Better reflex jamming, using shellcode on the target.
[goodfet] / client / GoodFETCC.py
index 9c838b1..67c1be9 100644 (file)
@@ -79,6 +79,7 @@ class GoodFETCC(GoodFET):
     def RF_setfreq(self,frequency):
         """Set the frequency in Hz."""
         #FIXME CC1110 specific
+        #Some frequencies fail, probably and FSCAL thing.
         
         hz=frequency;
         freq=int(hz/396.728515625);
@@ -91,7 +92,18 @@ class GoodFETCC(GoodFET):
         self.pokebysym("FREQ1",freq1);
         self.pokebysym("FREQ0",freq0);
         
-
+        self.pokebysym("TEST1",0x31);
+        self.pokebysym("TEST0",0x09);
+        
+        #self.pokebysym("PA_TABLE0" ,   0x60);  #above mid
+        
+        #self.pokebysym("FSCAL2" ,   0x2A);  #above mid
+        self.pokebysym("FSCAL2" ,   0x0A);  #beneath mid
+        
+        #self.CC_RFST_CAL(); #SCAL
+        #time.sleep(1);
+    
+        
     def RF_getfreq(self):
         """Get the frequency in Hz."""
         #FIXME CC1110 specific
@@ -134,9 +146,12 @@ class GoodFETCC(GoodFET):
         self.CCdebuginstr([0x02, 0xf0, 0x00]); #ljmp 0xF000
         self.resume();
         while wait>0 and (0==self.CCstatus()&0x20):
-            time.sleep(0.1);
+            a=1;
+            #time.sleep(0.1);
             #print "Waiting for shell code to return.";
         return;
+    def ishalted(self):
+        return self.CCstatus()&0x20;
     def shellcode(self,code,wait=1):
         """Copy a block of code into RAM and execute it."""
         i=0;
@@ -148,7 +163,8 @@ class GoodFETCC(GoodFET):
         self.CCdebuginstr([0x02, 0xf0, 0x00]); #ljmp 0xF000
         self.resume();
         while wait>0 and (0==self.CCstatus()&0x20):
-            time.sleep(0.1);
+            a=1;
+            #time.sleep(0.1);
             #print "Waiting for shell code to return.";
         return;
     def CC1110_crystal(self):
@@ -210,15 +226,19 @@ class GoodFETCC(GoodFET):
             self.pokebysym("FREQ2"    , 0x21)   # Frequency control word, high byte.
             self.pokebysym("FREQ1"    , 0x71)   # Frequency control word, middle byte.
             self.pokebysym("FREQ0"    , 0x7a)   # Frequency control word, low byte.
-        if band=="ismus" or band=="us":
+        elif band=="ismus" or band=="us":
             self.pokebysym("FREQ2"    , 0x22)   # Frequency control word, high byte.
             self.pokebysym("FREQ1"    , 0xB1)   # Frequency control word, middle byte.
             self.pokebysym("FREQ0"    , 0x3B)   # Frequency control word, low byte.
-        if band=="ismlf" or band=="lf":
+        elif band=="ismlf" or band=="lf":
             self.pokebysym("FREQ2"    , 0x10)   # Frequency control word, high byte.
             self.pokebysym("FREQ1"    , 0xB0)   # Frequency control word, middle byte.
             self.pokebysym("FREQ0"    , 0x71)   # Frequency control word, low byte.
-        
+        elif band=="none":
+            band="none";
+        else:
+            #Got a frequency, not a band.
+            self.RF_setfreq(eval(band));
         self.pokebysym("MDMCFG4"  , 0x7B)   # Modem configuration.
         self.pokebysym("MDMCFG3"  , 0x83)   # Modem configuration.
         self.pokebysym("MDMCFG2"  , 0x13)   # Modem configuration.
@@ -243,11 +263,12 @@ class GoodFETCC(GoodFET):
         self.pokebysym("TEST2"    , 0x81)   # Various test settings.
         self.pokebysym("TEST1"    , 0x35)   # Various test settings.
         self.pokebysym("TEST0"    , 0x09)   # Various test settings.
-        #self.pokebysym("PA_TABLE0", 0xC0)   # PA output power setting.
-        self.pokebysym("PKTCTRL1" , 0x04)   # Packet automation control.
+        self.pokebysym("PA_TABLE0", 0xC0)   # PA output power setting.
+        self.pokebysym("PKTCTRL1" , 0x04)   # Packet automation control, w/ lqi
+        #self.pokebysym("PKTCTRL1" , 0x00)   # Packet automation control. w/o lqi
         self.pokebysym("PKTCTRL0" , 0x05)   # Packet automation control, w/ checksum.
-        #self.pokebysym("PKTCTRL0" , 0x01)   # Packet automation control, w/o checksum.
-        self.pokebysym("ADDR"     , 0x00)   # Device address.
+        #self.pokebysym("PKTCTRL0" , 0x00)   # Packet automation control, w/o checksum, fixed length
+        self.pokebysym("ADDR"     , 0x01)   # Device address.
         self.pokebysym("PKTLEN"   , 0xFF)   # Packet length.
         
         self.pokebysym("SYNC1",0xD3);
@@ -259,52 +280,28 @@ class GoodFETCC(GoodFET):
         self.CC1110_crystal(); #FIXME, '1110 specific.
         self.RF_idle();
         
-        #self.resume();
-        #time.sleep(1);
-        #self.halt();
         
         RFST=0xDFE1;
         
-        
-        self.pokebysym("FSCTRL1"  , 0x0a)   # Frequency synthesizer control.
-        self.pokebysym("FSCTRL0"  , 0x00)   # Frequency synthesizer control.
+        self.config_simpliciti();
         
         #Don't change these while the radio is active.
-        self.pokebysym("FSCAL3"   , 0xA9)   # Frequency synthesizer calibration.
-        self.pokebysym("FSCAL2"   , 0x0A)   # Frequency synthesizer calibration.
-        self.pokebysym("FSCAL1"   , 0x00)   # Frequency synthesizer calibration.
-        self.pokebysym("FSCAL0"   , 0x11)   # Frequency synthesizer calibration.
+        #self.pokebysym("FSCAL3"   , 0xA9)   # Frequency synthesizer calibration.
+        #self.pokebysym("FSCAL2"   , 0x0A)   # Frequency synthesizer calibration.
+        #self.pokebysym("FSCAL1"   , 0x00)   # Frequency synthesizer calibration.
+        #self.pokebysym("FSCAL0"   , 0x11)   # Frequency synthesizer calibration.
         
+        #Ramp up the power.
+        #self.pokebysym("PA_TABLE0", 0xFF)   # PA output power setting.
         
-        #self.pokebysym("FREQ2"    , 0x10)   # Frequency control word, high byte.
-        #self.pokebysym("FREQ1"    , 0xEC)   # Frequency control word, middle byte.
-        #self.pokebysym("FREQ0"    , 0x4E)   # Frequency control word, low byte.
+        #This is what drops to OOK.
+        #Comment to keep GFSK, might be better at jamming.
         self.pokebysym("MDMCFG4"  , 0x86)   # Modem configuration.
         self.pokebysym("MDMCFG3"  , 0x83)   # Modem configuration.
         self.pokebysym("MDMCFG2"  , 0x30)   # Modem configuration.
         self.pokebysym("MDMCFG1"  , 0x22)   # Modem configuration.
         self.pokebysym("MDMCFG0"  , 0xF8)   # Modem configuration.
-        self.pokebysym("CHANNR"   , 0x00)   # Channel number.
-        self.pokebysym("DEVIATN"  , 0x00)   # Modem deviation setting (when FSK modulation is enabled).
-        self.pokebysym("FREND1"   , 0x56)   # Front end RX configuration.
-        
-        self.pokebysym("FREND0"   , 0x10)   # Front end RX configuration.
-        self.pokebysym("MCSM0"    , 0x14)   # Main Radio Control State Machine configuration.
-        self.pokebysym("FOCCFG"   , 0x16)   # Frequency Offset Compensation Configuration.
-        self.pokebysym("BSCFG"    , 0x6C)   # Bit synchronization Configuration.
         
-        self.pokebysym("AGCCTRL2" , 0x03)   # AGC control.
-        self.pokebysym("AGCCTRL1" , 0x40)   # AGC control.
-        self.pokebysym("AGCCTRL0" , 0x91)   # AGC control.
-        
-        self.pokebysym("TEST2"    , 0x88)   # Various test settings.
-        self.pokebysym("TEST1"    , 0x31)   # Various test settings.
-        self.pokebysym("TEST0"    , 0x09)   # Various test settings.
-        self.pokebysym("PA_TABLE0", 0xC0)   # PA output power setting.
-        self.pokebysym("PKTCTRL1" , 0x04)   # Packet automation control.
-        self.pokebysym("PKTCTRL0" , 0x22)   # Packet automation control.
-        self.pokebysym("ADDR"     , 0x00)   # Device address.
-        self.pokebysym("PKTLEN"   , 0xFF)   # Packet length.
         
         self.pokebysym("SYNC1",0xAA);
         self.pokebysym("SYNC0",0xAA);
@@ -321,9 +318,6 @@ class GoodFETCC(GoodFET):
             #print "state=%02x" % state;
         print "Holding a carrier on %f MHz." % (self.RF_getfreq()/10**6);
         
-        #Not needed, radio works when CPU is halted.
-        #self.resume();
-        
         return;
             
     def RF_getsmac(self):
@@ -344,21 +338,22 @@ class GoodFETCC(GoodFET):
         return 0;
     def RF_rxpacket(self):
         """Get a packet from the radio.  Returns None if none is waiting."""
-        #RFST=0xDFE1
-        #self.pokebyte(RFST,0x01); #SCAL
-        #self.pokebyte(RFST,0x02); #SRX
-        
         self.shellcodefile("rxpacket.ihx");
-        #time.sleep(1);
-        self.halt();
         len=self.peek8(0xFE00,"xdata");
-        #print "Grabbing %i bytes." %len;
-        return self.peekblock(0xFE00,len,"data");
-    def RF_txpacket(self,payload):
+        return self.peekblock(0xFE00,len+1,"data");
+    def RF_txpacket(self,packet):
         """Transmit a packet.  Untested."""
         
-        print "FIXME, Chipcon packet transmission is not yet implemented.";
+        self.pokeblock(0xFE00,packet,"data");
+        self.shellcodefile("txpacket.ihx");
         return;
+    def RF_txrxpacket(self,packet):
+        """Transmit a packet.  Untested."""
+        
+        self.pokeblock(0xFE00,packet,"data");
+        self.shellcodefile("txrxpacket.ihx");
+        len=self.peek8(0xFE00,"xdata");
+        return self.peekblock(0xFE00,len+1,"data");
 
     def RF_getrssi(self):
         """Returns the received signal strenght, with a weird offset."""
@@ -576,9 +571,7 @@ class GoodFETCC(GoodFET):
         self.data=[adr&0xff, val&0xff];
         self.writecmd(self.APP,0x02, 2, self.data);
         return ord(self.data[0]);
-    def pokebyte(self,adr,val,mem="data"):
-        if mem!="data":
-            print "FIXME: poking of non data bytes not yet supported.";
+    def pokebyte(self,adr,val,mem="xdata"):
         self.CCpokedatabyte(adr,val);
     def CCpokedatabyte(self,adr,val):
         """Write a byte to data memory."""