unleashed-firmware/applications/plugins/subbrute/subbrute_device.c

669 lines
23 KiB
C

#include "subbrute_device.h"
#include "subbrute_i.h"
#include <furi.h>
#include <furi_hal.h>
#include <furi_hal_subghz.h>
#include <stdint.h>
#include <stdbool.h>
#include <lib/subghz/types.h>
#include <lib/subghz/protocols/base.h>
#include <storage/storage.h>
#include <dialogs/dialogs.h>
#include <stream/stream.h>
#include <stream/buffered_file_stream.h>
#include <lib/toolbox/path.h>
#include <lib/flipper_format/flipper_format_i.h>
#define TAG "SubBruteDevice"
/**
* List of protocols
*/
static const char* protocol_came = "CAME";
static const char* protocol_cham_code = "Cham_Code";
static const char* protocol_linear = "Linear";
static const char* protocol_nice_flo = "Nice FLO";
static const char* protocol_princeton = "Princeton";
static const char* protocol_raw = "RAW";
/**
* Values to not use less memory for packet parse operations
*/
static const char* subbrute_key_file_start =
"Filetype: Flipper SubGhz Key File\nVersion: 1\nFrequency: %u\nPreset: %s\nProtocol: %s\nBit: %d";
static const char* subbrute_key_file_key = "%s\nKey: %s\n";
static const char* subbrute_key_file_princeton_end = "%s\nKey: %s\nTE: %d\n";
static const char* subbrute_key_small_no_tail = "Bit: %d\nKey: %s\n";
static const char* subbrute_key_small_with_tail = "Bit: %d\nKey: %s\nTE: %d\n";
// Why nobody set in as const in all codebase?
static const char* preset_ook270_async = "FuriHalSubGhzPresetOok270Async";
static const char* preset_ook650_async = "FuriHalSubGhzPresetOok650Async";
static const char* preset_2fsk_dev238_async = "FuriHalSubGhzPreset2FSKDev238Async";
static const char* preset_2fsk_dev476_async = "FuriHalSubGhzPreset2FSKDev476Async";
static const char* preset_msk99_97_kb_async = "FuriHalSubGhzPresetMSK99_97KbAsync";
static const char* preset_gfs99_97_kb_async = "FuriHalSubGhzPresetGFS99_97KbAsync";
SubBruteDevice* subbrute_device_alloc() {
SubBruteDevice* instance = malloc(sizeof(SubBruteDevice));
instance->state = SubBruteDeviceStateIDLE;
instance->key_index = 0;
instance->load_path = furi_string_alloc();
instance->preset_name = furi_string_alloc();
instance->protocol_name = furi_string_alloc();
instance->decoder_result = NULL;
instance->receiver = NULL;
instance->environment = subghz_environment_alloc();
subbrute_device_attack_set_default_values(instance, SubBruteAttackCAME12bit307);
return instance;
}
void subbrute_device_free(SubBruteDevice* instance) {
furi_assert(instance);
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "subbrute_device_free");
#endif
// I don't know how to free this
instance->decoder_result = NULL;
if(instance->receiver != NULL) {
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "subghz_receiver_free");
#endif
subghz_receiver_free(instance->receiver);
instance->receiver = NULL;
}
subghz_environment_free(instance->environment);
instance->environment = NULL;
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "before free");
#endif
furi_string_free(instance->load_path);
furi_string_free(instance->preset_name);
furi_string_free(instance->protocol_name);
free(instance);
}
bool subbrute_device_save_file(SubBruteDevice* instance, const char* dev_file_name) {
furi_assert(instance);
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "subbrute_device_save_file: %s", dev_file_name);
#endif
bool result = subbrute_device_create_packet_parsed(instance, instance->key_index, false);
if(!result) {
FURI_LOG_E(TAG, "subbrute_device_create_packet_parsed failed!");
//subbrute_device_notification_message(instance, &sequence_error);
return false;
}
Storage* storage = furi_record_open(RECORD_STORAGE);
Stream* stream = buffered_file_stream_alloc(storage);
result = false;
do {
if(!buffered_file_stream_open(stream, dev_file_name, FSAM_READ_WRITE, FSOM_OPEN_ALWAYS)) {
buffered_file_stream_close(stream);
break;
}
stream_write_cstring(stream, instance->payload);
result = true;
} while(false);
buffered_file_stream_close(stream);
stream_free(stream);
if(!result) {
FURI_LOG_E(TAG, "stream_write_string failed!");
//subbrute_device_notification_message(instance, &sequence_error);
}
furi_record_close(RECORD_STORAGE);
return result;
}
const char* subbrute_device_error_get_desc(SubBruteFileResult error_id) {
const char* result;
switch(error_id) {
case(SubBruteFileResultOk):
result = "OK";
break;
case(SubBruteFileResultErrorOpenFile):
result = "invalid name/path";
break;
case(SubBruteFileResultMissingOrIncorrectHeader):
result = "Missing or incorrect header";
break;
case(SubBruteFileResultFrequencyNotAllowed):
result = "Invalid frequency!";
break;
case(SubBruteFileResultMissingOrIncorrectFrequency):
result = "Missing or incorrect Frequency";
break;
case(SubBruteFileResultPresetInvalid):
result = "Preset FAIL";
break;
case(SubBruteFileResultMissingProtocol):
result = "Missing Protocol";
break;
case(SubBruteFileResultProtocolNotSupported):
result = "RAW unsupported";
break;
case(SubBruteFileResultDynamicProtocolNotValid):
result = "Dynamic protocol unsupported";
break;
case(SubBruteFileResultProtocolNotFound):
result = "Protocol not found";
break;
case(SubBruteFileResultMissingOrIncorrectBit):
result = "Missing or incorrect Bit";
break;
case(SubBruteFileResultBigBitSize):
result = "Has more than 24 Bits";
break;
case(SubBruteFileResultMissingOrIncorrectKey):
result = "Missing or incorrect Key";
break;
case(SubBruteFileResultMissingOrIncorrectTe):
result = "Missing or incorrect TE";
break;
case SubBruteFileResultUnknown:
default:
result = "Unknown error";
break;
}
return result;
}
bool subbrute_device_create_packet_parsed(SubBruteDevice* instance, uint64_t step, bool small) {
furi_assert(instance);
//char step_payload[32];
//memset(step_payload, '0', sizeof(step_payload));
memset(instance->payload, 0, sizeof(instance->payload));
FuriString* candidate = furi_string_alloc();
if(instance->attack == SubBruteAttackLoadFile) {
if(step >= sizeof(instance->file_key)) {
return false;
}
char subbrute_payload_byte[4];
furi_string_set_str(candidate, instance->file_key);
snprintf(subbrute_payload_byte, 4, "%02X ", (uint8_t)step);
furi_string_replace_at(candidate, instance->load_index * 3, 3, subbrute_payload_byte);
//snprintf(step_payload, sizeof(step_payload), "%02X", (uint8_t)instance->file_key[step]);
} else {
//snprintf(step_payload, sizeof(step_payload), "%16X", step);
//snprintf(step_payload, sizeof(step_payload), "%016llX", step);
FuriString* buffer = furi_string_alloc();
furi_string_printf(buffer, "%16X", step);
int j = 0;
furi_string_set_str(candidate, " ");
for(uint8_t i = 0; i < 16; i++) {
if(furi_string_get_char(buffer, i) != ' ') {
furi_string_set_char(candidate, i + j, furi_string_get_char(buffer, i));
} else {
furi_string_set_char(candidate, i + j, '0');
}
if(i % 2 != 0) {
j++;
}
}
furi_string_free(buffer);
}
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "candidate: %s, step: %d", furi_string_get_cstr(candidate), step);
#endif
if(small) {
if(instance->has_tail) {
snprintf(
instance->payload,
sizeof(instance->payload),
subbrute_key_small_with_tail,
instance->bit,
furi_string_get_cstr(candidate),
instance->te);
} else {
snprintf(
instance->payload,
sizeof(instance->payload),
subbrute_key_small_no_tail,
instance->bit,
furi_string_get_cstr(candidate));
}
} else {
if(instance->has_tail) {
snprintf(
instance->payload,
sizeof(instance->payload),
subbrute_key_file_princeton_end,
instance->file_template,
furi_string_get_cstr(candidate),
instance->te);
} else {
snprintf(
instance->payload,
sizeof(instance->payload),
subbrute_key_file_key,
instance->file_template,
furi_string_get_cstr(candidate));
}
}
#ifdef FURI_DEBUG
//FURI_LOG_D(TAG, "payload: %s", instance->payload);
#endif
furi_string_free(candidate);
return true;
}
SubBruteFileResult subbrute_device_attack_set(SubBruteDevice* instance, SubBruteAttacks type) {
furi_assert(instance);
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "subbrute_device_attack_set: %d", type);
#endif
subbrute_device_attack_set_default_values(instance, type);
switch(type) {
case SubBruteAttackLoadFile:
// In this case values must be already set
// file_result =
// subbrute_device_load_from_file(instance, furi_string_get_cstr(instance->load_path));
// if(file_result != SubBruteFileResultOk) {
// // Failed load file so failed to set attack type
// return file_result; // RETURN
// }
break;
case SubBruteAttackCAME12bit303:
case SubBruteAttackCAME12bit307:
case SubBruteAttackCAME12bit433:
case SubBruteAttackCAME12bit868:
if(type == SubBruteAttackCAME12bit303) {
instance->frequency = 303875000;
} else if(type == SubBruteAttackCAME12bit307) {
instance->frequency = 307800000;
} else if(type == SubBruteAttackCAME12bit433) {
instance->frequency = 433920000;
} else /* ALWAYS TRUE if(type == SubBruteAttackCAME12bit868) */ {
instance->frequency = 868350000;
}
instance->bit = 12;
furi_string_set_str(instance->protocol_name, protocol_came);
furi_string_set_str(instance->preset_name, preset_ook650_async);
break;
case SubBruteAttackChamberlain9bit300:
case SubBruteAttackChamberlain9bit315:
case SubBruteAttackChamberlain9bit390:
if(type == SubBruteAttackChamberlain9bit300) {
instance->frequency = 300000000;
} else if(type == SubBruteAttackChamberlain9bit315) {
instance->frequency = 315000000;
} else /* ALWAYS TRUE if(type == SubBruteAttackChamberlain9bit390) */ {
instance->frequency = 390000000;
}
instance->bit = 9;
furi_string_set_str(instance->protocol_name, protocol_cham_code);
furi_string_set_str(instance->preset_name, preset_ook650_async);
break;
case SubBruteAttackLinear10bit300:
instance->frequency = 300000000;
instance->bit = 10;
furi_string_set_str(instance->protocol_name, protocol_linear);
furi_string_set_str(instance->preset_name, preset_ook650_async);
break;
case SubBruteAttackLinear10bit310:
instance->frequency = 310000000;
instance->bit = 10;
furi_string_set_str(instance->protocol_name, protocol_linear);
furi_string_set_str(instance->preset_name, preset_ook650_async);
break;
case SubBruteAttackNICE12bit433:
instance->frequency = 433920000;
instance->bit = 12;
furi_string_set_str(instance->protocol_name, protocol_nice_flo);
furi_string_set_str(instance->preset_name, preset_ook650_async);
break;
case SubBruteAttackNICE12bit868:
instance->frequency = 868350000;
instance->bit = 12;
furi_string_set_str(instance->protocol_name, protocol_nice_flo);
furi_string_set_str(instance->preset_name, preset_ook650_async);
break;
default:
FURI_LOG_E(TAG, "Unknown attack type: %d", type);
return SubBruteFileResultProtocolNotFound; // RETURN
}
/*if(!furi_hal_subghz_is_tx_allowed(instance->frequency)) {
FURI_LOG_E(TAG, "Frequency invalid: %d", instance->frequency);
return SubBruteFileResultMissingOrIncorrectFrequency; // RETURN
}*/
// For non-file types we didn't set SubGhzProtocolDecoderBase
instance->receiver = subghz_receiver_alloc_init(instance->environment);
subghz_receiver_set_filter(instance->receiver, SubGhzProtocolFlag_Decodable);
furi_hal_subghz_reset();
uint8_t protocol_check_result = SubBruteFileResultProtocolNotFound;
if(type != SubBruteAttackLoadFile) {
instance->decoder_result = subghz_receiver_search_decoder_base_by_name(
instance->receiver, furi_string_get_cstr(instance->protocol_name));
if(!instance->decoder_result ||
instance->decoder_result->protocol->type == SubGhzProtocolTypeDynamic) {
FURI_LOG_E(TAG, "Can't load SubGhzProtocolDecoderBase in phase non-file decoder set");
} else {
protocol_check_result = SubBruteFileResultOk;
}
} else {
// And here we need to set preset enum
instance->preset =
subbrute_device_convert_preset(furi_string_get_cstr(instance->preset_name));
protocol_check_result = SubBruteFileResultOk;
}
subghz_receiver_free(instance->receiver);
instance->receiver = NULL;
if(protocol_check_result != SubBruteFileResultOk) {
return SubBruteFileResultProtocolNotFound;
}
instance->has_tail =
(strcmp(furi_string_get_cstr(instance->protocol_name), protocol_princeton) == 0);
// Calc max value
if(instance->attack == SubBruteAttackLoadFile) {
instance->max_value = 0x3F;
} else {
FuriString* max_value_s;
max_value_s = furi_string_alloc();
for(uint8_t i = 0; i < instance->bit; i++) {
furi_string_cat_printf(max_value_s, "1");
}
instance->max_value = (uint64_t)strtol(furi_string_get_cstr(max_value_s), NULL, 2);
furi_string_free(max_value_s);
}
// Now we are ready to set file template for using in the future with snprintf
// for sending attack payload
snprintf(
instance->file_template,
sizeof(instance->file_template),
subbrute_key_file_start,
instance->frequency,
furi_string_get_cstr(instance->preset_name),
furi_string_get_cstr(instance->protocol_name),
instance->bit);
// strncat(instance->file_template, "\n", sizeof(instance->file_template));
// strncat(instance->file_template, subbrute_key_file_key, sizeof(instance->file_template));
// if(instance->has_tail) {
// strncat(
// instance->file_template,
// subbrute_key_file_princeton_end,
// sizeof(instance->file_template));
// }
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "tail: %d, file_template: %s", instance->has_tail, instance->file_template);
#endif
// Init payload
subbrute_device_create_packet_parsed(instance, instance->key_index, false);
return SubBruteFileResultOk;
}
uint8_t subbrute_device_load_from_file(SubBruteDevice* instance, FuriString* file_path) {
furi_assert(instance);
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "subbrute_device_load_from_file: %s", furi_string_get_cstr(file_path));
#endif
SubBruteFileResult result = SubBruteFileResultUnknown;
Storage* storage = furi_record_open(RECORD_STORAGE);
FlipperFormat* fff_data_file = flipper_format_file_alloc(storage);
FuriString* temp_str;
temp_str = furi_string_alloc();
uint32_t temp_data32;
instance->receiver = subghz_receiver_alloc_init(instance->environment);
subghz_receiver_set_filter(instance->receiver, SubGhzProtocolFlag_Decodable);
furi_hal_subghz_reset();
do {
if(!flipper_format_file_open_existing(fff_data_file, furi_string_get_cstr(file_path))) {
FURI_LOG_E(TAG, "Error open file %s", furi_string_get_cstr(file_path));
result = SubBruteFileResultErrorOpenFile;
break;
}
if(!flipper_format_read_header(fff_data_file, temp_str, &temp_data32)) {
FURI_LOG_E(TAG, "Missing or incorrect header");
result = SubBruteFileResultMissingOrIncorrectHeader;
break;
}
// Frequency
if(flipper_format_read_uint32(fff_data_file, "Frequency", &temp_data32, 1)) {
instance->frequency = temp_data32;
if(!furi_hal_subghz_is_tx_allowed(instance->frequency)) {
result = SubBruteFileResultFrequencyNotAllowed;
break;
}
} else {
FURI_LOG_E(TAG, "Missing or incorrect Frequency");
result = SubBruteFileResultMissingOrIncorrectFrequency;
break;
}
// Preset
if(!flipper_format_read_string(fff_data_file, "Preset", temp_str)) {
FURI_LOG_E(TAG, "Preset FAIL");
result = SubBruteFileResultPresetInvalid;
} else {
instance->preset_name = furi_string_alloc_set(furi_string_get_cstr(temp_str));
}
// Protocol
if(!flipper_format_read_string(fff_data_file, "Protocol", temp_str)) {
FURI_LOG_E(TAG, "Missing Protocol");
result = SubBruteFileResultMissingProtocol;
break;
} else {
instance->protocol_name = furi_string_alloc_set(furi_string_get_cstr(temp_str));
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "Protocol: %s", furi_string_get_cstr(instance->protocol_name));
#endif
}
instance->decoder_result = subghz_receiver_search_decoder_base_by_name(
instance->receiver, furi_string_get_cstr(instance->protocol_name));
if(!instance->decoder_result ||
strcmp(furi_string_get_cstr(instance->protocol_name), "RAW") == 0) {
FURI_LOG_E(TAG, "RAW unsupported");
result = SubBruteFileResultProtocolNotSupported;
break;
}
if(instance->decoder_result->protocol->type == SubGhzProtocolTypeDynamic) {
FURI_LOG_E(TAG, "Protocol is dynamic - not supported");
result = SubBruteFileResultDynamicProtocolNotValid;
break;
}
#ifdef FURI_DEBUG
else {
FURI_LOG_D(TAG, "Decoder: %s", instance->decoder_result->protocol->name);
}
#endif
// instance->decoder_result = subghz_receiver_search_decoder_base_by_name(
// instance->receiver, furi_string_get_cstr(instance->protocol_name));
//
// if(!instance->decoder_result) {
// FURI_LOG_E(TAG, "Protocol not found");
// result = SubBruteFileResultProtocolNotFound;
// break;
// }
// Bit
if(!flipper_format_read_uint32(fff_data_file, "Bit", &temp_data32, 1)) {
FURI_LOG_E(TAG, "Missing or incorrect Bit");
result = SubBruteFileResultMissingOrIncorrectBit;
break;
} else {
if(temp_data32 > 24) {
FURI_LOG_E(TAG, "Incorrect Bits, 24 is maximum");
result = SubBruteFileResultBigBitSize;
break;
}
instance->bit = temp_data32;
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "Bit: %d", instance->bit);
#endif
}
// Key
if(!flipper_format_read_string(fff_data_file, "Key", temp_str)) {
FURI_LOG_E(TAG, "Missing or incorrect Key");
result = SubBruteFileResultMissingOrIncorrectKey;
break;
} else {
snprintf(
instance->file_key,
sizeof(instance->file_key),
"%s",
furi_string_get_cstr(temp_str));
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "Key: %s", instance->file_key);
#endif
}
// TE
if(!flipper_format_read_uint32(fff_data_file, "TE", &temp_data32, 1)) {
FURI_LOG_E(TAG, "Missing or incorrect TE");
//result = SubBruteFileResultMissingOrIncorrectTe;
//break;
} else {
instance->te = temp_data32;
instance->has_tail = true;
}
// Repeat
if(flipper_format_read_uint32(fff_data_file, "Repeat", &temp_data32, 1)) {
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "Repeat: %d", temp_data32);
#endif
instance->repeat = temp_data32;
} else {
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "Repeat: 3 (default)");
#endif
instance->repeat = 3;
}
result = SubBruteFileResultOk;
} while(0);
furi_string_free(temp_str);
flipper_format_file_close(fff_data_file);
flipper_format_free(fff_data_file);
furi_record_close(RECORD_STORAGE);
subghz_receiver_free(instance->receiver);
instance->decoder_result = NULL;
instance->receiver = NULL;
if(result == SubBruteFileResultOk) {
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "Loaded successfully");
#endif
}
return result;
}
void subbrute_device_attack_set_default_values(
SubBruteDevice* instance,
SubBruteAttacks default_attack) {
furi_assert(instance);
#ifdef FURI_DEBUG
FURI_LOG_D(TAG, "subbrute_device_attack_set_default_values");
#endif
instance->attack = default_attack;
instance->key_index = 0x00;
instance->load_index = 0x00;
memset(instance->file_template, 0, sizeof(instance->file_template));
memset(instance->current_key, 0, sizeof(instance->current_key));
memset(instance->text_store, 0, sizeof(instance->text_store));
memset(instance->payload, 0, sizeof(instance->payload));
if(default_attack != SubBruteAttackLoadFile) {
memset(instance->file_key, 0, sizeof(instance->file_key));
instance->max_value = (uint64_t)0x00;
furi_string_free(instance->protocol_name);
furi_string_free(instance->preset_name);
furi_string_free(instance->load_path);
instance->load_path = furi_string_alloc();
instance->protocol_name = furi_string_alloc_set(protocol_raw);
instance->preset_name = furi_string_alloc_set(preset_ook650_async);
instance->preset = FuriHalSubGhzPresetOok650Async;
instance->repeat = 5;
instance->te = 0;
instance->has_tail = false;
}
#ifdef FURI_DEBUG
FURI_LOG_D(
TAG, "subbrute_device_attack_set_default_values done. has_tail: %d", instance->has_tail);
//furi_delay_ms(250);
#endif
}
FuriHalSubGhzPreset subbrute_device_convert_preset(const char* preset_name) {
FuriString* preset;
preset = furi_string_alloc_set(preset_name);
FuriHalSubGhzPreset preset_value;
if(furi_string_cmp_str(preset, preset_ook270_async) == 0) {
preset_value = FuriHalSubGhzPresetOok270Async;
} else if(furi_string_cmp_str(preset, preset_ook650_async) == 0) {
preset_value = FuriHalSubGhzPresetOok650Async;
} else if(furi_string_cmp_str(preset, preset_2fsk_dev238_async) == 0) {
preset_value = FuriHalSubGhzPreset2FSKDev238Async;
} else if(furi_string_cmp_str(preset, preset_2fsk_dev476_async) == 0) {
preset_value = FuriHalSubGhzPreset2FSKDev476Async;
} else if(furi_string_cmp_str(preset, preset_msk99_97_kb_async) == 0) {
preset_value = FuriHalSubGhzPresetMSK99_97KbAsync;
} else if(furi_string_cmp_str(preset, preset_gfs99_97_kb_async) == 0) {
preset_value = FuriHalSubGhzPresetMSK99_97KbAsync;
} else {
preset_value = FuriHalSubGhzPresetCustom;
}
furi_string_free(preset);
return preset_value;
}