Tuesday, October 5, 2010

CC1110 Instrumentation with Python

by Travis Goodspeed <travis at radiantmachines.com>
concerning the GirlTech IMME,
utilizing the GoodFET's Chipcon Debugger
to instrument Michael Ossmann's $16 Pocket Spectrum Analyzer.


Kenwood Spectrum, Overlay

Often a neighbor, such as myself, finds himself with a damned useful tool that's missing logging. Further, when this is a black-box application, it is undeniably inconvenient to patch in logging where no communications method exists. In this brief article, I will demonstrate how to instrument a Chipcon CC1110 application using Python and a GoodFET with zero bytes of modification to the original firmware image. My target's source code is available, but the technique applies just as well to black-box firmware.

Specifically, I want to dump the raw data from Michael Ossmann's $16 Pocket Spectrum Analyzer in order to demo it on stage at our Toorcon 12 talk, Real Men Carry Pink Pagers. I'll assume the reader to be familiar with Mike's article, as well as my article on wiring an IMME for debugging with a GoodFET. Readers wishing to play along can order a GoodFET31 for little or no money by following these instructions.

From the datasheet or Mike's Makefile it can be seen that the external RAM (XDATA, which is called external for historic reasons) section begins at 0xF000. The only structure at this location is xdata channel_info chan_table[NUM_CHANNELS], where NUM_CHANNELS is defined to be 132 and the channel_info struct is eight bytes, defined as
typedef struct {
/* frequency setting */
u8 freq2;
u8 freq1;
u8 freq0;

/* frequency calibration */
u8 fscal3;
u8 fscal2;
u8 fscal1;

/* signal strength */
u8 ss;
u8 max;
} channel_info;


The first several entries in this struct might be as follows. The first of these lines defines the frequency to be 0x22af4b, the frequency calibration to be 0xef2c27, and the signal strength to be 0x41. The final byte defines the maximum strength, which is zero unless max-highlighting mode is turned on.
 22 af 4b ef 2c 27 41 00
22 b1 43 ef 2c 27 3e 00
22 b3 3b ef 2c 27 46 00
22 b5 33 ef 2c 27 3c 00
22 b7 2b ef 2c 27 44 00
22 b9 23 ef 2c 28 3c 00
22 bb 1b ef 2c 28 42 00
22 bd 13 ef 2c 28 3f 00
22 bf 0b ef 2c 28 3d 00
22 c1 03 ef 2c 28 40 00
22 c2 fb ef 2c 28 3d 00
22 c4 f3 ef 2c 28 3e 00
...


This information can be extracted by halting and resuming the CPU, just as I did in my article on the PRNG Vulnerability of Z-Stack's ZigBee SEP ECC implementation. That is, GoodFETCC.CCpeekdatabyte() is used to grab these bytes from the CC1110's RAM. The following code dumped the fragment shown above.
#!/usr/bin/env python 

import sys;

sys.path.append('/Users/travis/svn/goodfet/trunk/client/')

from GoodFETCC import GoodFETCC;
from intelhex import IntelHex16bit, IntelHex;
import time;

client=GoodFETCC();
client.serInit();

client.setup();
client.start();

bytescount=8*132;
bytestart=0xf000;

while 1:
time.sleep(1);
client.CChaltcpu();

dump="";
for foo in range(0,bytescount):
dump=("%s %02x" % (dump,client.CCpeekdatabyte(bytestart+foo)));
if foo%8==7: dump=dump+"\n";
print dump;
sys.stdout.flush();
client.CCreleasecpu();


To get proper data, it is necessary to add a wake-up delay of a few seconds, so that the table is populated by the first sampling. Additionally, it is handy to convert the frequency to MHz from its native unit (Hz/396.728515625). Finally, successive pages should be separated by a time column in order to facilitate graphing. The result is this script, which can be found in the GoodFET project as "contrib/ccspecantap/specantap.py".

An example recording can be seen below, as a spectrum recording of a friend's Kenwood FreeTalk UBZ-AL14 FM Transceiver unit. This is compatible with other family FM radios, and I wanted to know which center frequencies were in use. In the first image, I've highlighted the noise floor as blue and the peaks as green. In the second image, the time domain is used to show broadcasts on several channels in sequence, all of which fall into one of the two center frequencies: 925MHz and 935MHz. The raw data is here, best viewed with NASA's excellent Viewpoints tool.
Kenwood FreeTalk Spectrum
Kenwood FreeTalk Channels

Future additions to this project will include integration into the GoodFET radio framework, as well as a 2.4GHz version built around the CC2430 and CC2530. The performance of the tap can be greatly improved by using block transactions rather than peeking individual bytes, and the view can be re-tuned by poking the configuration IDATA variables, positions of which are described in specan.rst as produced by the SDCC compiler.

It's also handy to know that a Chipcon radio will halt if the 0xA5 opcode is executed. In this manner, patching a single byte of a while() loop can allow the state at every iteration to be dumped.

This technique of scripted debugging through a programmer can be handy for more than instrumentation. Unit tests can be run on an assembly line without additional wiring, and--by single-stepping--execution traces of unknown firmware can be generated for assisting in reverse engineering. Those with enough patience can use this to fuzz test embedded systems for security vulnerabilities.

For help instrumenting your own Chipcon or MSP430 project, join us in #goodfet on irc.freenode.net or send me an email. The project has advanced to the point where interesting things can be done from Python alone, and I'd quite like to see what could be done with it.

25 comments:

Unknown said...

Neat trick. Another way to add logging would be to reverse engineer the link to the Cypress chip on the dongle.

http://blog.hodgepig.org/2010/10/22/im-me-usb-dongle-hacking/

Unknown said...

My cousin recommended this blog and she was totally right keep up the fantastic work!



calibration company

Blogger said...

If you need your ex-girlfriend or ex-boyfriend to come crawling back to you on their knees (no matter why you broke up) you must watch this video
right away...

(VIDEO) Win your ex back with TEXT messages?

Blogger said...

Quantum Binary Signals

Professional trading signals delivered to your mobile phone every day.

Follow our signals right now and profit up to 270% daily.

latesttechnologyblogs said...

Really good information to show through this blog. I really appreciate you for all the valuable information that you are providing us through your blog. python Online course

Roman reigns said...

One thing that always troubled me was that even with the net, most people still don’t tend to address about the topic in this quality.

Structural Analysis
Structural Analysis in USA

Entertaining Game Channel said...

This is Very very nice article. Everyone should read. Thanks for sharing. Don't miss WORLD'S BEST TrainDrivingSimulatorFreeGames

Neha Sharma said...

gmp certification in delhi
halal certification in delhi
ce certification in delhi
iso 14001 certification in delhi
iso 22000 certification in delhi
iso 27001 certification in delhi
iso certification services in delhi
website designing services
seo serivces in delhi

Neha Sharma said...

Bali Honeymoon Packages From Delhi
Bali Honeymoon Packages From Chennai
Hong Kong Packages From Delhi
Europe Packages from Delhi
Bali Honeymoon Packages From Bangalore
Bali Honeymoon Packages From Mumbai
Maldives Honeymoon Packages From Bangalore
travel company in Delhi

Neha Sharma said...

we have provide the best fridge repair service.
fridge repair in faridabad
Videocon Fridge Repair in Faridabad
Whirlpool Fridge Repair in Faridabad
Hitachi Fridge Repair In Faridabad
Washing Machine Repair in Noida
godrej washing machine repair in noida
whirlpool Washing Machine Repair in Noida
IFB washing Machine Repair in Noida
LG Washing Machine Repair in Noida

Neha Sharma said...

we have provide the best ppc service.
ppc company in gurgaon
website designing company in Gurgaon
PPC company in Noida
seo company in gurgaon
PPC company in Mumbai
PPC company in Chandigarh

Neha Sharma said...


Rice Bags Manufacturers
Pouch Manufacturers
wall putty bag manufacturers
Lyrics with music

jacklinemelda said...

Every student has the chance of enjoying our affordable informative research papers. The writers hired at the company are professionals with significant experience.

meldaresearch said...

Do you have an insight into the qualities took out for in a company offering excellent Article Review Papers Services? Asking for Article Review Writing Service is noble because it enhances your Review Article Writing Service performance.

jacklinemelda said...

Are you in need of Custom Term Paper Writing Services for your various Custom Term Paper Assignment Services? Do not fret; Legitimate Custom Term Paper Writing Services is here to provide the necessary assistance you require to attain your academic aspirations.

loolog said...

gmail inloggen ok

meritstep said...

I just loved your article on the beginners guide to starting a blog.If somebody take this blog article seriously in their life, he/she can earn his living by doing blogging.thank you for thizs article. python online training

john said...

مهدی احمدوند
راغب
مهدی جهانی
ایوان بند

دانلود آهنگ said...

حامد برادران دلتنگ
رضا شیری خوش قلب
مازیار فلاحی
مرتضی اشرفی

meldaresearch said...

Are you encountering challenges searching for Psychology Research Paper Writing Services? Look no further; Custom Psychology Essay Writing Services has a solution to your Psychology College Research Paper.

meldaresearch said...

Finding the best Help with Medical Assignment is not easy unless one is keen to establish a professional medical assignment help & medical homework help online.

Situs Judi Online Terpercaya said...

NAGAQQ: AGEN BANDARQ BANDARQ ONLINE ADUQ ONLINE DOMINOQQ TERBAIK

Yang Merupakan Agen Bandarq, Domino 99, Dan Bandar Poker Online Terpercaya di asia hadir untuk anda semua dengan permainan permainan menarik dan bonus menarik untuk anda semua

Bonus yang diberikan NagaQQ :
* Bonus rollingan 0.5%,setiap senin di bagikannya
* Bonus Refferal 10% + 10%,seumur hidup
* Bonus Jackpot, yang dapat anda dapatkan dengan mudah
* Minimal Depo 15.000
* Minimal WD 20.000

Memegang Gelar atau title sebagai Agen BandarQ Terbaik di masanya

Games Yang di Hadirkan NagaQQ :
* Poker Online
* BandarQ
* Domino99
* Bandar Poker
* Bandar66
* Sakong
* Capsa Susun
* AduQ
* Perang Bacarrat (New Game)

Tersedia Deposit Via pulsa :
Telkomsel & XL

Info Lebih lanjut Kunjungi :
Website : NagaQQ
Facebook : NagaQQ Official
Kontakk : Info NagaQQ
linktree : Agen Judi Online
WHATSAPP : +855977509035
Line : Cs_nagaQQ
TELEGRAM : +855967014811


BACA JUGA BLOGSPORT KAMI YANG LAIN:
agen bandarq terbaik
Winner NagaQQ
Daftar NagaQQ
Agen Poker Online

SEO King of Earth.. visit asiainfotech.in said...

Best Digital Marketing Company

Digital Marketing Expert

SEO Expert & Company

Website Design and Development Company

Best IT Consultant

Biggest Pharma Company

Lucifer D said...

AllWeb4U Known As The Best Digital Agency in the Market. We deliver SEO (Search Engine Optimization), SMO (Social Media Optimization), ORM (Online Reputation Management) & Web Development Services.

Unknown said...

Find best towing service in Portland metro area with Towing Elite. We are the best and leading service providers offering car towing, business towing and more.
Towing Services in Portland
Tow Truck Company in Beaverton
Towing Services in Tigard
Towing Company in Vancouver
Flatbed Towing in Vancouver
Towing Company in Clackamas