X-Git-Url: http://git.rot13.org/?p=goodfet;a=blobdiff_plain;f=client%2Fgoodfet.nrf;h=a7ed5d1a591e53b4d09b8f175b527190fe1d083c;hp=2e88a6f34aa507fc0c8205d1fa98841ed6d15e14;hb=586e50d09b9c31458248b524b4618a2baf898e19;hpb=e688c89007d6908088121915a191e2ff19c54cff diff --git a/client/goodfet.nrf b/client/goodfet.nrf index 2e88a6f..a7ed5d1 100755 --- a/client/goodfet.nrf +++ b/client/goodfet.nrf @@ -30,6 +30,32 @@ def printpacket(packet): s="%s %02x" % (s,ord(foo)); print "%s" % s; + +def printmspacket(packet,offset=1): + keyword=client.RF_getsmac(); + #print "keyword=%010x" % key; + key=[]; + ct=[]; + for foo in range(0,5): + key.append(keyword&0xFF); + keyword=(keyword>>8); + #print "Keybyte %02x" % key[foo]; + i=0; + s=""; + + for foo in packet: + if i>=4: + ct.append(ord(foo)^key[(i+offset)%5]); + s="%s %02x" % (s,ord(foo)^key[(i+offset)%5]); + else: + ct.append(ord(foo)); + s="%s %02x" % (s,ord(foo)); + i=i+1; + #print "%s" % (s); + + if ct[0]==0x0a and ct[1]==0x78 and ct[9]!=0: + letter=ct[9]+ord('A')-4; + print "%c" % letter; def printconfig(): print "Encoding %s" % client.RF_getenc(); print "Freq %10i MHz" % (client.RF_getfreq()/10**6); @@ -48,18 +74,19 @@ if(len(sys.argv)==1): print "%s regbits" % sys.argv[0]; print "%s pyregs" % sys.argv[0]; print ""; + print "%s tune aa|55,mac,r5,r6\n\tTunes to a configuration." % sys.argv[0]; print "%s sniff\n\tSniffs packets by current config." % sys.argv[0]; print "%s sniffob\n\tSniffs OpenBeacon traffic." % sys.argv[0]; print "%s snifftp\n\tSniffs Turning Point Clicker traffic." % sys.argv[0]; print "%s sniffsf\n\tSniffs SparkFun Dongle traffic." % sys.argv[0]; print ""; + print "%s sniffmacs \n\tSniffs for MAC addresses on the present channel." % sys.argv[0]; print "%s sniffprom [0xaa|0x55]\n\tSniffs promiscuously for a preamble of 0xAA or 0x55" % sys.argv[0]; print "%s autotune\n\tSearches for a valid destination address." % sys.argv[0]; print ""; print "%s sniffskybrake\n\tSniffs skybrake. [broken?]" % sys.argv[0]; print "%s sniffmskb\n\tSniffs MS KB. [broken?]" % sys.argv[0]; - print "%s hosttp\n\tHosts Turning Point Clicker traffic." % sys.argv[0]; print "%s carrier [freq]\n\tHolds a carrier on [freq] Hz." % sys.argv[0]; @@ -100,7 +127,7 @@ if(sys.argv[1]=="test"): print "ERROR: Failed to set MAC address."; print "Final registers:" printconfig(); - + if(sys.argv[1]=="carrier"): if len(sys.argv)>2: client.RF_setfreq(eval(sys.argv[2])); @@ -109,6 +136,12 @@ if(sys.argv[1]=="carrier"): print "\nHolding a carrier wave."; while(1): time.sleep(1); + +if(sys.argv[1]=="tune"): + if len(sys.argv)>2: + client.tune(sys.argv[2]); + else: + print "Specify a tuning, such as 'aa,c78c65805e,14,09'"; if(sys.argv[1]=="regs"): for r in range(0,0x20): print "r[0x%02x]=0x%010x //%16s " % (r,client.peek(r),regnames[r]); @@ -235,21 +268,79 @@ if(sys.argv[1]=="sniffprom"): printpacket(packet); sys.stdout.flush(); -class AddressGuesser(): +class AutoTuner(): """This guesses addresses by searching through packets.""" - #packets=[]; addresses={}; - def packetaddr(self,packet): - s=""; + client=None; + + #Limits on search space, because you usually know what you're looking for. + rate=False; + chan=False; + sync=False; + startch=0; #Useful for forcing an early match. + def init(self,goodfet, + rate=True,chan=True,sync=True): + """Initializes a link to the GoodFET for autotuning.""" + self.client=goodfet; + self.rate=rate; + self.chan=chan; + self.sync=sync; + + client.poke(0x00,0x00); #Stop nRF + client.poke(0x01,0x00); #Disable Shockburst + client.poke(0x02,0x01); #Set RX Pipe 0 + + #Disable shockburst. + client.poke(0x1C,0x00); + client.poke(0x1D,0x00); + + client.RF_setmaclen(2); # SETUP_AW for shortest + + #historic + #client.RF_setsmac(0x00AA); + #client.RF_setsmac(0x0055); + + client.poke(0x00,0x70|0x03); #prime radio. + + return; + def packetaddr(self,packet,justmac=False): + """Returns a loaded packet address, including channel and rate.""" + + sync=self.client.RF_getsmac()&0xFF; + + mac=""; + #MAC,RF_CH,RATE for i in range(0,5): - s="%s%02x" % (s,ord(packet[i])); - return s; + mac="%s%02x" % (mac,ord(packet[i])); + if justmac: + return mac; + ch=self.client.peek(0x05); + rate=self.client.peek(0x06); + return "%02x,%s,%02x,%02x" % ( + sync,mac,ch,rate); + def validmac(self,packet): + sync=self.client.RF_getsmac()&0xFF; + mac=self.packetaddr(packet,justmac=True); + if (ord(packet[0])&0x80)^(sync&0x80): + #print "%02x%02x invalid entry." % (sync,ord(packet[0])); + #This is a special kind of failure. Freq is probably right, but MAC is wrong. + return False; + if mac=='5555555555' or mac=='aaaaaaaaaa' or mac=='0000000000': + return False; + return True; + def handle(self,packet): + """Handles a packet.""" #printpacket(packet); - #self.packets.append(packet); + + if not self.validmac(packet): + #print "Dropped packet from %s" % self.packetaddr(packet,justmac=True); + #printpacket(packet); + return; + addr=self.packetaddr(packet); - #Increment the address. + #Increment the address count. count=0; try: count=self.addresses[addr]; @@ -257,39 +348,106 @@ class AddressGuesser(): pass; self.addresses[addr]=count+1; rate=count*1.0/len(self.addresses); - if self.addresses[addr]>1: - print "'%s' looks valid, %0.5f" % ( - addr,rate); + if self.addresses[addr]>1 or rate>0.01: + print "'%s' looks valid\t%i\t%0.5f" % ( + addr,count,rate); + return addr; + tunecount=0; + def selftune(self,threshold=2,forever=False, + delay=5.0): + """Tunes to the first strong signal. + It's important that this not get triggered by false positives.""" + + while 1: + self.retune(); + start=time.mktime(time.localtime()); + sys.stdout.flush(); + while (time.mktime(time.localtime())-start) < delay: + packet=None; + while packet==None: + packet=client.RF_rxpacket(); + addr=guesser.handle(packet); + try: + count=self.addresses[addr]; + except: + count=0; + if count>threshold and forever==False: + #Tune it in here? + client.tune(addr); + return addr; + + + def retune(self): + """Tunes to another channel or preamble looking for the next packet.""" + count=self.tunecount; + self.tunecount=count+1; + + #Swap the SYNC value most often. + if self.sync: + sync=0x00AA; + if count&1: + sync=0x0055; + self.client.RF_setsmac(sync); + count=(count>>1); + + if self.rate: + #Then the data rate. + rate=0; + + #This swaps between 1Mbps and 2Mbps. + #TODO add support for 256kbps, if anyone uses it. + if count&1: + rate=rate|0x08; + #print "Setting rate to 0x%02x" % rate; + if(rate==0x20): + rate=0x08; + self.client.poke(0x06,rate); + count=(count>>1); + + if self.chan: + self.client.poke(0x05, + (count+self.startch)&0x7f); + print "Tuned to %i MHz" % ( + self.client.RF_getfreq() + /(10**6)); + #Grab two packets to clear buffers. + #Should retune only after a few packets to reduce this delay. + packet=client.RF_rxpacket(); + packet=client.RF_rxpacket(); return; + if(sys.argv[1]=="autotune"): #Reversal of transmitter code from nRF_CMD.c of OpenBeacon #TODO remove all poke() calls. - guesser=AddressGuesser(); + guesser=AutoTuner(); + guesser.init(client,rate=True,sync=True,chan=True); - client.poke(0x00,0x00); #Stop nRF - client.poke(0x01,0x00); #Disable Shockburst - client.poke(0x02,0x01); #Set RX Pipe 0 #client.RF_setfreq(2481 * 10**6); - #client.poke(0x06,0x09); #2MBps, -18dBm in RF_SETUP + client.poke(0x06,0x09); #2MBps, -18dBm in RF_SETUP client.poke(0x07,0x78); #Reset status register - #OpenBeacon defines these in little endian as follows. - client.RF_setmaclen(2); # SETUP_AW for shortest + #This is determined by the MAC, which we don't yet know. - #It's better to have a known fragment, when one is available. - #client.RF_setsmac(0x00AA); - #client.RF_setsmac(0x0055); + #Longest length. + client.RF_setpacketlen(32); - #Should end in 55 or AA depending upon the packet. - tail=0x55 - if(len(sys.argv)>2): - tail=int(sys.argv[2],16); - else: - print "Please specify a tail of 0xAA or 0x55."; - sys.exit(1); - client.RF_setsmac(tail); + #Power radio, prime for RX, no checksum + client.poke(0x00,0x70|0x03); #0x08 for checksum, 0x04 for two. + + print "Autotuning on %i MHz" % ( + client.RF_getfreq()/10**6); + print "sync,mac,r5,r6"; + #Now we're ready to get packets. + guesser.selftune(threshold=2, + forever=True); + +if(sys.argv[1]=="sniffmacs"): + #Reversal of transmitter code from nRF_CMD.c of OpenBeacon + #TODO remove all poke() calls. + guesser=AutoTuner(); + guesser.init(client,rate=False,sync=True,chan=False); #Longest length. client.RF_setpacketlen(32); @@ -297,15 +455,12 @@ if(sys.argv[1]=="autotune"): #Power radio, prime for RX, no checksum client.poke(0x00,0x70|0x03); #0x08 for checksum, 0x04 for two. - print "Listening as %010x on %i MHz" % (client.RF_getsmac(), - client.RF_getfreq()/10**6); + print "Holding autotune on %i MHz" % ( + client.RF_getfreq()/10**6); + print "sync,mac,r5,r6"; #Now we're ready to get packets. - while 1: - packet=None; - while packet==None: - packet=client.RF_rxpacket(); - guesser.handle(packet); - sys.stdout.flush(); + guesser.selftune(threshold=2, + forever=True); if(sys.argv[1]=="sniffmskb"): #MSWK 3000 v2.0 @@ -321,30 +476,103 @@ if(sys.argv[1]=="sniffmskb"): #This is the address of a specific keyboard. #Other keyboards will be different. - - client.RF_setmaclen(2); + client.RF_setmaclen(5); #Known pairs. The channel and the low address bytes must match. #client.RF_setfreq((2400+0x13) * 10**6); - #client.RF_setsmac(0x0c00a3598cd); + #client.RF_setsmac(0xc00a3598cd); - client.RF_setfreq((2400+0x15) * 10**6); - client.RF_setsmac( 0x0c10446facd); + #client.RF_setfreq((2400+0x15) * 10**6); + #client.RF_setsmac(0xc10446facd); #Mac packet length, illegally 0-length address field. - client.RF_setpacketlen(32); + client.RF_setpacketlen(16); - #Power radio, prime for RX, no checksum - client.poke(0x00,0x70|0x03); #0x08 for checksum, 0x04 for two. + #aa,c00a3598cd,13,09 + if len(sys.argv)>2: + client.tune(sys.argv[2]); + else: + + print "Searching for a keyboard."; + + guesser=AutoTuner(); + guesser.init(client, rate=False, sync=True, chan=True); + guesser.selftune(threshold=4,forever=False, + delay=10.0); + client.poke(0x00,0x00); #Stop nRF + client.poke(0x01,0x00); #Disable Shockburst + client.poke(0x02,0x01); #Set RX Pipe 0 + client.RF_setmaclen(5); + + #Finally, dynamic payload lengths need to be enabled. + #client.poke(0x01,0x01); + client.poke(0x1C,0x01); + client.poke(0x1D,0x06); + + client.poke(0x00,0x70|0x03); #prime radio. print "Listening as %010x on %i MHz" % (client.RF_getsmac(), client.RF_getfreq()/10**6); #Now we're ready to get packets. while 1: packet=None; while packet==None: - #time.sleep(0.1); + #time.sleep(1); + packet=client.RF_rxpacket(); + #print "."; + printmspacket(packet); + sys.stdout.flush(); + +if(sys.argv[1]=="sniffant"): + #Prototyped on Garmin device. + #Channel hopping is pretty damned fast, hard to follow. + #This doesn't really work yet, still experimenting. + + #Might be more effective to sniff knowing the MFG ID and Dev. ID, + #as these predict a lot of the MAC address. + + client.poke(0x00,0x00); #Stop nRF + client.poke(0x01,0x00); #Disable Shockburst + client.poke(0x02,0x01); #Set RX Pipe 0 + + client.poke(0x05,57); #broadcast-only channel + client.poke(0x06,0x00); #1MBps + client.poke(0x07,0x78); #Reset status register + + #Is this appropriate? Might be 3. + client.RF_setmaclen(5); + + + #Mac packet length, illegally 0-length address field. + client.RF_setpacketlen(16); + + if len(sys.argv)>2: + client.tune(sys.argv[2]); + else: + + print "Searching for ANT+."; + + guesser=AutoTuner(); + guesser.init(client, rate=False, sync=True, chan=True); + guesser.selftune(threshold=2,forever=False, + delay=9.0); + + client.poke(0x00,0x00); #Stop nRF + client.poke(0x01,0x00); #Disable Shockburst + client.poke(0x02,0x01); #Set RX Pipe 0 + client.RF_setmaclen(5); + + + client.poke(0x00,0x70|0x03); #prime radio. + print "Dumping ANT as %010x on %i MHz" % (client.RF_getsmac(), + client.RF_getfreq()/10**6); + #Now we're ready to get packets. + while 1: + packet=None; + while packet==None: + #time.sleep(1); packet=client.RF_rxpacket(); + #print "."; printpacket(packet); sys.stdout.flush(); @@ -428,6 +656,10 @@ if(sys.argv[1]=="snifftp"): client.poke(0x01,0x00); #Disable Shockburst client.poke(0x02,0x01); #Set RX Pipe 0 + #Disable shockburst. + client.poke(0x1C,0x00); + client.poke(0x1D,0x00); + client.RF_setfreq((2400+0x29) * 10**6); client.poke(0x06,0x00); #1Mbps client.poke(0x07,0x78); #Reset status register @@ -483,11 +715,20 @@ if(sys.argv[1]=="hosttp"): sys.stdout.flush(); if(sys.argv[1]=="sniff"): + if len(sys.argv)>2: + print "Set MAC to %s" % sys.argv[2]; + client.tune(sys.argv[2]); + client.RF_setmaclen(5); + #client.poke(0x00,0x00); #Stop nRF client.poke(0x07,0x78); #Reset status register - #Power radio, prime for RX, checksum. - client.poke(0x00,0x70|0x03|0x08); + #Power radio, prime for RX, no checksum. + client.poke(0x00,0x70|0x03); + #Mac packet length. + client.RF_setpacketlen(32); + #Mac length, reduced + #client.RF_setmaclen(3); # SETUP_AW for shortest print "Listening as %010x on %i MHz" % (client.RF_getsmac(), client.RF_getfreq()/10**6);