-
Notifications
You must be signed in to change notification settings - Fork 10
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
receive 32 bytes of BLE advertising packets on channel 38
- Loading branch information
Showing
4 changed files
with
140 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,109 @@ | ||
/* | ||
* Copyright 2019 Mike Ryan | ||
* | ||
* This file is part of Uberducky and is released under the terms of the | ||
* GPL version 2. Refer to COPYING for more information. | ||
*/ | ||
|
||
#include "ble.h" | ||
|
||
#include "ubertooth.h" | ||
|
||
// advertising channel 38 | ||
uint16_t rf_channel = 2426; | ||
|
||
// initialize RF and strobe FSON | ||
static void cc2400_init_rf(void) { | ||
u16 grmdm, mdmctrl; | ||
uint32_t sync = rbit(0x8e89bed6); | ||
|
||
mdmctrl = 0x0040; // 250 kHz frequency deviation | ||
grmdm = 0x4CE1; // un-buffered mode, packet w/ sync word detection | ||
// 0 10 01 1 001 11 0 00 0 1 | ||
// | | | | | +--------> CRC off | ||
// | | | | +-----------> sync word: 32 MSB bits of SYNC_WORD | ||
// | | | +---------------> 1 preamble byte of 01010101 | ||
// | | +-----------------> packet mode | ||
// | +--------------------> buffered mode | ||
// +-----------------------> sync error bits: 2 | ||
|
||
cc2400_set(MANAND, 0x7ffe); | ||
cc2400_set(LMTST, 0x2b22); | ||
|
||
cc2400_set(MDMTST0, 0x124b); | ||
// 1 2 4b | ||
// 00 0 1 0 0 10 01001011 | ||
// | | | | | +---------> AFC_DELTA = ?? | ||
// | | | | +------------> AFC settling = 4 pairs (8 bit preamble) | ||
// | | | +--------------> no AFC adjust on packet | ||
// | | +----------------> do not invert data | ||
// | +------------------> TX IF freq 1 0Hz | ||
// +--------------------> PRNG off | ||
// | ||
// ref: CC2400 datasheet page 67 | ||
// AFC settling explained page 41/42 | ||
|
||
cc2400_set(GRMDM, grmdm); | ||
|
||
cc2400_set(SYNCL, sync & 0xffff); | ||
cc2400_set(SYNCH, (sync >> 16) & 0xffff); | ||
|
||
cc2400_set(FSDIV, rf_channel - 1); // 1 MHz IF | ||
cc2400_set(MDMCTRL, mdmctrl); | ||
|
||
// XOSC16M should always be stable, but leave this test anyway | ||
while (!(cc2400_status() & XOSC16M_STABLE)); | ||
|
||
// wait for FS_LOCK | ||
cc2400_strobe(SFSON); | ||
while (!(cc2400_status() & FS_LOCK)) ; | ||
} | ||
|
||
// dewhiten and reverse the bit order of a packet in place | ||
static void ble_dewhiten(uint8_t *pkt, unsigned len) { | ||
unsigned i; | ||
uint32_t *pkt_out = (void *)pkt; | ||
|
||
uint32_t dewhiten[] = { | ||
0x2044c5d6, 0x8fe1de59, 0x42afa51b, 0x60cd4e7b, 0x902262eb, 0xc7f0ef2c, | ||
0xa157d28d, 0xb066a73d, 0x48113175, 0xe3f87796, 0xd0abe946, 0xd833539e, | ||
}; | ||
|
||
for (i = 0; i < len; i+= 4) { | ||
uint32_t v = pkt[i+0] << 24 | ||
| pkt[i+1] << 16 | ||
| pkt[i+2] << 8 | ||
| pkt[i+3] << 0; | ||
pkt_out[i/4] = rbit(v) ^ dewhiten[i/4]; | ||
} | ||
} | ||
|
||
void ble_init(void) { | ||
cc2400_strobe(SRFOFF); | ||
while (cc2400_status() & FS_LOCK) ; | ||
|
||
cc2400_init_rf(); | ||
cc2400_strobe(SRX); | ||
} | ||
|
||
int ble_get_packet(uint8_t *pkt) { | ||
unsigned i; | ||
|
||
// when the FIFO is full the radio state returns to FS_ON | ||
if ((cc2400_get(FSMSTATE) & 0x1f) != STATE_STROBE_FS_ON) | ||
return 0; | ||
|
||
// load all bytes into buffer | ||
for (i = 0; i < BLE_PACKET_SIZE; ++i) | ||
pkt[i] = cc2400_get8(FIFOREG); | ||
|
||
// dewhiten | ||
ble_dewhiten(pkt, BLE_PACKET_SIZE); | ||
|
||
// restart RF | ||
while (!(cc2400_status() & FS_LOCK)) ; | ||
cc2400_strobe(SRX); | ||
while ((cc2400_get(FSMSTATE) & 0x1f) != STATE_STROBE_RX) ; | ||
|
||
return 1; | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
#ifndef __BLE_H__ | ||
#define __BLE_H__ | ||
|
||
#include <stdint.h> | ||
|
||
#define BLE_PACKET_SIZE 32 | ||
|
||
void ble_init(void); | ||
int ble_get_packet(uint8_t *pkt); | ||
|
||
#endif /* __BLE_H__ */ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters