Welcome to the rfcat project
The goals of the project are to reduce the time for security researchers to create needed tools for analyzing unknown targets, to aid in reverse-engineering of hardware, and to satiate my rf lust.
RfCat currently requires Python 2.7. the only suspected incompatibilities with Python 3.x are minimal, mostly print("stuff") versus print "stuff" and other str/bytes issues.
New development efforts should copy the "application.c" file to "appWhateverMyToolIs.c" and attempt to avoid making changes to other files in the repo if at all possible. that is only a recommendation, because future bug-fixes in other libraries/headers will go much more smoothely for you.
A couple gotchas to keep in mind while developing for the cc1111
Installing and getting up to speed with rfcat...
First things first. Using rfcat requires that you either use the python client in root mode (sudo works well), or configure udev to allow non-root users full access to the dongle. you must also have one of the supported dongles flashed with the necessary application firmware.
sudo cp etc/udev/rules.d/20-rfcat.rules /etc/udev/rules.d
sudo udevadm control --reload-rulesPlease make sure any user accounts you want to allow access to the RfCat dongle are members of the dialout group.
This tool is created, maintained, and used primarily on linux. make and sdcc must be installed for creating new firmware and some of the helper functions we provide through make.
--------------------------------
| 1 2 |
| 3 4 |
------ 5 6 |
| USB 7 8 |
------ 9 10 |
| 11 12 |
| GoodFET 13 14 |
-------------------------------- --------------------------------
| |
| RST 1 2 TP ------
| GND 3 4 VCC USB |
| DC/P2_2 5 6 DD/P2_1 ------
| Chronos |
--------------------------------
GoodFET Chronos GreatFET Chronos
PIN PIN PIN PIN
1 <----- DD -----> 6 J1.37 <----- DD -----> 6
2 <----- VCC ----> 4 J1.2 <----- VCC ----> 4
5 <----- RST ----> 1 J1.40 <----- RST ----> 1
7 <----- DC -----> 5 J1.39 <----- DC -----> 5
9 <----- GND ----> 3 J1.1 <----- GND ----> 3 --------------------------------
| 2 4 6 8 10 2 4 6 8 10 |
| 1 3 5 7 9 1 3 5 7 9 |
|-TEST-PINS----DEBUG-PINS------|
| |
------ |
| USB |
------ |
| Don's Dongle (EMK) |
--------------------------------
GoodFET EMK GreatFET EMK
PIN DEBUG PIN PIN DEBUG PIN
1 <----- DD -----> 4 J1.37 <----- DD -----> 4
2 <----- VCC ----> 2 J1.2 <----- VCC ----> 2
5 <----- RST ----> 7 J1.40 <----- RST ----> 7
7 <----- DC -----> 3 J1.39 <----- DC -----> 3
9 <----- GND ----> 1 J1.1 <----- GND ----> 1Pogo pads on the back are clearly marked, but if you want to use the header...
-----------------------------------------
| YARD Stick One 2 4 6 8 10 12 14 |
| 1 3 5 7 9 11 13 ------
| USB |
| ------
| |
-----------------------------------------
GoodFET YARD Stick One GreatFET YARD Stick One
PIN PIN PIN PIN
1 <----- DD -----> 1 J1.37 <----- DD -----> 1
2 <----- VCC ----> 2 J1.2 <----- VCC ----> 2
5 <----- RST ----> 5 J1.40 <----- RST ----> 5
7 <----- DC -----> 7 J1.39 <----- DC -----> 7
9 <----- GND ----> 9 J1.1 <----- GND ----> 9You will also need to install the build requirements of python-usb, libusb-1.0.0, make, and sdcc.
sudo apt install python-usb libusb-1.0.0 make sdccFor sdcc and its dependency, sdcc-libraries, you may need to download it from a earlier release's repository if you are on a newer version of Debian or Ubuntu such as:
Next, your user must have read/write access to the dongle when it shows up to the operating system.
For most Linux distros, this means you have to be a member of the "dialout" group.
usermod -a -G sudo $USER
su - $USERYou will also need permanent symlinks to the USB serial devices that will communicate with the CHRONOS, DONSDONGLE or YARDSTICKONE bootloader when required. If you haven't done this step already (see above), then run:
sudo cp etc/udev/rules.d/20-rfcat.rules /etc/udev/rules.d
sudo udevadm control --reload-rulesTo prepare your dongle for the first time, you'll need to hook up your debugger as described above
Intended development model is using a GoodFET although one of our developers uses the chipcon debugger from Texas Instruments.
cd rfcat/firmware/
make testgoodfetThis will read info from your dongle using the GoodFET. you should see something like:
SmartRF not found for this chip.
Ident CC1111/r1103/ps0x0400
Freq 0.000 MHz
RSSI 00make backupdongle will read the current firmware from your dongle to the file .../bins/original-dongle-hex.backup.
(make restoredongle) to revert to the original firmware. make clean installRfCatChronosDongle will clean, build, and install the RfCat (appFHSSNIC.c) firmware for a Chronos dongle.make clean installRfCatDonsDongle will clean, build, and install the RfCat (appFHSSNIC.c) firmware for a cc1111emk.make clean installimmesnifffw will clean, build, and install the RfSniff firmware for the IMME girls toy from girltech Dependencies: Fergus Noble's CC-Bootloader (slightly modified). For your convenience, hex files are provided in the CCBootloader sub-directory in firmware.
Source can be found here
Which is branched from here
and do:
(install rfcat_bootloader from the CC-Bootloader subdirectory to somewhere on your execution path)
cd firmware
for EMK/DONSDONGLE:
make installdonsbootloader
for CHRONOS:
make installchronosbootloader
for YARDSTICKONE:
make installys1bootloader
now unplug the debugger and plug in your USB dongle.
If you have just installed the bootloader, the dongle should be in bootloader mode, indicated by a solid LED.
If you are re-flashing a dongle that is already running rfcat firmware, such as a YarstickOne, the Makefile targets will force it into bootloader
mode for you, but you can manually put it into bootloader mode either by holding down the EMK/DONS button as you plug
it into USB (on the CHRONOS or YARDSTICKONE jumper P2_2/DC to GROUND), or by issuing the command d.bootloader() to rfcat in interactive
mode (rfcat -r), or by issuing the command rfcat --bootloader --force from the command line.
Once you have a solid LED, or if you're running an rfcat dongle, you can do the following:
cd firmware
for EMK/DONSDONGLE:
make installRfCatDonsDongleCCBootloaderfor CHRONOS:
make installRfCatChronosDongleCCBootloaderfor YARDSTICKONE:
make installRfCatYS1CCBootloaderThe new version will be installed, and bootloader exited.
Install rfcat onto your system. on most linux systems, this will place rfcat and rfcat_server in /usr/local/bin/ and rflib into /usr/*/lib/python2.x/dist-packages
ipython
apt-get install ipythonpip install -e . (installs in editable mode and runs from the unpacked or checked out location)If you have configured your system to allow non-root use:
type "rfcat -r" (if your system is not configured to allow non-root use, prepend "sudo" or you must run as root) you should have now entered an interactive python shell, where tab-completion and other aids should make a very powerful experience i love the raw-byte handling and introspection of it all.
try things like:
while the toolset was created to make communicating with <ghz much easier, you will find the cc1111 manual from ti a great value. the better you understand the radio, the better your experience will be. play with the radio settings, but i recommend playing in small amounts and watch for the effects. several things in the radio configuration settings are mandatory to get right in order to receive or transmit anything (one of those odd requirements is the TEST2/1/0 registers!)
If you watched any of my talks on rfcat, you will likely remember that you need to put the radio in IDLE state before configuring. (I said it three times, in a row, in different inflections).
However, you will find that I've done that for you in the client for most things. The only time you need to do this yourself are:
use d.setRFRegister()ZWave Attack: https://github.com/initbrain/Z-Attack
Other than that, hack fun, and feel free to share any details you can about successes and questions about failures you are able!
@ and the rest of the development team.