浣跨敤HackRF鎴栬匯TL-SDR鍔犲彉棰戝櫒錛岄偅鏄瀬濂界殑錛屼絾鏄垜鏈緇堥渶瑕佹妸鎵鏈変笢瑗塊兘鎵撳寘鍒頒竴涓皬絀洪棿閲岄潰銆?/p>
鍙弬鑰冨彟涓涓〉闈細(xì)Travis Goodspeed, 浣滆呬笉浠呭梾鎺簡(jiǎn)綾諱技鐨勯敭鐩?Microsoft Comfort Desktop 5000), 榪樻紨紺轟簡(jiǎn)鎬庝箞鏍?span style="line-height: 25.6000003814697px;">鐢ㄤ粬鐨勪竴涓彨GoodFET鐨勮澶囧拰python鐨勮剼鏈?/span>goodfet.nrf錛?span style="line-height: 25.6000003814697px;">鍘?/span>璁?nRF24L01+ 鑺墖鍡呮帰 2.4GHz 鐨勬暟鎹?/span>.
Travis鍙戠幇鍡呮帰璇ヨ澶囧瓨鍦ㄥ涓毦鐐癸紝涓嶄粎鐜板湪闇瑕佹寚瀹氶閬擄紙棰戠巼錛夛紝鑰屼笖榪橀渶瑕佹寚瀹歁AC鍦板潃銆俷RF鑺墖鍙彁渚涘彂閫佸埌鎸囧畾MAC鍦板潃鐨勬暟鎹寘銆傛澶栵紝nRF鑺墖涓嶄細(xì)鍙戦丮AC鍦板潃鏁版嵁錛屽洜涓轟綘宸茬粡鎸囧畾浜?(鍦?code style="box-sizing: border-box; font-family: Consolas, 'Liberation Mono', Menlo, Courier, monospace; font-size: 13.6000003814697px; padding: 0.2em 0px; margin: 0px; border-radius: 3px; background-color: rgba(0, 0, 0, 0.0392157);">RX_ADDR_P[0-5]6涓閬撲腑鐨勪竴涓?/code>)銆?/p>
Travis鍙戠幇鍦ㄦ寚瀹歁AC闀垮害鐨勬椂鍊欙紝鍦ㄦ墜鍐屼腑涓篠ETUP_AW錛屽綋璁劇疆涓?#8216;0’鐨勬椂鍊欒璁や負(fù)鏄潪娉曠殑錛?/span>
'00' - Illegal
'01' - 3 bytes
'10' - 4 bytes
'11' – 5 bytes
浣嗘槸瀹為檯璁劇疆MAC鍦板潃涓轟袱涓瓧鑺傦紝騫朵笖鎶奙AC璁劇疆鍦╬reamble鐨勪綅緗?0x00AA or 0x0055, in binary 0000000010101010 or 0000000001010101
), 灝辮兘嬈洪獥璁懼鍦ㄦ暟鎹儴鍒嗛鍏堟彁渚涘畬鏁寸殑MAC鍦板潃緇欐垜浠紝璇峰弬鑰冭繖綃囩鍫′簡(jiǎn)鐨?a style="box-sizing: border-box; color: #4183c4; text-decoration: none; background-image: initial; background-attachment: initial; background-size: initial; background-origin: initial; background-clip: initial; background-position: initial; background-repeat: initial;">鏂囩珷瀛︿範(fàn)鍏蜂綋緇嗚妭銆?/p>
铏界劧鐜板湪鎴戜滑鍙互浣跨敤GoodFET錛岀數(shù)鑴戝姞nRF24L01+鏉ュ仛鍡呮帰嫻嬭瘯錛屼絾鏄渶緇堟垜浠繕鏄笇鏈涜兘澶熺敤涓濂椾究瀹滅殑宓屽叆寮忚澶囨潵瀹炵幇姝ゅ姛鑳姐傛垜浠彲浠ヤ嬌鐢═ravis鐨勭爺絀舵垚鏋滐紝浣跨敤鍦ㄥ井鎺у埗鍣?宓屽叆寮廋紼嬪簭鏉ュ疄鐜版墍鏈夊姛鑳姐?/p>
鍙﹀錛屾垜浠仛浜?jiǎn)涓浜涙敼榪涖?Goodfet.nrf 鍛婅瘔鎴戜滑鎬庢牱鎵弿鎴戜滑鎯寵鐩戝惉鐨勮澶囷細(xì)
榪欐剰鍛崇潃鎵弿涓涓畬鏁寸殑棰戠巼鑼冨洿闇瑕佸ぇ綰?5鍒嗛挓錛?and at least several keystrokes must be pressed while we're sniffing within the correct 10 second period. ) 鍦ㄤ粩緇嗗涔?fàn)浜?jiǎn)Travis鐨勭爺絀訛紝KeyKeriki 鐨勯」鐩紝浠ュ強(qiáng)嫻嬭瘯浜?jiǎn)鎴戠殑閿洏锛屾垜浠彲浠ュ仛涓浜涙敼榪涳細(xì)
0xAA (10101010)
鍥犱負(fù)0xAA鍚庨潰姘歌繙璺熺殑鏄? (0xCD 浜岃繘鍒?11001101
)浠ヤ繚鎸佹瘮鐗逛綅浜ゆ浛錛岃繖鏍峰張鍔犲揩浜?jiǎn)涓鍊嶇殑鎼滅儲(chǔ)閫熷害銆?/li>Thorsten Schröder 鍜?Max Moser 璁捐浜?jiǎn)涓涓鍫′簡(jiǎn)鐨勪笢涓?nbsp;KeyKeriki, 鑳藉鐩戝惉寰蔣閿洏錛屽畬鍏ㄩ嗗悜浜?jiǎn)瑙e瘑鐨剺q囩▼騫朵笖鍋氫簡(jiǎn)涓澶囪兘澶熷畬鍏ㄥ疄鐜拌繖浜涖傜劧鑰岋紝浠栦滑鐨勮澶囬渶瑕佷袱涓棤綰跨數(shù)鍜屼竴涓珮绔井澶勭悊鍣紝鏉ユ崟鑾峰拰瑙f瀽浠?Mbps閫氫俊鐨勯敭鐩樿澶囦駭鐢熺殑鏁版嵁銆俆ravis鐨勯」鐩櫧鐒剁墰閫鹼紝浣嗘槸闇瑕佷竴鍙扮數(shù)鑴戜富鏈猴紝鑰屼笖瀵逛簬鎴戜滑縐樺瘑鎵ц浠誨姟錛岃繖濂楄澶囪繕鏄お澶т簡(jiǎn)錛屽洜姝ゆ垜浠敼榪涗簡(jiǎn)璁捐錛岀幇鍦ㄥ彧闇瑕佷竴涓粔浠鋒棤綰跨數(shù)鍜屼竴涓井澶勭悊鍣紝鍔熻椾綆鑰屼笖浣撶Н灝忥紝涓嶅啀闇瑕佺數(shù)鑴戝拰鍏朵粬鏃犵嚎鐢?shù)璁惧銆?/p>
Thorsten 鍜?Max 鍙戠幇榪欎釜鍑婚敭鍙槸浣跨敤ECB妯″紡綆鍗曠殑鍜?span style="line-height: 25.6000003814697px;">MAC鍦板潃寮傛垨鍔犲瘑 , 鎴戜滑鍙互浣跨敤Travis鐨勬柟娉曞埄鐢╪RF24L01+鏉ュ梾鎺㈠拰鑾峰彇MAC鍦板潃錛岃繖縐嶅姞瀵嗘柟娉曠浉褰撲簬鍙槸鎶婃墤鍏嬬墝鍒囦簡(jiǎn)涓嬈°?/span>
緇忚繃榪涗竴姝ヨ皟鏌ュ彂鐜幫紝鎴戜滑鐜板湪鐭ラ亾鎵鏈夊井杞敭鐩樼殑MAC鍦板潃閮芥槸浠?xCD寮濮嬬殑錛屽疄闄呮寜閿紙涓嬪浘姍欒壊閮ㄥ垎錛夋伆濂戒笌MAC鍦板潃絎竴涓瓧鑺傚榻愶紝榪欏氨鏄鍗充嬌鎴戜滑涓嶇煡閬撳畬鏁寸殑MAC鍦板潃錛屾垜浠緷鐒惰兘澶熻В瀵嗘寜閿秷鎭紝鍥犱負(fù)榪欎釜瀵歸綈鏄笉浼?xì)鍙樼殑锛孧AC鍦板潃寮澶翠竴涓瓧鑺?xCD涔熸槸涓嶅彉鐨勩?/p>
鐢變簬鏁版嵁鍖呭姞瀵嗛儴鍒嗙殑闀垮害鏄?1涓瓧鑺傦紝鑰孧AC鍦板潃鍗?涓瓧鑺傦紝CRC鏍¢獙鏄瘡涓瓧鑺傚仛錛屽紓鎴栵紙鍔犲瘑鍓嶏級(jí)錛屼綘浼?xì)鍙戠庮C竴浜涙湁鎰忔濈殑浜嬫儏錛岀敱浜嶮AC鍦板潃琚紓鎴栦簡(jiǎn)涓ゆ錛屾垜浠兘澶熷湪涓嶉渶瑕佺煡閬撳畬鏁碝AC鍦板潃鐨勬儏鍐典笅璁$畻鏍¢獙鍊鹼紝榪欐槸鍥犱負(fù)MAC琚紓鎴栦袱嬈★紝灝辯浉褰撲簬浠涔堥兘娌″仛錛岃岀11涓瓧鑺傚張鏄疢AC鍦板潃鐨勭涓涓瓧鑺傦紝鎴戜滑鐭ラ亾鏄?xCD銆傛牴鎹繖涓壒鎬ф垜浠彲浠ヨ繘琛屼竴浜涘叾浠栫殑鏀誨嚮錛屾瘮濡傛洿鏀規(guī)寜閿拰CRC鏍¢獙錛屽悓鏍蜂笉闇瑕佺煡閬揗AC鍦板潃錛岃繖灝嗕細(xì)鍦ㄦ垜浠ュ悗鐨勯」鐩仛鐩稿叧婕旂ず銆?/p>
KeyKeriki 欏圭洰涓殑涓欏墊紨紺轟簡(jiǎn)瑙e瘑榪囩▼錛?/p>
KeySweeper鐨勮В瀵嗛儴鍒嗕唬鐮?
// decrypt those keyboard packets!
void decrypt(uint8_t* pkt)
{
// our encryption key is the 5-byte MAC address and
// starts 4 bytes in (4-byte header is unencrypted)
for (int i = 4; i < 15; i++)
pkt[i] ^= mac >> (((i - 4) % 5) * 8) & 0xFF;
}
鍘熸枃錛?span style="font-family: monospace; font-size: medium; line-height: normal; white-space: pre-wrap;">KeySweeper