├── README.md
├── bin
├── README.txt
├── gps-sdr-sim
└── gps-sdr-sim_x64
├── date2.txt
├── images
├── LCD.png
├── WALB.gif
├── WALB.png
├── WALB2.png
├── ads-b_iq.png
├── adsb_wave.png
├── iq_signal.png
├── rotary_enc.png
├── schematic.png
└── test_setup2.png
├── level2.txt
├── menu2.txt
├── python
├── replay.ini
└── replay.py
├── replay2.c
├── scritps
├── .gitkeep
├── ads-b.sh
├── eth.sh
├── i2c-disp.sh
├── kill_proc.sh
├── sim_start.sh
├── stat.sh
└── wlan.sh
└── webui
├── LatLon.css
├── LatLon.ini.php
├── LatLon.js
├── LatLon.php
├── LatLon.tmpl.php
├── README.md
├── kill_proc.sh
├── smooth2.php
└── start2.php
/README.md:
--------------------------------------------------------------------------------
1 | # WALB ( Wireless Attack Launch Box )
2 | ## What is WALB ?
3 | * WALB is a Raspberry Pi2/Pi3 and HackRF based lunch box sized portable RF signal generator.
4 | * The intended purpose of the WALB development is to test or demonstrate the security issue of wireless devices and location based applications.
5 | * By preparing a I/Q binary data, it is possible to generate any signal in the frequency range available to HackRF.
6 | * For GPS and ADS-B, real time signal generator module is included in WALB.
7 | * It uses HackRF as a SDR unit with enhanced GPS-SDR-SIM for GPS signal generation.
8 | * It has a 8x2 LCD and a rotary encoder with two color LED and a push switch for the operation of WALB.
9 | * Since WALB works with battery powered, you can use it any where you like.
10 | * Adding new simulation scenario or signal generation, it can be achieved by SSH login and simply edit the menu items using your favorite text editor.
11 | * By preparing the binary I / Q signal file of 8 bit signed, you can generate arbitrary RF signals.
12 | * To do so, you simply need to edit and add TEXT menu items specifying the filename of I/Q file, frequency, and sample rate.
13 | * If you prepare an external program to generate the I / Q signal in real time,you can also add the program and/or script in the menu.
14 | * You can set or chose GPS spoofing scenario by predefined location and/or date & time.
15 |
16 | 
17 |
18 | ## Prerequisites.
19 | You need to install GPS-SDR-SIM,HackRF host tools, and WireringPi on RaspberryPi.
20 | Rapsberry Pi3 is highly recomended for better performance of the real time signal generation.
21 | It requires apache2 and php5 if you wish to use web based UI.
22 |
23 | The installation instruction links are as follows.
24 | RaspberryPi:
25 | https://www.raspberrypi.org/
26 | GPS-SDR-SIM:
27 | https://github.com/osqzss/gps-sdr-sim
28 | HackRF:
29 | https://github.com/mossmann/hackrf
30 | WireringPi:
31 | http://wiringpi.com/download-and-install/
32 |
33 | Additional info to control hackrf via HTTP server.
34 | * You have to set udev rules.
35 | ```
36 | (1)Add /etc/udev/rules.d/52-hackrf.rules as follows.
37 | ATTR{idVendor}=="1d50", ATTR{idProduct}=="604b", SYMLINK+="hackrf-jawbreaker-%k", MODE="660", GROUP="plugdev"
38 | ATTR{idVendor}=="1d50", ATTR{idProduct}=="6089", SYMLINK+="hackrf-one-%k", MODE="660", GROUP="plugdev"
39 | ATTR{idVendor}=="1fc9", ATTR{idProduct}=="000c", SYMLINK+="hackrf-dfu-%k", MODE="660", GROUP="plugdev"
40 | (2) Refrect udev rules.
41 | $sudo udevadm control --reload-rules
42 | (3) Add www-data user into plugdev.
43 | $sudo usermod -aG plugdev www-data
44 | (4) Restart Apache2
45 | $sudo systemctl restart apache2
46 | ```
47 |
48 | ## directory structure of WALB software:
49 | ```
50 | /home/pi/
51 | /IQ-files ... binary I/Q files to pass hackRF or text files used for genaration of I/Q file by
52 | dedicated real time signal generation program such as enhanced GPS-SDR-SIM, or ADS-B_gen
53 | /bin/gps-sdr-sim ... enhanced GPS-SDR-SIM binary file and ephemeris file(s).
54 | replay2 ... Main startup program of the WALB
55 | menu2.txt ... Main menu items displayed on LCD
56 | level2.txt ... Sub menu-1: transmit power setteing
57 | date2.txt ... Sub menu-2: date&time setting for GPS time spoofing
58 | scripts/
59 | sim_start.sh ... Script to start I/Q signal generation and kick HackRF to transmit
60 | ic2-disp.sh ... Script to control LCD
61 | stat.sh ... Script to check if hackrf_transfer is active
62 | kill_proc.sh ... Script to kill gps-sdr-sim and/or hackrf_transfer
63 | eth.sh ... Script to display eth0 IP address on LCD
64 | wlan.sh ... Script to display wlan0 IP address on LCD
65 | /python/ ... Python port file from replay2.c
66 |
67 | /var/www/html/webui/ ... Sctipt files to set GPS-SDR-SIM location via Web UI.
68 | LatLon.php ... Web UI
69 | LatLon.ini.php ...
70 | LatLon.tmpl.php ... Template file.
71 | LatLon.js ...
72 | start2.php ... Start/Stop GPS signal generation
73 | kill_proc.php ... Kill process of hackrf_transfer, gps-sdr-sim and smooth.php for terminate signal generation.
74 | smooth2.php ... Script for location interpolation between previos position and latest clicked position.
75 | ```
76 | ## Installation
77 | # compile
78 | gcc replay2.c -I/usr/local/include -L/usr/local/lib -lwiringPi -o replay2
79 | (You may need to adjust -I/Lxxxxx for the location of wireringPi)
80 |
81 | ## Usage demo links.
82 | * Wireless Attack Launch Box operation demo. (Length: 3 minutes)
83 | https://www.youtube.com/watch?v=SIPCqLmJFig
84 |
85 | * Real time GPS signal generation by WALB. (Length: 2 minutes)
86 | https://www.youtube.com/watch?v=-V4KLIqEzQg
87 |
88 | * GPS time spoofing demo intended to test GPS week number rollover issue. (Length: 140 seconds)
89 | https://www.youtube.com/watch?v=mEU5RjRJ2lI
90 |
91 | * ADS-B replay attack demo.( Length: 2 minites)
92 | https://www.youtube.com/watch?v=APc1hreOkYU
93 |
--------------------------------------------------------------------------------
/bin/README.txt:
--------------------------------------------------------------------------------
1 | --------------------------------------------------------------
2 | gps-sdr-sim_x64 for Ubuntu16.04 based on https://github.com/osqzss/gps-sdr-sim
3 | --------------------------------------------------------------
4 | This binary file is compiled for x64 CPU on Ubuntu16.04.
5 | Added feature is interactive location (Lat,Lon,Alt) update mode.
6 | You can specify a file which contains one line Lat,Lon,Alt.
7 | Use external program to update the contents of the file.
8 |
9 | Usage: gps-sdr-sim [options]
10 | Options:
11 | -e RINEX navigation file for GPS ephemerides (required)
12 | -u User motion file (dynamic mode)
13 | -g NMEA GGA stream (dynamic mode)
14 | -c ECEF X,Y,Z in meters (static mode) e.g. 3967283.154,1022538.181,4872414.484
15 | * -l Lat,Lon,Hgt (static mode) e.g. 35.681298,139.766247,10.0 | FILE_NAME
16 | -t Scenario start time YYYY/MM/DD,hh:mm:ss
17 | -T Overwrite TOC and TOE to scenario start time
18 | -d Duration [sec] (dynamic mode max: 300, static mode max: 86400)
19 | -o