pwn 0.5.618 → 0.5.620

data/lib/pwn/sdr/decoder/rfid.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # RFID decoder covering LF (125/134 kHz), HF (13.56 MHz) and UHF
+      # (860–960 MHz EPC Gen2). Near-field ASK/load-modulation is not
+      # recoverable from GQRX audio, so this drives a Proxmark3 (LF/HF) via
+      # `pm3 -c '...'` or `nfc-list` (HF), and `rtl_433` in flex/analyzer mode
+      # for UHF backscatter — whichever tool is present.
+      module RFID
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RFID.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+
+          direct_cmd, bins, proto =
+            if hz < 1_000_000
+              ["pm3 -c 'lf search'", %w[pm3], 'RFID-LF']
+            elsif hz.between?(13_000_000, 14_000_000)
+              if PWN::SDR::Decoder::Base.bin_available?(bin: 'pm3')
+                ["pm3 -c 'hf search'", %w[pm3], 'RFID-HF']
+              else
+                ['nfc-list -v', %w[nfc-list], 'RFID-HF']
+              end
+            else
+              ["rtl_433 -f #{hz} -A -F json", %w[rtl_433], 'RFID-UHF']
+            end
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: proto,
+            required_bins: bins,
+            direct_cmd: direct_cmd,
+            line_match: /(UID|EPC|TAG|ATQA|SAK|EM4|HID|ISO|Chipset|"model")/i,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RFID.parse_line(line: 'UID: 04 A1 B2 C3 D4 E5 F6')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'RFID' }
+          out[:uid]  = ::Regexp.last_match(1).delete(' ') if line =~ /UID[:=]?\s*((?:[0-9A-Fa-f]{2}\s*){4,10})/
+          out[:epc]  = ::Regexp.last_match(1) if line =~ /EPC[:=]?\s*([0-9A-Fa-f]+)/
+          out[:atqa] = ::Regexp.last_match(1) if line =~ /ATQA[:=]?\s*([0-9A-Fa-f ]+)/
+          out[:sak]  = ::Regexp.last_match(1) if line =~ /SAK[:=]?\s*([0-9A-Fa-f]+)/
+          out[:tag]  = ::Regexp.last_match(1) if line =~ /(EM4\w+|HID\w*|Mifare\w*|NTAG\w*|ISO\s?\d+)/i
+          out[:summary] = "RFID #{out[:tag]} UID=#{out[:uid] || out[:epc]}".squeeze(' ')
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: LF/HF need a Proxmark3 (`pm3`) or libnfc reader; UHF uses
+                  `rtl_433 -A`. Band chosen automatically from freq_obj[:freq].
+
+            #{self}.parse_line(line: 'UID: 04 A1 B2 C3 D4 E5 F6  SAK: 08  Mifare Classic 1K')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/rtl433.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # Generic ISM/keyfob/sensor decoder backed by `rtl_433`.
+      #
+      # Covers the OOK/ASK/FSK device zoo on 300–315 / 390 / 433.92 / 868 /
+      # 902–928 MHz: car/garage keyfobs, TPMS, weather stations, utility
+      # meters, doorbells, alarm PIRs, etc. rtl_433 owns the SDR directly and
+      # emits one JSON object per decoded frame (`-F json`), which this module
+      # merges verbatim into the freq_obj log line.
+      module RTL433
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RTL433.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz       = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          gain     = freq_obj[:rf_gain]
+          sdr_args = freq_obj[:sdr_args].to_s
+
+          cmd = ['rtl_433', '-f', hz.to_s, '-F', 'json', '-M', 'level', '-M', 'protocol']
+          cmd.push('-g', gain.to_s) if gain
+          cmd.push('-d', sdr_args) unless sdr_args.empty?
+          direct_cmd = Shellwords.join(cmd)
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'RTL433',
+            required_bins: %w[rtl_433],
+            direct_cmd: direct_cmd,
+            line_match: /^\s*{/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RTL433.parse_line(line: '{"time":"...","model":"..."}')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          h = begin
+            JSON.parse(line, symbolize_names: true)
+          rescue StandardError
+            { unparsed: line }
+          end
+          out = { protocol: 'RTL433' }.merge(h)
+
+          bits = []
+          bits << out[:model].to_s if out[:model]
+          bits << "id=#{out[:id]}" if out[:id]
+          bits << "ch=#{out[:channel]}" if out[:channel]
+          bits << "code=#{out[:code]}" if out[:code]
+          bits << "cmd=#{out[:cmd] || out[:button]}" if out[:cmd] || out[:button]
+          bits << "temp=#{out[:temperature_C]}C" if out[:temperature_C]
+          bits << "rssi=#{out[:rssi]}" if out[:rssi]
+          out[:summary] = bits.empty? ? line[0, 120] : bits.join(' ')
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `rtl_433`. Owns the SDR directly (pass
+                  freq_obj[:sdr_args] like ':1' or 'driver=hackrf' to select
+                  a device other than the one GQRX is holding).
+
+            #{self}.parse_line(line: '{\"model\":\"Acurite-Tower\",\"id\":1234,...}')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/rtty.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # RTTY (Radioteletype, ITA2/Baudot) decoder for the amateur RTTY
+      # sub-bands (rtty20/rtty40/rtty80). GQRX supplies FM-demodulated audio
+      # containing the classic 170 Hz-shift 45.45-baud mark/space tones;
+      # `minimodem` recovers the 5-bit Baudot stream and prints ASCII.
+      module RTTY
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RTTY.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+
+          # minimodem reads s16le mono from stdin at the rate we hand it; keep
+          # sox at 22 050 Hz (Base default) and tell minimodem the same.
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'RTTY',
+            required_bins: %w[sox minimodem],
+            decode_cmd: 'minimodem --rx --quiet --rtty -R 22050 -f -',
+            line_match: /\S/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RTTY.parse_line(line: 'RYRYRY DE W1AW')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s.strip
+          out  = { protocol: 'RTTY', text: line }
+          if (m = line.match(/\bDE\s+([A-Z0-9]{1,3}\d[A-Z]{1,4})\b/))
+            out[:callsign] = m[1]
+          end
+          out[:summary] = "RTTY #{line}"[0, 120]
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            #{self}.parse_line(line: 'RYRYRY CQ CQ DE W1AW')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/wifi.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # 802.11 (WiFi) beacon/probe decoder for the 2.4 / 5 / 6 GHz bands.
+      #
+      # 20+ MHz OFDM cannot be recovered from a general-purpose SDR at
+      # bit-level in real time, so this module drives an existing monitor-mode
+      # NIC via `tshark` (or `airodump-ng`) instead — freq_obj[:mon_iface]
+      # selects the interface, freq_obj[:freq] is mapped to a WLAN channel.
+      module WiFi
+        TSHARK_FIELDS = %w[
+          frame.time_relative
+          wlan.fc.type_subtype
+          wlan.bssid
+          wlan.sa
+          wlan.da
+          wlan_radio.channel
+          wlan_radio.signal_dbm
+          wlan.ssid
+        ].freeze
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::WiFi.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          iface = (freq_obj[:mon_iface] || 'wlan0mon').to_s
+          hz    = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          mhz   = (hz / 1_000_000.0).round
+
+          tshark = ['tshark', '-i', iface, '-I', '-l', '-n',
+                    '-Y', 'wlan.fc.type == 0',
+                    '-T', 'fields', '-E', 'separator=|']
+          TSHARK_FIELDS.each { |f| tshark.push('-e', f) }
+
+          inner = "iw dev #{Shellwords.escape(iface)} set freq #{mhz} 2>/dev/null; " \
+                  "exec #{Shellwords.join(tshark)}"
+          direct_cmd = "bash -c #{Shellwords.escape(inner)}"
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'WiFi-802.11',
+            required_bins: %w[tshark iw],
+            direct_cmd: direct_cmd,
+            line_match: /\S/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::WiFi.parse_line(line: 't|subtype|bssid|sa|da|ch|rssi|ssid')
+
+        public_class_method def self.parse_line(opts = {})
+          f = opts[:line].to_s.split('|', -1)
+          out = {
+            protocol: 'WiFi',
+            subtype: f[1], bssid: f[2], sa: f[3], da: f[4],
+            channel: f[5], rssi_dbm: f[6], ssid: f[7]
+          }.reject { |_, v| v.to_s.empty? }
+          out[:summary] = "WiFi ch#{out[:channel]} #{out[:bssid]} '#{out[:ssid]}' #{out[:rssi_dbm]}dBm"
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires a monitor-mode WLAN interface (freq_obj[:mon_iface],
+                  default 'wlan0mon'), `iw`, and `tshark`. General SDRs cannot
+                  demodulate 802.11 OFDM in real time.
+
+            #{self}.parse_line(line: '0.1|8|aa:bb:..|aa:bb:..|ff:ff:..|6|-42|linksys')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/zigbee.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # IEEE 802.15.4 / ZigBee decoder for the 2.405–2.480 GHz allocation.
+      # 250 kbit/s O-QPSK requires raw I/Q; this drives KillerBee's `zbdump`
+      # (with any supported adapter — CC2531, ApiMote, RZUSB, HackRF via
+      # gr-ieee802-15-4) or falls back to `whsniff` piped through `tshark`
+      # for structured PAN/src/dst/cmd extraction.
+      module ZigBee
+        TSHARK_FIELDS = %w[
+          frame.time_relative
+          wpan.src16
+          wpan.dst16
+          wpan.src64
+          wpan.dst64
+          wpan.dst_pan
+          wpan.frame_type
+          zbee_nwk.cmd.id
+          wpan.seq_no
+        ].freeze
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::ZigBee.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          # 802.15.4 ch11..26 → 2405 + 5*(ch-11) MHz
+          ch = (((hz - 2_405_000_000) / 5_000_000.0).round + 11).clamp(11, 26)
+
+          tshark = ['tshark', '-r', '-', '-l', '-T', 'fields', '-E', 'separator=|']
+          TSHARK_FIELDS.each { |f| tshark.push('-e', f) }
+
+          inner = "whsniff -c #{ch} 2>/dev/null | #{Shellwords.join(tshark)}"
+          direct_cmd = "bash -c #{Shellwords.escape(inner)}"
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'ZigBee',
+            required_bins: %w[whsniff tshark],
+            direct_cmd: direct_cmd,
+            line_match: /\S/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::ZigBee.parse_line(line: 't|src16|dst16|src64|dst64|pan|type|cmd|seq')
+
+        public_class_method def self.parse_line(opts = {})
+          f = opts[:line].to_s.split('|', -1)
+          out = {
+            protocol: 'ZigBee',
+            src16: f[1], dst16: f[2],
+            src64: f[3], dst64: f[4],
+            pan_id: f[5], frame_type: f[6],
+            nwk_cmd: f[7], seq: f[8]
+          }.reject { |_, v| v.to_s.empty? }
+          out[:summary] = "ZigBee PAN=#{out[:pan_id]} #{out[:src16] || out[:src64]}→#{out[:dst16] || out[:dst64]} type=#{out[:frame_type]}"
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `whsniff` (CC2531) or KillerBee, plus `tshark`.
+                  Channel is derived from freq_obj[:freq] (11–26).
+
+            #{self}.parse_line(line: '0.1|0x0001|0xffff||||0x01||42')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder.rb

@@ -5,15 +5,73 @@ module PWN
   # into memory only when they're needed. For more information, see:
   # http://www.rubyinside.com/ruby-techniques-revealed-autoload-1652.html
   module SDR
-    # Deocder Module for SDR signals.
+    # Decoder namespace for SDR signals. Every child module exposes a
+    # uniform `.decode(freq_obj:)` entry point (see PWN::SDR::Decoder::Base)
+    # so PWN::SDR::GQRX can dispatch on a `decoder:` key from
+    # PWN::SDR::FrequencyAllocation.band_plans.
     module Decoder
-      autoload :Base, 'pwn/sdr/decoder/base'
-      autoload :Flex, 'pwn/sdr/decoder/flex'
-      autoload :GSM, 'pwn/sdr/decoder/gsm'
-      autoload :POCSAG, 'pwn/sdr/decoder/pocsag'
-      autoload :RDS, 'pwn/sdr/decoder/rds'
+      autoload :ADSB,      'pwn/sdr/decoder/adsb'
+      autoload :APT,       'pwn/sdr/decoder/apt'
+      autoload :Base,      'pwn/sdr/decoder/base'
+      autoload :Bluetooth, 'pwn/sdr/decoder/bluetooth'
+      autoload :DECT,      'pwn/sdr/decoder/dect'
+      autoload :Flex,      'pwn/sdr/decoder/flex'
+      autoload :GPS,       'pwn/sdr/decoder/gps'
+      autoload :GSM,       'pwn/sdr/decoder/gsm'
+      autoload :Iridium,   'pwn/sdr/decoder/iridium'
+      autoload :LTE,       'pwn/sdr/decoder/lte'
+      autoload :LoRa,      'pwn/sdr/decoder/lora'
+      autoload :Morse,     'pwn/sdr/decoder/morse'
+      autoload :P25,       'pwn/sdr/decoder/p25'
+      autoload :POCSAG,    'pwn/sdr/decoder/pocsag'
+      autoload :Pager,     'pwn/sdr/decoder/pager'
+      autoload :RDS,       'pwn/sdr/decoder/rds'
+      autoload :RFID,      'pwn/sdr/decoder/rfid'
+      autoload :RTL433,    'pwn/sdr/decoder/rtl433'
+      autoload :RTTY,      'pwn/sdr/decoder/rtty'
+      autoload :WiFi,      'pwn/sdr/decoder/wifi'
+      autoload :ZigBee,    'pwn/sdr/decoder/zigbee'
 
-      # Display a List of Every PWN::AI Module
+      # symbol → module map. Keys are what a band_plan's :decoder value (or
+      # PWN::SDR::GQRX.init_freq's decoder: kwarg) may be set to.
+      REGISTRY = {
+        adsb: :ADSB,
+        apt: :APT,
+        bluetooth: :Bluetooth,
+        dect: :DECT,
+        flex: :Flex,
+        gprs: :GSM,
+        gps: :GPS,
+        gsm: :GSM,
+        iridium: :Iridium,
+        ism: :RTL433,
+        keyfob: :RTL433,
+        lora: :LoRa,
+        lte: :LTE,
+        morse: :Morse,
+        p25: :P25,
+        pager: :Pager,
+        pocsag: :POCSAG,
+        rds: :RDS,
+        rfid: :RFID,
+        rtl433: :RTL433,
+        rtty: :RTTY,
+        wifi: :WiFi,
+        zigbee: :ZigBee
+      }.freeze
+
+      # Supported Method Parameters::
+      # mod = PWN::SDR::Decoder.resolve(
+      #   decoder: 'required - Symbol/String key from REGISTRY (e.g. :pocsag)'
+      # )
+
+      public_class_method def self.resolve(opts = {})
+        key = opts[:decoder].to_s.downcase.to_sym
+        const = REGISTRY[key]
+        raise "ERROR: Unknown decoder key #{key.inspect}. Supported: #{REGISTRY.keys.sort.join(', ')}" unless const
+
+        const_get(const)
+      end
 
       # Author(s):: 0day Inc. <support@0dayinc.com>
 
@@ -21,6 +79,8 @@ module PWN
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
 
+      # Display a List of Every PWN::SDR::Decoder Module
+
       public_class_method def self.help
         constants.sort
       end