bug fixes (see changelog)

This commit is contained in:
Derek Jamison 2023-09-02 22:08:39 -05:00
parent 99e76d6214
commit 31fbce8209
9 changed files with 63 additions and 5 deletions

View File

@ -1,6 +1,6 @@
# Rolling Flaws
Rolling Flaws (version 1.3) by [@CodeAllNight](https://twitter.com/codeallnight).
Rolling Flaws (version 1.4) by [@CodeAllNight](https://twitter.com/codeallnight).
[YouTube demo](https://youtu.be/gMnGuDC9EQo?si=4HLZpkC4XWhh97uQ) of using Rolling Flaws application. The video shows how to use the application to simulate a receiver that has a Replay attack flaw, Pairing FZ to a receiver, Cloning sequence attack, Future attack, Rollback attack & KGB attack. The Rolling Flaws application also supports things like "ENC00" attack & window-next attacks, which are described in scenarios below but was not in video. Rolljam is discussed in document, but discouraged to test since it is [illegal to jam signals](https://www.fcc.gov/general/jammer-enforcement) in the US. If you have additional ideas, please let me know!

Binary file not shown.

Before

Width:  |  Height:  |  Size: 2.1 KiB

After

Width:  |  Height:  |  Size: 2.1 KiB

View File

@ -2,6 +2,15 @@
This file contains all changelogs for latest releases, from 1.3 onward.
## v1.4
### Fixed
If received signal is less than 500ms from last decoded signal, we ignore it now. In the future, we can consider checking the "Key" to see if something in the signal changed, but for now, we just ignore it.
In some firmware, the MF fails to parse because it is mising a \n at the end of the file. This is now fixed.
In some firmware, the SN fails to parse because it is mising from keeloq.c; the application will now use Fix data in that case.
## v1.3
### Added

View File

@ -1,6 +1,6 @@
# Rolling Flaws
Rolling Flaws (version 1.3) by [@CodeAllNight](https://twitter.com/codeallnight).
Rolling Flaws (version 1.4) by [@CodeAllNight](https://twitter.com/codeallnight).
[YouTube demo](https://youtu.be/gMnGuDC9EQo?si=4HLZpkC4XWhh97uQ) of using Rolling Flaws application. The video shows how to use the application to simulate a receiver that has a Replay attack flaw, Pairing FZ to a receiver, Cloning sequence attack, Future attack, Rollback attack & KGB attack. The Rolling Flaws application also supports things like "ENC00" attack & window-next attacks, which are described in scenarios below but was not in video. Rolljam is discussed in document, but discouraged to test since it is [illegal to jam signals](https://www.fcc.gov/general/jammer-enforcement) in the US. If you have additional ideas, please let me know!

View File

@ -8,5 +8,5 @@ App(
fap_icon="rolling_flaws.png",
fap_category="Sub-GHz",
fap_icon_assets="assets",
fap_description="Rolling code receiver (version 1.3), used to learn about rolling code flaws. Watch video at https://youtu.be/gMnGuDC9EQo",
fap_description="Rolling code receiver (version 1.4), used to learn about rolling code flaws. Watch video at https://youtu.be/gMnGuDC9EQo",
)

View File

@ -1,7 +1,7 @@
#pragma once
#define ROLLING_FLAWS_ABOUT_TEXT \
"Rolling code receiver\n version 1.3\n" \
"Rolling code receiver\n version 1.4\n" \
"---\n" \
"Practice rolling code attacks without risking a desync!\n" \
"This app is for educational\n" \

View File

@ -169,16 +169,28 @@ static bool is_open(RollingFlawsModel* model, KeeLoqData* data) {
return false;
}
uint32_t last_decode = 0;
void decode_keeloq(RollingFlawsModel* model, FuriString* buffer, bool sync) {
FURI_LOG_T(TAG, "Decoding KeeLoq 64bit");
uint32_t now = furi_get_tick();
if(now - last_decode < furi_ms_to_ticks(500)) {
FURI_LOG_D(TAG, "Ignoring decode. Too soon.");
last_decode = now;
return;
}
last_decode = now;
KeeLoqData* data = keeloq_data_alloc();
__furi_string_extract_string(buffer, 0, "MF:", '\r', data->mf);
__furi_string_extract_string_until(buffer, 0, "MF:", '\r', data->mf);
__furi_string_extract_string(buffer, 0, "Key:", '\r', model->key);
data->fix = __furi_string_extract_int(buffer, "Fix:0x", ' ', FAILED_TO_PARSE);
data->hop = __furi_string_extract_int(buffer, "Hop:0x", ' ', FAILED_TO_PARSE);
data->sn = __furi_string_extract_int(buffer, "Sn:0x", ' ', FAILED_TO_PARSE);
if(data->sn == FAILED_TO_PARSE) {
FURI_LOG_I(TAG, "Sn:0x not found. Using Fix data.");
data->sn = data->fix & 0x0FFFFFFF;
}
data->btn = __furi_string_extract_int(buffer, "Btn:", '\r', FAILED_TO_PARSE);
data->cnt = __furi_string_extract_int(buffer, "Cnt:", '\r', FAILED_TO_PARSE);
// NOTE: "Enc:" needs to be added to "keeloq.c" subghz_protocol_decoder_keeloq_get_string() method.

View File

@ -27,6 +27,36 @@ size_t __furi_string_extract_string(
return term;
}
size_t __furi_string_extract_string_until(
FuriString* buffer,
size_t start_index,
char* text,
char delim,
FuriString* result) {
size_t len = strlen(text);
size_t valid_index = furi_string_size(buffer) - 1;
size_t field = furi_string_search_str(buffer, text, start_index) + len;
size_t term = -1;
if(field < valid_index) {
term = furi_string_search_char(buffer, delim, field);
if(term < valid_index) {
furi_string_reset(result);
furi_string_set_n(result, buffer, field, term - field);
FURI_LOG_I(TAG, "%s data is >>%s<<", text, furi_string_get_cstr(result));
} else {
term = furi_string_size(buffer);
furi_string_reset(result);
furi_string_set_n(result, buffer, field, term - field);
FURI_LOG_E(TAG, "Failed to find terminator for >>%s<<, using end of string", text);
FURI_LOG_I(TAG, "%s data is >>%s<<", text, furi_string_get_cstr(result));
}
} else {
FURI_LOG_E(TAG, "Failed to find >>%s<<", text);
}
return term;
}
uint32_t
__furi_string_extract_int(FuriString* buffer, char* text, char delim, uint32_t default_value) {
uint32_t value = default_value;

View File

@ -14,6 +14,13 @@ size_t __furi_string_extract_string(
char delim,
FuriString* result);
size_t __furi_string_extract_string_until(
FuriString* buffer,
size_t start_index,
char* text,
char until_delim,
FuriString* result);
uint32_t
__furi_string_extract_int(FuriString* buffer, char* text, char delim, uint32_t default_value);