Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
110 lines (86 sloc) 3.06 KB
/*
* Copyright 2019 Mike Ryan
*
* This file is part of Uberducky and is released under the terms of the
* GPL version 2. Refer to COPYING for more information.
*/
#include "ble.h"
#include "ubertooth.h"
// advertising channel 38
uint16_t rf_channel = 2426;
// initialize RF and strobe FSON
static void cc2400_init_rf(void) {
u16 grmdm, mdmctrl;
uint32_t sync = rbit(0x8e89bed6);
mdmctrl = 0x0040; // 250 kHz frequency deviation
grmdm = 0x4CE1; // un-buffered mode, packet w/ sync word detection
// 0 10 01 1 001 11 0 00 0 1
// | | | | | +--------> CRC off
// | | | | +-----------> sync word: 32 MSB bits of SYNC_WORD
// | | | +---------------> 1 preamble byte of 01010101
// | | +-----------------> packet mode
// | +--------------------> buffered mode
// +-----------------------> sync error bits: 2
cc2400_set(MANAND, 0x7ffe);
cc2400_set(LMTST, 0x2b22);
cc2400_set(MDMTST0, 0x124b);
// 1 2 4b
// 00 0 1 0 0 10 01001011
// | | | | | +---------> AFC_DELTA = ??
// | | | | +------------> AFC settling = 4 pairs (8 bit preamble)
// | | | +--------------> no AFC adjust on packet
// | | +----------------> do not invert data
// | +------------------> TX IF freq 1 0Hz
// +--------------------> PRNG off
//
// ref: CC2400 datasheet page 67
// AFC settling explained page 41/42
cc2400_set(GRMDM, grmdm);
cc2400_set(SYNCL, sync & 0xffff);
cc2400_set(SYNCH, (sync >> 16) & 0xffff);
cc2400_set(FSDIV, rf_channel - 1); // 1 MHz IF
cc2400_set(MDMCTRL, mdmctrl);
// XOSC16M should always be stable, but leave this test anyway
while (!(cc2400_status() & XOSC16M_STABLE));
// wait for FS_LOCK
cc2400_strobe(SFSON);
while (!(cc2400_status() & FS_LOCK)) ;
}
// dewhiten and reverse the bit order of a packet in place
static void ble_dewhiten(uint8_t *pkt, unsigned len) {
unsigned i;
uint32_t *pkt_out = (void *)pkt;
uint32_t dewhiten[] = {
0x2044c5d6, 0x8fe1de59, 0x42afa51b, 0x60cd4e7b, 0x902262eb, 0xc7f0ef2c,
0xa157d28d, 0xb066a73d, 0x48113175, 0xe3f87796, 0xd0abe946, 0xd833539e,
};
for (i = 0; i < len; i+= 4) {
uint32_t v = pkt[i+0] << 24
| pkt[i+1] << 16
| pkt[i+2] << 8
| pkt[i+3] << 0;
pkt_out[i/4] = rbit(v) ^ dewhiten[i/4];
}
}
void ble_init(void) {
cc2400_strobe(SRFOFF);
while (cc2400_status() & FS_LOCK) ;
cc2400_init_rf();
cc2400_strobe(SRX);
}
int ble_get_packet(uint8_t *pkt) {
unsigned i;
// when the FIFO is full the radio state returns to FS_ON
if ((cc2400_get(FSMSTATE) & 0x1f) != STATE_STROBE_FS_ON)
return 0;
// load all bytes into buffer
for (i = 0; i < BLE_PACKET_SIZE; ++i)
pkt[i] = cc2400_get8(FIFOREG);
// dewhiten
ble_dewhiten(pkt, BLE_PACKET_SIZE);
// restart RF
while (!(cc2400_status() & FS_LOCK)) ;
cc2400_strobe(SRX);
while ((cc2400_get(FSMSTATE) & 0x1f) != STATE_STROBE_RX) ;
return 1;
}
You can’t perform that action at this time.