bug fixes (see changelog)
This commit is contained in:
parent
99e76d6214
commit
31fbce8209
@ -1,6 +1,6 @@
|
||||
# Rolling Flaws
|
||||
|
||||
Rolling Flaws (version 1.3) by [@CodeAllNight](https://twitter.com/codeallnight).
|
||||
Rolling Flaws (version 1.4) by [@CodeAllNight](https://twitter.com/codeallnight).
|
||||
|
||||
[YouTube demo](https://youtu.be/gMnGuDC9EQo?si=4HLZpkC4XWhh97uQ) of using Rolling Flaws application. The video shows how to use the application to simulate a receiver that has a Replay attack flaw, Pairing FZ to a receiver, Cloning sequence attack, Future attack, Rollback attack & KGB attack. The Rolling Flaws application also supports things like "ENC00" attack & window-next attacks, which are described in scenarios below but was not in video. Rolljam is discussed in document, but discouraged to test since it is [illegal to jam signals](https://www.fcc.gov/general/jammer-enforcement) in the US. If you have additional ideas, please let me know!
|
||||
|
||||
|
Binary file not shown.
Before Width: | Height: | Size: 2.1 KiB After Width: | Height: | Size: 2.1 KiB |
@ -2,6 +2,15 @@
|
||||
|
||||
This file contains all changelogs for latest releases, from 1.3 onward.
|
||||
|
||||
## v1.4
|
||||
|
||||
### Fixed
|
||||
If received signal is less than 500ms from last decoded signal, we ignore it now. In the future, we can consider checking the "Key" to see if something in the signal changed, but for now, we just ignore it.
|
||||
|
||||
In some firmware, the MF fails to parse because it is mising a \n at the end of the file. This is now fixed.
|
||||
|
||||
In some firmware, the SN fails to parse because it is mising from keeloq.c; the application will now use Fix data in that case.
|
||||
|
||||
## v1.3
|
||||
|
||||
### Added
|
||||
|
@ -1,6 +1,6 @@
|
||||
# Rolling Flaws
|
||||
|
||||
Rolling Flaws (version 1.3) by [@CodeAllNight](https://twitter.com/codeallnight).
|
||||
Rolling Flaws (version 1.4) by [@CodeAllNight](https://twitter.com/codeallnight).
|
||||
|
||||
[YouTube demo](https://youtu.be/gMnGuDC9EQo?si=4HLZpkC4XWhh97uQ) of using Rolling Flaws application. The video shows how to use the application to simulate a receiver that has a Replay attack flaw, Pairing FZ to a receiver, Cloning sequence attack, Future attack, Rollback attack & KGB attack. The Rolling Flaws application also supports things like "ENC00" attack & window-next attacks, which are described in scenarios below but was not in video. Rolljam is discussed in document, but discouraged to test since it is [illegal to jam signals](https://www.fcc.gov/general/jammer-enforcement) in the US. If you have additional ideas, please let me know!
|
||||
|
||||
|
@ -8,5 +8,5 @@ App(
|
||||
fap_icon="rolling_flaws.png",
|
||||
fap_category="Sub-GHz",
|
||||
fap_icon_assets="assets",
|
||||
fap_description="Rolling code receiver (version 1.3), used to learn about rolling code flaws. Watch video at https://youtu.be/gMnGuDC9EQo",
|
||||
fap_description="Rolling code receiver (version 1.4), used to learn about rolling code flaws. Watch video at https://youtu.be/gMnGuDC9EQo",
|
||||
)
|
||||
|
@ -1,7 +1,7 @@
|
||||
#pragma once
|
||||
|
||||
#define ROLLING_FLAWS_ABOUT_TEXT \
|
||||
"Rolling code receiver\n version 1.3\n" \
|
||||
"Rolling code receiver\n version 1.4\n" \
|
||||
"---\n" \
|
||||
"Practice rolling code attacks without risking a desync!\n" \
|
||||
"This app is for educational\n" \
|
||||
|
@ -169,16 +169,28 @@ static bool is_open(RollingFlawsModel* model, KeeLoqData* data) {
|
||||
return false;
|
||||
}
|
||||
|
||||
uint32_t last_decode = 0;
|
||||
void decode_keeloq(RollingFlawsModel* model, FuriString* buffer, bool sync) {
|
||||
FURI_LOG_T(TAG, "Decoding KeeLoq 64bit");
|
||||
uint32_t now = furi_get_tick();
|
||||
if(now - last_decode < furi_ms_to_ticks(500)) {
|
||||
FURI_LOG_D(TAG, "Ignoring decode. Too soon.");
|
||||
last_decode = now;
|
||||
return;
|
||||
}
|
||||
last_decode = now;
|
||||
|
||||
KeeLoqData* data = keeloq_data_alloc();
|
||||
__furi_string_extract_string(buffer, 0, "MF:", '\r', data->mf);
|
||||
__furi_string_extract_string_until(buffer, 0, "MF:", '\r', data->mf);
|
||||
__furi_string_extract_string(buffer, 0, "Key:", '\r', model->key);
|
||||
|
||||
data->fix = __furi_string_extract_int(buffer, "Fix:0x", ' ', FAILED_TO_PARSE);
|
||||
data->hop = __furi_string_extract_int(buffer, "Hop:0x", ' ', FAILED_TO_PARSE);
|
||||
data->sn = __furi_string_extract_int(buffer, "Sn:0x", ' ', FAILED_TO_PARSE);
|
||||
if(data->sn == FAILED_TO_PARSE) {
|
||||
FURI_LOG_I(TAG, "Sn:0x not found. Using Fix data.");
|
||||
data->sn = data->fix & 0x0FFFFFFF;
|
||||
}
|
||||
data->btn = __furi_string_extract_int(buffer, "Btn:", '\r', FAILED_TO_PARSE);
|
||||
data->cnt = __furi_string_extract_int(buffer, "Cnt:", '\r', FAILED_TO_PARSE);
|
||||
// NOTE: "Enc:" needs to be added to "keeloq.c" subghz_protocol_decoder_keeloq_get_string() method.
|
||||
|
@ -27,6 +27,36 @@ size_t __furi_string_extract_string(
|
||||
return term;
|
||||
}
|
||||
|
||||
size_t __furi_string_extract_string_until(
|
||||
FuriString* buffer,
|
||||
size_t start_index,
|
||||
char* text,
|
||||
char delim,
|
||||
FuriString* result) {
|
||||
size_t len = strlen(text);
|
||||
size_t valid_index = furi_string_size(buffer) - 1;
|
||||
size_t field = furi_string_search_str(buffer, text, start_index) + len;
|
||||
size_t term = -1;
|
||||
if(field < valid_index) {
|
||||
term = furi_string_search_char(buffer, delim, field);
|
||||
if(term < valid_index) {
|
||||
furi_string_reset(result);
|
||||
furi_string_set_n(result, buffer, field, term - field);
|
||||
FURI_LOG_I(TAG, "%s data is >>%s<<", text, furi_string_get_cstr(result));
|
||||
} else {
|
||||
term = furi_string_size(buffer);
|
||||
furi_string_reset(result);
|
||||
furi_string_set_n(result, buffer, field, term - field);
|
||||
FURI_LOG_E(TAG, "Failed to find terminator for >>%s<<, using end of string", text);
|
||||
FURI_LOG_I(TAG, "%s data is >>%s<<", text, furi_string_get_cstr(result));
|
||||
}
|
||||
} else {
|
||||
FURI_LOG_E(TAG, "Failed to find >>%s<<", text);
|
||||
}
|
||||
|
||||
return term;
|
||||
}
|
||||
|
||||
uint32_t
|
||||
__furi_string_extract_int(FuriString* buffer, char* text, char delim, uint32_t default_value) {
|
||||
uint32_t value = default_value;
|
||||
|
@ -14,6 +14,13 @@ size_t __furi_string_extract_string(
|
||||
char delim,
|
||||
FuriString* result);
|
||||
|
||||
size_t __furi_string_extract_string_until(
|
||||
FuriString* buffer,
|
||||
size_t start_index,
|
||||
char* text,
|
||||
char until_delim,
|
||||
FuriString* result);
|
||||
|
||||
uint32_t
|
||||
__furi_string_extract_int(FuriString* buffer, char* text, char delim, uint32_t default_value);
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user