HaleHound SD Data Pack
======================
Pack version:      2026-11-11
IEEE snapshot:     2026-11-11   (every file below verified against the live
                                 IEEE MA-L / MA-M / MA-S / IAB registries on
                                 this date)

WHAT THIS IS
------------
Reference data HaleHound reads from the SD card. The firmware runs without it,
but two features are reduced: MAC addresses show no vendor name, and a drone
broadcasting Remote ID shows a raw serial instead of a manufacturer.

The web flasher writes the ESP32's internal flash over USB. It has no way to
reach your SD card, so these files have to be copied across by hand. That is
why they ship separately.


HOW TO INSTALL
--------------
1. Put the SD card in your computer.
2. Copy every file in this pack to the TOP LEVEL (root) of the card.
   Not into a folder. The firmware looks for /oui.db, not /somefolder/oui.db.
3. Eject the card, put it in the unit, power on.

Correct:    E:\oui.db          /Volumes/HALEHOUND/oui.db
Wrong:      E:\sdpack\oui.db   /Volumes/HALEHOUND/HaleHound/oui.db


WHAT'S IN IT
------------
oui.db          IEEE OUI registry - 40,478 manufacturer prefixes, 1.24 MB

                Turns MAC addresses into vendor names in the WiFi station
                scanner and the EAPOL capture AP list. Without it you still get
                names for about 45 common vendors built into the firmware; with
                it you get the full registry.

                This is a BINARY file built from the IEEE registry, not the raw
                IEEE download. Copying IEEE's oui.txt or oui.csv onto the card
                will NOT work - the firmware checks the file header and ignores
                anything that is not in this format.

drone_rid.db    Remote ID manufacturer prefixes - 13 vendors, 864 bytes

                Turns the ANSI/CTA-2063A serial in a Remote ID broadcast into a
                vendor and model family. Without it, a drone that is correctly
                broadcasting Remote ID shows as "1581F1ZN0000..." instead of
                "DJI Mavic / Air / Mini". Covers DJI, Autel, Skydio, Parrot,
                AgEagle, Microdrones, Percepto, Wingtra, Inspired Flight,
                Harris Aerial and XAG.

qr/             QR Generator payloads - 35 payloads and 5 chain sequences

                The QR Generator reads these from /qr on the card. Without the
                folder the payload picker is empty.

                *.txt is ONE payload per file. Escapes: \n \r \t \\ and
                \xHH for a raw byte. A single trailing newline is stripped, so
                use \n if you want one in the code.

                *.seq is a chain - one step per line, stepped with PREV/NEXT.
                Lines starting with # are ignored. Each line may begin with a
                symbology prefix:

                    QR:    QR code (the default if no prefix)
                    C128:  Code 128
                    DMX:   Data Matrix

                That is what lets one chain switch symbology mid-sequence.

                What's in there: keyboard-wedge control-character probes
                (the BadBarcode class - a wedge scanner TYPES ASCII 0-31, so a
                barcode can carry Tab, Enter, Escape and Ctrl combinations),
                LOLBAS Run-dialog templates, input-sanitisation probes for SQL,
                XSS, command, LDAP and template injection, a right-to-left
                override spoof, and WIFI: join URIs. See qr/README.md for the
                full breakdown and sources.

                The LOLBAS templates carry ATTACKER / BASE64HERE placeholders -
                edit them before use. They are templates, not armed payloads.

                Add your own by dropping files in /qr - up to 48, names up to
                28 characters, 1 KB per payload, 16 steps per chain.

drone_oui.db    Drone vendor OUI prefixes - 85 prefixes, 2.7 KB

                Staged for a future firmware version. The current release does
                not read this file yet - it is included so the pack does not
                need replacing when that lands. Harmless to copy across now.


CHECKING IT WORKED
------------------
Connect a serial monitor at 115200 baud and open the WiFi station scanner:

    [OUI] /oui.db open: 40478 entries, rec=32B

If that line does not appear, the file is not being found. Check it is at the
root of the card and named exactly "oui.db" - all lowercase, no ".txt" on the
end from an editor that saved it wrong.

For the drone table, open Drone Detect with a Remote ID source in range. A
detected aircraft should name its maker rather than showing a bare serial.


KEEPING IT CURRENT
------------------
The IEEE registry gains new entries continuously, and new drone models and
CTA-2063A prefixes get registered, so anything registered after the snapshot
date above will not resolve until you update. A newer pack can be dropped
straight over the old files - no reflash needed. That is the whole point of
keeping this data on the card instead of inside the firmware.

Newer packs are published at the same place you got this one:

    https://flash.halehound.com


FILES THE FIRMWARE MAKES BY ITSELF
----------------------------------
You do not need to add these - the firmware writes them on first boot if they
are missing, and your edits are preserved afterwards:

    keeloq_mfkeys.txt      SubGHz manufacturer keys
    nrf_tuning.json        NRF24 tuning profile
    subghz_tuning.json     SubGHz tuning profile
    config.txt             device settings
    calibrationData        touch calibration

Loot and capture folders (/wp_loot, /eapol, /rfid, /subghz and others) are
created as needed.
