Tuesday, March 1, 2011

GoodFET on the TelosB, TMote Sky

by Travis Goodspeed <travis at radiantmachines.com>
with kind thanks to Sergey Bratus, Ryan Speers, and Ricky Melgares,
for contributions of code, conversation, and general neighborliness.

Telos B

As I was recently reminded that the Crossbow Telos B and Sentilla TMote Sky devices litter most universities, left over from wireless sensor network research, it seemed like a perfect target. As such, I'm happy to announce that the GoodFET firmware now fully supports the Telos B and TMote, and also that support for the Zolertia Z1 mote will be coming soon. KillerBee integration should come in the next few weeks, but there's plenty of fun to be had in the meantime.

This brief tutorial will walk you through cross-compiling the GoodFET firmware for the Telos B or TMote Sky, as well as simple packet sniffing and injection. As the GoodFET project is always being refactored in one way or another, you can expect a bit of this to change.

Compiling the Firmware

A port of the GoodFET firmware is defined by three things. First, the $platform environment variable defines the header file from which port definitions come. Most platforms just use platforms/goodfet.h, which is loaded when $platform is undefined or set to 'goodfet'. Some devices, such as the two varieties of the Next Hope Badge and the Telos B, use ports which are not the same as the standard GoodFET's layout. In particular, it's rather common for the Slave-Select (!SS) line to be unique to the hardware layout of a particular board. Setting $platform to 'telosb' takes care of this.

Additionally, the Telos B uses the MSP430F1611 chip, so $mcu must be set to 'msp430x1611'. (That's with an 'x', as the linker doesn't care whether the chip is in the F, G, or C variants.)

Finally, a normal GoodFET includes a lot of modules for things like JTAG and similar protocols that the Telos B does not include wiring for. Although leaving them in doesn't hurt, it does make the firmware larger, which is annoying when repeatedly recompiling and reflashing during firmware development. To restrict support to just the monitor, the SPI Flash chip, and the Chipcon SPI radio, it is handy to set $config to 'monitor spi ccspi'.

export platform=telosb
export mcu=msp430x1611
export config='monitor ccspi spi'
make clean install


Accessing the SPI Flash

The Telos B is reset in a manner very different from the GoodFET, courtesy of a bit-banged I2C controller. Someday we'll figure out how to auto-detect this, but until then you will need to have $platform set to 'telosb' just as you did when compiling.

The Telos B contains a Numonyx M25P80 SPI Flash chip, which is compatible with the goodfet.spiflash client. Unfortunately, most units use a variety of this chip that does not respond to a request for its model number. (According to the datasheet, this feature is only available in the 110nm version. Datasheets have a way of phrasing bugs as if they were just optional features.) On those lucky units with a properly behaving chip, run 'goodfet.spiflash info' to get its capacity and model number. Upgrading to a larger chip or replacing the SMD unit with a socketed one will cause no problems, as the client will automatically adapt.

GoodFET for the Telos B

You may also use the standard peek, erase, dump, and flash verbs to access the contents of the chip. When the chip refuses to identify itself, the GoodFET will default to a size of 8Mb, so explicit ranges needed be given for things like 'goodfet.spiflash dump telosb_m25p80.bin'.

As the M25P80 chip is not access-controlled in any way, it's a handy way to grab old data from a node. On some academically-sourced devices, you might find leftover data or code from LogStorage or Deluge. On commercial devices, these chips sometimes keep hold more interesting things.

Sniffing ZigBee, 802.15.4

While the Flash chip is a neat little toy and handy for forensics, most users of the Telos B port will be interested in the CC2420 radio. As a final collaboration between Ember and Chipcon, the '2420 was one of the first popular 802.15.4 chips, and it is still quite handy for reversing and exploit ZigBee devices. Just as before, you must set $platform to be 'telosb' or the client will not connect.

To sniff raw 802.15.4 packets on channel 11, just call 'goodfet.ccspi sniff 11'. This enables promiscuous mode, so you will see traffic from all PANs and to all MACs in the region. If you are only interested in broadcast traffic, use 'goodfet.ccspi bsniff 11' instead.
goodfet.ccspi sniff 11

As much fun as it is to sit with the 802.15.4 and ZigBee protocol documentation to figure out what a packet means the first time, white-washing this particular fence quickly becomes boring. For that reason, Ryan Speers and Ricky Melgares at Dartmouth tossed together a Scapy module for dissecting these sorts of packets. It's in the scappy-com Mercurial repository, so check it out with "hg clone http://hg.secdev.org/scapy-com" then run "sudo python setup.py install" after the prerequisite packages have been installed.

Once the community build of Scapy has been installed, you can run 'goodfet.ccspi sniffdissect 11' to print the Scapy dissections of various packets. As this code is less than a week old, there are a few kinks to work out, so ignore the warning messages that pop up at the beginning of the log. (Scapy likes to initialize the operating system's networking stack even though we're using a GoodFET instead. This is infuriating on OpenBSD, but merely an annoyance on OS X and Linux.)

802.15.4 Scapy

If you have no other 15.4 equipment to play with, you can do a transmission test with 'goodfet.ccspi txtest 11'. In the following section, I'll show you to how to send and receive packets in a Python script, which is useful for talking to the myriad of wireless sensors that have less than serious security.

Scripting the CC2420

The GoodFET project is built as a number of client scripts which are written in spaghetti code, features from which are slowly moved out of spaghetti and into classes. That is to say, the heavy lifting should be in GoodFETCCSPI.py, while short and sweet client scripts will be found in goodfet.ccspi. As an example, this section will cover the functioning of 'goodfet.ccspi txtoscount' which implements the radio protocol spoken by the TinyOS RadioCountToLeds application.

Rather than go into too much detail, I'll just point out the lines that are most instructive. Just like sing-along cartoons, this only works if you read the code, so please open up your favorite editor and follow along. While you're at it, use 'svn blame' to figure out which new GoodFET developer wrote that routine. If too much time has passed, you'll also need to back up to the revision that was current when I wrote this review. Then jump back a few more revisions to figure out which bugs of mine had to be fixed before his code worked. Isn't revision control nifty?

By default, the CC2420 only receives packets addressed to the local PAN and MAC as well as those sent to the broadcast address. In order to receive promiscuously, allowing the client to automatically identify any devices on the channel, it is necessary to enable promiscuous mode with 'client.RF_promiscuity(1)'. You might also want to tune away from the default channel with 'client.RF_setchan()'.

Also, as checksums must be correct in any outbound traffic, it is necessary to enable the AUTOCRC mode with 'client.RF_autocrc(1)'. This appends a checksum to every outbound packet, and it also rejects any inbound packets with invalid checksums, which is helpful to reduce noise but would sometimes accidentally rejects packets from non-compliant devices during sniffing. (TinyOS always uses the AUTOCRC feature, so it isn't an issue in this particular application.)

Packet reception, as is standard among the radio modules, is performed by 'client.RF_rxpacket()'. This method returns None if no packet has been received, so a synchronous application ought to spin in a loop until something else is returned.

Finally, the routine needs to broadcast its own reply, either from a stock template or from the sniffed packet. This is accomplished by passing an array of bytes to 'client.RF_txpacket(packet)'.

That's really all there is to it.

Conclusions

The GoodFET is primarily a tool for reverse engineering, and integration with other tools is a priority. KillerBee and Kismet plugins are already in development, and clients for all sorts of 802.15.4 devices will be written as hardware becomes available. Support for the CC2420's AES engine will also be added, so that encrypted packets can be sniffed once keys are sniffed from the air or by syringe with a bus analyzer.

That's all folks. Grab a Telos B or TMote and start poking at devices. Good targets might include Z-Wave door locks and ZigBee thermostats.

74 comments:

Bianca said...
This comment has been removed by a blog administrator.
Travis Goodspeed said...

With the new build system, don't bother defining $config, $platform, or $mcu.
export board=telosb
make clean install
goodfet.ccspi info


Also, I mistakenly thought that ZWave was a form of Zigbee. It's not, but you can sniff it with a GirlTech IMME's CC1110 radio.

Cheers,
--Travis

Sean said...

Hi, Nice project. Can you please tell me where can I download the TelosB codes of this project?

Blogger said...

Teeth Night Guard is providing personalized fitting and high quality customized dental guards.

Roman reigns said...

I liked the way you wrote the article. It was very straightforward and your knowledge on the subject is fantastic.

Reverse Engineering in USA
Reverse Engineering in UK

Amber Collins said...

Thanks for sharing such a nice Blog.I like it.

www.gumawawebsite.blogspot.com

Karolinax said...

League Of Legends 10.1 Yama Notları

sri said...

Thank you for excellent article.You made an article that is interesting.


http://rexapparels.com/kids-wear-manufacturer-in-tirupur-india/
http://rexapparels.com/corporate-t-shirt-manufacturer-in-tirupur-india/
http://rexapparels.com/school-t-shirt-manufacturer-in-tirupur-india/
http://rexapparels.com/sports-t-shirt-manufacturer-in-tirupur-india/

Agarwal Packers an Movers said...

Agarwal Packers and Movers

Agarwal Packers and Movers

Agarwal Packers and Movers

Agarwal Packers and Movers

Agarwal Packers and Movers

Agarwal Packers an Movers said...

Agarwal Packers and Movers

Agarwal Packers and Movers

Agarwal Packers and Movers

Agarwal Packers and Movers

Agarwal Packers and Movers

Mithun Prakash said...

Hi, thank you so much for sharing with us.
Personal Shopping
Grocery Shopping

Bextol said...

People in United Kingdom speak the English language. The linguistic diversity of United Kingdom is vaguely diverse according to a fractionalization scale which for United Kingdom is 0.0532. The followers of Christianity are the religious majority in the country. 79.6% of United Kingdom's population live in cities. This percentage comprises the urban population of United Kingdom. http://www.confiduss.com/en/jurisdictions/united-kingdom/culture/

GRSoft Developers said...

Great Research Solutions Pvt. Ltd. ( GRSoft ) is an IT company with no geographical boundaries and provides all that you can think of around IT including consulting, solutions, applications and outsourcing services.

Hire Software Developers

GRSoft Developers said...

GRSoft Gaming is an honor winning, Live Casino game advancement organization of India. We offer curiosity and inventive game development with an exceptionally talented group of developer. Our bleeding edge gaming innovation creates esteem included gaming arrangements. Quality is our real worry for club game development. We offer tweaked Casino game development benefits over the globe and help you furnish with customized development. With our Casino game, individuals couldn't imagine anything better than to chance their gaining and appreciate the advantages. We have created numerous effective games like the video poker game, Sports wagering game, online club game, lottery games, and numerous other common games.

Hire Dedicated Casino Game Developers

shopify said...

We have prepared this exciting piece of clothing out of supreme quality and highly refined satin fabric which has its interior stitched with a smooth viscose lining keeping you at uttermost comfort while you wear it when playing the game. Gta V Leather Jackets

GRSoft Developers said...

GRSoft Gaming is an honor winning, Live Casino game advancement organization of India. We offer curiosity and inventive game development with an exceptionally talented group of developer. Our bleeding edge gaming innovation creates esteem included gaming arrangements. Quality is our real worry for club game development. We offer tweaked Casino game development benefits over the globe and help you furnish with customized development. With our Casino game, individuals couldn't imagine anything better than to chance their gaining and appreciate the advantages. We have created numerous effective games like the video poker game, Sports wagering game, online club game, lottery games, and numerous other common games.

Casino Game Development Companies in India | Hire Poker Game Developers | Casino Game Developer | Casino Games Development Companies | Hire Poker Developers | Gaming Software Companies in India Rummy Game Software | Rummy Game Development

GRSoft Developers said...

GRSoft's Remote IT infrastructure services are custom tailored based upon your business needs. Our Remote IT infrastructure services align network architecture and end-to-end communication, to ensure your company has the best IT solutions. We provide wide array of IT infrastructure services, right from IT infrastructure and consulting support to managing the most complex of IT infrastructural issues, with absolute precision.

Remote IT Infrastructure Support Services

Mussawir said...

Simply want to say your article is as surprising. The clearness in your post is just spectacular and I can assume you are an expert on this subject. Achasoda

Malena Morgan said...

Your Article Is So Informative I Like This Type Of Articles Too
In other words, if you use a good "Grammar" piece (ie. How do we spell it? What should it be called?) don't worry about putting in additional text: the article will take care of all that for us. Don´t bother with paragraphs because your content isn't fit to read anyway. If there are too many links let me know and maybe they can be reduced or removed later on… Also, try to make sure everyone involved understands each other well so people areníll have more information coming from them at an earlier stage which is exactly what this style was meant as – extra info! And mos The Falcon And The Winter Soldier Zemo Coat

Huongkv said...

Liên hệ Aivivu, đặt vé máy bay tham khảo

vé máy bay đi Mỹ giá rẻ 2021

vé máy bay từ houston về việt nam

khi nào có chuyến bay từ nhật về việt nam

mua vé máy bay từ đức về việt nam

thông tin chuyến bay từ canada về việt nam

Chuyến bay từ Hàn Quốc về Việt Nam

Dshred said...

buy tank tops for girls online from Dshred at easy prices delivered at your doorstep. Get free shipping

buy legit marijuana online said...

firstly, we are the most trusted online dispensary shipping worldwide 2021 buy weed online in addition,
packwoods pre roll
buy weed online cheap

Sam Patrick said...

Two Best Blogs About Insomnia That You Must Need To Visit.

How To Conquer Insomnia? Causes And symptoms!
Insomnia! Look Before You Leap!

CSS Founder said...

Are you looking for the best Web Design companies in Doha? If yes then connect with CSS Founder to get the user and seo friendly website for your business.

MalaysiaAssignmentHelp said...

Are you looking for someone to assist you with a research paper? Don't worry, Malaysia assignment assistance is your one-stop-shop for all your academic needs. Our Malaysian Research Paper Helper is well-versed in the format of research papers. When you assign a writer for the first assignment, you'll get a 30% discount.

Alex Jarvis said...

Very Informative.. Thanks for sharing!

Jewellery in Pakistan

PromoteDial - Prince Kumar said...

We are the best and experienced SEO Company in Delhi we are able to provide high rank to your website on Google SERP so that you can increase your online business.

CSS Founder said...

Are you interested to take your business online? If yes then connect with web design company in navi mumbai that provides the best and high-quality website design & development services at an affordable price.

Zack said...

really helpful article and so informative, i'd love to share it with my freinds too, Regards

Shopizia

mudasir said...

He Is Very Great ANd KnowLedge Full Artical He Is very Great Artical

Best Pizza in Karachi

Alex Hales said...

If you've come to this website, you've definitely heard of animated whiteboard video maker, but aren't sure what it is, why it's so popular, or how you can produce your own. If that's the case, this advice will help you out. Continue reading to discover more about whiteboard animation from beginning to end. also, check out more services corporate video production company

Gaurav's Blog said...

Thank you for an excellent article. You made an article that is interesting.
UPSC PRELIMS DAILY QUIZ 2022

Unknown said...

최고의 메이져 먹튀검증 이곳에서 즐기세요

Cssfounder said...

If you are looking for a house so we have a great deal for you at an affordable price for more information please visit our website.
Top Projects in Sector 63 Noida

Lillian J. Turner said...

Nice Blog. Thanks for sharing with us. Such amazing information.

Tips to download pictures and videos on Instagram

Akash Kanaujiya said...

Is your goal to increase the digital presence of your business in this digital world? If you want to make a website especially to promote your product or brand, then let me tell you that we have the most intelligent web designers, if you want to design your business website then contact us.
Website design company helsinki

AlmumtaZ said...

Are you looking for a tent service? If yes, so You can go with Al mumtaz we have lots of tent products.
For more information please visit our site.
Car Parking Shades

Firaaz Azeez said...

Firaaz Azeez
Firaaz Azeez
Firaaz Azeez
Firaaz Azeez
Firaaz Azeez
Firaaz Azeez
Firaaz Azeez

FIFA said...

Great work! This is the type of information that are supposed to be shared around the net. Shame on the search engines for not positioning this post upper! Come on over and discuss with my web site . Thanks =)

토토사이트
사설토토
먹튀검증

FIFA said...

I procrastinate a lot and don’t manage to get nearly anything done. waiting for your further write ups thanks once again.

스포츠중계
토토
스포츠토토티비

FIFA said...

Awesome post. I’m a regular visitor of your site and appreciate you taking the time to maintain the excellent site. I will be a regular visitor for a long time.

토토사이트
프로토
배트맨토토

Akash Kanaujiya said...

We promise to deliver a website that interacts with the audience as well as establishes your company as a brand. CSS Founder has brought possibilities to increase your business, go here to contact us!
Website design company Constanta

blog experts said...

i am expert amazon marketing consultant who provides expert advice on how to sell on the Amazon platform.

akashpromotedial said...

Promotedial are Providing the best Google Ads services for the last 10 years we are offering our service take for Google Ads and digital marketing kind of service, Promotedial has made a different mark in the field of Google Ads Services with its hard work and sincerity, Promotedial is a Google Ads company click the link for contact us. Google Ads Services in Bulgaria

Sophia Grace said...

Global Functional Beverage Market Report and Forecast 2022-2027’, gives an in-depth analysis of the global Functional Beverage Market, assessing the market based on its segments like types, distribution channels, and major regions. The report tracks the latest trends in the industry and studies their impact on the overall market. It also assesses the market dynamics, covering the key demand and price indicators, along with analysing the market based on the SWOT and Porter’s Five Forces models. The changing preference of consumers towards healthy beverages owing to the changing lifestyles and increasing nutritional needs due to busy routine is driving the market growth. In addition to this, the consumption of functional beverages boost energy, helps in weight loss, and enhance mental focus. These benefits of the drink are anticipated to propel its demand in the forecast period.





For nore reports check here also : Asia Pacific Vaccine Market, Micro Inverter Market, Albumin Market, Middle East and Africa Cybersecurity Market,Cloud Gaming Market, Learning Management System Market, States Flooring Market, Sports and Energy Drinks Market, Brazil Healthcare, Sterilisation Services Market, Media Monitoring Tools Market

Go Hoardings | Outdoor Advertising Agency said...

We are the best holding service provider in India. For more information please connect with us. Office Media Advertising

7 Hotel Hills and Resorts | BlogSpot said...

The best hotel I’ve ever been privileged enough to stay at. Resorts in Lansdowne

Rio Resort Lansdowne said...

Resort Located at the perfect place for a perfect vacation. Hotel in Lansdowne

thorndalemedicalclinic said...

Thanks for the remarkable information. Please keep updating us. Best GP in Dublin

Oasis Visas said...

Thank you for sharing such amazing content. I would like to share my articles with you hope your users like them, we are immigration consultants in India. Are you interested to know about Canada PR Points Calculator Free, Oasis Resource Management is one of the leading visa consultants in India to know more Please go through my articles once.

AELConsultants said...

Get college term paper written by expert and professional writers in Malysia.Visi website for more details.

Love Ronaldo said...

“Not all angels have wings … some have scrubs.” Patient Home Care Services in Greater Noida

philipshugues said...

The TelosB, TMote Sky is a plug-and-play mouse that includes the good FET software. And now get best affordable custom assignment writing service uk. The most crucial characteristic of the good FET programme is that it provides a natural mouse and keyboard experience.

RSM Enterprises said...

The medicine comes with an active component of Super Eroxib (Tadalafil 20mg + Dapoxetine 60mg)Tablets.
Tadalafil 20mg Tablet Cheap Price
Order Now : +91 92163-25377

samira said...

دانلود ریمیکس رادیو جوان قدیمی شاد یکجا فوق العاده شاد ریمیکس شاد قدیمی jafar-190@

samira said...

دانلود آهنگ های ریمیکس جدید شاد ایرانی و خارجی جدید آهنگ ریمیکس jafar-184@

7 Hotel Hills and Resorts | BlogSpot said...

" Great place to stay nice people " lansdowne resorts Contact us:- 7 Hills Hotel & Resort 189, Village Fatehpur, Lansdowne Road, Pauri Garhwal, Uttarakhand. Mob 1: (+91) 9911125253 Mob 2: (+91) 9457587878 ld7hills@gmail.com

Anonymous said...

Het artikel is echt geweldig, bedankt! Kun je ook iets schrijven over website laten maken?

Designers Dan said...

Learn how VPS Hosting is good for your website and blogs.

Designers Dan said...

VPS Server Hosting is more scalable and flexible than shared hosting, given that each VPS has dedicated resources that can be tailored to meet the requirements of the website. This feature enables website owners to handle larger volumes of traffic, install custom software, and carry out other resource-intensive tasks without having to worry about performance issues. Check out free Minecraft hosting here.

Health care said...

Nice tutorial nursing care for home

Health care said...

Great tutorial. Nice tools. health care services

Kamila Hornakova said...

And that's probably why you often dream about shooting stars or planets.

E visa Dubai said...

Very nice Blog. Getting a Dubai Visa for Morocco Passport is now easy on EvisaDubai. Just visit the site and know all about visa type, prices and much more. They offer an easy way to apply for the visa.

Oman Visa | Visits Visa said...

Want a Dubai visa? Click on our website and Oman visa apply Online only on Visitsvisa. We are one of the best visa service providers and has approved millions of visa.

Anonymous said...


GoodFET is a versatile open-source hardware and software framework designed for embedded systems. When used with platforms like the TelosB and TMote Sky, it provides access to low-level hardware interfaces, enabling debugging, programming, and experimentation on these wireless sensor nodes. It's a valuable tool for IoT and sensor network development. protective orders in virginia protective order in virginia

cssfoundergurgaon said...

If you are looking for the best Website Designing Company in Gurgaon then CSS Founder can be the right choice for you.

Saudi e-visa said...

Saudi Arabia Visa
Visitsvisa is the best visa provider company in Noida, India. Through this website, you can apply for any country's visa in a few steps and receive it via email.

Jewel Galore said...

Explore the charm of traditional elegance with Jewel Galore's jhumka earrings . Our collection pays homage to the timeless beauty of Indian jewelry, offering a stunning range of designs.

OSH UNIVERSITY said...

Pursue excellence at Osh University through dynamic graduate courses designed to propel you into the forefront of your field. Join a community of scholars, where innovation and knowledge converge to redefine what's possible in your academic and professional journey.

Shalamar Hospital said...

Trust Shalamar Hospital for premier psychiatric care with our top psychiatrist in Lahore . We offer advanced treatment and therapy options to address a wide range of mental health concerns.

Robert Adler said...

Kudos to your blog for being a beacon of knowledge in the ever-evolving world of web and mobile app development! Your insights on top frameworks have proven invaluable for our team in San Diego , shaping our approach to crafting cutting-edge mobile applications. Your guidance has empowered us to explore new horizons about Software Development San Diego delivering exceptional solutions to our clients. The wealth of information here is a game-changer, and we eagerly anticipate more pearls of wisdom in future posts. Cheers to elevating the standards of mobile app development!

India Visa said...

It is required to have visible marks on India Visa applications, such as tattoos, birthmarks, or any other distinguishing marks that must be mentioned accurately. In the visa application form for India, there is typically a section where applicants are asked to provide details about any visible distinguishing marks on their bodies. It's essential to fill out the visa application form accurately and truthfully, including providing information about any visible marks. Failure to disclose this information accurately could lead to complications or delays in the visa application process.

Jewel Galore said...

Adorn yourself with the timeless beauty of Kundan choker set available at Jewelgalore. Our exquisite collection embraces the traditional craftsmanship and elegance of Pakistan, allowing you to make a statement with sophistication and charm.