Posted tagged ‘Projects’

Still Here…

May 26, 2014

Sorry for not updating this blog more often than I intended to, lately…

Not a great deal to report on, from a personal perspective, since I’ve mostly being trying to focus on getting through this stage of my course, and am waiting for exam results, so that I can hopefully progress onto my final year. 

Since the last time that I posted about them, my Wireshark dissectors (especially the USB CCID, and NXP PN532 ones) have seen some significant updates, thanks to the much-appreciated assistance of Michal Labedzki, and other members of the upstream Wireshark community.

This means that most of the CCID-specific USB descriptors are now dissected, and the PN532 dissector now not only supports the entire command set, but also supports the custom Host Communication Interface wrapper protocol, used by certain devices.

As a side project, I decided to start a new, L4Ka::Pistachio-based OS project, earlier this month, by branching the official GitHub repository, which as of yet still doesn’t have a name.

This one won’t initially be as ambitious as my prior, failed attempts; and I’ve already made some progress on implementing a C library, using code from the existing “libio“, various versions of BSD, and Solaris; and a shell using the existing driver for serial port, and keyboard. 

The keyboard driver is still pretty buggy (shift key support doesn’t work, for some reason); however, the serial driver works fine in QEMU, and even seems to cope with Unicode characters (the example text is a song title from a Korean band (DOZ), for the curious), without problems, provided a suitable font is available:

Image

I also started trying to implement support for ATA-based hard disk access (using a public-domain driver), and the FAT series of file systems (using Chan’s driver), but this doesn’t quite work properly, yet. 

Also, my C library implementation still has a fairly large numbers of flaws, and missing features (no file support, or streams support are probably the most glaring omissions, right now), so it’s difficult to port things to it.

Anyway, I hope that provides some explanation for my absence for so long.

Advertisements

WAP @ Home

May 26, 2013

Last night, I decided to install Kannel (an Open Source Wireless Application Protocol gateway), for a challenge.

It seems that installation itself was easy (just a case of downloading a snapshot archive, unpacking it, installing the libxml2-dev package from the Ubuntu repositories, and then running ./configure && make && make install to install it.

However, actually configuring it to run successfully was harder, since the “bearerbox“, and “wapbox” utilities will just unceremoniously quit with a “panic” notice, if they can’t either find their configuration file, or if it isn’t structured in a suitable manner.

I ended up copying the example configuration file from ~/kannel-snapshot/doc/examples/kannel.conf to /etc/kannel/kannel.conf, and modifying it to look like:

I also had to configure my residential gateway/router to use my laptop’s IPv4 address as a DMZ host. (Although I originally intended to just allow inbound traffic on UDP ports 9200, and 9201, for testing purposes).

After doing so, the core BearerBox utility can be invoked with bearerbox /etc/kannel/kannel.conf.

WAPBox is supposed to start automatically – however, it didn’t in my case, so I had to manually invoke
wapbox /etc/kannel/kannel.conf, in order to prevent this error:

To test to see if I could connect to the newly-installed gateway, I decided to play with the “Network Settings” view of the BlackBerry OS version of the Shazam application, since it allows for overriding of the default GPRS/WAP settings.

I ended up using the following settings (which will probably be useless for other readers, but otherwise provide a template):

APN: payandgo.o2.co.uk
Username: payandgo
Password: password
WAP Gateway IP: 95.150.51.112
WAP Port: 9201

(*) These are network WAP Settings

[Y] Enable Overrides

After selecting “Test Settings”, and waiting a while, I eventually received a packet from O2’s GPRS gateway on behalf of my handset:

Unfortunately, it seems that connections are not always successful – presumably due to either WAPBox/BearerBox configuration issues, or problems with connectivity between the GPRS gateway, my handset, and my network.

(I suspect that O2 occasionally block third-party gateway connectivity, or that the BlackBerry OS WAP stack copes badly with multiple failed connection attempts).

Connectivity problems aside, this might be a useful way of debugging/testing applications using cellular data networking on handsets without a Wi-Fi radio.

Repackaged CryptoRF/LibNFC Example Code

March 30, 2013

Earlier, I tried to build the “NFC-CryptoRF” example code from the LibNFC Wiki, without success against LibNFC 1.7.0-rc4-9-g3584338, under Ubuntu 12.10.

Unsurprisingly, thanks to the LibNFC developers constantly changing their public APIs (for good reasons, I’m sure), said example code has succumbed to bit-rot, and only builds against obsolete versions of LibNFC.

Therefore, it seems that the only immediately obvious way for this code to be useful is to either downgrade the installed library version, or attempt to fix the hacky code to compensate for changes.

Luckily, after temporarily uninstalling my trunk version; downloading, and installing a LibNFC 1.3.4 source archive, applying the patch from a member of the LibNFC Forums to the example code, and attempting to rebuild everything, it seems that the example code works as it should.

After reinstating my modern LibNFC version; configuring 1.3.4’s build process to install to a temporary directory, copying the resulting ancient shared object file to “libnfc.so.0” in the example code directory, and creating a wrapper shell (“crf134“) script based upon the arguments passing technique mentioned here, it seems that I can now enjoy being able to use this tool, alongside more modern, “global” versions of LibNFC…

Anyway, to save others the hassle, I’ve uploaded the resulting product to Google Code.

As proof of peaceful co-existence with a more modern version of LibNFC:

Finally, in order to satisfy the terms of the (L)GPL, I have also included the original, uncompressed LibNFC 1.3.4 archive, the patched example source code, a copy of the patch, and the unpacked LibNFC directory containing both source, and 32-bit Linux binaries.

Finally, CryptoRF

March 29, 2013

Yesterday, I finally received a package from Atmel USA containing some sample ISO/IEC14443 Type-B CryptoRF tags, after numerous failed attempts at requesting some via their sample request form.

I ordered 1 sample of the 8KB AT88SC0808CRF-MX1 variant, and 2 samples of the 4KB AT88RF04C-MX1G variant.

The 4KB tags seem to be unusually packaged, and I don’t know if it’d be safe to carefully attempt to cut the strip in half using scissors, in order to make it easier to work with each:

I was probably expecting to receive paper-mounted tags, similar to my FeliCa Lite, and MiFare UltraLight ones – but the product seems to work as advertised.

Curiously, I was able to trigger an unusual hardware glitch in the PN532 chipset, if I carefully placed the strip of 4KB tags in the reader’s field in a specific way, which manifested in the following output from nfc-list -v:

I’ve also uploaded a USB trace file demonstrating this phenomenon, here.

It seems that I’m supposed to see this, instead:

Unsurprisingly, I can’t seem to be able to reliably read either of these two, without even more careful positioning – which suggests anti-collision problems (probably since both have the same unique ID, as supplied)…

The 8KB version, and its accompanying protective packaging looks like:

(Hand not included!)

…and nfc-list -v says:

When I get time, I intend to study the datasheet, and probably play with building TAMA shell scripts, with a view to trying to write another command set dissector.

That said, I have, however tried to compile the sample code on the LibNFC wiki, without success.

Maybe someone else has succeeded in building it against the latest revisions of LibNFC?

Minor Wireshark NFC/RFID Dissector Updates

March 6, 2013

Recently, I updated my FeliCa, and NXP PN532 Wireshark dissectors to support the following functionality:

PN532 dissector:

  • Support for dissection of MiFare command payloads in PN532 InDataExchange packets (bug #8291)
    • This means that command packets (but not responses) from tools such as MFOC, and the tools from LibNFC for accessing MiFare Classic, and MiFare UltraLight tokens are dissected.
  • Support for dissection of FeliCa payloads in PN532 InCommunicateThru packets (bug #8246)
    • This means that dissection of packets from almost all of an “NFC Tag Type 3” (barring NDEF payload data) tag reading session should be dissected, using the FeliCa “flavour” of notation.

FeliCa dissector:

  • Support for the FeliCa Plug system code (bug #7767)
    • This theoretically means that Sony’s new FeliCa Plug should be identified in “Polling Response” packets.
  • Update to identify commands from the full FeliCa Standard profile (bug #8243)
    • This theoretically means that commands related to enciphered reading/writing, authentication, searching for system/service codes, and requesting system information from the latest FeliCa Standard tokens should be at least identified.

I have also been trying to update Google’s dissectors to work with the latest SVN revisions of Wireshark, with mixed success. However, it seems that project has temporarily stalled – save for some brief exchanges on its mailing list, that didn’t really go anywhere.

Anyway, I remain willing to assist with that effort; and in the interim, I hope that this new functionality is useful.

A renovated PureDarwin XMas disk image

August 27, 2012

Recently, I spent a few hours on modifying the “PureDarwin XMas” disk image, in the hope of trying to boot it under VirtualBox, and QEMU, with mixed success.

The modifications themselves entailed the following steps…

  • Using an installation of Mac OS X 10.6 under VirtualBox to mount said disk image
  • Extracting its primary partition from the rather Byzantine partitioning scheme in use using Disk Utility’s new disk image creation feature
  • Re-partitioning the original image to use a standard x86 MBR partitioning scheme, and creating a single partition
  • Mounting the newly created partition image using Disk Copy, again
  • Copying the raw sector contents of the mounted partition image to the newly created MBR partition, using “DD”
  • Installing the Chameleon v2.0-RC4 r684 bootloader

Under some versions of QEMU, it seems to be possible to boot it as far as a working shell, where the startx command can be issued, in order to launch a customised version of WindowMaker:
 However, under VirtualBox on my AMD Phenom II-based HP G62 laptop, booting fails at:

If I attach the modified image to a Ubuntu virtual machine, copy its raw sectors to an SD card, and reboot my laptop with it inserted into a USB card reader, I can also attempt to boot it, and launch WindowMaker with some success:

Unfortunately, the ancient version of XFree86 supplied in the image doesn’t support the AMD graphics chipset in this G62-series model – so graphical corruption, similar to that seen when trying to boot certain old Linux distributions on incompatible hardware can be witnessed.

There is also an unresolved glitch where the image fails to reboot, under certain circumstances, seemingly due to some issues involving file system drivers, and replaying the volume journal during mounting. This problem may also be encountered when trying to boot it from a locked SD card, for the first time.

Anyway, for others wishing to try it, I’ve uploaded a copy of the modified disk image to Google Code.

Interfacing with a PayPass card under Linux using LibNFC

March 14, 2012

This morning, I received an Orange Cash prepaid debit MasterCard, and preceded to see if I could use its ISO/IEC 14443-A interface to access its EMV application directory.

After spending some time searching the Web, I realised that not many people have successfully attempted to do so using LibNFC (or if they have, they’ve decided to remain quiet about it, for reasons unknown); and resorted to trying to use CardPeek‘s EMV script – which worked successfully with the ISO/IEC 7816 contact interfaces of all of the cards that I’ve tried (until I accidentally broke one of the contact interface pins), but doesn’t work with my reader’s RFID transceiver…

Using LibNFC’s nfc-list -v command, I was able to obtain the following information regarding the contactless interface:

1 ISO14443A passive target(s) found:
    ATQA (SENS_RES): 00  04
* UID size: single
* bit frame anticollision supported
       UID (NFCID1): 29  8b  cf  51
      SAK (SEL_RES): 28
* Compliant with ISO/IEC 14443-4
* Not compliant with ISO/IEC 18092
   ATS: 78 80 82 02 80 31 80 66 b0 84
 12 01 6e 01 83 00 90 00
* Max Frame Size accepted by PICC: 256 bytes
* Bit Rate Capability:
  * Same bitrate in both directions mandatory
* Frame Waiting Time: 77.33 ms
* Start-up Frame Guard Time: 1.208 ms
* Node ADdress not supported
* Card IDentifier supported
* Historical bytes Tk: 80 31 80 66 b0 84 12 01 6e 01 83 00 90 00
  * Tk after 0x80 consist of optional consecutive
      COMPACT-TLV data objects;
    the last data object may carry a status indicator of one,
      two or three bytes.
    See ISO/IEC 7816-4 8.1.1.3 for more info
Fingerprinting based on ATQA & SAK values:
* JCOP31 v2.3.1
* SmartMX with Mifare 1K emulation

I’ve modified the formatting of that command’s output slightly, so that it fits within this blog’s template boundaries –  but the data is identical to what I see when running it.

Since I couldn’t find any useful example code in C or C++ for exchanging ISO/IEC 7816 APDUs with contactless cards, I decided to investigate the possibility of modifying one of the TAMA scripts (UltraLightRead.cmd) in the LibNFC repository, and discovered that by prefixing the EMV commands mentioned in Saush’s blog post with 40 01, I was able to make the card respond to a request for the Payment System Environment.

The resulting script looks like this:

02; // Get firmware version
4A 01 00; // 1 target requested
// Select the payment system environment
40 01 00 A4 04 00 0E 31 50 41 59 2E 53 59 53 2E 44 44 46 30 31;

And the resulting packet received from the card reader’s PN532 chipset looks like:

If I get chance, I’ll probably see if I can modify CardPeek’s EMV script somehow to generate APDUs with InDataExchange (0x40) framing, and hopefully get contactless mode working with my reader (so that I don’t have to implement EMV by myself, in order to test other commands) – but I have my doubts, somehow.

In the meantime, I hope that this discovery is vaguely helpful for others…