X-Git-Url: http://git.rot13.org/?p=goodfet;a=blobdiff_plain;f=client%2Fgoodfet.nrf;h=42f3b724789c0b195ebc33177a561e3e45b28e6f;hp=35d608f746026d6559fbf7df7746a4326b7bca3b;hb=f15cabc15a42fb1b0b57e433dc3a1f300cff2b6c;hpb=074a0dce3d0ff96141185ce319140d52bf18ce22 diff --git a/client/goodfet.nrf b/client/goodfet.nrf index 35d608f..42f3b72 100755 --- a/client/goodfet.nrf +++ b/client/goodfet.nrf @@ -30,23 +30,71 @@ def printpacket(packet): s="%s %02x" % (s,ord(foo)); print "%s" % s; + +mskbstring=""; +oldseq=-1; def printmspacket(packet,offset=1): + """Decodes a Microsoft keyboard packet and maintains the typed strings.""" + global mskbstring, oldseq; keyword=client.RF_getsmac(); #print "keyword=%010x" % key; key=[]; + ct=[]; for foo in range(0,5): key.append(keyword&0xFF); keyword=(keyword>>8); #print "Keybyte %02x" % key[foo]; i=0; s=""; + for foo in packet: if i>=4: + ct.append(ord(foo)^key[(i+offset)%5]); s="%s %02x" % (s,ord(foo)^key[(i+offset)%5]); else: + ct.append(ord(foo)); s="%s %02x" % (s,ord(foo)); i=i+1; + #Uncomment this to print the raw packet, kinda noisy. print "%s" % (s); + + letter=None; + seq=ct[4]; + if ct[0]==0x0a and ct[1]==0x78 and seq!=oldseq: + oldseq=seq; + #TODO replace this with a dictionary, and support modifiers. + if ct[9]==0: + #Key up event, not worth logging. + pass; + elif ct[9]>=4 and ct[9]<0x1E: + letter=ct[9]+ord('A')-4; + elif ct[9]>=0x1E and ct[9]<0x27: + letter=ct[9]+ord('1')-0x1E; + elif ct[9]==0x27: + letter=ord('0'); + elif ct[9]==0x29: + #escape + letter=ord('e'); + elif ct[9]==0x2d: + letter=ord('-'); + elif ct[9]==0x2e: + letter=ord('='); + elif ct[9]==0x35: + letter=ord('`'); + elif ct[9]==0x2C: + letter=ord('_'); + elif ct[9]==0x34: + letter=ord('\''); + elif ct[9]==0x36: + letter=ord(','); + elif ct[9]==0x37: + letter=ord('.'); + else: + print "Unknown character 0x%02x." % ct[9]; + letter=ord('?'); + if letter!=None: + mskbstring="%s%c" % (mskbstring,letter); + print "# %s" % mskbstring def printconfig(): print "Encoding %s" % client.RF_getenc(); print "Freq %10i MHz" % (client.RF_getfreq()/10**6); @@ -70,16 +118,12 @@ if(len(sys.argv)==1): print "%s sniffob\n\tSniffs OpenBeacon traffic." % sys.argv[0]; print "%s snifftp\n\tSniffs Turning Point Clicker traffic." % sys.argv[0]; print "%s sniffsf\n\tSniffs SparkFun Dongle traffic." % sys.argv[0]; + print "%s sniffmskb\n\tSniffs Microsoft Keyboard traffic." % sys.argv[0]; print ""; - print "%s sniffmacs \n\tSniffs for MAC addresses on the present channel."; + print "%s sniffmacs \n\tSniffs for MAC addresses on the present channel." % sys.argv[0]; print "%s sniffprom [0xaa|0x55]\n\tSniffs promiscuously for a preamble of 0xAA or 0x55" % sys.argv[0]; print "%s autotune\n\tSearches for a valid destination address." % sys.argv[0]; print ""; - print "%s sniffskybrake\n\tSniffs skybrake. [broken?]" % sys.argv[0]; - print "%s sniffmskb\n\tSniffs MS KB. [broken?]" % sys.argv[0]; - - print "%s hosttp\n\tHosts Turning Point Clicker traffic." % sys.argv[0]; - print "%s carrier [freq]\n\tHolds a carrier on [freq] Hz." % sys.argv[0]; sys.exit(); @@ -108,8 +152,9 @@ if(sys.argv[1]=="test"): 2*10**6]: client.RF_setrate(foo); if(client.RF_getrate()!=foo): - print "ERROR Rate %i not supported. Got %i instead." % (foo, - client.RF_getrate()); + print "ERROR Rate %i not supported. Got %i instead." % ( + foo, + client.RF_getrate()); print "\n\n"; client.poke(0x0A,0xDEADBEEF,5); @@ -268,14 +313,22 @@ class AutoTuner(): rate=False; chan=False; sync=False; + macreject=False; + printing=False; startch=0; #Useful for forcing an early match. + maclen=5; #Some are shorter. def init(self,goodfet, - rate=True,chan=True,sync=True): + rate=True,chan=True,sync=True, + macreject=True, printing=False, + maclen=5): """Initializes a link to the GoodFET for autotuning.""" self.client=goodfet; self.rate=rate; self.chan=chan; self.sync=sync; + self.macreject=macreject; + self.printing=printing; + self.maclen=maclen; client.poke(0x00,0x00); #Stop nRF client.poke(0x01,0x00); #Disable Shockburst @@ -284,7 +337,7 @@ class AutoTuner(): #Disable shockburst. client.poke(0x1C,0x00); client.poke(0x1D,0x00); - + client.RF_setmaclen(2); # SETUP_AW for shortest #historic @@ -294,6 +347,7 @@ class AutoTuner(): client.poke(0x00,0x70|0x03); #prime radio. return; + def packetaddr(self,packet,justmac=False): """Returns a loaded packet address, including channel and rate.""" @@ -301,7 +355,7 @@ class AutoTuner(): mac=""; #MAC,RF_CH,RATE - for i in range(0,5): + for i in range(0,self.maclen): mac="%s%02x" % (mac,ord(packet[i])); if justmac: return mac; @@ -312,17 +366,30 @@ class AutoTuner(): def validmac(self,packet): sync=self.client.RF_getsmac()&0xFF; mac=self.packetaddr(packet,justmac=True); - if (ord(packet[0])&0x80)^(sync&0x80): + + #BT preamble is A or 5. + #Fix this to work on the smallest bit, not the highest. + if ((ord(packet[0])&0x80)^(sync&0x80)) and self.macreject: #print "%02x%02x invalid entry." % (sync,ord(packet[0])); #This is a special kind of failure. Freq is probably right, but MAC is wrong. return False; - if mac=='5555555555' or mac=='aaaaaaaaaa' or mac=='0000000000': - return False; + blacklist=['5555555555', 'aaaaaaaaaa', + '0000000000', 'ffffffffff', + '55555555', 'aaaaaaaa', + '00000000', 'ffffffff', + '555555', 'aaaaaa', + '000000', 'ffffff', + '7fffff', 'aaffff', 'aaaaff', + 'afffff', 'abffff', '5fffff']; + for foo in blacklist: + if mac==foo: + return False; return True; def handle(self,packet): """Handles a packet.""" - #printpacket(packet); + if self.printing: + printpacket(packet); if not self.validmac(packet): #print "Dropped packet from %s" % self.packetaddr(packet,justmac=True); @@ -389,9 +456,10 @@ class AutoTuner(): #TODO add support for 256kbps, if anyone uses it. if count&1: rate=rate|0x08; - #print "Setting rate to 0x%02x" % rate; + if(rate==0x20): rate=0x08; + print "Setting rate to 0x%02x" % rate; self.client.poke(0x06,rate); count=(count>>1); @@ -427,6 +495,36 @@ if(sys.argv[1]=="autotune"): #Power radio, prime for RX, no checksum client.poke(0x00,0x70|0x03); #0x08 for checksum, 0x04 for two. + print "Autotuning on %i MHz" % ( + client.RF_getfreq()/10**6); + print "sync,mac,r5,r6"; + #Now we're ready to get packets. + guesser.startch=16; + guesser.selftune(threshold=2, + delay=10, + forever=True); + +if(sys.argv[1]=="autotunebt"): + #Reversal of transmitter code from nRF_CMD.c of OpenBeacon + #TODO remove all poke() calls. + guesser=AutoTuner(); + guesser.init(client,rate=True,sync=False,chan=True, + macreject=False, printing=True); + + + #client.RF_setfreq(2481 * 10**6); + client.poke(0x06,0x00); #1MBps + client.poke(0x07,0x78); #Reset status register + + #Bluetooth preamble is 0xA; BTLE is 0xAA. + client.RF_setsmac(0x000A); + + #Longest length. + client.RF_setpacketlen(32); + + #Power radio, prime for RX, no checksum + client.poke(0x00,0x70|0x03); #0x08 for checksum, 0x04 for two. + print "Autotuning on %i MHz" % ( client.RF_getfreq()/10**6); print "sync,mac,r5,r6"; @@ -569,44 +667,6 @@ if(sys.argv[1]=="sniffant"): -if(sys.argv[1]=="sniffskybrake"): - #Reversal of transmitter code from nRF_CMD.c of OpenBeacon - #TODO remove all poke() calls. - - client.poke(0x00,0x00); #Stop nRF - client.poke(0x01,0x00); #Disable Shockburst - client.poke(0x02,0x01); #Set RX Pipe 0 - - client.RF_setfreq(2439 * 10**6); - client.poke(0x06,0x00); #1MBps - client.poke(0x07,0x78); #Reset status register - - #OpenBeacon defines these in little endian as follows. - client.RF_setmaclen(2); # SETUP_AW for 3-byte addresses. - #0x01, 0x02, 0x03, 0x02, 0x01 - - client.RF_setsmac(0x070700d2c4); #reversed - - #client.RF_setsmac(0xd2c4); - #client.RF_setsmac(0); - - #Mac packet length, illegally 0-length address field. - client.RF_setpacketlen(32); - - #Power radio, prime for RX, one-byte checksum. - client.poke(0x00,0x70|0x03); #0x08 for one byte, 0x04 for two. - - print "Listening as %010x on %i MHz" % (client.RF_getsmac(), - client.RF_getfreq()/10**6); - print "%i byte mac match." % client.RF_getmaclen(); - #Now we're ready to get packets. - while 1: - packet=None; - while packet==None: - #time.sleep(0.1); - packet=client.RF_rxpacket(); - printpacket(packet); - sys.stdout.flush(); if(sys.argv[1]=="sniffsf"): #Reversal of transmitter code from nRF_CMD.c of OpenBeacon @@ -642,24 +702,31 @@ if(sys.argv[1]=="sniffsf"): printpacket(packet); sys.stdout.flush(); -if(sys.argv[1]=="snifftp"): +if(sys.argv[1]=="sniffnike"): + #TODO remove all poke() calls. + client.poke(0x00,0x00); #Stop nRF client.poke(0x01,0x00); #Disable Shockburst client.poke(0x02,0x01); #Set RX Pipe 0 - client.RF_setfreq((2400+0x29) * 10**6); - client.poke(0x06,0x00); #1Mbps + client.RF_setfreq(2425 * 10**6); + client.poke(0x06,0x20|0x06); #250 kbps client.poke(0x07,0x78); #Reset status register - client.RF_setmaclen(3); # SETUP_AW for 3-byte addresses. - client.RF_setsmac(0x123456); - client.RF_setpacketlen(4); + #Nike Settings + client.RF_setmaclen(2); # Illegal by datasheet, but it works! + client.RF_setsmac(0xc2bd); + client.RF_settmac(0xc2bd); #Should we forge data? + + client.RF_setpacketlen(32); #No idea what the length is. #Power radio, prime for RX, two-byte checksum. - client.poke(0x00,0x70|0x03|0x04|0x08); + client.poke(0x00,0x70|0x03); #0x08 for checksum, 0x04 for two bytes. print "Listening as %010x on %i MHz" % (client.RF_getsmac(), client.RF_getfreq()/10**6); + print "Expect some false-positives."; + #Now we're ready to get packets. while 1: packet=None; @@ -669,14 +736,16 @@ if(sys.argv[1]=="snifftp"): printpacket(packet); sys.stdout.flush(); -if(sys.argv[1]=="hosttp"): +if(sys.argv[1]=="snifftp"): client.poke(0x00,0x00); #Stop nRF client.poke(0x01,0x00); #Disable Shockburst client.poke(0x02,0x01); #Set RX Pipe 0 - chan=0x29; - - client.RF_setfreq((2400+chan) * 10**6); + #Disable shockburst. + client.poke(0x1C,0x00); + client.poke(0x1D,0x00); + + client.RF_setfreq((2400+0x29) * 10**6); client.poke(0x06,0x00); #1Mbps client.poke(0x07,0x78); #Reset status register @@ -685,7 +754,11 @@ if(sys.argv[1]=="hosttp"): client.RF_setpacketlen(4); #Power radio, prime for RX, two-byte checksum. - client.poke(0x00,0x70|0x03|0x04|0x08); + #client.poke(0x00,0x70|0x03|0x04|0x08); + + #Power radio, prime for RX, no checksum. + client.poke(0x00,0x70|0x03); + print "Listening as %010x on %i MHz" % (client.RF_getsmac(), client.RF_getfreq()/10**6); @@ -693,14 +766,12 @@ if(sys.argv[1]=="hosttp"): while 1: packet=None; while packet==None: + #time.sleep(0.1); packet=client.RF_rxpacket(); - mac=((ord(packet[0])<<16)+ - (ord(packet[1])<<8)+ - ord(packet[2])); - key=packet[3]; - print "%c from %06x" % (key,mac); + printpacket(packet); sys.stdout.flush(); + if(sys.argv[1]=="sniff"): if len(sys.argv)>2: print "Set MAC to %s" % sys.argv[2];