pwn 0.5.505 → 0.5.507

data/lib/pwn/sdr/decoder/gsm.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # SDR Decoder for GSM signals.
+      module GSM
+        POWER_THRESHOLD = 0.1
+        SLEEP_INTERVAL = 0.1
+        HEADER_SIZE = 44
+        BURST_DURATION_SEC = 0.000577
+
+        # TSC 0 binary sequence (26 bits): 00100101110000101010011011
+        TSC_0 = [0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1].freeze
+
+        # Starts the live decoding thread.
+        def self.start(opts = {})
+          gqrx_obj = opts[:gqrx_obj]
+          raise ':ERROR: :gqrx_obj is required' unless gqrx_obj.is_a?(Hash)
+
+          record_path = gqrx_obj[:record_path]
+          frequency = gqrx_obj[:frequency]
+          sample_rate = gqrx_obj[:bandwidth].to_i
+          gqrx_sock = gqrx_obj[:gqrx_sock]
+
+          gqrx_obj[:decoder_stop_flag] ||= [false]
+
+          sleep 0.1 until File.exist?(record_path)
+
+          header = File.binread(record_path, HEADER_SIZE)
+          raise 'Invalid WAV header' unless header.start_with?('RIFF') && header.include?('WAVE')
+
+          bytes_read = HEADER_SIZE
+
+          puts "GSM Decoder started for frequency: #{frequency}, sample_rate: #{sample_rate}"
+
+          Thread.new do
+            loop do
+              break if gqrx_obj[:decoder_stop_flag][0]
+
+              current_size = File.size(record_path)
+              if current_size > bytes_read
+                new_bytes = current_size - bytes_read
+                # Ensure full I/Q pairs (8 bytes)
+                new_bytes -= new_bytes % 8
+                data = File.binread(record_path, new_bytes, bytes_read)
+                process_chunk(
+                  data: data,
+                  sample_rate: sample_rate,
+                  frequency: frequency
+                )
+                bytes_read = current_size
+              end
+
+              sleep SLEEP_INTERVAL
+            end
+          rescue StandardError => e
+            puts "Decoder error: #{e.message}"
+          ensure
+            cleanup(record_path: record_path)
+          end
+        end
+
+        # Stops the decoding thread.
+        def self.stop(opts = {})
+          thread = opts[:thread]
+          gqrx_obj = opts[:gqrx_obj]
+          raise ':ERROR: :thread and :gqrx_obj are required' unless thread && gqrx_obj.is_a?(Hash)
+
+          gqrx_obj[:decoder_stop_flag][0] = true
+          thread.join(1.0)
+        end
+
+        class << self
+          private
+
+          def process_chunk(opts = {})
+            data = opts[:data]
+            sample_rate = opts[:sample_rate]
+            frequency = opts[:frequency]
+            raise ':ERROR: :data, :sample_rate, and :frequency are required' unless data && sample_rate && frequency
+
+            samples = data.unpack('f< *')
+            return if samples.length.odd? # Skip incomplete
+
+            complex_samples = []
+            (0...samples.length).step(2) do |i|
+              complex_samples << Complex(samples[i], samples[i + 1])
+            end
+
+            window_size = [(sample_rate * BURST_DURATION_SEC).round, complex_samples.length].min
+            return if window_size <= 0
+
+            # Simplified power on sliding windows
+            powers = []
+            complex_samples.each_cons(window_size) do |window|
+              power = window.map { |c| c.abs**2 }.sum / window_size
+              powers << power
+            end
+
+            max_power = powers.max
+            return unless max_power > POWER_THRESHOLD
+
+            # Demod the entire chunk (assume burst-aligned roughly)
+            bits = demod_gmsk(complex_samples)
+            # Synchronize via TSC correlation
+            sync_offset = find_tsc_offset(bits, TSC_0)
+            return unless sync_offset >= 0
+
+            # Extract data bits from normal burst structure
+            burst_start = sync_offset - 58 # TSC starts at symbol 58 (0-index)
+            return unless burst_start >= 0 && burst_start + 148 <= bits.length
+
+            data_bits = extract_data_bits(bits, burst_start)
+            puts "Burst synchronized at offset #{sync_offset} for #{frequency} Hz (power: #{max_power.round(4)})"
+            decode_imsi(
+              data_bits: data_bits,
+              frequency: frequency
+            )
+          end
+
+          def demod_gmsk(complex_samples)
+            return [] if complex_samples.length < 2
+
+            bits = []
+            (1...complex_samples.length).each do |i|
+              prod = complex_samples[i] * complex_samples[i - 1].conj
+              # Sign of imaginary part for quadrature differential
+              bit = (prod.imag >= 0 ? 0 : 1) # Or adjust polarity
+              bits << bit
+            end
+            bits
+          end
+
+          def find_tsc_offset(bits, tsc)
+            max_corr = -1
+            best_offset = -1
+            tsc_length = tsc.length # 26
+            (0...(bits.length - tsc_length + 1)).each do |offset|
+              window = bits[offset, tsc_length]
+              corr = window.zip(tsc).count { |b1, b2| b1 == b2 }
+              if corr > max_corr
+                max_corr = corr
+                best_offset = offset
+              end
+            end
+            # Threshold: e.g., >20 matches for good sync
+            max_corr > 20 ? best_offset : -1
+          end
+
+          # Extract 114 data bits from normal burst (ignoring tails/guard)
+          def extract_data_bits(bits, burst_start)
+            data1_start = burst_start + 2
+            data2_start = burst_start + 88 # After TSC 26 + data1 57 = 85, +3? Wait, structure: tail2(0-1), data(2-58), tsc(59-84), data(85-141), tail(142-143)
+            data1 = bits[data1_start, 57]
+            data2 = bits[data2_start, 57]
+            data1 + data2
+          end
+
+          def decode_imsi(opts = {})
+            data_bits = opts[:data_bits]
+            frequency = opts[:frequency]
+            raise ':ERROR: :data_bits and :frequency are required' unless data_bits && frequency
+
+            # Simplified "IMSI extraction": Interpret first ~60 bits as packed digits (4 bits per digit, BCD-like).
+            # In reality: Deinterleave (over bursts), Viterbi decode convolutional code (polys G0=10011b, G1=11011b),
+            # CRC check, parse L3 message (e.g., Paging Req Type 1 has IMSI IE at specific offset, packed BCD).
+            # Here: Raw data bits to 15-digit IMSI (first 60 bits -> 15 nibbles).
+            return unless data_bits.length >= 60
+
+            imsi_digits = []
+            data_bits[0, 60].each_slice(4) do |nibble|
+              digit = nibble.join.to_i(2)
+              imsi_digits << (digit % 10) # Mod 10 for digit-like, or keep as is for hex
+            end
+
+            # Format as 3(MCC)+3(MNC)+9(MSIN)
+            mcc = imsi_digits[0, 3].join
+            mnc = imsi_digits[3, 3].join
+            msin = imsi_digits[6, 9].join
+            imsi = "#{mcc.ljust(3, '0')}#{mnc.ljust(3, '0')}#{msin.ljust(9, '0')}"
+
+            puts "Decoded IMSI: #{imsi} at #{frequency} Hz"
+            # TODO: Integrate full L3 parser (e.g., from ruby-gsm gem or custom).
+          end
+
+          def cleanup(opts = {})
+            record_path = opts[:record_path]
+            raise ':ERROR: :record_path is required' unless record_path
+
+            return unless File.exist?(record_path)
+
+            File.delete(record_path)
+            puts "Cleaned up recording: #{record_path}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module PWN
+  # This file, using the autoload directive loads SDR modules
+  # into memory only when they're needed. For more information, see:
+  # http://www.rubyinside.com/ruby-techniques-revealed-autoload-1652.html
+  module SDR
+    # Deocder Module for SDR signals.
+    module Decoder
+      autoload :GSM, 'pwn/sdr/decoder/gsm'
+
+      # Display a List of Every PWN::AI Module
+
+      public_class_method def self.help
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/{plugins → sdr}/flipper_zero.rb

@@ -1,13 +1,13 @@
 # frozen_string_literal: true
 
 module PWN
-  module Plugins
+  module SDR
     # This plugin is used for interacting with Bus Pirate v3.6
     # This plugin may be compatible with other versions, however,
     # has not been tested with anything other than v3.6.
     module FlipperZero
       # Supported Method Parameters::
-      # PWN::Plugins::FlipperZero.connect_via_screen(
+      # PWN::SDR::FlipperZero.connect_via_screen(
       #   block_dev: 'optional - serial block device path (defaults to /dev/ttyACM0)'
       # )
 
@@ -34,7 +34,7 @@ module PWN
       end
 
       # Supported Method Parameters::
-      # flipper_zero_obj = PWN::Plugins::FlipperZero.connect(
+      # flipper_zero_obj = PWN::SDR::FlipperZero.connect(
       #   block_dev: 'optional serial block device path (defaults to /dev/ttyACM0)',
       #   baud: 'optional (defaults to 9600)',
       #   data_bits: 'optional (defaults to 8)',
@@ -50,7 +50,7 @@ module PWN
       end
 
       # Supported Method Parameters::
-      # response = PWN::Plugins::FlipperZero.request(
+      # response = PWN::SDR::FlipperZero.request(
       #   flipper_zero_obj: 'required - flipper_zero_obj returned from #connect method',
       #   payload: 'optional - payload to send to the device (defaults to help)'
       # )
@@ -75,7 +75,7 @@ module PWN
       end
 
       # Supported Method Parameters::
-      # PWN::Plugins::FlipperZero.disconnect(
+      # PWN::SDR::FlipperZero.disconnect(
       #   flipper_zero_obj: 'required - flipper_zero_obj returned from #connect method'
       # )
 

data/lib/pwn/sdr/frequency_allocation.rb

@@ -0,0 +1,372 @@
+# frozen_string_literal: true
+
+require 'open3'
+require 'json'
+require 'fileutils'
+
+module PWN
+  module SDR
+    # This plugin interacts with the remote control interface of GQRX.
+    module FrequencyAllocation
+      # Supported Method Parameters::
+      # profiles = PWN::SDR::FrequencyAllocation.profiles
+      # Supported Method Parameters::
+      # profiles = PWN::SDR::FrequencyAllocation.profiles
+      public_class_method def self.profiles
+        # TODO: Wifi5 / Wifi6 profiles,
+        # migrate to a YAML file, and add
+        # rSpec test to ensure all profiles
+        # contain consistent key-value pairs
+        {
+          ads_b978: {
+            start_freq: '978.000.000',
+            target_freq: '979.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 100_000,
+            precision: 5
+          },
+          ads_b1090: {
+            start_freq: '1.090.000.000',
+            target_freq: '1.091.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 100_000,
+            precision: 5
+          },
+          analog_tv_vhf: {
+            start_freq: '54.000.000',
+            target_freq: '216.000.000',
+            demodulator_mode: 'WFM',
+            bandwidth: 600_000,
+            precision: 5
+          },
+          analog_tv_uhf: {
+            start_freq: '470.000.000',
+            target_freq: '890.000.000',
+            demodulator_mode: 'WFM',
+            bandwidth: 600_000,
+            precision: 5
+          },
+          am_radio: {
+            start_freq: '540.000',
+            target_freq: '1.700.000',
+            demodulator_mode: 'AM',
+            bandwidth: 10_000,
+            precision: 4
+          },
+          bluetooth: {
+            start_freq: '2.402.000.000',
+            target_freq: '2.480.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 100_000,
+            precision: 5
+          },
+          cdma: {
+            start_freq: '824.000.000',
+            target_freq: '849.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 125_000,
+            precision: 6
+          },
+          cw20: {
+            start_freq: '14.000.000',
+            target_freq: '14.350.000',
+            demodulator_mode: 'CW',
+            bandwidth: 150,
+            precision: 3
+          },
+          cw40: {
+            start_freq: '7.000.000',
+            target_freq: '7.300.000',
+            demodulator_mode: 'CW',
+            bandwidth: 150,
+            precision: 3
+          },
+          cw80: {
+            start_freq: '3.500.000',
+            target_freq: '3.800.000',
+            demodulator_mode: 'CW',
+            bandwidth: 150,
+            precision: 3
+          },
+          fm_radio: {
+            start_freq: '87.900.000',
+            target_freq: '108.000.000',
+            demodulator_mode: 'WFM',
+            bandwidth: 200_000,
+            precision: 6
+          },
+          frs: {
+            start_freq: '462.562.500',
+            target_freq: '467.725.000',
+            demodulator_mode: 'FM',
+            bandwidth: 200_000,
+            precision: 3
+          },
+          gmrs: {
+            start_freq: '462.550.000',
+            target_freq: '467.725.000',
+            demodulator_mode: 'FM',
+            bandwidth: 200_000,
+            precision: 3
+          },
+          gprs: {
+            start_freq: '880.000.000',
+            target_freq: '915.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 200_000,
+            precision: 4
+          },
+          gps_l1: {
+            start_freq: '1.574.420.000',
+            target_freq: '1.576.420.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 200_000,
+            precision: 6
+          },
+          gps_l2: {
+            start_freq: '1.226.600.000',
+            target_freq: '1.228.600.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 200_000,
+            precision: 6
+          },
+          gsm: {
+            start_freq: '824.000.000',
+            target_freq: '894.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 200_000,
+            precision: 4
+          },
+          high_rfid: {
+            start_freq: '13.560.000',
+            target_freq: '13.570.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 200_000,
+            precision: 3
+          },
+          lora433: {
+            start_freq: '432.000.000',
+            target_freq: '434.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 50_000,
+            precision: 3
+          },
+          lora915: {
+            start_freq: '902.000.000',
+            target_freq: '928.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 50_000,
+            precision: 3
+          },
+          low_rfid: {
+            start_freq: '125.000',
+            target_freq: '134.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 200_000,
+            precision: 1
+          },
+          keyfob300: {
+            start_freq: '300.000.000',
+            target_freq: '300.100.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 50_000,
+            precision: 4
+          },
+          keyfob310: {
+            start_freq: '310.000.000',
+            target_freq: '310.100.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 50_000,
+            precision: 4
+          },
+          keyfob315: {
+            start_freq: '315.000.000',
+            target_freq: '315.100.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 50_000,
+            precision: 4
+          },
+          keyfob390: {
+            start_freq: '390.000.000',
+            target_freq: '390.100.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 50_000,
+            precision: 4
+          },
+          keyfob433: {
+            start_freq: '433.000.000',
+            target_freq: '434.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 50_000,
+            precision: 4
+          },
+          keyfob868: {
+            start_freq: '868.000.000',
+            target_freq: '869.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 50_000,
+            precision: 4
+          },
+          rtty20: {
+            start_freq: '14.000.000',
+            target_freq: '14.350.000',
+            demodulator_mode: 'RTTY',
+            bandwidth: 170,
+            precision: 3
+          },
+          rtty40: {
+            start_freq: '7.000.000',
+            target_freq: '7.300.000',
+            demodulator_mode: 'RTTY',
+            bandwidth: 170,
+            precision: 3
+          },
+          rtty80: {
+            start_freq: '3.500.000',
+            target_freq: '3.800.000',
+            demodulator_mode: 'RTTY',
+            bandwidth: 170,
+            precision: 3
+          },
+          ssb10: {
+            start_freq: '28.000.000',
+            target_freq: '29.700.000',
+            demodulator_mode: 'USB',
+            bandwidth: 2_700,
+            precision: 6
+          },
+          ssb12: {
+            start_freq: '24.890.000',
+            target_freq: '24.990.000',
+            demodulator_mode: 'USB',
+            bandwidth: 2_700,
+            precision: 6
+          },
+          ssb15: {
+            start_freq: '21.000.000',
+            target_freq: '21.450.000',
+            demodulator_mode: 'USB',
+            bandwidth: 2_700,
+            precision: 6
+          },
+          ssb17: {
+            start_freq: '18.068.000',
+            target_freq: '18.168.000',
+            demodulator_mode: 'USB',
+            bandwidth: 2_700,
+            precision: 6
+          },
+          ssb20: {
+            start_freq: '14.000.000',
+            target_freq: '14.350.000',
+            demodulator_mode: 'USB',
+            bandwidth: 2_700,
+            precision: 6
+          },
+          ssb40: {
+            start_freq: '7.000.000',
+            target_freq: '7.300.000',
+            demodulator_mode: 'LSB',
+            bandwidth: 2_700,
+            precision: 6
+          },
+          ssb80: {
+            start_freq: '3.500.000',
+            target_freq: '3.800.000',
+            demodulator_mode: 'LSB',
+            bandwidth: 2_700,
+            precision: 6
+          },
+          ssb160: {
+            start_freq: '1.800.000',
+            target_freq: '2.000.000',
+            demodulator_mode: 'LSB',
+            bandwidth: 2_700,
+            precision: 6
+          },
+          tempest: {
+            start_freq: '400.000.000',
+            target_freq: '430.000.000',
+            demodulator_mode: 'WFM',
+            bandwidth: 200_000,
+            precision: 4
+          },
+          uhf_rfid: {
+            start_freq: '860.000.000',
+            target_freq: '960.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 100_000,
+            precision: 5
+          },
+          wifi24: {
+            start_freq: '2.400.000.000',
+            target_freq: '2.500.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 200_000,
+            precision: 7
+          },
+          wifi5: {
+            start_freq: '5.150.000.000',
+            target_freq: '5.850.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 200_000,
+            precision: 7
+          },
+          wifi6: {
+            start_freq: '5.925.000.000',
+            target_freq: '7.125.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 200_000,
+            precision: 7
+          },
+          zigbee: {
+            start_freq: '2.405.000.000',
+            target_freq: '2.485.000.000',
+            demodulator_mode: 'RAW',
+            bandwidth: 200_000,
+            precision: 7
+          }
+        }
+      rescue StandardError => e
+        raise e
+      end
+
+      # Supported Method Parameters::
+      # opts = PWN::SDR::FrequencyAllocation.load(
+      #   profile: 'required - valid FrequencyAllocation profile name returned from #profiles method'
+      # )
+      public_class_method def self.load(opts = {})
+        profile = opts[:profile]&.to_sym
+
+        profiles_available = profiles
+        raise "ERROR: Invalid profile: #{profile}" unless profiles_available.key?(profile)
+
+        profiles_available[profile]
+      rescue StandardError => e
+        raise e
+      end
+
+      # Author(s):: 0day Inc. <support@0dayinc.com>
+
+      public_class_method def self.authors
+        "AUTHOR(S):
+          0day Inc. <support@0dayinc.com>
+        "
+      end
+
+      # Display Usage for this Module
+
+      public_class_method def self.help
+        puts "USAGE:
+          profiles = #{self}.profiles
+
+          opts = #{self}.load(
+            profile: 'required - valid frequency allocation profile name returned from #profiles method'
+          )
+
+          #{self}.authors
+        "
+      end
+    end
+  end
+end