X-Git-Url: http://git.rot13.org/?p=goodfet;a=blobdiff_plain;f=client%2Fgoodfet.nrf;h=fb22497c93603a709c0f4ac26d0577d480053dd3;hp=35d608f746026d6559fbf7df7746a4326b7bca3b;hb=e027df82b3f7b6c0ed428a504220e13ae02886e9;hpb=074a0dce3d0ff96141185ce319140d52bf18ce22 diff --git a/client/goodfet.nrf b/client/goodfet.nrf index 35d608f..fb22497 100755 --- a/client/goodfet.nrf +++ b/client/goodfet.nrf @@ -30,23 +30,69 @@ def printpacket(packet): s="%s %02x" % (s,ord(foo)); print "%s" % s; + +mskbstring=""; +oldseq=-1; def printmspacket(packet,offset=1): + """Decodes a Microsoft keyboard packet and maintains the typed strings.""" + global mskbstring, oldseq; keyword=client.RF_getsmac(); #print "keyword=%010x" % key; key=[]; + ct=[]; for foo in range(0,5): key.append(keyword&0xFF); keyword=(keyword>>8); #print "Keybyte %02x" % key[foo]; i=0; s=""; + for foo in packet: if i>=4: + ct.append(ord(foo)^key[(i+offset)%5]); s="%s %02x" % (s,ord(foo)^key[(i+offset)%5]); else: + ct.append(ord(foo)); s="%s %02x" % (s,ord(foo)); i=i+1; + #Uncomment this to print the raw packet, kinda noisy. print "%s" % (s); + + letter=None; + seq=ct[4]; + if ct[0]==0x0a and ct[1]==0x78 and seq!=oldseq: + oldseq=seq; + #TODO replace this with a dictionary, and support modifiers. + if ct[9]==0: + #Key up event, not worth logging. + pass; + elif ct[9]>=4 and ct[9]<0x1E: + letter=ct[9]+ord('A')-4; + elif ct[9]>=0x1E and ct[9]<0x27: + letter=ct[9]+ord('1')-0x1E; + elif ct[9]==0x27: + letter=ord('0'); + elif ct[9]==0x29: + #escape + letter=ord('e'); + elif ct[9]==0x2d: + letter=ord('-'); + elif ct[9]==0x2e: + letter=ord('='); + elif ct[9]==0x35: + letter=ord('`'); + elif ct[9]==0x2C: + letter=ord('_'); + elif ct[9]==0x34: + letter=ord('\''); + elif ct[9]==0x36: + letter=ord(','); + else: + print "Unknown character 0x%02x." % ct[9]; + letter=ord('?'); + if letter!=None: + mskbstring="%s%c" % (mskbstring,letter); + print "# %s" % mskbstring def printconfig(): print "Encoding %s" % client.RF_getenc(); print "Freq %10i MHz" % (client.RF_getfreq()/10**6); @@ -70,16 +116,12 @@ if(len(sys.argv)==1): print "%s sniffob\n\tSniffs OpenBeacon traffic." % sys.argv[0]; print "%s snifftp\n\tSniffs Turning Point Clicker traffic." % sys.argv[0]; print "%s sniffsf\n\tSniffs SparkFun Dongle traffic." % sys.argv[0]; + print "%s sniffmskb\n\tSniffs Microsoft Keyboard traffic." % sys.argv[0]; print ""; - print "%s sniffmacs \n\tSniffs for MAC addresses on the present channel."; + print "%s sniffmacs \n\tSniffs for MAC addresses on the present channel." % sys.argv[0]; print "%s sniffprom [0xaa|0x55]\n\tSniffs promiscuously for a preamble of 0xAA or 0x55" % sys.argv[0]; print "%s autotune\n\tSearches for a valid destination address." % sys.argv[0]; print ""; - print "%s sniffskybrake\n\tSniffs skybrake. [broken?]" % sys.argv[0]; - print "%s sniffmskb\n\tSniffs MS KB. [broken?]" % sys.argv[0]; - - print "%s hosttp\n\tHosts Turning Point Clicker traffic." % sys.argv[0]; - print "%s carrier [freq]\n\tHolds a carrier on [freq] Hz." % sys.argv[0]; sys.exit(); @@ -284,7 +326,7 @@ class AutoTuner(): #Disable shockburst. client.poke(0x1C,0x00); client.poke(0x1D,0x00); - + client.RF_setmaclen(2); # SETUP_AW for shortest #historic @@ -569,44 +611,6 @@ if(sys.argv[1]=="sniffant"): -if(sys.argv[1]=="sniffskybrake"): - #Reversal of transmitter code from nRF_CMD.c of OpenBeacon - #TODO remove all poke() calls. - - client.poke(0x00,0x00); #Stop nRF - client.poke(0x01,0x00); #Disable Shockburst - client.poke(0x02,0x01); #Set RX Pipe 0 - - client.RF_setfreq(2439 * 10**6); - client.poke(0x06,0x00); #1MBps - client.poke(0x07,0x78); #Reset status register - - #OpenBeacon defines these in little endian as follows. - client.RF_setmaclen(2); # SETUP_AW for 3-byte addresses. - #0x01, 0x02, 0x03, 0x02, 0x01 - - client.RF_setsmac(0x070700d2c4); #reversed - - #client.RF_setsmac(0xd2c4); - #client.RF_setsmac(0); - - #Mac packet length, illegally 0-length address field. - client.RF_setpacketlen(32); - - #Power radio, prime for RX, one-byte checksum. - client.poke(0x00,0x70|0x03); #0x08 for one byte, 0x04 for two. - - print "Listening as %010x on %i MHz" % (client.RF_getsmac(), - client.RF_getfreq()/10**6); - print "%i byte mac match." % client.RF_getmaclen(); - #Now we're ready to get packets. - while 1: - packet=None; - while packet==None: - #time.sleep(0.1); - packet=client.RF_rxpacket(); - printpacket(packet); - sys.stdout.flush(); if(sys.argv[1]=="sniffsf"): #Reversal of transmitter code from nRF_CMD.c of OpenBeacon @@ -647,6 +651,10 @@ if(sys.argv[1]=="snifftp"): client.poke(0x01,0x00); #Disable Shockburst client.poke(0x02,0x01); #Set RX Pipe 0 + #Disable shockburst. + client.poke(0x1C,0x00); + client.poke(0x1D,0x00); + client.RF_setfreq((2400+0x29) * 10**6); client.poke(0x06,0x00); #1Mbps client.poke(0x07,0x78); #Reset status register @@ -669,37 +677,6 @@ if(sys.argv[1]=="snifftp"): printpacket(packet); sys.stdout.flush(); -if(sys.argv[1]=="hosttp"): - client.poke(0x00,0x00); #Stop nRF - client.poke(0x01,0x00); #Disable Shockburst - client.poke(0x02,0x01); #Set RX Pipe 0 - - chan=0x29; - - client.RF_setfreq((2400+chan) * 10**6); - client.poke(0x06,0x00); #1Mbps - client.poke(0x07,0x78); #Reset status register - - client.RF_setmaclen(3); # SETUP_AW for 3-byte addresses. - client.RF_setsmac(0x123456); - client.RF_setpacketlen(4); - - #Power radio, prime for RX, two-byte checksum. - client.poke(0x00,0x70|0x03|0x04|0x08); - - print "Listening as %010x on %i MHz" % (client.RF_getsmac(), - client.RF_getfreq()/10**6); - #Now we're ready to get packets. - while 1: - packet=None; - while packet==None: - packet=client.RF_rxpacket(); - mac=((ord(packet[0])<<16)+ - (ord(packet[1])<<8)+ - ord(packet[2])); - key=packet[3]; - print "%c from %06x" % (key,mac); - sys.stdout.flush(); if(sys.argv[1]=="sniff"): if len(sys.argv)>2: