Statistics
| Branch: | Tag: | Revision:

amiro-os / test / periphery-lld / bq27500_v1 / aos_test_bq27500.c @ 8d4d058e

History | View | Annotate | Download (27.052 KB)

1 e545e620 Thomas Schöpping
/*
2
AMiRo-OS is an operating system designed for the Autonomous Mini Robot (AMiRo) platform.
3 84f0ce9e Thomas Schöpping
Copyright (C) 2016..2019  Thomas Schöpping et al.
4 e545e620 Thomas Schöpping

5
This program is free software: you can redistribute it and/or modify
6
it under the terms of the GNU General Public License as published by
7
the Free Software Foundation, either version 3 of the License, or
8
(at your option) any later version.
9

10
This program is distributed in the hope that it will be useful,
11
but WITHOUT ANY WARRANTY; without even the implied warranty of
12
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13
GNU General Public License for more details.
14

15
You should have received a copy of the GNU General Public License
16
along with this program.  If not, see <http://www.gnu.org/licenses/>.
17
*/
18
19 ddf34c3d Thomas Schöpping
#include <amiroos.h>
20 4c72a54c Thomas Schöpping
#include <aos_test_bq27500.h>
21 e545e620 Thomas Schöpping
22 4c72a54c Thomas Schöpping
#if (AMIROOS_CFG_TESTS_ENABLE == true) || defined(__DOXYGEN__)
23 e545e620 Thomas Schöpping
24
#include <string.h>
25 f3ac1c96 Thomas Schöpping
26
/******************************************************************************/
27
/* LOCAL DEFINITIONS                                                          */
28
/******************************************************************************/
29 e545e620 Thomas Schöpping
30 57a5ea60 Marc Rothmann
// change saved unseal keys to test bruteforcing
31 4c72a54c Thomas Schöpping
#if defined(BQ27500_TEST_BRUTEFORCE)
32 57a5ea60 Marc Rothmann
33 7de0cc90 Thomas Schöpping
#if defined(BQ27500_LLD_DEFAULT_UNSEAL_KEY0)
34 57a5ea60 Marc Rothmann
#undef BQ27500_LLD_DEFAULT_UNSEAL_KEY0
35
#define BQ27500_LLD_DEFAULT_UNSEAL_KEY0 0x1234
36 7de0cc90 Thomas Schöpping
#endif /* defined(BQ27500_LLD_DEFAULT_UNSEAL_KEY0) */
37 57a5ea60 Marc Rothmann
38 7de0cc90 Thomas Schöpping
#if defined(BQ27500_LLD_DEFAULT_UNSEAL_KEY1)
39 57a5ea60 Marc Rothmann
#undef BQ27500_LLD_DEFAULT_UNSEAL_KEY1
40
#define BQ27500_LLD_DEFAULT_UNSEAL_KEY1 0x5678
41 7de0cc90 Thomas Schöpping
#endif /* defined(BQ27500_LLD_DEFAULT_UNSEAL_KEY1) */
42 57a5ea60 Marc Rothmann
43 4c72a54c Thomas Schöpping
#endif /* defined(BQ27500_TEST_BRUTEFORCE) */
44 57a5ea60 Marc Rothmann
45 f3ac1c96 Thomas Schöpping
/******************************************************************************/
46
/* EXPORTED VARIABLES                                                         */
47
/******************************************************************************/
48
49
/******************************************************************************/
50
/* LOCAL TYPES                                                                */
51
/******************************************************************************/
52
53
/******************************************************************************/
54
/* LOCAL VARIABLES                                                            */
55
/******************************************************************************/
56
57
/******************************************************************************/
58
/* LOCAL FUNCTIONS                                                            */
59
/******************************************************************************/
60
61 57a5ea60 Marc Rothmann
bq27500_lld_control_status_t _try_unseal(BQ27500Driver* driver, uint16_t key0, uint16_t key1, apalTime_t timeout) {
62
  uint16_t dst;
63
  bq27500_lld_control_status_t ctrl;
64
  bq27500_lld_send_ctnl_data(driver, key1, timeout);
65
  aosThdUSleep(1);
66
  bq27500_lld_send_ctnl_data(driver, key0, timeout);
67
  aosThdUSleep(1);
68
  bq27500_lld_sub_command_call(driver, BQ27500_LLD_SUB_CMD_CONTROL_STATUS, timeout);
69
  aosThdUSleep(1);
70
  bq27500_lld_std_command(driver, BQ27500_LLD_STD_CMD_Control, &dst, timeout);
71
  bq27500_lld_sub_command_read(driver, &ctrl.value, timeout);
72
  return ctrl;
73
}
74
75
uint8_t _bruteforce_sealed_key_bitflips(BaseSequentialStream* stream, BQ27500Driver* driver, uint16_t key0, uint16_t key1, apalTime_t timeout) {
76
  bq27500_lld_control_status_t ctrl;
77
  uint16_t k0;
78
  uint16_t k1 = key1;
79
  for (uint8_t i = 0; i < 16; i++) {
80
    k0 = key0 ^ (1 << i); // flip bit i
81
    ctrl = _try_unseal(driver, k0, k1, timeout);
82
    if (ctrl.content.ss == 0x0) {
83
      chprintf(stream, "\t\tSUCCESS!\n");
84
      chprintf(stream, "\t\tkey0: 0x%X, key1: 0x%X\n", k0, k1);
85
      return 1;
86
    }
87
  }
88
  k0 = key0;
89
  for (uint8_t i = 0; i < 16; i++) {
90
    k1 = key1 ^ (1 << i); // flip bit i
91
    ctrl = _try_unseal(driver, k0, k1, timeout);
92
    if (ctrl.content.ss == 0x0) {
93
      chprintf(stream, "\t\tSUCCESS!\n");
94
      chprintf(stream, "\t\tkey0: 0x%X, key1: 0x%X\n", k0, k1);
95
      return 1;
96
    }
97
  }
98
  return 0;
99
}
100
101
void _bruteforce_sealed_key(BaseSequentialStream* stream, BQ27500Driver* driver, apalTime_t timeout) {
102
  chprintf(stream, "start bruteforcing sealed keys...\n");
103
  bq27500_lld_control_status_t ctrl;
104
  uint16_t key0_reversed = 0x7236;
105
  uint16_t key1_reversed = 0x1404;
106
  uint16_t key0 = BQ27500_LLD_DEFAULT_UNSEAL_KEY0;
107
  uint16_t key1 = BQ27500_LLD_DEFAULT_UNSEAL_KEY1;
108
  uint16_t k0 = key0;
109
  uint16_t k1 = key1;
110
111
  // testing default keys in different orders
112
  chprintf(stream, "\ttry reversed byte order and different key order...\n");
113
  // default unseal keys
114
  ctrl = _try_unseal(driver, k0, k1, timeout);
115
  if (ctrl.content.ss == 0x0) {
116
    chprintf(stream, "\t\tSUCCESS!\n");
117
    chprintf(stream, "\t\tkey0: 0x%X, key1: 0x%X\n", k0, k1);
118
    return;
119
  }
120
  // default unseal keys in reversed order
121
  ctrl = _try_unseal(driver, k1, k0, timeout);
122
  if (ctrl.content.ss == 0x0) {
123
    chprintf(stream, "\t\tSUCCESS!\n");
124
    chprintf(stream, "\t\tkey0: 0x%X, key1: 0x%X\n", k0, k1);
125
    return;
126
  }
127
  // byte reversed keys
128
  k0 = key0_reversed;
129
  k1 = key1_reversed;
130
  ctrl = _try_unseal(driver, k0, k1, timeout);
131
  if (ctrl.content.ss == 0x0) {
132
    chprintf(stream, "\t\tSUCCESS!\n");
133
    chprintf(stream, "\t\tkey0: 0x%X, key1: 0x%X\n", k0, k1);
134
    return;
135
  }
136
  // byte reversed keys in reversed order
137
  ctrl = _try_unseal(driver, k1, k0, timeout);
138
  if (ctrl.content.ss == 0x0) {
139
    chprintf(stream, "\t\tSUCCESS!\n");
140
    chprintf(stream, "\t\tkey0: 0x%X, key1: 0x%X\n", k0, k1);
141
    return;
142
  }
143
  chprintf(stream, "\t\tfailed\n");
144
145
146
  // testing single bit flips of the default keys in different orders
147
  chprintf(stream, "\ttry single bit flips of default keys...\n");
148
  // default unseal keys
149
  uint8_t result = 0;
150
  result = _bruteforce_sealed_key_bitflips(stream, driver, key0, key1, timeout);
151
  if (result == 1) {
152
    return;
153
  }
154
  // default unseal keys in reversed order
155
  result = _bruteforce_sealed_key_bitflips(stream, driver, key1, key0, timeout);
156
  if (result == 1) {
157
    return;
158
  }
159
  // byte reversed keys
160
  result = _bruteforce_sealed_key_bitflips(stream, driver, key0_reversed, key1_reversed, timeout);
161
  if (result == 1) {
162
    return;
163
  }
164
  // byte reversed keys in reversed order
165
  result = _bruteforce_sealed_key_bitflips(stream, driver, key1_reversed, key0_reversed, timeout);
166
  if (result == 1) {
167
    return;
168
  }
169
  chprintf(stream, "\t\tfailed\n");
170
171
172
  // bruteforcing one of the keys, assuming only one of them was changed
173
  chprintf(stream, "\ttry bruteforcing a single key...\n");
174
  // default unseal key0
175
  for (uint32_t i = 0; i <= 0xFFFF; i++) {
176
    ctrl = _try_unseal(driver, key0, i, timeout);
177
    if (ctrl.content.ss == 0x0) {
178
      chprintf(stream, "\t\tSUCCESS!\n");
179
      chprintf(stream, "\t\tkey0: 0x%X, key1: 0x%X\n", key0, i);
180
      return;
181
    }
182
  }
183
  chprintf(stream, "\t\tkey failed. 1/8\n");
184
  // reversed unseal key0
185
  for (uint32_t i = 0; i <= 0xFFFF; i++) {
186
    ctrl = _try_unseal(driver, key0_reversed, i, timeout);
187
    if (ctrl.content.ss == 0x0) {
188
      chprintf(stream, "\t\tSUCCESS!\n");
189
      chprintf(stream, "\t\tkey0: 0x%X, key1: 0x%X\n", key0_reversed, i);
190
      return;
191
    }
192
  }
193
  chprintf(stream, "\t\tkey failed. 2/8\n");
194
  // default unseal key0 in reversed order
195
  for (uint32_t i = 0; i <= 0xFFFF; i++) {
196
    ctrl = _try_unseal(driver, i, key0, timeout);
197
    if (ctrl.content.ss == 0x0) {
198
      chprintf(stream, "\t\tSUCCESS!\n");
199
      chprintf(stream, "\t\tkey0: 0x%X, key1: 0x%X\n", i, key0);
200
      return;
201
    }
202
  }
203
  chprintf(stream, "\t\tkey failed. 3/8\n");
204
  // reversed unseal key0 in reversed order
205
  for (uint32_t i = 0; i <= 0xFFFF; i++) {
206
    ctrl = _try_unseal(driver, i, key0_reversed, timeout);
207
    if (ctrl.content.ss == 0x0) {
208
      chprintf(stream, "\t\tSUCCESS!\n");
209
      chprintf(stream, "\t\tkey0: 0x%X, key1: 0x%X\n", i, key0_reversed);
210
      return;
211
    }
212
  }
213
  chprintf(stream, "\t\tkey failed. 4/8\n");
214
  // default unseal key1
215
  for (uint32_t i = 0; i <= 0xFFFF; i++) {
216
    ctrl = _try_unseal(driver, i, key1, timeout);
217
    if (ctrl.content.ss == 0x0) {
218
      chprintf(stream, "