pwn 0.5.613 → 0.5.617

data/lib/pwn/sdr/decoder/base.rb

@@ -0,0 +1,251 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'open3'
+require 'tty-spinner'
+require 'tty-screen'
+require 'io/wait'
+
+module PWN
+  module SDR
+    module Decoder
+      # Shared pipeline plumbing for every PWN::SDR::Decoder::* module.
+      #
+      # Encapsulates the pattern established by PWN::SDR::Decoder::Flex and
+      # PWN::SDR::Decoder::RDS:
+      #
+      #   1. Bind to the GQRX UDP audio stream (48 kHz s16le mono).
+      #   2. Feed it through `sox` (resample to 22 050 Hz) into an external
+      #      demodulator (multimon-ng, rtl_433, acarsdec, dsd, ...).
+      #   3. Read decoded lines back on a background thread, hand each to a
+      #      caller-supplied parser Proc, merge with freq_obj, JSON-log it.
+      #   4. Show a TTY::Spinner status line and exit cleanly on [ENTER].
+      #
+      # Decoders whose external tool needs raw I/Q direct from the SDR (ADSB,
+      # GSM, LoRa, WiFi, ZigBee, ...) can instead pass `direct_cmd:` — Base
+      # will spawn it stand-alone (no UDP → sox bridge) and still handle the
+      # spinner / stdout parser / logging / [ENTER]-to-skip loop uniformly.
+      module Base
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Base.run_pipeline(
+        #   freq_obj:    'required - freq_obj Hash from PWN::SDR::GQRX.init_freq',
+        #   protocol:    'required - short name used in banner / log filename',
+        #   decode_cmd:  'optional - shell pipeline reading 22 050 Hz s16le on stdin',
+        #   direct_cmd:  'optional - stand-alone shell cmd (owns the SDR itself)',
+        #   line_match:  'optional - Regexp/String a stdout line must match',
+        #   parser:      'optional - Proc.new { |line| Hash } to structure a line',
+        #   required_bins: 'optional - Array of executables that must exist on PATH',
+        #   resample_hz: 'optional - sox output rate for decode_cmd (default 22050)'
+        # )
+
+        public_class_method def self.run_pipeline(opts = {})
+          freq_obj      = opts[:freq_obj]
+          protocol      = opts[:protocol] || 'SIGNAL'
+          decode_cmd    = opts[:decode_cmd]
+          direct_cmd    = opts[:direct_cmd]
+          line_match    = opts[:line_match]
+          parser        = opts[:parser]
+          required_bins = Array(opts[:required_bins])
+          resample_hz   = opts[:resample_hz] || 22_050
+
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          gqrx_sock = freq_obj[:gqrx_sock]
+          udp_ip    = freq_obj[:udp_ip]   || '127.0.0.1'
+          udp_port  = freq_obj[:udp_port] || 7355
+          freq_obj  = freq_obj.dup
+          freq_obj.delete(:gqrx_sock)
+          freq_obj.delete(:decoder_module)
+
+          skip_freq_char = "\n"
+
+          puts JSON.pretty_generate(freq_obj)
+          puts "\n*** #{protocol} Decoder ***"
+          puts 'Press [ENTER] to continue to next frequency...'
+
+          missing = required_bins.reject { |b| bin_available?(bin: b) }
+          unless missing.empty?
+            puts "[!] Missing required executable(s): #{missing.join(', ')}"
+            puts '    Install them and re-run, or press [ENTER] to skip.'
+          end
+
+          spinner = TTY::Spinner.new(
+            '[:spinner] :status',
+            format: :arrow_pulse,
+            clear: true,
+            hide_cursor: true
+          )
+          spinner_overhead = 12
+          max_title_length = [TTY::Screen.width - spinner_overhead, 50].max
+          banner = "INFO: Decoding #{protocol} on udp://#{udp_ip}:#{udp_port} ..."
+          banner = "INFO: Decoding #{protocol} via `#{direct_cmd.to_s.split.first}` ..." if direct_cmd
+          banner = banner[0...max_title_length] if banner.length > max_title_length
+          spinner.update(status: banner)
+          spinner.auto_spin
+
+          log_file = "/tmp/#{protocol.downcase.gsub(/[^a-z0-9]+/, '_')}_decoder_#{Time.now.strftime('%Y%m%d')}.log"
+
+          udp_listener = nil
+          receiver_thread = nil
+          mm_stdin = mm_stdout = mm_stderr = mm_wait_thr = nil
+
+          if direct_cmd && missing.empty?
+            mm_stdin, mm_stdout, mm_stderr, mm_wait_thr = Open3.popen3(direct_cmd)
+          elsif decode_cmd && missing.empty?
+            udp_listener = PWN::SDR::GQRX.listen_udp(udp_ip: udp_ip, udp_port: udp_port)
+
+            full_cmd = 'sox -t raw -e signed-integer -b 16 -r 48000 -c 1 - ' \
+                       "-t raw -e signed-integer -b 16 -r #{resample_hz} -c 1 - | #{decode_cmd}"
+            mm_stdin, mm_stdout, mm_stderr, mm_wait_thr = Open3.popen3(full_cmd)
+
+            receiver_thread = Thread.new do
+              loop do
+                data, = udp_listener.recv(4096)
+                next unless data.to_s.bytesize.positive?
+
+                mm_stdin.write(data)
+                begin
+                  mm_stdin.flush
+                rescue StandardError
+                  nil
+                end
+              end
+            rescue IOError, Errno::EPIPE, Errno::ECONNRESET
+              nil
+            end
+          end
+
+          current_title = 'Waiting for data frames...'
+          decoder_thread = nil
+          if mm_stdout
+            decoder_thread = Thread.new do
+              buffer = ''
+              loop do
+                chunk = mm_stdout.readpartial(4096)
+                buffer = "#{buffer}#{chunk}"
+                while (line = buffer.slice!(/^.*\n/))
+                  line = line.chomp
+                  next if line.empty?
+                  next if line_match && !match_line?(line: line, matcher: line_match)
+
+                  dec_msg = { decoded_at: Time.now.strftime('%Y-%m-%d %H:%M:%S%z'), raw: line }
+                  dec_msg.merge!(parser.call(line)) if parser.respond_to?(:call)
+                  final_msg = freq_obj.merge(dec_msg)
+
+                  spinner.stop
+                  puts JSON.pretty_generate(final_msg)
+                  spinner.auto_spin
+
+                  File.open(log_file, 'a') { |f| f.puts("#{JSON.generate(final_msg)},") }
+                  disp = dec_msg[:summary] || line
+                  current_title = disp[0...max_title_length]
+                end
+              rescue IOError
+                break
+              end
+            end
+          elsif gqrx_sock
+            # No external decoder — fall back to live signal-strength telemetry
+            decoder_thread = Thread.new do
+              loop do
+                lvl = PWN::SDR::GQRX.cmd(gqrx_sock: gqrx_sock, cmd: 'l STRENGTH').to_f
+                current_title = "signal #{format('%+.1f', lvl)} dBFS (analog / no external demod)"
+                sleep 0.3
+              end
+            rescue StandardError
+              nil
+            end
+          end
+
+          loop do
+            spinner.update(status: current_title)
+            next unless $stdin.wait_readable(0)
+
+            begin
+              char = $stdin.read_nonblock(1)
+              next unless char == skip_freq_char
+
+              puts "\n[!] ENTER pressed → stopping #{protocol} decoder..."
+              break
+            rescue IO::WaitReadable, EOFError
+              nil
+            end
+          end
+
+          spinner.success('Decoding stopped')
+        rescue StandardError => e
+          spinner.error("Decoding failed: #{e.message}") if defined?(spinner) && spinner
+          raise
+        ensure
+          [receiver_thread, decoder_thread].compact.each { |t| t.kill if t.alive? }
+          [mm_stdin, mm_stdout, mm_stderr].compact.each do |io|
+            io.close
+          rescue StandardError
+            nil
+          end
+          begin
+            mm_wait_thr&.value
+          rescue StandardError
+            nil
+          end
+          PWN::SDR::GQRX.disconnect_udp(udp_listener: udp_listener) if udp_listener
+          spinner.stop if defined?(spinner) && spinner
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Base.bin_available?(bin: 'multimon-ng')
+
+        public_class_method def self.bin_available?(opts = {})
+          bin = opts[:bin].to_s
+          return false if bin.empty?
+
+          ENV.fetch('PATH', '').split(File::PATH_SEPARATOR).any? do |dir|
+            File.executable?(File.join(dir, bin))
+          end
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Base.match_line?(line: str, matcher: Regexp|String|Array)
+
+        public_class_method def self.match_line?(opts = {})
+          line    = opts[:line].to_s
+          matcher = opts[:matcher]
+          case matcher
+          when Regexp then line.match?(matcher)
+          when String then line.start_with?(matcher)
+          when Array  then matcher.any? { |m| match_line?(line: line, matcher: m) }
+          else true
+          end
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.run_pipeline(
+              freq_obj:      'required - freq_obj from PWN::SDR::GQRX.init_freq',
+              protocol:      'required - short protocol name',
+              decode_cmd:    'optional - stdin pipeline (sox-resampled 22 050 Hz s16le)',
+              direct_cmd:    'optional - stand-alone cmd that owns the SDR',
+              line_match:    'optional - Regexp/String/Array line filter',
+              parser:        'optional - Proc { |line| Hash } structured extractor',
+              required_bins: 'optional - Array of executables that must be on PATH',
+              resample_hz:   'optional - sox output rate (default 22050)'
+            )
+
+            #{self}.bin_available?(bin: 'multimon-ng')
+            #{self}.match_line?(line: str, matcher: Regexp|String|Array)
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/gsm.rb

@@ -3,213 +3,112 @@
 module PWN
   module SDR
     module Decoder
-      # SDR Decoder for GSM signals.
+      # GSM (2G) broadcast-channel decoder.
+      #
+      # GSM is 270.833 kbit/s GMSK — it CANNOT be recovered from GQRX's 48 kHz
+      # demodulated-audio UDP tap. This module therefore drives the SDR
+      # directly via `grgsm_livemon_headless` (from gr-gsm) which publishes
+      # decoded Um bursts as GSMTAP on udp/4729, then reads them back with
+      # `tshark` for structured field extraction (MCC/MNC/LAC/CI/ARFCN, paging
+      # IMSIs/TMSIs, System Information messages, etc.).
+      #
+      # Interface matches PWN::SDR::Decoder::Flex / ::RDS so the GQRX
+      # dispatcher (`decoder: :gsm`) works uniformly.
       module GSM
-        POWER_THRESHOLD = 0.1
-        SLEEP_INTERVAL = 0.1
-        HEADER_SIZE = 44
-        BURST_DURATION_SEC = 0.000577
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::GSM.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
 
-        # TSC 0 binary sequence (26 bits): 00100101110000101010011011
-        TSC_0 = [0, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1].freeze
-
-        # Starts the live decoding thread.
-        public_class_method def self.start(opts = {})
-          freq_obj = opts[:freq_obj]
-          raise ':ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
-
-          gqrx_sock = freq_obj[:gqrx_sock]
-          freq = freq_obj[:freq]
-          bandwidth = freq_obj[:bandwidth].to_i
-          record_path = freq_obj[:record_path]
-
-          sleep 0.1 until File.exist?(record_path)
-
-          header = File.binread(record_path, HEADER_SIZE)
-          raise 'Invalid WAV header' unless header.start_with?('RIFF') && header.include?('WAVE')
-
-          bytes_read = HEADER_SIZE
-
-          puts "GSM Decoder started for freq: #{freq}, bandwidth: #{bandwidth}"
-
-          Thread.new do
-            loop do
-              current_size = File.size(record_path)
-              if current_size > bytes_read
-                new_bytes = current_size - bytes_read
-                # Ensure full I/Q pairs (8 bytes)
-                new_bytes -= new_bytes % 8
-                data = File.binread(record_path, new_bytes, bytes_read)
-                process_chunk(
-                  data: data,
-                  bandwidth: bandwidth,
-                  freq: freq
-                )
-                bytes_read = current_size
-              end
-
-              sleep SLEEP_INTERVAL
-            end
-          rescue StandardError => e
-            puts "Decoder error: #{e.message}"
-          ensure
-            cleanup(record_path: record_path)
-          end
-        end
-
-        # Stops the decoding thread.
-        public_class_method def self.stop(opts = {})
+        public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
           raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
 
-          decoder_thread = freq_obj[:decoder_thread]
-          decoder_thread.kill if decoder_thread.is_a?(Thread)
+          hz   = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          gain = (freq_obj[:rf_gain] || 40).to_s.to_f
+
+          tshark_fields = %w[
+            frame.time
+            gsmtap.arfcn
+            gsmtap.chan_type
+            gsm_a.imsi
+            gsm_a.tmsi
+            e212.mcc
+            e212.mnc
+            gsm_a.lac
+            gsm_a.bssmap.cell_ci
+            gsm_a.dtap.msg_rr_type
+          ]
+
+          direct_cmd = "sh -c 'grgsm_livemon_headless -f #{hz} -g #{gain} >/dev/null 2>&1 & " \
+                       'LMPID=$!; trap "kill $LMPID 2>/dev/null" EXIT; sleep 2; ' \
+                       'tshark -i lo -l -Y gsmtap -T fields -E separator=\| ' \
+                       "#{tshark_fields.map { |f| "-e #{f}" }.join(' ')}'"
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'GSM',
+            required_bins: %w[grgsm_livemon_headless tshark],
+            direct_cmd: direct_cmd,
+            line_match: /\S/,
+            parser: proc { |line| parse_line(line: line) }
+          )
         end
 
-        class << self
-          private
-
-          def process_chunk(opts = {})
-            data = opts[:data]
-            bandwidth = opts[:bandwidth]
-            freq = opts[:freq]
-            raise ':ERROR: :data, :bandwidth, and :freq are required' unless data && bandwidth && freq
-
-            samples = data.unpack('f< *')
-            return if samples.length.odd? # Skip incomplete
-
-            complex_samples = []
-            (0...samples.length).step(2) do |i|
-              complex_samples << Complex(samples[i], samples[i + 1])
-            end
-
-            window_size = [(bandwidth * BURST_DURATION_SEC).round, complex_samples.length].min
-            return if window_size <= 0
-
-            # Simplified power on sliding windows
-            powers = []
-            complex_samples.each_cons(window_size) do |window|
-              power = window.map { |c| c.abs**2 }.sum / window_size
-              powers << power
-            end
-
-            max_power = powers.max
-            return unless max_power > POWER_THRESHOLD
-
-            # Demod the entire chunk (assume burst-aligned roughly)
-            bits = demod_gmsk(complex_samples)
-            # Synchronize via TSC correlation
-            sync_offset = find_tsc_offset(bits, TSC_0)
-            return unless sync_offset >= 0
-
-            # Extract data bits from normal burst structure
-            burst_start = sync_offset - 58 # TSC starts at symbol 58 (0-index)
-            return unless burst_start >= 0 && burst_start + 148 <= bits.length
-
-            data_bits = extract_data_bits(bits, burst_start)
-            puts "Burst synchronized at offset #{sync_offset} for #{freq} Hz (power: #{max_power.round(4)})"
-            decode_imsi(
-              data_bits: data_bits,
-              freq: freq
-            )
-          end
-
-          def demod_gmsk(complex_samples)
-            return [] if complex_samples.length < 2
-
-            bits = []
-            (1...complex_samples.length).each do |i|
-              prod = complex_samples[i] * complex_samples[i - 1].conj
-              # Sign of imaginary part for quadrature differential
-              bit = (prod.imag >= 0 ? 0 : 1) # Or adjust polarity
-              bits << bit
-            end
-            bits
-          end
-
-          def find_tsc_offset(bits, tsc)
-            max_corr = -1
-            best_offset = -1
-            tsc_length = tsc.length # 26
-            (0...(bits.length - tsc_length + 1)).each do |offset|
-              window = bits[offset, tsc_length]
-              corr = window.zip(tsc).count { |b1, b2| b1 == b2 }
-              if corr > max_corr
-                max_corr = corr
-                best_offset = offset
-              end
-            end
-            # Threshold: e.g., >20 matches for good sync
-            max_corr > 20 ? best_offset : -1
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::GSM.parse_line(line: 'ts|arfcn|chan|imsi|tmsi|mcc|mnc|lac|ci|rr')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          f = line.split('|', -1)
+          out = {
+            protocol: 'GSM',
+            arfcn: f[1],
+            chan_type: f[2],
+            imsi: f[3],
+            tmsi: f[4],
+            mcc: f[5],
+            mnc: f[6],
+            lac: f[7],
+            cell_id: f[8],
+            rr_msg_type: f[9]
+          }.reject { |_, v| v.to_s.empty? }
+
+          if out[:imsi].to_s.length.between?(14, 16)
+            out[:imsi_mcc]  = out[:imsi][0, 3]
+            out[:imsi_mnc]  = out[:imsi][3, 3]
+            out[:imsi_msin] = out[:imsi][6..]
           end
 
-          # Extract 114 data bits from normal burst (ignoring tails/guard)
-          def extract_data_bits(bits, burst_start)
-            data1_start = burst_start + 2
-            data2_start = burst_start + 88 # After TSC 26 + data1 57 = 85, +3? Wait, structure: tail2(0-1), data(2-58), tsc(59-84), data(85-141), tail(142-143)
-            data1 = bits[data1_start, 57]
-            data2 = bits[data2_start, 57]
-            data1 + data2
-          end
-
-          def decode_imsi(opts = {})
-            data_bits = opts[:data_bits]
-            freq = opts[:freq]
-            raise ':ERROR: :data_bits and :freq are required' unless data_bits && freq
-
-            # Simplified "IMSI extraction": Interpret first ~60 bits as packed digits (4 bits per digit, BCD-like).
-            # In reality: Deinterleave (over bursts), Viterbi decode convolutional code (polys G0=10011b, G1=11011b),
-            # CRC check, parse L3 message (e.g., Paging Req Type 1 has IMSI IE at specific offset, packed BCD).
-            # Here: Raw data bits to 15-digit IMSI (first 60 bits -> 15 nibbles).
-            return unless data_bits.length >= 60
-
-            imsi_digits = []
-            data_bits[0, 60].each_slice(4) do |nibble|
-              digit = nibble.join.to_i(2)
-              imsi_digits << (digit % 10) # Mod 10 for digit-like, or keep as is for hex
-            end
-
-            # Format as 3(MCC)+3(MNC)+9(MSIN)
-            mcc = imsi_digits[0, 3].join
-            mnc = imsi_digits[3, 3].join
-            msin = imsi_digits[6, 9].join
-            imsi = "#{mcc.ljust(3, '0')}#{mnc.ljust(3, '0')}#{msin.ljust(9, '0')}"
-
-            puts "Decoded IMSI: #{imsi} at #{freq} Hz"
-            # TODO: Integrate full L3 parser (e.g., from ruby-gsm gem or custom).
-          end
-
-          def cleanup(opts = {})
-            record_path = opts[:record_path]
-            raise ':ERROR: :record_path is required' unless record_path
-
-            return unless File.exist?(record_path)
-
-            File.delete(record_path)
-            puts "Cleaned up recording: #{record_path}"
-          end
+          summary_bits = []
+          summary_bits << "ARFCN=#{out[:arfcn]}" if out[:arfcn]
+          summary_bits << "MCC/MNC=#{out[:mcc]}/#{out[:mnc]}" if out[:mcc]
+          summary_bits << "LAC=#{out[:lac]} CI=#{out[:cell_id]}" if out[:lac]
+          summary_bits << "IMSI=#{out[:imsi]}" if out[:imsi]
+          summary_bits << "TMSI=#{out[:tmsi]}" if out[:tmsi]
+          out[:summary] = "GSM #{summary_bits.join(' ')}".strip
+          out
         end
 
         # Author(s):: 0day Inc. <support@0dayinc.com>
 
         public_class_method def self.authors
-          "AUTHOR(S):
-            0day Inc. <support@0dayinc.com>
-          "
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
 
         # Display Usage for this Module
 
         public_class_method def self.help
           puts "USAGE:
-            gsm_decoder_thread = PWN::SDR::Decoder::GSM.start(
-              freq_obj: 'required - freq_obj returned from PWN::SDR::Receiver::GQRX.init_freq method'
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
             )
 
-            # To stop the decoder thread:
-            PWN::SDR::Decoder::GSM.stop(
-              freq_obj: 'required - freq_obj returned from PWN::SDR::Receiver::GQRX.init_freq method'
-            )
+            NOTE: Requires `grgsm_livemon_headless` (gr-gsm) and `tshark`.
+                  GSM cannot be decoded from GQRX's 48 kHz audio tap; this
+                  module drives the SDR directly and reads GSMTAP on lo:4729.
+
+            #{self}.parse_line(line: 'ts|arfcn|chan|imsi|tmsi|mcc|mnc|lac|ci|rr')
 
             #{self}.authors
           "