Ambit Companion
Android won't let an app read the hardware address of another device on the network. A desktop will, and it turns out that makes a big difference.
| Phone | Companion | |
|---|---|---|
| Devices identified | 21 of 40 | 39 of 41 |
| Hardware addresses | 2 | 39 |
Both measured on the same network, one after the other. The MAC addresses are what does it. Every one of them gives you the manufacturer via the IEEE registry, and on a laptop that's a single system call.
Download
Two packages, one for Windows and one for Linux. Each carries its own Java runtime, so there's nothing to install first — you unpack it and run it. The fingerprint databases are inside too, which is most of why the download is the size it is.
Version 0.1.3
What happens when you run it
On Windows this is going to interrupt you twice before it runs. Neither interruption means something is wrong, but you should know what you're clicking past rather than take my word for it, so here's the whole sequence.
A code-signing certificate costs several hundred euros a year. I'm one person and I can't justify that for a program most people will run once, so your computer has no way to check who wrote this — and it says so. That warning is doing its job.
First: check the file
Anyone can write "just click through the warning". That is also, word for word, what someone handing you malware would write. The checksum is what turns it into something you can test for yourself: it proves the file you downloaded is the file I published. Run this where it landed and compare it to the SHA-256 above.
Windows certutil -hashfile ambit-companion-VERSION-windows.zip SHA256
Linux sha256sum ambit-companion-VERSION-linux.tar.gzIf it doesn't match, don't run it, and please tell me. I'd want to know.
Then unpack it
On Windows, right-click the zip and choose Extract All. You get a
folder ambit-companion with ambit-companion.exe in it.
On Linux, tar -xzf ambit-companion-VERSION-linux.tar.gz. The
launcher is ambit-companion/bin/ambit-companion and it is already executable,
so there's no chmod step. That's exactly why Linux gets a tar.gz instead of a
zip: zip doesn't carry the executable bit, and a zipped copy would arrive with everything
in it unrunnable.
Windows stops you once: "Windows protected your PC"
That's SmartScreen, and it's the missing signature talking. The dialog shows you a Don't run button and hides the other one.
Click More info. It will say Unknown publisher, which is correct — that's precisely what I am to your computer. Then click Run anyway. You only do this once; Windows remembers afterwards.
Then Windows asks about the firewall
"Allow this app to communicate on these networks." Different question entirely, and you'd get it for signed software too. It isn't about trusting me — it's that the program opens a port so your phone can reach it.
Tick Private networks. Leave Public networks unticked: your home or office wifi is the private one, and there's no reason for this to accept anything from a café. If you untick both by mistake, scanning still works and only the pairing with your phone breaks; you can put it right under Windows Defender Firewall → Allow an app through firewall.
On Linux nothing warns you
There's no equivalent step. Unpack it, run the launcher, that's it.
What it does with that network permission
It listens on your own network and nowhere else. No cloud, no relay, no account, and anything that hasn't paired with it gets nothing back. Close the program and the port closes with it.
It never needs administrator rights
Reading the neighbour table uses whatever your system already ships, so arp
or ip neigh, and the port sweep is plain sockets. If it ever asks you for a
password, something has gone wrong.
How pairing works
Running ambit-companion serve prints a QR code with the machine's address on
your network, a port and a 256-bit key in it. Your phone scans that and the two are
paired. Everything after that is encrypted with AES-256-GCM.
I skipped TLS on purpose. No certificate authority is going to sign for a machine with a DHCP address and no name, so TLS here would mean a self-signed certificate and yet another warning to click past, which teaches people the wrong habit. Carrying a key across with your camera is both stronger and less work.
The phone half isn't done
To be straight about it: the desktop program works and scans fine on its own, but the pairing code inside the Android app isn't written yet. So for now the companion is a standalone scanner and can't feed anything to your phone. That's a large part of why Ambit still says "in development".