pwn 0.5.617 → 0.5.620

data/lib/pwn/sdr/decoder/wifi.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # 802.11 (WiFi) beacon/probe decoder for the 2.4 / 5 / 6 GHz bands.
+      #
+      # 20+ MHz OFDM cannot be recovered from a general-purpose SDR at
+      # bit-level in real time, so this module drives an existing monitor-mode
+      # NIC via `tshark` (or `airodump-ng`) instead — freq_obj[:mon_iface]
+      # selects the interface, freq_obj[:freq] is mapped to a WLAN channel.
+      module WiFi
+        TSHARK_FIELDS = %w[
+          frame.time_relative
+          wlan.fc.type_subtype
+          wlan.bssid
+          wlan.sa
+          wlan.da
+          wlan_radio.channel
+          wlan_radio.signal_dbm
+          wlan.ssid
+        ].freeze
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::WiFi.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          iface = (freq_obj[:mon_iface] || 'wlan0mon').to_s
+          hz    = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          mhz   = (hz / 1_000_000.0).round
+
+          tshark = ['tshark', '-i', iface, '-I', '-l', '-n',
+                    '-Y', 'wlan.fc.type == 0',
+                    '-T', 'fields', '-E', 'separator=|']
+          TSHARK_FIELDS.each { |f| tshark.push('-e', f) }
+
+          inner = "iw dev #{Shellwords.escape(iface)} set freq #{mhz} 2>/dev/null; " \
+                  "exec #{Shellwords.join(tshark)}"
+          direct_cmd = "bash -c #{Shellwords.escape(inner)}"
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'WiFi-802.11',
+            required_bins: %w[tshark iw],
+            direct_cmd: direct_cmd,
+            line_match: /\S/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::WiFi.parse_line(line: 't|subtype|bssid|sa|da|ch|rssi|ssid')
+
+        public_class_method def self.parse_line(opts = {})
+          f = opts[:line].to_s.split('|', -1)
+          out = {
+            protocol: 'WiFi',
+            subtype: f[1], bssid: f[2], sa: f[3], da: f[4],
+            channel: f[5], rssi_dbm: f[6], ssid: f[7]
+          }.reject { |_, v| v.to_s.empty? }
+          out[:summary] = "WiFi ch#{out[:channel]} #{out[:bssid]} '#{out[:ssid]}' #{out[:rssi_dbm]}dBm"
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires a monitor-mode WLAN interface (freq_obj[:mon_iface],
+                  default 'wlan0mon'), `iw`, and `tshark`. General SDRs cannot
+                  demodulate 802.11 OFDM in real time.
+
+            #{self}.parse_line(line: '0.1|8|aa:bb:..|aa:bb:..|ff:ff:..|6|-42|linksys')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/zigbee.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # IEEE 802.15.4 / ZigBee decoder for the 2.405–2.480 GHz allocation.
+      # 250 kbit/s O-QPSK requires raw I/Q; this drives KillerBee's `zbdump`
+      # (with any supported adapter — CC2531, ApiMote, RZUSB, HackRF via
+      # gr-ieee802-15-4) or falls back to `whsniff` piped through `tshark`
+      # for structured PAN/src/dst/cmd extraction.
+      module ZigBee
+        TSHARK_FIELDS = %w[
+          frame.time_relative
+          wpan.src16
+          wpan.dst16
+          wpan.src64
+          wpan.dst64
+          wpan.dst_pan
+          wpan.frame_type
+          zbee_nwk.cmd.id
+          wpan.seq_no
+        ].freeze
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::ZigBee.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          # 802.15.4 ch11..26 → 2405 + 5*(ch-11) MHz
+          ch = (((hz - 2_405_000_000) / 5_000_000.0).round + 11).clamp(11, 26)
+
+          tshark = ['tshark', '-r', '-', '-l', '-T', 'fields', '-E', 'separator=|']
+          TSHARK_FIELDS.each { |f| tshark.push('-e', f) }
+
+          inner = "whsniff -c #{ch} 2>/dev/null | #{Shellwords.join(tshark)}"
+          direct_cmd = "bash -c #{Shellwords.escape(inner)}"
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'ZigBee',
+            required_bins: %w[whsniff tshark],
+            direct_cmd: direct_cmd,
+            line_match: /\S/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::ZigBee.parse_line(line: 't|src16|dst16|src64|dst64|pan|type|cmd|seq')
+
+        public_class_method def self.parse_line(opts = {})
+          f = opts[:line].to_s.split('|', -1)
+          out = {
+            protocol: 'ZigBee',
+            src16: f[1], dst16: f[2],
+            src64: f[3], dst64: f[4],
+            pan_id: f[5], frame_type: f[6],
+            nwk_cmd: f[7], seq: f[8]
+          }.reject { |_, v| v.to_s.empty? }
+          out[:summary] = "ZigBee PAN=#{out[:pan_id]} #{out[:src16] || out[:src64]}→#{out[:dst16] || out[:dst64]} type=#{out[:frame_type]}"
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `whsniff` (CC2531) or KillerBee, plus `tshark`.
+                  Channel is derived from freq_obj[:freq] (11–26).
+
+            #{self}.parse_line(line: '0.1|0x0001|0xffff||||0x01||42')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder.rb

@@ -5,15 +5,73 @@ module PWN
   # into memory only when they're needed. For more information, see:
   # http://www.rubyinside.com/ruby-techniques-revealed-autoload-1652.html
   module SDR
-    # Deocder Module for SDR signals.
+    # Decoder namespace for SDR signals. Every child module exposes a
+    # uniform `.decode(freq_obj:)` entry point (see PWN::SDR::Decoder::Base)
+    # so PWN::SDR::GQRX can dispatch on a `decoder:` key from
+    # PWN::SDR::FrequencyAllocation.band_plans.
     module Decoder
-      autoload :Base, 'pwn/sdr/decoder/base'
-      autoload :Flex, 'pwn/sdr/decoder/flex'
-      autoload :GSM, 'pwn/sdr/decoder/gsm'
-      autoload :POCSAG, 'pwn/sdr/decoder/pocsag'
-      autoload :RDS, 'pwn/sdr/decoder/rds'
+      autoload :ADSB,      'pwn/sdr/decoder/adsb'
+      autoload :APT,       'pwn/sdr/decoder/apt'
+      autoload :Base,      'pwn/sdr/decoder/base'
+      autoload :Bluetooth, 'pwn/sdr/decoder/bluetooth'
+      autoload :DECT,      'pwn/sdr/decoder/dect'
+      autoload :Flex,      'pwn/sdr/decoder/flex'
+      autoload :GPS,       'pwn/sdr/decoder/gps'
+      autoload :GSM,       'pwn/sdr/decoder/gsm'
+      autoload :Iridium,   'pwn/sdr/decoder/iridium'
+      autoload :LTE,       'pwn/sdr/decoder/lte'
+      autoload :LoRa,      'pwn/sdr/decoder/lora'
+      autoload :Morse,     'pwn/sdr/decoder/morse'
+      autoload :P25,       'pwn/sdr/decoder/p25'
+      autoload :POCSAG,    'pwn/sdr/decoder/pocsag'
+      autoload :Pager,     'pwn/sdr/decoder/pager'
+      autoload :RDS,       'pwn/sdr/decoder/rds'
+      autoload :RFID,      'pwn/sdr/decoder/rfid'
+      autoload :RTL433,    'pwn/sdr/decoder/rtl433'
+      autoload :RTTY,      'pwn/sdr/decoder/rtty'
+      autoload :WiFi,      'pwn/sdr/decoder/wifi'
+      autoload :ZigBee,    'pwn/sdr/decoder/zigbee'
 
-      # Display a List of Every PWN::AI Module
+      # symbol → module map. Keys are what a band_plan's :decoder value (or
+      # PWN::SDR::GQRX.init_freq's decoder: kwarg) may be set to.
+      REGISTRY = {
+        adsb: :ADSB,
+        apt: :APT,
+        bluetooth: :Bluetooth,
+        dect: :DECT,
+        flex: :Flex,
+        gprs: :GSM,
+        gps: :GPS,
+        gsm: :GSM,
+        iridium: :Iridium,
+        ism: :RTL433,
+        keyfob: :RTL433,
+        lora: :LoRa,
+        lte: :LTE,
+        morse: :Morse,
+        p25: :P25,
+        pager: :Pager,
+        pocsag: :POCSAG,
+        rds: :RDS,
+        rfid: :RFID,
+        rtl433: :RTL433,
+        rtty: :RTTY,
+        wifi: :WiFi,
+        zigbee: :ZigBee
+      }.freeze
+
+      # Supported Method Parameters::
+      # mod = PWN::SDR::Decoder.resolve(
+      #   decoder: 'required - Symbol/String key from REGISTRY (e.g. :pocsag)'
+      # )
+
+      public_class_method def self.resolve(opts = {})
+        key = opts[:decoder].to_s.downcase.to_sym
+        const = REGISTRY[key]
+        raise "ERROR: Unknown decoder key #{key.inspect}. Supported: #{REGISTRY.keys.sort.join(', ')}" unless const
+
+        const_get(const)
+      end
 
       # Author(s):: 0day Inc. <support@0dayinc.com>
 
@@ -21,6 +79,8 @@ module PWN
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
 
+      # Display a List of Every PWN::SDR::Decoder Module
+
       public_class_method def self.help
         constants.sort
       end

data/lib/pwn/sdr/frequency_allocation.rb

@@ -14,7 +14,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '100.000',
-            precision: 5
+            precision: 5,
+            decoder: :adsb
           },
           ads_b1090: {
             ranges: [
@@ -22,7 +23,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '100.000',
-            precision: 5
+            precision: 5,
+            decoder: :adsb
           },
           aeronautical_lf: {
             ranges: [
@@ -70,7 +72,8 @@ module PWN
             ],
             demodulator_mode: :CW,
             bandwidth: '150',
-            precision: 3
+            precision: 3,
+            decoder: :morse
           },
           amateur_60m: {
             ranges: [
@@ -142,7 +145,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '200.000',
-            precision: 6
+            precision: 6,
+            decoder: :lte
           },
           bluetooth: {
             ranges: [
@@ -150,7 +154,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '1.000.000',
-            precision: 5
+            precision: 5,
+            decoder: :bluetooth
           },
           cb: {
             ranges: [
@@ -166,7 +171,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '1.250.000',
-            precision: 6
+            precision: 6,
+            decoder: :lte
           },
           cw20: {
             ranges: [
@@ -174,7 +180,8 @@ module PWN
             ],
             demodulator_mode: :CW,
             bandwidth: '150',
-            precision: 3
+            precision: 3,
+            decoder: :morse
           },
           cw40: {
             ranges: [
@@ -182,7 +189,8 @@ module PWN
             ],
             demodulator_mode: :CW,
             bandwidth: '150',
-            precision: 3
+            precision: 3,
+            decoder: :morse
           },
           cw80: {
             ranges: [
@@ -190,7 +198,8 @@ module PWN
             ],
             demodulator_mode: :CW,
             bandwidth: '150',
-            precision: 3
+            precision: 3,
+            decoder: :morse
           },
           dect: {
             ranges: [
@@ -198,7 +207,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '100.000',
-            precision: 5
+            precision: 5,
+            decoder: :dect
           },
           fm_radio: {
             ranges: [
@@ -231,7 +241,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '171.200',
-            precision: 4
+            precision: 4,
+            decoder: :gsm
           },
           gps_l1: {
             ranges: [
@@ -239,7 +250,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '30.000.000',
-            precision: 6
+            precision: 6,
+            decoder: :gps
           },
           gps_l2: {
             ranges: [
@@ -247,7 +259,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '11.000.000',
-            precision: 6
+            precision: 6,
+            decoder: :gps
           },
           gsm: {
             ranges: [
@@ -255,7 +268,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '200.000',
-            precision: 4
+            precision: 4,
+            decoder: :gsm
           },
           high_rfid: {
             ranges: [
@@ -263,7 +277,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '400.000',
-            precision: 3
+            precision: 3,
+            decoder: :rfid
           },
           iridium: {
             ranges: [
@@ -271,7 +286,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '704.000',
-            precision: 6
+            precision: 6,
+            decoder: :iridium
           },
           ism_5g: {
             ranges: [
@@ -279,7 +295,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '150.000.000',
-            precision: 7
+            precision: 7,
+            decoder: :rtl433
           },
           ism_902: {
             ranges: [
@@ -287,7 +304,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '26.000.000',
-            precision: 3
+            precision: 3,
+            decoder: :rtl433
           },
           keyfob300: {
             ranges: [
@@ -295,7 +313,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '50.000',
-            precision: 4
+            precision: 4,
+            decoder: :rtl433
           },
           keyfob310: {
             ranges: [
@@ -303,7 +322,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '50.000',
-            precision: 4
+            precision: 4,
+            decoder: :rtl433
           },
           keyfob315: {
             ranges: [
@@ -311,7 +331,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '50.000',
-            precision: 4
+            precision: 4,
+            decoder: :rtl433
           },
           keyfob390: {
             ranges: [
@@ -319,7 +340,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '50.000',
-            precision: 4
+            precision: 4,
+            decoder: :rtl433
           },
           keyfob433: {
             ranges: [
@@ -327,7 +349,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '50.000',
-            precision: 4
+            precision: 4,
+            decoder: :rtl433
           },
           keyfob868: {
             ranges: [
@@ -335,7 +358,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '50.000',
-            precision: 4
+            precision: 4,
+            decoder: :rtl433
           },
           land_mobile_uhf: {
             ranges: [
@@ -367,7 +391,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '500.000',
-            precision: 3
+            precision: 3,
+            decoder: :lora
           },
           lora8x: {
             ranges: [
@@ -375,7 +400,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '500.000',
-            precision: 3
+            precision: 3,
+            decoder: :lora
           },
           lora9x: {
             ranges: [
@@ -383,7 +409,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '500.000',
-            precision: 3
+            precision: 3,
+            decoder: :lora
           },
           low_rfid: {
             ranges: [
@@ -391,7 +418,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '40.000',
-            precision: 1
+            precision: 1,
+            decoder: :rfid
           },
           marine_vhf: {
             ranges: [
@@ -449,7 +477,8 @@ module PWN
             ],
             demodulator_mode: :FM,
             bandwidth: '25.000',
-            precision: 4
+            precision: 4,
+            decoder: :pager
           },
           pager_flex: {
             ranges: [
@@ -487,7 +516,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '200.000',
-            precision: 6
+            precision: 6,
+            decoder: :lte
           },
           public_safety_700: {
             ranges: [
@@ -495,7 +525,8 @@ module PWN
             ],
             demodulator_mode: :FM,
             bandwidth: '25.000',
-            precision: 4
+            precision: 4,
+            decoder: :p25
           },
           rtty20: {
             ranges: [
@@ -503,7 +534,8 @@ module PWN
             ],
             demodulator_mode: :FM,
             bandwidth: '170',
-            precision: 3
+            precision: 3,
+            decoder: :rtty
           },
           rtty40: {
             ranges: [
@@ -511,7 +543,8 @@ module PWN
             ],
             demodulator_mode: :FM,
             bandwidth: '170',
-            precision: 3
+            precision: 3,
+            decoder: :rtty
           },
           rtty80: {
             ranges: [
@@ -519,7 +552,8 @@ module PWN
             ],
             demodulator_mode: :FM,
             bandwidth: '170',
-            precision: 3
+            precision: 3,
+            decoder: :rtty
           },
           shortwave1: {
             ranges: [
@@ -671,7 +705,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '400.000',
-            precision: 5
+            precision: 5,
+            decoder: :rfid
           },
           umts: {
             ranges: [
@@ -679,7 +714,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '5.000.000',
-            precision: 6
+            precision: 6,
+            decoder: :lte
           },
           weather_sat: {
             ranges: [
@@ -687,7 +723,8 @@ module PWN
             ],
             demodulator_mode: :FM,
             bandwidth: '15.000',
-            precision: 5
+            precision: 5,
+            decoder: :apt
           },
           wifi24: {
             ranges: [
@@ -695,7 +732,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '20.000.000',
-            precision: 7
+            precision: 7,
+            decoder: :wifi
           },
           wifi5: {
             ranges: [
@@ -703,7 +741,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '20.000.000',
-            precision: 7
+            precision: 7,
+            decoder: :wifi
           },
           wifi6: {
             ranges: [
@@ -711,7 +750,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '20.000.000',
-            precision: 7
+            precision: 7,
+            decoder: :wifi
           },
           zigbee: {
             ranges: [
@@ -719,7 +759,8 @@ module PWN
             ],
             demodulator_mode: :RAW,
             bandwidth: '2.000.000',
-            precision: 7
+            precision: 7,
+            decoder: :zigbee
           }
         }
       rescue StandardError => e