transport key arg in zbdsniff

riverloopsec / killerbee

IEEE 802.15.4/ZigBee Security Research Toolkit

http://www.riverloopsecurity.com

Other

764 stars 215 forks source link

transport key arg in zbdsniff #253

Open jamesleytevidal opened 2 years ago

jamesleytevidal commented 2 years ago

Hi there,

Working with a newer version of zbdsniff than I'm used to (for reference, the versions I've used previously supported DCF, so a while back...)

I don't see any documentation on the transport key (-k) argument. I have pcaps with a transport key in them but zbdsniff refuses to extract them without the -k value...

apologies for not connecting the dots myself - if I have a pcap with a key in it, what value should I be using for -k to extract said key?

taylorcenters commented 2 years ago

Haven't had a chance to look too much into this. Would the key it's expecting be ZigBeeAlliance09?

jamesleytevidal commented 2 years ago

So, out of curiosity I did try that, presuming it was in hex I used 5a6967426565416c6c69616e63653039 and got this.

However, I'm seeing this error regardless of key or format of the key that I've tried so far.

(worth noting this is just testing against good 'ol control4-sample )

jamesleytevidal commented 2 years ago

My concern is resolved with https://github.com/riverloopsec/killerbee/pull/260 if that can make it's way back into your codebase.