ElectronicCats / CatSniffer

CatSniffer is an original multiprotocol and multiband board for sniffing, communicating, and attacking IoT (Internet of Things) devices using the latest radio IoT protocols. It is a highly portable USB stick that integrates TI CC1352, Semtech SX1262, and an RP2040 for V3 or a Microchip SAMD21E17 for V2
https://github.com/ElectronicCats/CatSniffer
Other
500 stars 67 forks source link

PyCatSniffer + Wireshark not working on MacOS #67

Closed zkvL closed 5 months ago

zkvL commented 5 months ago

Describe the problem: When trying to capture BLE ADV packets on MacOS with PyCatSniffer no packets are shown.

To Reproduce:

  1. Entered the CatSniffer board into bootloader by holding BOOT1 + Press and Release RESET 1 + Release BOOT1
    • Tried copying SerialPassthroughwithboot.ino.elf.uf2 to RPI-RP2 before entering bootloader mode and without the SerialPassthrough
  2. When LEDs were blinking in waterfall mode, I proceeded to flash the firmware

On MacOS flashed the firmware using catnip:

❯❯❯ python3 catnip_uploader.py releases
Releases available:
0: airtag_scanner_CC1352P_7.hex
1: airtag_spoofer_CC1352P_7.hex
2: sniffer_fw_CC1352P_7.hex
3: sniffle_CC1352P_7.hex

❯❯❯ python3 catnip_uploader.py load 2 /dev/cu.usbmodem14401
[...]
Connecting to target...
CC1350 PG2.0 (7x7mm): 704KB Flash, 20KB SRAM, CCFG.BL_CONFIG at 0x000AFFD8
Primary IEEE Address: 00:12:4B:00:2A:79:C0:94
    Performing mass erase
Erasing all main bank flash sectors
    Erase done
Writing 720896 bytes starting at address 0x00000000
Write 208 bytes at 0x000AFF308
    Write done
Verifying by comparing CRC32 calculations.
    Verified (match: 0x52c24bf8)
Done uploading sniffer_fw_CC1352P_7.hex to /dev/cu.usbmodem14401
  1. Installed Wireshark dissectors by copying the content of:

    .dissectors:
    ├── catsniffer-blepi.lua
    ├── catsniffer-register.lua
    └── catsniffer-rpi.lua

    to the Personal LUA Plugins Path on Wireshark. For MacOS it was: $HOME/.local/lib/wireshark/plugins

  2. Configured the DLT 147 value

  3. Ran cat_sniffer.py

    
    ❯❯❯  python3 cat_sniffer.py sniff /dev/cu.usbmodem14401 -phy 0 -ch 37 -pf -pfn catsniffer.pcap -df -ff -ws
    [...]
    PyCat-Sniffer CLI - For sniffing the TI CC1352 device communication interfaces.
    Type help or ? to list commands.

PycatSniffer CLI> 2024-01-25 13:49:01.709 Wireshark[73878:8530619] WARNING: Secure coding is not enabled for restorable state! Enable secure coding by implementing NSApplicationDelegate.applicationSupportsSecureRestorableState: and returning YES. (wireshark:73878) 13:49:04.823974 [GUI WARNING] -- Populating font family aliases took 123 ms. Replace uses of missing font family "SF Mono" with one that exists to avoid this cost. (wireshark:73878) 13:49:05.148722 [Capture MESSAGE] -- Capture Start ...



**Expected behavior:**
BLE packets being captured on Wireshark/CatSniffer

**Screenshots:**
![SS 2024-01-25 at 1 50 00 p m](https://github.com/ElectronicCats/CatSniffer/assets/15888622/868848f3-afdc-411c-bc5a-084db1647af8)
![SS 2024-01-25 at 1 51 55 p m](https://github.com/ElectronicCats/CatSniffer/assets/15888622/b2cf2d32-6a00-4fbf-ac61-cf568162fbbf)

**Additional context:**
Also tried on a VM Linux using the same methods to flash the board, and a Windows VM with SmartRF Packet Sniffer (uploaded `SerialPassthroughwithboot.ino` in this case as the wiki says) 
- For Linux VM I got the same behavior as with MacOS
- For Windows VM, the SmartRF Packet Sniffer  is not able to detect the CatSniffer board

I tried to capture Flipper Zero BLE spam attack packages and starting pairing mode on IoT devices.

**Tested environment**
- MacOS Sonoma 14.0 (23A344)
- VM Kali Linux 6.0.0-kali3-amd64
- VM Windows 10 x64 
JahazielLem commented 5 months ago

When the firmware is finished uploading the LEDS are blinking in what sequence? Try when the firmware is done, reset the board with the RESET button from the CC1352 and the RP2040 or disconnect and connect the board, before running the pycatsniffer.py.

wero1414 commented 5 months ago

Hello @zkvL did you download the latest version of the serialPasstrhough firmware?

Please check that is the same version as the latest you can find it here:

https://github.com/ElectronicCats/CatSniffer-Firmware/releases/tag/board-v3.x-v1.1.0

zkvL commented 5 months ago

Copied the latest version @wero1414 and that seemed to be the issue, Thanks!