pwn 0.5.621 → 0.5.626

data/lib/pwn/sdr/decoder/rtty.rb

@@ -106,11 +106,28 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          PWN::SDR::Decoder::Base.run_native(
-            freq_obj: freq_obj,
-            protocol: 'RTTY',
-            demod: Demod.new
-          )
+          # Prefer true-air I/Q (FM-demod → existing audio demod) when the
+          # operator asks for a source/file or sets freq_obj[:iq_source].
+          # Otherwise keep the GQRX 48 kHz UDP audio path (run_native).
+          want_iq = opts[:source] || opts[:file] || freq_obj[:iq_source] || freq_obj[:iq_file]
+          if want_iq
+            PWN::SDR::Decoder::Base.run_iq(
+              freq_obj: freq_obj,
+              protocol: 'RTTY',
+              demod: Demod.new,
+              sample_rate: (opts[:sample_rate] || freq_obj[:iq_rate] || 48_000).to_i,
+              source: opts[:source],
+              file: opts[:file],
+              fm_demod: true,
+              note: 'RTTY true-air: FM-demod I/Q then native bit recovery; falls back to detector without SDR hardware.'
+            )
+          else
+            PWN::SDR::Decoder::Base.run_native(
+              freq_obj: freq_obj,
+              protocol: 'RTTY',
+              demod: Demod.new
+            )
+          end
         end
 
         # Author(s):: 0day Inc. <support@0dayinc.com>
@@ -122,7 +139,7 @@ module PWN
         # Display Usage for this Module
 
         public_class_method def self.help
-          puts "USAGE (ruby-native 2-FSK ITA2, no external binaries):
+          puts "USAGE (true-air I/Q + GQRX-audio native paths, no external binaries):
             #{self}.decode(
               freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
             )

data/lib/pwn/sdr/decoder/wifi.rb

@@ -3,17 +3,68 @@
 module PWN
   module SDR
     module Decoder
-      # Pure-Ruby 802.11 (WiFi) activity detector.
-      #
-      # 20+ MHz OFDM cannot be demodulated in interpreted Ruby in real
-      # time. Native mode reports channel occupancy/duty and maps
-      # freq_obj to a WLAN channel number. `parse_line` retained for
-      # offline pipe-delimited tshark-fields analysis.
+      # True-air + detector-fallback decoder for WiFi.
+      # Prefers PWN::FFI I/Q (RTL-SDR / ADALM-Pluto / HackRF / capture file)
+      # via Base.run_iq; degrades to Base.run_detector with no hardware.
       module WiFi
-        TSHARK_FIELDS = %w[
-          frame.time_relative wlan.fc.type_subtype wlan.bssid wlan.sa
-          wlan.da wlan_radio.channel wlan_radio.signal_dbm wlan.ssid
-        ].freeze
+        # Streaming I/Q energy/burst demod for Base.run_iq.
+        class DemodIQ
+          def initialize(rate:, protocol:, modulation:, extra: {})
+            @rate = rate.to_f
+            @protocol = protocol
+            @modulation = modulation
+            @extra = extra
+            @floor = nil
+            @in_burst = false
+            @burst_t0 = nil
+            @peak = -200.0
+            @burst_n = 0
+            @threshold = (extra[:threshold] || 8.0).to_f
+          end
+
+          def feed_iq(samples, rate: nil, &)
+            @rate = rate.to_f if rate
+            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
+            hop = [(@rate / 1000.0).round, 1].max
+            i = 0
+            while i < m2.length
+              win = m2[i, hop]
+              break if win.nil? || win.empty?
+
+              ms = win.sum / win.length
+              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
+              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
+              delta = lvl - @floor
+              if delta >= @threshold
+                unless @in_burst
+                  @in_burst = true
+                  @burst_t0 = Time.now
+                  @peak = lvl
+                end
+                @peak = lvl if lvl > @peak
+              elsif @in_burst
+                @in_burst = false
+                @burst_n += 1
+                dur_ms = ((Time.now - @burst_t0) * 1000).round
+                msg = {
+                  protocol: @protocol, event: 'burst', source: 'iq',
+                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
+                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
+                  duration_ms: dur_ms, modulation: @modulation,
+                  sample_rate: @rate.to_i
+                }.merge(@extra.except(:threshold))
+                # protocol-specific enrichment
+                msg.merge!(self.class.enrich(msg)) if self.class.respond_to?(:enrich)
+                msg[:summary] = format(
+                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
+                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
+                )
+                yield msg if block_given?
+              end
+              i += hop
+            end
+          end
+        end
 
         # Supported Method Parameters::
         # PWN::SDR::Decoder::WiFi.decode(
@@ -22,33 +73,38 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          hz  = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
-          mhz = (hz / 1_000_000.0).round
-          ch  = case mhz
-                when 2412..2472 then ((mhz - 2412) / 5) + 1
-                when 2484       then 14
-                when 5000..5900 then (mhz - 5000) / 5
-                else 0
-                end
-          PWN::SDR::Decoder::Base.run_detector(
+
+          rate  = (opts[:sample_rate] || freq_obj[:iq_rate] || 2_000_000).to_i
+          proto = 'WiFi-802.11'
+          demod = DemodIQ.new(
+            rate: rate, protocol: proto, modulation: 'OFDM',
+            extra: { threshold: 6.0 }
+          )
+          PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: 'WiFi-802.11',
-            note: '20+ MHz OFDM — native mode reports channel occupancy/duty only.',
+            protocol: proto,
+            sample_rate: rate,
+            source: opts[:source],
+            file: opts[:file],
+            demod: demod,
             threshold: 6.0,
-            describe: proc { |b| { modulation: 'OFDM', channel: ch, mhz: mhz, airtime_ms: b[:duration_ms] } }
+            note: '20+ MHz OFDM — true-air I/Q path reports channel occupancy/duty.',
+            describe: proc { |b| { modulation: 'OFDM', airtime_ms: b[:duration_ms] } }
           )
         end
 
-        # Supported Method Parameters::
-        # PWN::SDR::Decoder::WiFi.parse_line(line: 't|subtype|bssid|sa|da|ch|rssi|ssid')
+        TSHARK_FIELDS = %w[
+          frame.time_relative wlan.fc.type_subtype wlan.bssid wlan.sa
+          wlan.da wlan_radio.channel wlan_radio.signal_dbm wlan.ssid
+        ].freeze
 
         public_class_method def self.parse_line(opts = {})
           f = opts[:line].to_s.split('|', -1)
           out = {
             protocol: 'WiFi', subtype: f[1], bssid: f[2], sa: f[3], da: f[4],
-            channel: f[5], rssi_dbm: f[6], ssid: f[7]
+            channel: f[5], rssi: f[6], ssid: f[7]
           }.reject { |_, v| v.to_s.empty? }
-          out[:summary] = "WiFi ch#{out[:channel]} #{out[:bssid]} '#{out[:ssid]}' #{out[:rssi_dbm]}dBm"
+          out[:summary] = "WiFi ch=#{out[:channel]} BSSID=#{out[:bssid]} SSID=#{out[:ssid]} RSSI=#{out[:rssi]}"
           out
         end
 
@@ -58,16 +114,14 @@ module PWN
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
 
-        # Display Usage for this Module
-
         public_class_method def self.help
-          puts "USAGE (ruby-native detector, no external binaries):
+          puts "USAGE (true-air I/Q via PWN::FFI + detector fallback):
             #{self}.decode(
-              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq',
+              source:   'optional - :auto|:rtlsdr|:adalm_pluto|:file',
+              file:     'optional - .cu8/.cs16 capture'
             )
 
-            #{self}.parse_line(line: '0.1|8|aa:bb:..|aa:bb:..|ff:ff:..|6|-42|linksys')
-
             #{self}.authors
           "
         end

data/lib/pwn/sdr/decoder/zigbee.rb

@@ -3,17 +3,68 @@
 module PWN
   module SDR
     module Decoder
-      # Pure-Ruby IEEE 802.15.4 / ZigBee activity detector.
-      #
-      # 250 kbit/s O-QPSK across 2 MHz channels — native mode reports
-      # per-channel packet bursts and derives channel 11–26 from
-      # freq_obj. `parse_line` retained for offline pipe-delimited
-      # analysis.
+      # True-air + detector-fallback decoder for ZigBee.
+      # Prefers PWN::FFI I/Q (RTL-SDR / ADALM-Pluto / HackRF / capture file)
+      # via Base.run_iq; degrades to Base.run_detector with no hardware.
       module ZigBee
-        TSHARK_FIELDS = %w[
-          frame.time_relative wpan.src16 wpan.dst16 wpan.src64 wpan.dst64
-          wpan.dst_pan wpan.frame_type zbee_nwk.cmd.id wpan.seq_no
-        ].freeze
+        # Streaming I/Q energy/burst demod for Base.run_iq.
+        class DemodIQ
+          def initialize(rate:, protocol:, modulation:, extra: {})
+            @rate = rate.to_f
+            @protocol = protocol
+            @modulation = modulation
+            @extra = extra
+            @floor = nil
+            @in_burst = false
+            @burst_t0 = nil
+            @peak = -200.0
+            @burst_n = 0
+            @threshold = (extra[:threshold] || 8.0).to_f
+          end
+
+          def feed_iq(samples, rate: nil, &)
+            @rate = rate.to_f if rate
+            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
+            hop = [(@rate / 1000.0).round, 1].max
+            i = 0
+            while i < m2.length
+              win = m2[i, hop]
+              break if win.nil? || win.empty?
+
+              ms = win.sum / win.length
+              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
+              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
+              delta = lvl - @floor
+              if delta >= @threshold
+                unless @in_burst
+                  @in_burst = true
+                  @burst_t0 = Time.now
+                  @peak = lvl
+                end
+                @peak = lvl if lvl > @peak
+              elsif @in_burst
+                @in_burst = false
+                @burst_n += 1
+                dur_ms = ((Time.now - @burst_t0) * 1000).round
+                msg = {
+                  protocol: @protocol, event: 'burst', source: 'iq',
+                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
+                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
+                  duration_ms: dur_ms, modulation: @modulation,
+                  sample_rate: @rate.to_i
+                }.merge(@extra.except(:threshold))
+                # protocol-specific enrichment
+                msg.merge!(self.class.enrich(msg)) if self.class.respond_to?(:enrich)
+                msg[:summary] = format(
+                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
+                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
+                )
+                yield msg if block_given?
+              end
+              i += hop
+            end
+          end
+        end
 
         # Supported Method Parameters::
         # PWN::SDR::Decoder::ZigBee.decode(
@@ -22,31 +73,35 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          hz = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
-          ch = (((hz - 2_405_000_000) / 5_000_000.0).round + 11).clamp(11, 26)
-          PWN::SDR::Decoder::Base.run_detector(
+
+          rate  = (opts[:sample_rate] || freq_obj[:iq_rate] || 2_000_000).to_i
+          proto = 'ZigBee'
+          demod = DemodIQ.new(
+            rate: rate, protocol: proto, modulation: 'O-QPSK',
+            extra: { threshold: 8.0 }
+          )
+          PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: 'ZigBee',
-            note: '250 kbit/s O-QPSK — native mode reports 802.15.4 packet bursts only.',
+            protocol: proto,
+            sample_rate: rate,
+            source: opts[:source],
+            file: opts[:file],
+            demod: demod,
             threshold: 8.0,
-            describe: proc { |b|
-              octets = (b[:duration_ms] * 250 / 8).round
-              { modulation: 'O-QPSK', channel: ch, est_octets: octets, classification: octets < 20 ? 'ACK/beacon' : 'data-frame' }
-            }
+            note: 'O-QPSK 250 kbit/s DSSS — true-air I/Q path reports frame bursts on the tuned channel.',
+            describe: proc { |b| { modulation: 'O-QPSK', symbol_rate: 62_500, classification: b[:duration_ms] < 5 ? 'ACK' : 'MAC-frame' } }
           )
         end
 
-        # Supported Method Parameters::
-        # PWN::SDR::Decoder::ZigBee.parse_line(line: 't|src16|dst16|src64|dst64|pan|type|cmd|seq')
-
         public_class_method def self.parse_line(opts = {})
-          f = opts[:line].to_s.split('|', -1)
-          out = {
-            protocol: 'ZigBee', src16: f[1], dst16: f[2], src64: f[3], dst64: f[4],
-            pan_id: f[5], frame_type: f[6], nwk_cmd: f[7], seq: f[8]
-          }.reject { |_, v| v.to_s.empty? }
-          out[:summary] = "ZigBee PAN=#{out[:pan_id]} #{out[:src16] || out[:src64]}→#{out[:dst16] || out[:dst64]} type=#{out[:frame_type]}"
-          out
+          line = opts[:line].to_s
+          out  = { protocol: 'ZigBee' }
+          out[:pan]    = ::Regexp.last_match(1) if line =~ /PAN[:= ]+([0-9A-Fa-f]+)/i
+          out[:src]    = ::Regexp.last_match(1) if line =~ /src[:= ]+([0-9A-Fa-f:]+)/i
+          out[:dst]    = ::Regexp.last_match(1) if line =~ /dst[:= ]+([0-9A-Fa-f:]+)/i
+          out[:cmd]    = ::Regexp.last_match(1) if line =~ /\b(Beacon|Data|ACK|Cmd)\b/i
+          out[:summary] = "ZigBee #{out[:cmd]} PAN=#{out[:pan]} #{out[:src]}→#{out[:dst]}"
+          out.compact
         end
 
         # Author(s):: 0day Inc. <support@0dayinc.com>
@@ -55,16 +110,14 @@ module PWN
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
 
-        # Display Usage for this Module
-
         public_class_method def self.help
-          puts "USAGE (ruby-native detector, no external binaries):
+          puts "USAGE (true-air I/Q via PWN::FFI + detector fallback):
             #{self}.decode(
-              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq',
+              source:   'optional - :auto|:rtlsdr|:adalm_pluto|:file',
+              file:     'optional - .cu8/.cs16 capture'
             )
 
-            #{self}.parse_line(line: '0.1|0x0001|0xffff||||0x01||42')
-
             #{self}.authors
           "
         end

data/lib/pwn/sdr/decoder.rb

@@ -11,11 +11,12 @@ module PWN
     # PWN::SDR::FrequencyAllocation.band_plans.
     #
     # 100 % ruby-native — no decoder in this namespace shells out to an
-    # external binary. Audio-rate protocols (POCSAG, FLEX, Morse, RTTY,
-    # APT, Pager) are fully demodulated in Ruby via PWN::SDR::Decoder::DSP;
-    # wideband/I/Q-only protocols (ADS-B, GSM, LTE, GPS, LoRa, WiFi, DECT,
-    # ZigBee, Bluetooth, Iridium, P25, RFID, RTL433) run a native
-    # burst/energy characteriser (see Base.run_detector).
+    # external binary. Three pipelines (Base):
+    #   run_native   — GQRX 48 kHz audio tap (POCSAG/FLEX/Morse/RTTY/APT/Pager)
+    #   run_iq       — true-air I/Q via PWN::FFI::{RTLSdr,AdalmPluto,HackRF}
+    #                  or a .cu8/.cs16 capture file; all modules use this when
+    #                  hardware/file is present (ADS-B fully slices Mode-S PPM)
+    #   run_detector — energy/burst characteriser fallback when no I/Q source
     module Decoder
       autoload :ADSB,      'pwn/sdr/decoder/adsb'
       autoload :APT,       'pwn/sdr/decoder/apt'