Tuesday, September 6, 2011

A Bluetooth GoodFET for the N900

by Travis Goodspeed <travis at radiantmachines.com>
continuing Promiscuity is the NRF24L01+'s Duty
with kind thanks to @fbz, @skytee, and their Hacker Hostel.

Bluetooth GoodFET

Since building my packet sniffer for the Microsoft 2.4GHz keyboards, I've frequently wanted to demo it without having to drag out a laptop. Laptops are heavy, they are inconvenient, and cables just make matters worse. While it is possible to port it to a standalone board or to add an LCD to the Next Hope Badge, I'd rather have the entire GoodFET client library available over bluetooth to my Nokia N900. Pictured above is my prototype build, which reliably sniffs keyboard traffic on battery power for a more than an hour. Rather than serving as a build tutorial, this article will chronicle the bugs that cropped up during the port, in the hope that they'll help other neighbors trying to port the GoodFET firmware to new devices.

This sniffer was assembled from a Next Hope Badge running the GoodFET firmware with hardwired DCO calibrations, a Roving Networks RN41 module, and three NiMH batteries. The client uses py-bluez at the moment, but I might port it to LightBlue for OS X support. Future models will use a GirlTech IMME or Telos B in place of the Next Hope Badge, to allow me to play with APCO P25 or ZigBee networks without a laptop.

Compiling the Firmware


Most of the GoodFET devices are built around an FT232RL and MSP430, with the FTDI taking care of USB to serial conversions. The client software just opens /dev/ttyUSB0 or its local equivalent through py-serial, then uses the DTR and RTS lines to reset the MSP430 into either the GoodFET application or a masked-ROM bootloader, the BSL. The client and the hardware do a little initialization dance in which the GoodFET is reset until the clock configuration register within the device matches 16MHz. So when you run 'goodfet.monitor info' and it replies with "Clocked at 0x8f9e", the devices has rebooted several times until it finds by chance that 0x8F9E is a stable clock configuration for 16MHz.

When replacing the FTDI with a Bluetooth module, the DTR and RTS lines are unavailable with the timing resolution that is necessary to enter the BSL. Rather than rely upon them, I left them disconnected and instead ran only the TX and RX lines from the RN41 to the NHBadge. The !RST signal is also disconnected, so the GoodFET will boot when power is applied and cannot be rebooted except by the appropriate software command.

Bluetooth GoodFET

This creates a number of complications in the client, which I'll get to later, but the important thing for firmware is that the clock configuration must be explicitly known by the firmware at compile or link time. To specify this at compile time, set CFLAGS="-DSTATICDCO=0x8F9E". To specify it at link time, just flash the image without erasing the INFO flash that resides from 0x1000 to 0x1100 in the MSP430X chips.

Additionally, the firmware must be told which pins to use and which microcontroller to target. These are specified by exporting platform="nhb12b" and mcu="msp430x2618". If an NHB12 were used instead of the NHB12B, then the platform would be redefined appropriately. Finally, the firmware size (and thus the flashing time) can be significantly reduced by exporting config="monitor nrf spi" to reduce the set of applications to only the Monitor, Nordic RF, and SPI applications.

To ease in reconfiguring my build environment, I left a script to create these settings in trunk/firmware/configs/examples/bluetooth-nhb12b.sh . Be sure to change the STATICDCO value to that of your own hardware when building it.

Next Hope Badge Flashing

Finally, the firmware had to be flashed by JTAG, rather than BSL. This was done the same way the Next Hope Badges were originally programmed at the factory, by wedging the board into a GoodFET programmer and running 'goodfet.msp430 flash goodfet.hex', then verifying with 'goodfet.msp430 verify goodfet.hex'.

Patching the Client


Recalling that the client was initially designed to use py-serial, a few changes were required to make it function through py-bluez.

Before writing a proper client, I wrote a quick py-bluez script to connect to the GoodFET and print any string that is received. Briefly touching the !RST signal on the JTAG connector to its GND pin resets the device, causing it this client to print "http://goodfet.sf.net/". If the default GoodFET firmware is flashed, with no STATICDCO or Info Flash, the string will be printed as garbage most times, with one attempt in ten producing a legible string.

Having verified that the timing and baud rate were correct, I continued by writing a communications module, GoodFETbtser(), that emulates the read() and write() functions of serial.Serial() used by the rest of the application. Additionally, the GoodFETbtser.read() function is written so as to always return the exact number of bytes requested by the receiver, as Bluetooth buffering sometimes breaks apart packets that would otherwise reliably be received as contiguous chunks.

The following is a screenshot (with GoodFET.verbose=1) of a transmission being split in half because of a read() request returning too few bytes.
Bluetooth Packetization Bug

Additionally, the initialization routine was modified such that if the GOODFET environment variable is set to a six byte MAC address. Setting it to "bluetooth" causes the firmware to search for Bluetooth devices by name, then exit with instructions for setting the MAC. Later revisions might attempt to use the first observed RFCOMM adapter.

Conclusions


The final client is already mainstreamed into the GoodFET's subversion repository, and it looks a little like the following when packet sniffing encrypted OpenBeacon traffic. It can also sniff Turning Point Clickers, Microsoft Keyboards, and anything else that uses the 2.4GHz Nordic chips.

Bluetooth GoodFET OpenBeacon Sniffing

I've already ordered parts to build Bluetooth versions of the Girltech IMME and the Telos B for mobile sniffing of APCO P25 and ZigBee. My rebuilds will include integrated battery charging from USB and the option of running standalone with the bluetooth module disabled, in order to greatly increase battery life. The client ought to run unmodified on rooted Android devices by use of SL4A and py-bluez. Additionally, I'm planning a firmware port to the OpenBeacon USB 2 module from Bitmanufaktur GmbH.

As a final note, I would like to remind all good neighbors that there is no reason why offensive security can't be fun for the whole family.
Bluetooth GoodFET

42 comments:

webhostingreview said...
This comment has been removed by a blog administrator.
webhostingreview said...
This comment has been removed by a blog administrator.
richard said...

iam trying to buy a goodfet41 about 6. also I live in the UK .Why are they not posted on dorkbotPDX Circuit board page? why are you so elusive both email & web page links are broken & Have been for weeks. otherwise I WOULDNT be trying to get in touch in this way

Travis Goodspeed said...

Howdy Richard,

Email your shipping address to sixtysixav at hotmail.com along with a request for six GF41 boards. Shipping to the UK is not a problem.

I don't have any connection to Dorkbot PDX, but they are welcome to manufacture and sell GoodFET boards. The GF41 gerbers can be found as goodfet41.zip.

My email address--travis at radiantmachines.com--is still up and active. I apologize for any unanswered emails, but there are only so many hours in a day. I cannot spend them all doing pro bono support for my hobby.

Which links are broken?

--Travis

http://www.livemsntr.com said...
This comment has been removed by a blog administrator.
calibration singapore said...

Thank you for the info. It sounds pretty user friendly. I guess I’ll pick one up for fun. thank u...




Calibration Singapore

akmal niazi khan said...

Engineering stuff and techniques that you mentioned on your blog are awesome. Being a electrical Engineer I really enjoy your all posts and learn a lot not only Electrical engineering knowledge but others technologies and tools as well.
Love from EDesk

Paper Testinginstrument said...

paper testing equipments-Looking for Paper Testing Equipments? We are offering Paper Testing Equipment Manufacturer to provide correct dimensions and sturdiness, thus, extremely demanded between our shoppers.

Mia Gomez said...

We write essays, articles, Custom writing, dissertations, term papers and more. We provide quality writing in any format you desire. All of our papers are written from scratch so there is no worry about receiving pre-written papers. We custom make the papers according to the order. Our writers set the quality standard when it comes.

Deba Sheesh said...

Thanks for your great post. I have read your post completely and acquire more knowledge from this article. Thanks for your useful post. Liquid Level Switch

Blogger said...

If you want your ex-girlfriend or ex-boyfriend to come crawling back to you on their knees (no matter why you broke up) you must watch this video
right away...

(VIDEO) Why your ex will NEVER get back...

thesan enterprise said...

Thesan Enterprise is one of the leading bolt and nut suppliers, washer and bolts suppliers in Singapore. VIEW MORE - Bolt and nut

Mcafee activate said...

www.mcafee.com/activate
mcafee livesafe retail card
mcafee activation code
www.mcafee.com/activate
roku.com/link

rahul gupta said...

Change Wifi settings using Linksys cloud account – It is important to change the basic WiFi settings on your router in order to establish a unique and secure connection. A protected WiFi prevents unwanted access to personal information.

Linksys cloud account

You can get Norton product from an online store or retail stores. In both cases, you will get Norton product key, using this key you can activate and use Norton product.

norton product key

Webroot SecureAnywhere Antivirus Shield not working – Webroot SecureAnywhere Antivirus includes a number of shields, which works in the background and protects your system. These shields persistently monitor your system and protect your system from the viruses or malware. Webroot SecureAnywhere includes Real-time Shield, Rootkit Shield,

Webroot SecureAnywhere


Uninstall Dell Printer Driver – Before reinstalling any printer drivers, it is best to remove any printer drivers that were previously installed, not doing so can cause problems that prevent the computer from communicating with the printer.

Dell Printer Driver

Roku & Echo Device said...

If your echo won't connect to wifi Or having any problem to setup Alexa to Wifi then Don't Worry we are here to help you just follow the simple steps which is given on our website. We'll help you to connect Alexa to wifi, connect echo to wifi and amazon echo not connecting to wifi and other problems. For instant help, call us at our amazon echo help number +1-888-745-1666.
Setup echo
Setup Echo Dot

Digital Marketing Course in Panchkula said...

Are you looking for best Digital Marketing Course in Panchkula, Then we are here always guide to you about Digital Marketing Course.We are google certified Institute in Panchkula.You can schedule your DEMO classes of 2 days to know more about Digital Marketing.

Echo & Roku Device said...

Do not panic if your Echo Look Setup is not running working. We are always here to solve all the problems related to your echo Look like echo Look wifi settings,installation,troubleshooting.Now the solution is at your fingertips. Just pick your phone and call us at :+1-888-745-1666 if you want to Connect Echo Look To Wifi.

Michael Jones said...

If you are searching Assignment Help.You can suggest them to use different online sources to develop the reading habit in them. Using different online sources can be beneficial for their assignment help for a long run. Organise each topic in a story form to develop their interest in the class.

Ireland Assignment Help said...

Students of Ireland can buy assignments online and submit their assignment on time by order assignment on IrelandAssignmentHelp.com. Collect reliable and affordable report writing services and retain best position in college. Get academic support from our efficient report writing helper and complete your assignment on time.

Singapore Assignment Help said...

Assignment help is one of the most popular assignment services in singapore. It's time to update yourself for assignment help singapore services for getting good grades in academics.

james cook said...

Congrats on having such well managed site! It has good looks and contains informative content as well.We are an online platform where students check & write reviews for assignments related websites.Here you can check allassignmenthelp.com reviews

talha said...

Great site and a great topic as well I really get amazed to read this. It’s really good. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. brass handicrafts

talha said...

Great site and a great topic as well I really get amazed to read this. It’s really good. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. brass handicrafts

talha said...

Great site and a great topic as well I really get amazed to read this. It’s really good. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. brass handicrafts

onlinecontentwritinghelp said...

Success of your thesis paper is the responsibility of our thesis writers. With the help of professional Ph.D. thesis writers, we assure that our customers get the best insights on every aspect of thesis paper from beginning to end. Our written thesis papers are 100% unique and original as they are generated by expert thesis writer only. Each and every thesis writers are:

Online Assignmet Help said...

Hi this is Olivia Crew and i am SEO Expert in a reputed company livewebtutors. you are providing very informative and knowledgeable article so thank you for sharing with us. such a nice article.
nursing assignment help

MyAssignmentHelpAu said...

This is one of the finest post i have ever seen. The information is genuine and relatable and i am looking forward to avail the services of My Assignment Help . You can email us at Info@Myassignmenthelpau.Com or Phone Number: +61-2-8005-8227

mycoursehelp said...

I really happy found this website eventually. Really informative and inoperative! Thanks for the post and effort! Please keep sharing more such article. I've really like your blog and inspire me in many ways. We have already set a high standard for Coursework help.

Pankaj Singh said...

Nice Blog, I have seen this blog and I can say that this an amazing and informative blog. Visit for
Outsourced Web Hosting Support

Amy Willor said...


A high-standard post with all imperative information about Assignment Help UK services. Looking forward to avail the premium services.

MyAssignmentHelpSG said...

An unmatched and nonpareil post i have ever seen. The content is so appealing that it has created an impulse to avail Assignment Help Singapore services.

talha said...

Great site and a great topic as well I really get amazed to read this. It’s really good. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. brass handicrafts

talha said...

I am very happy to read this. This is the kind of manual that needs to be given and not the random misinformation that’s at the other blogs. Appreciate your sharing this best posting. marketing assignment help australia

Naseem Ansari said...

Thank you for the blog. It's a really very nice your article. Thank you so much for the sharing.

visit:
Hotmail customer care number

iamashishgill said...

Just Call at once +1-877-718-7117 USA All Browser Customer care executives for fast assist and support offerings via Toll Free Phone. By Https Browser
Https Browser
Google Chrome Customer Service Number
Mozilla Firefox Customer Service Number
Safari Customer Service Number
Internet Explorer Customer Service Number

Amy Willor said...


A high-standard post with all imperative information about Assignment Help UK services. Looking forward to avail the premium services.

Customer Help Care said...

Thanks for this incredible blog. This is amazing and informative for me, your blog always readable and informative. Visit for
Europe Honeymoon Packages
Hong Kong Honeymoon Packages
Maldives Honeymoon Packages

Unknown said...

Writing academic documents is a task most students prefer to leave up to the subject matter experts. This is because most of them are complex and comprehensive, the research for which consumes a large portion of their valuable time. During higher studies in colleges, students often have to prepare multiple documents, quizzes and surprise tests. This is the main reason why most students search for assignment help over the internet and choose only the most proficient and trusted academic writing experts. The increasing importance of writing assignments has prompted students to take a helping hand from assignment writing services. During higher studies in colleges, students often have to prepare multiple documents, quizzes and surprise tests. This is the main reason why most students search for assignment help Australia over the internet and choose only the most proficient and trusted academic writing experts. An assignment of IT is a scope to dig out new information and uncover the facts which could be a parallel study along with implanting it by creating new area of IT application. He starts disliking his school or college. But may come, he has to submit his assignment before the deadline, therefore he chooses to buy assignment services available to him. To help students complete their assignments My Assignment Services is here to serve them with the best assignment help.

Pankaj Singh said...

Whoa! That information has been fairly effective thank you so much for sharing with us. Visit for
Hong Kong Honeymoon Packages

Emma Justine said...

wow! Great information provided by you! Get Step-by-Step guide for Office – Activate, Download & complete installation from office.com/setup. After purchasing MS Office visit office.com/setup , sign in to your Microsoft account then enter product key for Office Setup and Office Install.

Emma Justine said...

Every day new threats emerge and wreak havoc. Ransomware attacks are on the rise, making data security very important. Therefore, you must get the robust protection for any of your preferred devices just by visiting mcafee.com/activate & norton.com/setup

Download Alexa App said...

We have a professional and well-trained team player to help you in amazon echo setup, and download alexa app. You can visit us at alexa.amazon.com and can also call us at our toll-
free +1-888-381-1555.
http www alexa.amazon.com
https www alexa.amazon.com
alexa.amazon.com
http://alexa.amazon.com
download the alexa app
how to connect echo dot to wifi
download alexa app for echo