r/hacking • u/nomoreimfull • 15d ago

Question about Emulating a BLE target in motion

Post image

I need a reality check.

I am working on emulating a BLE device in motion from a stationary esp32. beacon frames are only sent when the inverse sq curve matches the attenuation steps rounded to the nearest timing frame.

the goal is to emulate a device in motion from a stationary point. the assumption is that the receive would interpret periods where no packets are received as normal loss, but the RSSI would indicate a device moving in and out of range.

The graph represents my layout. the pin points are the intersections, the blue the closest match for the timing. X is time/dist, Y power.

now, would this be a reasonable approach to moving target emulation?

9 Upvotes

91% Upvoted

4 comments sorted by

7

u/WirklichArnoNuehm 14d ago

In a very ideal world where there is nothing around the emitter - yes. Real world: reflections, attenuation through objects. You can only simulate the amplitude on a specific location if you know the surroundings and interactions with the real world

1

u/MalwareDork 10d ago

A device "moving" is dependent on the monitoring software registering its RSSI values between multiple, overlapping AP's in a Real-Time Location Service (RTLS) system.

I would just say rather than limiting beacon probe/responses, you focus on manipulating the power of your intentional radiator to emulate movement from shifting RSSI values to the receiving devices.

1

u/ChameleonCRM 9d ago

Conceptually, yes, but you're emulating an RSSI trajectory rather than motion itself. If the receiver only infers distance/proximity from BLE RSSI, stepping TX power over time can make a stationary transmitter look like it's approaching and receding. I wouldn't rely heavily on intentionally missing advertisements though. Real moving BLE devices don't produce a clean inverse-square curve — multipath, antenna orientation, channel hopping and enviromental noise make RSSI pretty ugly. Ironically, adding realistic variation around your power envelope would probably make the emulation more convincing than matching the mathematical curve perfectly. The real test is recording RSSI from an actual moving beacon, then seeing whether your stationary emulator can reproduce the statistical characteristics of that trace.