iotsploit-exploits 0.0.7__tar.gz → 0.0.9__tar.gz

iotsploit_exploits-0.0.9/PKG-INFO

@@ -0,0 +1,85 @@
+Metadata-Version: 2.4
+Name: iotsploit-exploits
+Version: 0.0.9
+Summary: Official IoTSploit exploit plugin package
+License: GPL-3.0-or-later
+Author: IoTSploit Team
+Author-email: support@iotsploit.org
+Requires-Python: >=3.10,<4.0
+Classifier: License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
+Requires-Dist: facedancer (>=3.0.6,<4.0)
+Requires-Dist: iotsploit-core
+Requires-Dist: iotsploit-django
+Requires-Dist: iotsploit-protocols
+Requires-Dist: paramiko (>=3.0)
+Requires-Dist: pyserial (>=3.5)
+Requires-Dist: scapy (>=2.5)
+Description-Content-Type: text/markdown
+
+# iotsploit-exploits
+
+Official IoTSploit exploit plugin package. Contains all built-in exploit/security testing plugins.
+
+## Included Plugins
+
+Every plugin is registered as an `iotsploit.exploit_plugins` entry point in
+`pyproject.toml`; a plugin that is not registered cannot be run.
+
+The `demo_*` plugins are the reference gallery — one per framework capability,
+small enough to read, safe to run anywhere. Start there when writing a plugin,
+and see `docs/writing-plugins.md` for which file teaches what.
+
+| Plugin | Module | Description |
+|--------|--------|-------------|
+| Observations Demo | `iotsploit_exploits.demo.observations` | Reference: parameters, target reading, recording observations |
+| Interactive Demo | `iotsploit_exploits.demo.interactive` | Reference: operator prompts |
+| Async Demo | `iotsploit_exploits.demo.async_run` | Reference: long-running work, progress, cooperative stop |
+| Stream Demo | `iotsploit_exploits.demo.stream` | Reference: streaming live data to the UI |
+| Privileged Helper Check | `iotsploit_exploits.demo.privileged` | Reference: the bounded privileged helper |
+| UDS Probe | `iotsploit_exploits.uds.probe` | Generic UDS probing over DoIP |
+| DoIP Configuration DIDs | `iotsploit_exploits.doip.configuration_dids` | Read ZXD configuration data identifiers |
+| DoIP UDS 0x27 Authentication | `iotsploit_exploits.doip.authentication` | SecurityAccess with the local FastSA profile |
+| SOME/IP Discovery | `iotsploit_exploits.someip.someip_discover` | Record the service instances a segment announces |
+| SOME/IP Call | `iotsploit_exploits.someip.someip_call` | Call one SOME/IP method and decode the reply |
+| CAN Frame Composer | `iotsploit_exploits.canbus.frame_composer` | Compose and send CAN frames |
+| CAN Live Capture | `iotsploit_exploits.canbus.live_capture` | Bounded capture decoded against the target's definitions |
+| IP Scan | `iotsploit_exploits.ip_scan.ip_scan` | IP network scanner |
+| Nmap Scan | `iotsploit_exploits.nmap_scan.nmap_scan` | Nmap-based port scanner |
+| WiFi Scan | `iotsploit_exploits.wifi_scan.wifi_scan` | WiFi network scanner |
+| Flood Attack | `iotsploit_exploits.flood_attack.flood_attack` | ICMP/UDP/TCP/MAC flood against an ECU |
+| SYN Flood | `iotsploit_exploits.flood_attack.syn_flood_attack` | TCP SYN flood |
+| ADB Check | `iotsploit_exploits.adb_check.adb_check` | Android Debug Bridge security check |
+| Hydra SSH | `iotsploit_exploits.hydra_ssh_attack` | Hydra SSH credential attack |
+| SSH Plugin | `iotsploit_exploits.plugin_ssh` | SSH connection plugin |
+| Serial Reader | `iotsploit_exploits.serial.picocom_serial_reader` | Picocom serial reader |
+| GreatFET Echo | `iotsploit_exploits.greatfet_echo` | FTDI echo emulation |
+| Rubber Duck | `iotsploit_exploits.greatfet_rubber_duck` | USB rubber duck (GreatFET) |
+| Simple Rubber Duck | `iotsploit_exploits.simple_rubber_duck` | Simplified USB rubber duck |
+
+## System Tool Dependencies
+
+Some plugins require system-level tools (not installable via pip):
+
+- **nmap_scan**: Requires `nmap` (`apt install nmap`)
+- **hydra_ssh_attack**: Requires `hydra` (`apt install hydra`)
+- **adb_check**: Requires `adb` (`apt install android-tools-adb`)
+
+## Installation
+
+```bash
+pip install iotsploit-exploits
+```
+
+For development:
+
+```bash
+pip install -e ./iotsploit-exploits
+```
+

iotsploit_exploits-0.0.9/README.md

@@ -0,0 +1,59 @@
+# iotsploit-exploits
+
+Official IoTSploit exploit plugin package. Contains all built-in exploit/security testing plugins.
+
+## Included Plugins
+
+Every plugin is registered as an `iotsploit.exploit_plugins` entry point in
+`pyproject.toml`; a plugin that is not registered cannot be run.
+
+The `demo_*` plugins are the reference gallery — one per framework capability,
+small enough to read, safe to run anywhere. Start there when writing a plugin,
+and see `docs/writing-plugins.md` for which file teaches what.
+
+| Plugin | Module | Description |
+|--------|--------|-------------|
+| Observations Demo | `iotsploit_exploits.demo.observations` | Reference: parameters, target reading, recording observations |
+| Interactive Demo | `iotsploit_exploits.demo.interactive` | Reference: operator prompts |
+| Async Demo | `iotsploit_exploits.demo.async_run` | Reference: long-running work, progress, cooperative stop |
+| Stream Demo | `iotsploit_exploits.demo.stream` | Reference: streaming live data to the UI |
+| Privileged Helper Check | `iotsploit_exploits.demo.privileged` | Reference: the bounded privileged helper |
+| UDS Probe | `iotsploit_exploits.uds.probe` | Generic UDS probing over DoIP |
+| DoIP Configuration DIDs | `iotsploit_exploits.doip.configuration_dids` | Read ZXD configuration data identifiers |
+| DoIP UDS 0x27 Authentication | `iotsploit_exploits.doip.authentication` | SecurityAccess with the local FastSA profile |
+| SOME/IP Discovery | `iotsploit_exploits.someip.someip_discover` | Record the service instances a segment announces |
+| SOME/IP Call | `iotsploit_exploits.someip.someip_call` | Call one SOME/IP method and decode the reply |
+| CAN Frame Composer | `iotsploit_exploits.canbus.frame_composer` | Compose and send CAN frames |
+| CAN Live Capture | `iotsploit_exploits.canbus.live_capture` | Bounded capture decoded against the target's definitions |
+| IP Scan | `iotsploit_exploits.ip_scan.ip_scan` | IP network scanner |
+| Nmap Scan | `iotsploit_exploits.nmap_scan.nmap_scan` | Nmap-based port scanner |
+| WiFi Scan | `iotsploit_exploits.wifi_scan.wifi_scan` | WiFi network scanner |
+| Flood Attack | `iotsploit_exploits.flood_attack.flood_attack` | ICMP/UDP/TCP/MAC flood against an ECU |
+| SYN Flood | `iotsploit_exploits.flood_attack.syn_flood_attack` | TCP SYN flood |
+| ADB Check | `iotsploit_exploits.adb_check.adb_check` | Android Debug Bridge security check |
+| Hydra SSH | `iotsploit_exploits.hydra_ssh_attack` | Hydra SSH credential attack |
+| SSH Plugin | `iotsploit_exploits.plugin_ssh` | SSH connection plugin |
+| Serial Reader | `iotsploit_exploits.serial.picocom_serial_reader` | Picocom serial reader |
+| GreatFET Echo | `iotsploit_exploits.greatfet_echo` | FTDI echo emulation |
+| Rubber Duck | `iotsploit_exploits.greatfet_rubber_duck` | USB rubber duck (GreatFET) |
+| Simple Rubber Duck | `iotsploit_exploits.simple_rubber_duck` | Simplified USB rubber duck |
+
+## System Tool Dependencies
+
+Some plugins require system-level tools (not installable via pip):
+
+- **nmap_scan**: Requires `nmap` (`apt install nmap`)
+- **hydra_ssh_attack**: Requires `hydra` (`apt install hydra`)
+- **adb_check**: Requires `adb` (`apt install android-tools-adb`)
+
+## Installation
+
+```bash
+pip install iotsploit-exploits
+```
+
+For development:
+
+```bash
+pip install -e ./iotsploit-exploits
+```

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "iotsploit-exploits"
-version = "0.0.7"
+version = "0.0.9"
 description = "Official IoTSploit exploit plugin package"
 authors = ["IoTSploit Team <support@iotsploit.org>"]
 license = "GPL-3.0-or-later"
@@ -10,13 +10,15 @@ include = [
     { path = "src/iotsploit_exploits/rubber_duck_scripts/*.txt", format = ["sdist", "wheel"] },
     { path = "src/iotsploit_exploits/hydra_cracker/*.txt", format = ["sdist", "wheel"] },
 ]
+exclude = ["src/iotsploit_exploits/oem/**"]
 
 [tool.poetry.dependencies]
 python = ">=3.10,<4.0"
 iotsploit-core = "*"
 iotsploit-django = "*"
+iotsploit-protocols = "*"
 scapy = ">=2.5"
-pwntools = ">=4.12"
+paramiko = ">=3.0"
 pyserial = ">=3.5"
 # Bare ">=3.0" also matches legacy FaceDancer 2019.x releases under PEP 440.
 # Keep this on the 3.x line so the exploit imports resolve to the expected API.
@@ -28,15 +30,28 @@ syn_flood_attack = "iotsploit_exploits.flood_attack.syn_flood_attack:SynFloodAtt
 wifi_scan = "iotsploit_exploits.wifi_scan.wifi_scan:WifiScanPlugin"
 ip_scan = "iotsploit_exploits.ip_scan.ip_scan:IPScanPlugin"
 nmap_scan = "iotsploit_exploits.nmap_scan.nmap_scan:NmapScanPlugin"
+can_frame_composer = "iotsploit_exploits.canbus.frame_composer:CanFrameComposerPlugin"
+can_live_capture = "iotsploit_exploits.canbus.live_capture:CanLiveCapturePlugin"
+someip_discover = "iotsploit_exploits.someip.someip_discover:SomeIpDiscoverPlugin"
+someip_call = "iotsploit_exploits.someip.someip_call:SomeIpCallPlugin"
 adb_check = "iotsploit_exploits.adb_check.adb_check:AdbSecurityCheckPlugin"
 hydra_ssh_attack = "iotsploit_exploits.hydra_ssh_attack:HydraSSHAttackPlugin"
 plugin_ssh = "iotsploit_exploits.plugin_ssh:SSHPlugin"
+uds_probe = "iotsploit_exploits.uds.probe:UdsProbePlugin"
+doip_configuration_dids = "iotsploit_exploits.doip.configuration_dids:DoipConfigurationDidsPlugin"
+doip_27_authentication = "iotsploit_exploits.doip.authentication:Doip27AuthenticationPlugin"
 picocom_serial_reader = "iotsploit_exploits.serial.picocom_serial_reader:PicocomSerialReaderPlugin"
 greatfet_echo = "iotsploit_exploits.greatfet_echo:FTDIEchoPlugin"
 greatfet_rubber_duck = "iotsploit_exploits.greatfet_rubber_duck:RubberDuckPlugin"
 simple_rubber_duck = "iotsploit_exploits.simple_rubber_duck:SimpleRubberDuckPlugin"
-async_sleep_attack = "iotsploit_exploits.demo.async_sleep_attack:AsyncSleepAttackPlugin"
-stream_data_attack = "iotsploit_exploits.demo.stream_data_attack:StreamDataAttackPlugin"
+
+# The reference gallery: one plugin per framework capability. Grouped by
+# prefix so they sort together wherever plugins are listed.
+demo_async = "iotsploit_exploits.demo.async_run:AsyncDemoPlugin"
+demo_interactive = "iotsploit_exploits.demo.interactive:InteractiveDemoPlugin"
+demo_observations = "iotsploit_exploits.demo.observations:ObservationDemoPlugin"
+demo_privileged = "iotsploit_exploits.demo.privileged:PrivilegedDemoPlugin"
+demo_stream = "iotsploit_exploits.demo.stream:StreamDemoPlugin"
 
 [build-system]
 requires = ["poetry-core>=1.8.0"]

{iotsploit_exploits-0.0.7 → iotsploit_exploits-0.0.9}/src/iotsploit_exploits/adb_check/adb_check.py

@@ -1,9 +1,5 @@
 #!/usr/bin/python3
 
-import os
-# Disable pwntools terminal mode before importing to prevent fileno() errors in non-TTY environments
-os.environ.setdefault("PWNLIB_NOTERM", "1")
-
 import logging
 import traceback
 import pluggy
@@ -11,13 +7,13 @@ from iotsploit_django.tools.adb_mgr import ADB_Mgr
 from iotsploit_django.tools.doip_mgr import DoIP_Mgr
 from iotsploit_core.core.exploit_spec import ExploitResult
 from iotsploit_core.core.base_plugin import BasePlugin
-from iotsploit_core.utils import iots_logger
 from typing import Optional, List, Dict, Any
 
-logger = iots_logger.get_logger("adb_check")
+logger = logging.getLogger(__name__)
 hookimpl = pluggy.HookimplMarker("exploit_mgr")
 
 class AdbSecurityCheckPlugin(BasePlugin):
+    REQUIRES = ("binary:adb",)
     def __init__(self):
         super().__init__({
             'Name': 'ADB Security Check',
@@ -88,7 +84,6 @@ class AdbSecurityCheckPlugin(BasePlugin):
         try_root = params.get('try_root', False)
         check_suid = params.get('check_suid', True)
         check_writable = params.get('check_writable', True)
-        skip_interactive = params.get('skip_interactive', True)
         
         # If target is provided, try to get the device from it
         if target:
@@ -295,7 +290,7 @@ class AdbSecurityCheckPlugin(BasePlugin):
             
             # If root is required but we know we don't have it, don't even try
             if require_root and self._has_root is False:
-                logger.debug(f"Root access required for command but device is not rooted")
+                logger.debug("Root access required for command but device is not rooted")
                 return None
                 
             # Execute the command

iotsploit_exploits-0.0.9/src/iotsploit_exploits/canbus/__init__.py

@@ -0,0 +1,8 @@
+"""Official CAN plugins: compose one frame, and watch a bus.
+
+Both are thin. The catalogue, the codec, and the SocketCAN clients live in
+``iotsploit_protocols.canbus``; what belongs here is policy -- which requests
+are allowed, what has to be confirmed first, and what a result may claim.
+"""
+
+from __future__ import annotations

iotsploit_exploits-0.0.9/src/iotsploit_exploits/canbus/frame_composer.py

@@ -0,0 +1,414 @@
+"""Encode a target-defined CAN frame, and optionally put one on the wire.
+
+The safety shape of this plugin is the whole design, so it is worth stating
+plainly rather than leaving it to be inferred from the code:
+
+*Preview is the default and touches no hardware.* It resolves, encodes, and
+returns the exact bytes. It does not import ``python-can`` and does not open a
+socket, so it works on a host with no CAN interface at all.
+
+*Transmit requires a digest from the preview that produced those bytes.* The
+digest covers the target, the frame definition, the normalized values, the
+resulting bytes, and the physical channel. If the target was re-imported
+between preview and transmit -- a signal rescaled, a DLC corrected -- the
+recomputed digest differs and the send is refused rather than silently putting
+different bytes on the wire than the operator approved.
+
+The digest is a consistency guard and nothing more. It is not authorization, it
+is not a one-time token, and repeating a confirmed API call sends another
+frame. Authentication and rate limiting are platform-wide gaps that this
+feature must not pretend to fill.
+
+Sending on an interface that is already up needs no privileged helper verb;
+bringing an interface up is explicitly not this plugin's job.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+from datetime import datetime, timezone
+from typing import Any, Dict, Mapping, Optional, Tuple
+
+import pluggy
+from iotsploit_core.core.base_plugin import BasePlugin
+from iotsploit_core.core.exploit_spec import ExploitResult
+from iotsploit_protocols.canbus import TargetCanCatalog, decode_frame, encode_frame
+from iotsploit_protocols.canbus.definitions import EncodedFrame, FrameDefinition
+from iotsploit_protocols.canbus.errors import CanDefinitionError, CanValueError
+from iotsploit_protocols.canbus.socketcan import (
+    CanTransportError,
+    SocketCanClient,
+    SocketCanConfig,
+)
+from iotsploit_protocols.errors import NotConfigured
+
+logger = logging.getLogger(__name__)
+hookimpl = pluggy.HookimplMarker("exploit_mgr")
+
+SCHEMA_VERSION = 1
+PREVIEW = "preview"
+TRANSMIT = "transmit"
+DEFAULT_TIMEOUT_MS = 1000
+
+
+class RequestError(ValueError):
+    """The request itself is malformed, before any target is consulted."""
+
+    def __init__(self, message: str, field_errors: Optional[Dict[str, str]] = None) -> None:
+        self.field_errors = dict(field_errors or {})
+        super().__init__(message)
+
+
+def normalize_request(raw: Any) -> Dict[str, Any]:
+    """Accept the request as an object or as JSON text, then validate its shape.
+
+    The string form is not a second contract: it is the same schema, and it
+    exists because the CLI renders an unknown parameter type as a text field.
+    Normalizing here means one validation path afterwards rather than two that
+    drift.
+    """
+    if isinstance(raw, str):
+        text = raw.strip()
+        if not text:
+            raise RequestError("no request supplied")
+        try:
+            raw = json.loads(text)
+        except (ValueError, RecursionError) as error:
+            # Neither of these is a JSONDecodeError, and both come out of
+            # json.loads on input a person can send: a number with more than
+            # 4300 digits fails inside int() as a plain ValueError, and a
+            # document nested a thousand deep exhausts the stack because the
+            # decoder recurses per level. Catching only the subclass let both
+            # escape a function whose contract is that nothing but
+            # RequestError does.
+            raise RequestError(f"request is not valid JSON: {error}") from error
+
+    if not isinstance(raw, Mapping):
+        raise RequestError(
+            f"request must be an object or a JSON object string, not {type(raw).__name__}"
+        )
+
+    version = raw.get("schema_version")
+    if version != SCHEMA_VERSION:
+        raise RequestError(
+            f"unsupported request schema_version {version!r}; this plugin speaks {SCHEMA_VERSION}"
+        )
+
+    operation = raw.get("operation", PREVIEW)
+    if operation not in (PREVIEW, TRANSMIT):
+        raise RequestError(f"operation must be {PREVIEW!r} or {TRANSMIT!r}, not {operation!r}")
+
+    frame = raw.get("frame")
+    if not isinstance(frame, Mapping):
+        raise RequestError("request.frame must be an object naming the bus and frame")
+
+    for key in ("bus_id", "frame_id"):
+        if frame.get(key) is None:
+            raise RequestError(f"request.frame.{key} is required")
+
+    frame_id = frame.get("frame_id")
+    if isinstance(frame_id, str):
+        try:
+            frame_id = int(frame_id, 16) if frame_id.lower().startswith("0x") else int(frame_id)
+        except ValueError:
+            raise RequestError(f"request.frame.frame_id {frame_id!r} is not a number") from None
+    if not isinstance(frame_id, int) or isinstance(frame_id, bool):
+        raise RequestError("request.frame.frame_id must be an integer")
+
+    signals = raw.get("signals", {})
+    if not isinstance(signals, Mapping):
+        raise RequestError("request.signals must be an object of signal name to value")
+
+    transport = raw.get("transport") or {}
+    if not isinstance(transport, Mapping):
+        raise RequestError("request.transport must be an object")
+
+    interface = transport.get("interface", "socketcan")
+    if interface != "socketcan":
+        raise RequestError(f"transport.interface {interface!r} is not supported; use 'socketcan'")
+
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "operation": operation,
+        "bus_id": str(frame["bus_id"]),
+        "frame_id": frame_id,
+        "is_extended": bool(frame.get("is_extended", False)),
+        "expected_name": frame.get("name") or None,
+        "signals": dict(signals),
+        "interface": interface,
+        "channel": transport.get("channel"),
+        "timeout_ms": transport.get("timeout_ms", DEFAULT_TIMEOUT_MS),
+        "allow_draft_target": bool(raw.get("allow_draft_target", False)),
+        "preview_digest": raw.get("preview_digest"),
+    }
+
+
+def _stable(value: Any) -> Any:
+    """Everything as text, so a digest cannot depend on int-versus-float typing.
+
+    The point of the digest is to answer "is this the same request over the same
+    definitions". Two runs that produce 3 and 3.0 for one signal describe the
+    same frame, and a guard that intermittently disagrees with itself is worse
+    than no guard: it fails closed at random and teaches the operator to
+    distrust it.
+    """
+    if isinstance(value, Mapping):
+        return {str(k): _stable(v) for k, v in sorted(value.items(), key=lambda kv: str(kv[0]))}
+    if isinstance(value, (list, tuple)):
+        return [_stable(v) for v in value]
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if value is None:
+        return None
+    return str(value)
+
+
+def compute_digest(
+    *,
+    target_id: str,
+    target_status: str,
+    bus_id: str,
+    definition: FrameDefinition,
+    encoded: EncodedFrame,
+    channel: Optional[str],
+) -> str:
+    """A digest over everything that decides what reaches the wire.
+
+    Serialized with sorted keys, because a digest taken over incidental dict
+    ordering compares unequal for an unchanged request and turns the guard into
+    an intermittent refusal to transmit.
+    """
+    payload = _stable(
+        {
+            "schema_version": SCHEMA_VERSION,
+            "target": {"target_id": target_id, "status": target_status},
+            "bus_id": bus_id,
+            "definition": list(definition.encoding_key()),
+            "signals": encoded.signals,
+            "frame": {
+                "frame_id": encoded.frame_id,
+                "is_extended": encoded.is_extended,
+                "is_fd": encoded.is_fd,
+                "dlc": encoded.dlc,
+                "data_hex": encoded.data_hex,
+            },
+            "transport": {"interface": "socketcan", "channel": channel},
+        }
+    )
+    blob = json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=True)
+    return "sha256:" + hashlib.sha256(blob.encode("utf-8")).hexdigest()
+
+
+def _target_field(target: Any, name: str, default: Any = None) -> Any:
+    if isinstance(target, Mapping):
+        return target.get(name, default)
+    return getattr(target, name, default)
+
+
+def build_preview(
+    target: Any, request: Mapping[str, Any]
+) -> Tuple[Dict[str, Any], FrameDefinition, EncodedFrame]:
+    """Resolve, encode, and describe -- without touching any transport."""
+    target_id = _target_field(target, "target_id")
+    if not target_id:
+        raise RequestError("no target was supplied to the plugin")
+    target_status = str(_target_field(target, "status", "unknown") or "unknown")
+
+    catalog = TargetCanCatalog.from_target(target)
+    bus = catalog.bus(request["bus_id"])
+    definition = catalog.resolve(
+        request["bus_id"],
+        request["frame_id"],
+        request["is_extended"],
+        expected_name=request["expected_name"],
+    )
+    encoded = encode_frame(definition, request["signals"])
+
+    warnings = []
+    if target_status != "active":
+        warnings.append(
+            f"target {target_id!r} is {target_status!r}, not active; its CAN topology "
+            "may be an incomplete extract rather than the whole vehicle"
+        )
+    if bus.conflicts:
+        warnings.append(
+            f"{len(bus.conflicts)} other frames on this bus have conflicting definitions"
+        )
+
+    # Read the bytes back through the decoder. This is the one genuinely useful
+    # thing the inverse buys at preview time: it says what the frame states,
+    # rather than repeating what the operator typed.
+    read_back = decode_frame(definition, encoded.data)
+    if not read_back.ok:
+        warnings.append(f"encoded payload did not decode cleanly: {read_back.reason}")
+    elif read_back.reason:
+        warnings.append(read_back.reason)
+
+    digest = compute_digest(
+        target_id=str(target_id),
+        target_status=target_status,
+        bus_id=request["bus_id"],
+        definition=definition,
+        encoded=encoded,
+        channel=request["channel"],
+    )
+
+    data = {
+        "operation": request["operation"],
+        "target": {"target_id": str(target_id), "status": target_status},
+        "bus": {"bus_id": bus.bus_id, "name": bus.name},
+        "frame": {
+            "name": encoded.name,
+            "frame_id": encoded.frame_id,
+            "frame_id_hex": f"0x{encoded.frame_id:X}",
+            "is_extended": encoded.is_extended,
+            "is_fd": encoded.is_fd,
+            "dlc": encoded.dlc,
+            "data_hex": encoded.data_hex,
+            "owner_kind": definition.owner_kind,
+            "component_id": definition.component_id,
+        },
+        "signals": dict(encoded.signals),
+        "decoded": dict(read_back.signals) if read_back.ok else {},
+        "transport": {
+            "interface": "socketcan",
+            "channel": request["channel"],
+            "timeout_ms": request["timeout_ms"],
+        },
+        "preview_digest": digest,
+        "warnings": warnings,
+    }
+    return data, definition, encoded
+
+
+class CanFrameComposerPlugin(BasePlugin):
+    REQUIRES = ("platform:linux", "module:can")
+    def __init__(self):
+        super().__init__(
+            {
+                "Name": "CAN Frame Composer",
+                "Description": (
+                    "Encode target-defined signals and optionally send one SocketCAN "
+                    "frame. Preview never touches hardware; transmitting requires a "
+                    "matching preview digest and sends exactly one frame."
+                ),
+                "License": "GPL",
+                "Author": ["iotsploit"],
+                "Interactive": False,
+                "Parameters": {
+                    "request": {
+                        "type": "target_can_frame",
+                        "schema_version": SCHEMA_VERSION,
+                        "required": True,
+                        "description": (
+                            "Target CAN frame, signal values, transport, and operation."
+                        ),
+                    }
+                },
+            }
+        )
+
+    @hookimpl
+    def initialize(self, device_plugin: Any | None = None):
+        logger.debug("Initializing CanFrameComposerPlugin")
+
+    @hookimpl
+    def execute(
+        self, target: Any | None = None, parameters: dict | None = None
+    ) -> ExploitResult:
+        try:
+            request = normalize_request((parameters or {}).get("request"))
+        except RequestError as error:
+            return ExploitResult(False, str(error), {"field_errors": error.field_errors})
+
+        try:
+            data, definition, encoded = build_preview(target, request)
+        except CanValueError as error:
+            return ExploitResult(False, str(error), {"field_errors": error.field_errors})
+        except (CanDefinitionError, RequestError, NotConfigured) as error:
+            return ExploitResult(False, str(error), {})
+
+        if request["operation"] == PREVIEW:
+            return ExploitResult(
+                True, f"Encoded {data['frame']['name']} as {encoded.data_hex}", data
+            )
+
+        return self._transmit(request, data, encoded)
+
+    def _transmit(
+        self,
+        request: Mapping[str, Any],
+        data: Dict[str, Any],
+        encoded: EncodedFrame,
+    ) -> ExploitResult:
+        supplied = request.get("preview_digest")
+        if not supplied:
+            return ExploitResult(
+                False,
+                "transmitting requires the digest from a preview of this exact request",
+                data,
+            )
+        if supplied != data["preview_digest"]:
+            return ExploitResult(
+                False,
+                "the target or the request changed since this frame was previewed; "
+                "preview again and confirm the new bytes before sending",
+                data,
+            )
+
+        if data["target"]["status"] != "active" and not request["allow_draft_target"]:
+            return ExploitResult(
+                False,
+                f"target is {data['target']['status']!r}, not active; sending to a "
+                "draft target needs an explicit acknowledgement",
+                data,
+            )
+
+        channel = request.get("channel")
+        if not channel:
+            return ExploitResult(
+                False,
+                "no SocketCAN interface was chosen; pick one of the scanned CAN "
+                "devices, using its interface name such as 'can0'",
+                data,
+            )
+
+        try:
+            timeout = max(float(request["timeout_ms"]) / 1000.0, 0.001)
+            config = SocketCanConfig(
+                channel=str(channel), timeout=timeout, fd=encoded.is_fd
+            )
+        except (NotConfigured, TypeError, ValueError) as error:
+            return ExploitResult(False, str(error), data)
+
+        try:
+            with SocketCanClient(config) as client:
+                client.send(encoded)
+        except (CanTransportError, NotConfigured, OSError) as error:
+            return ExploitResult(False, str(error), data)
+
+        sent_at = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+        data = {**data, "operation": TRANSMIT, "sent": True, "sent_at": sent_at}
+
+        # The audit record. Deliberately says the socket accepted the frame and
+        # stops there: nothing here knows whether an ECU saw it.
+        logger.info(
+            "CAN frame composer: target=%s bus=%s frame=0x%X ext=%s fd=%s "
+            "channel=%s payload=%s -> accepted by local socket",
+            data["target"]["target_id"],
+            data["bus"]["bus_id"],
+            encoded.frame_id,
+            encoded.is_extended,
+            encoded.is_fd,
+            channel,
+            encoded.data_hex,
+        )
+        return ExploitResult(
+            True,
+            f"Sent {encoded.name} (0x{encoded.frame_id:X}) on {channel}: "
+            f"{encoded.data_hex}. The local socket accepted the frame; this does "
+            "not confirm any ECU received or acted on it.",
+            data,
+        )