X-Git-Url: http://git.rot13.org/?p=goodfet;a=blobdiff_plain;f=client%2Fgoodfet.nrf;h=42f3b724789c0b195ebc33177a561e3e45b28e6f;hp=fb22497c93603a709c0f4ac26d0577d480053dd3;hb=f15cabc15a42fb1b0b57e433dc3a1f300cff2b6c;hpb=f3c669a459fc7c9469b29e0bfd160590c4747f9a diff --git a/client/goodfet.nrf b/client/goodfet.nrf index fb22497..42f3b72 100755 --- a/client/goodfet.nrf +++ b/client/goodfet.nrf @@ -87,6 +87,8 @@ def printmspacket(packet,offset=1): letter=ord('\''); elif ct[9]==0x36: letter=ord(','); + elif ct[9]==0x37: + letter=ord('.'); else: print "Unknown character 0x%02x." % ct[9]; letter=ord('?'); @@ -150,8 +152,9 @@ if(sys.argv[1]=="test"): 2*10**6]: client.RF_setrate(foo); if(client.RF_getrate()!=foo): - print "ERROR Rate %i not supported. Got %i instead." % (foo, - client.RF_getrate()); + print "ERROR Rate %i not supported. Got %i instead." % ( + foo, + client.RF_getrate()); print "\n\n"; client.poke(0x0A,0xDEADBEEF,5); @@ -310,14 +313,22 @@ class AutoTuner(): rate=False; chan=False; sync=False; + macreject=False; + printing=False; startch=0; #Useful for forcing an early match. + maclen=5; #Some are shorter. def init(self,goodfet, - rate=True,chan=True,sync=True): + rate=True,chan=True,sync=True, + macreject=True, printing=False, + maclen=5): """Initializes a link to the GoodFET for autotuning.""" self.client=goodfet; self.rate=rate; self.chan=chan; self.sync=sync; + self.macreject=macreject; + self.printing=printing; + self.maclen=maclen; client.poke(0x00,0x00); #Stop nRF client.poke(0x01,0x00); #Disable Shockburst @@ -336,6 +347,7 @@ class AutoTuner(): client.poke(0x00,0x70|0x03); #prime radio. return; + def packetaddr(self,packet,justmac=False): """Returns a loaded packet address, including channel and rate.""" @@ -343,7 +355,7 @@ class AutoTuner(): mac=""; #MAC,RF_CH,RATE - for i in range(0,5): + for i in range(0,self.maclen): mac="%s%02x" % (mac,ord(packet[i])); if justmac: return mac; @@ -354,17 +366,30 @@ class AutoTuner(): def validmac(self,packet): sync=self.client.RF_getsmac()&0xFF; mac=self.packetaddr(packet,justmac=True); - if (ord(packet[0])&0x80)^(sync&0x80): + + #BT preamble is A or 5. + #Fix this to work on the smallest bit, not the highest. + if ((ord(packet[0])&0x80)^(sync&0x80)) and self.macreject: #print "%02x%02x invalid entry." % (sync,ord(packet[0])); #This is a special kind of failure. Freq is probably right, but MAC is wrong. return False; - if mac=='5555555555' or mac=='aaaaaaaaaa' or mac=='0000000000': - return False; + blacklist=['5555555555', 'aaaaaaaaaa', + '0000000000', 'ffffffffff', + '55555555', 'aaaaaaaa', + '00000000', 'ffffffff', + '555555', 'aaaaaa', + '000000', 'ffffff', + '7fffff', 'aaffff', 'aaaaff', + 'afffff', 'abffff', '5fffff']; + for foo in blacklist: + if mac==foo: + return False; return True; def handle(self,packet): """Handles a packet.""" - #printpacket(packet); + if self.printing: + printpacket(packet); if not self.validmac(packet): #print "Dropped packet from %s" % self.packetaddr(packet,justmac=True); @@ -431,9 +456,10 @@ class AutoTuner(): #TODO add support for 256kbps, if anyone uses it. if count&1: rate=rate|0x08; - #print "Setting rate to 0x%02x" % rate; + if(rate==0x20): rate=0x08; + print "Setting rate to 0x%02x" % rate; self.client.poke(0x06,rate); count=(count>>1); @@ -469,6 +495,36 @@ if(sys.argv[1]=="autotune"): #Power radio, prime for RX, no checksum client.poke(0x00,0x70|0x03); #0x08 for checksum, 0x04 for two. + print "Autotuning on %i MHz" % ( + client.RF_getfreq()/10**6); + print "sync,mac,r5,r6"; + #Now we're ready to get packets. + guesser.startch=16; + guesser.selftune(threshold=2, + delay=10, + forever=True); + +if(sys.argv[1]=="autotunebt"): + #Reversal of transmitter code from nRF_CMD.c of OpenBeacon + #TODO remove all poke() calls. + guesser=AutoTuner(); + guesser.init(client,rate=True,sync=False,chan=True, + macreject=False, printing=True); + + + #client.RF_setfreq(2481 * 10**6); + client.poke(0x06,0x00); #1MBps + client.poke(0x07,0x78); #Reset status register + + #Bluetooth preamble is 0xA; BTLE is 0xAA. + client.RF_setsmac(0x000A); + + #Longest length. + client.RF_setpacketlen(32); + + #Power radio, prime for RX, no checksum + client.poke(0x00,0x70|0x03); #0x08 for checksum, 0x04 for two. + print "Autotuning on %i MHz" % ( client.RF_getfreq()/10**6); print "sync,mac,r5,r6"; @@ -646,6 +702,40 @@ if(sys.argv[1]=="sniffsf"): printpacket(packet); sys.stdout.flush(); +if(sys.argv[1]=="sniffnike"): + #TODO remove all poke() calls. + + client.poke(0x00,0x00); #Stop nRF + client.poke(0x01,0x00); #Disable Shockburst + client.poke(0x02,0x01); #Set RX Pipe 0 + + client.RF_setfreq(2425 * 10**6); + client.poke(0x06,0x20|0x06); #250 kbps + client.poke(0x07,0x78); #Reset status register + + #Nike Settings + client.RF_setmaclen(2); # Illegal by datasheet, but it works! + client.RF_setsmac(0xc2bd); + client.RF_settmac(0xc2bd); #Should we forge data? + + client.RF_setpacketlen(32); #No idea what the length is. + + #Power radio, prime for RX, two-byte checksum. + client.poke(0x00,0x70|0x03); #0x08 for checksum, 0x04 for two bytes. + + print "Listening as %010x on %i MHz" % (client.RF_getsmac(), + client.RF_getfreq()/10**6); + print "Expect some false-positives."; + + #Now we're ready to get packets. + while 1: + packet=None; + while packet==None: + #time.sleep(0.1); + packet=client.RF_rxpacket(); + printpacket(packet); + sys.stdout.flush(); + if(sys.argv[1]=="snifftp"): client.poke(0x00,0x00); #Stop nRF client.poke(0x01,0x00); #Disable Shockburst @@ -664,7 +754,11 @@ if(sys.argv[1]=="snifftp"): client.RF_setpacketlen(4); #Power radio, prime for RX, two-byte checksum. - client.poke(0x00,0x70|0x03|0x04|0x08); + #client.poke(0x00,0x70|0x03|0x04|0x08); + + #Power radio, prime for RX, no checksum. + client.poke(0x00,0x70|0x03); + print "Listening as %010x on %i MHz" % (client.RF_getsmac(), client.RF_getfreq()/10**6);