvault — Combination key store
  • FOBcatch One — Dedicated rolljam
  • GPSlog — Field location logging
  • SpectrumView — Wideband spectrum
  • KeysPanel — Secure key management
  • SignalSearch — Protocol detection
  • FOBclone Vehicle — Vehicle DB replay
  • CC1200 Wideband — Extended spectrum

Hardware Specifications

Dual-MCU architecture with dedicated radios for every protocol. Built for precision, not compromise.

  • Primary MCU: ESP32-S3 (Wi-Fi, BLE, Sub-GHz via CC1101)
  • Co-processor: RP2350 (PIO capture, CAN, LF, NFC via PN532)
  • Sub-GHz: CC1101 + optional CC1200 (300 MHz–1 GHz)
  • UWB: DW3000 (precision ranging + AoA)
  • Secure Element: ATECC608B with encrypted key storage
  • Display: On-device OLED with rotary encoder navigation
  • Connectivity: USB-C, Wi-Fi AP, GPS (NMEA + 1PPS)

Campaign Pricing

Super Early Bird — $649 — 50 units at 32% off MSRP. Limited allocation.

Follow the campaign on Crowd Supply to be notified the moment it goes live.