Beginnings of a generic radio interface built on top of the old e-Go
sniffing code. Eventually this will be able to sniff ShockBurst™ and
Enhanced ShockBurst™ (aka PowerThirst™ AHHHHHHH).
The signal handler previously installed could cause hangs most commonly
observed on OS X. This much simpler handler sets a flag that is checked
in a tight while loop to prevent lockups.
In order to facilitate debugging, this patch implements fault handlers
that blink all three LEDs a certain number of times based on the nature
of the fault. The blinking pattern indicates which of the four major
fault types was triggered along with the subtype (example: usage fault
with divide by zero will blink five times followed by one).
Under certain circumstances, it is possible for a timer interrupt to
fire while a DMA interrupt is being handled. Regardless of interrupt
priority and subpriority between the DMA and timer interrupt, the timer
interrupt will never be serviced.
The LE sniffing code uses the timer interrupt to poll the CC2400's
FS_LOCK status. If this bug is triggered, the FS_LOCK polling will not
occur and the timer interrupt will not be rescheduled, causing capture
to freeze.
Curiously this only occurs after all DMA channels have been disabled,
and the DMACIntStat register will indicate 0 on all channels. The
interrupt fires 8 microseconds after the previous byte is received, when
the next byte would be available from the radio had the DMA channel not
be disabled. Perhaps it's an issue draining the FIFO?
Regardless, if a timer interrupt fires during a DMA interrupt handler,
it should be serviced either pre-emptively (if higher priority) or after
the DMA interrupt handler finishes (same or lower priority). This may be
a hardware issue with the chip.
Closes#326, although this fix is a kludge
Under heavy load and when processing long packets, all rxbufs can become
used. In this situation, buffer_get() will return NULL. The existing
code would dereference the NULL, freezing capture.
This fix checks for NULL and uses the timer interrupt to periodically
poll for available rxbufs. Once an rxbuf becomes available, capture is
resumed.
Note that the existing code includes a comment: TODO handle error
condition. Had that TODO been heeded, untold hours of debugging,
patches, and lost productivity could have been saved. All for want of an
error handler.
See #326
Occasionally a DMA interrupt would fire a few microseconds before the
timer1 interrupt for checking FSON status was scheduled. Due to some
weirdness in the ARM's NVIC, this was causing the timer1 interrupt
handler to never execute. This patch reduces DMA interrupt to the lowest
priority, allowing the timer1 interrupt handler to preempt the DMA
handler. See #326.
This does not completely solve the problem, as it is still possible for
the firmware to hang and become unresponsive to USB requests in
environments with a lot of BLE traffic.
`DLT_USER*` is intended for private use. It requires extra configuration in
tools like Wireshark to make it actually work, and causes problems for
Ubertooth users in other tools (eg: secdev/scapy#1673)
I don't have the hardware for this, so I cannot test this change.
The old mode turned off preamble, stuffed the preamble into one byte of
hardware sync word, and then stuffed the AA into the packet body.
Possibly due to a strange reading of the CC2400 manual?
This oft-requested feature uses the LE sniffing engine to log
advertising packets but NOT follow connections as they are observed.
Previously we recommended people use a hack involving filters, but the
new LE sniffing engine made that hack non-functional. Instead we now
formally support explicitly requesting not to follow connections.
Closes#327
The LE Connection Update Procedure allows devices to change their
connection parameters, mainly hop interval. This code has a major
shortcoming: if we miss the first packet after the update, the
connection is lost completely. This code and the new connection handling
code should be refactored to use the transmit window until at least one
packet is captured and an anchor is set.
- support filter masks. example: 11:22:33:00:00:00/24
- allow clearing the filter using -t none
- can set filter on same command as -f
- bumped libubertooth to 1.01
- bumped USB API to 1.04
The previous version of this code (and the version that all other tools
use) attempts to close ubertooth and then calls exit(0) inside the
signal handler. In addition to being bad practice, it can fail if the
signal is received in the middle of handling another USB command,
leaving the Ubertooth running in an inconsistent state. The other tools
should be similarly refactored.
Add a USB command to cancel following and add support for invoking it by
sending SIGUSR1 to the ubertooth-btle host command. If it is sent when a
connection is not being followed, it acts as a NOP.
Etienne Helluy-Lafont