Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/cclabsInc/RFCrack

A Software Defined Radio Attack Tool
https://github.com/cclabsInc/RFCrack

Last synced: 16 days ago
JSON representation

A Software Defined Radio Attack Tool

Awesome Lists containing this project

README 

        

                   ___                  _        ___            _

  / __|___ _ _  ___ ___| |___   / __|_____ __ _| |__  ___ _  _ ___

 | (__/ _ \ ' \(_- _ \ / -_) | (__/ _ \ V  V / '_ \/ _ \ || (_-<

  \___\___/_||_/__/\___/_\___|  \___\___/\_/\_/|_.__/\___/\_, /__/

                                                          |__/

            ___ ___ ___             _

      ___  | _ \ __/ __|_ _ __ _ __| |__

     |___| |   / _| (__| '_/ _` / _| / /

           |_|_\_| \___|_| \__,_\__|_\_\



    Welcome to RFCrack - A Software Defined Radio Attack Tool

    

    VERSION Update: this has been updated to Python3 and should work but there are all

                    kinds of issues I am running into with firmware versions, sdcc, rfcat

                    etc which may also effect you.. See the RFCat documentation if you run 

                    into issues. 



    Developer: @Ficti0n - http://ConsoleCowboys.com

    CCLabs: http://cclabs.io

    Blog: console-cowboys.blogspot.com

    Release Tutorial: https://www.youtube.com/watch?v=H7-g15YZBiI

    Reversing Signals With RFCrack: https://www.youtube.com/watch?v=XqKoVFyOst0

    Release: 1.5



    Hardware Needed: (1 Yardstick or 2 for RollingCode)

    YardStick: https://goo.gl/wd88sr



    RFCrack is my personal RF test bench, it was developed for testing RF communications

    between any physical device that communicates over sub Ghz frequencies. IoT devices,

    Cars, Alarm Systems etc... Testing was done with the Yardstick One on OSX, but

    RFCrack should work fine in linux. Support for other RF related testing will be

    added as needed in my testing. I am currently researching keyless Entry bypasses and

    other signal analysis functionality. New functionality will be added in the future with

    additional hardware requirements for some advanced attacks.



    Feel free to use this software as is for personal use only. Do not use this code

    in other projects or in commercial products. I hold no liability for your actions

    with this code. Your life choices are your own.



    Current supported Functionality:

    ---------------------------------

    - Replay attacks -i -F

    - Send Saved Payloads -s -u

    - Rolling code bypass attacks -r -F -M

    - Targeted -t -F

    - Jamming -j -F

    - Scanning incrementally through frequencies -b -v -F

    - Scanning common frequencies -k

    - Compare Live incoming signals to previous signal -k -c -f -u

    - Graph Signal -n -g -u



    Usage Examples / Attacks:

    -------------------------

    Live Replay:         python RFCrack.py -i

    Rolling Code:        python RFCrack.py -r -M MOD_2FSK -F 314350000

    Adjust RSSI Values:  python RFCrack.py -r -M MOD_2FSK -F 314350000 -U -100 -L -10

    Jamming:             python RFCrack.py -j -F 314000000

    Scan common freq:    python RFCrack.py -k

    Scan with your list: python RFCrack.py -k -f 433000000 314000000 390000000

    Incremental Scan:    python RFCrack.py -b -v 5000000

    Send Saved Payload:  python RFCrack.py -s -u ./captures/test.cap -F 315000000 -M MOD_ASK_OOK

    With Loaded Config:  python RFCrack.py -l ./device_templates/doorbell.config -r

    Graph a Signal:      python RFCrack.py -n -g -u 1f0fffe0fffc01ff803ff007fe0fffc1fff83fff07



    Live Signal Identification and Comparison (Use 2 Console Windows):

    -----------------------------------------------------------------

    Setup sniffer:      python RFCrack.py -k -c -f 390000000

    Setup Analysis:     python RFCrack.py -c -u 1f0fffe0fffc01ff803ff007fe0fffc1fff83fff07f -n



    Useful arguments:

    ------------------------

    -M Change modulation, usually MOD_2FSK or MOD_ASK_OOK

    -F Change the frequency used in attacks

    -U upper_rssi signal strength value for rolling Code

    -L lower.rssi signal strength value for rolling code

    -S Change Channel Spacing

    -V Change Deviation of modulation

    -a Jamming frequency variance from sniffer

    -s Send packet from a file source

    -d Save your current device settings into a loadable template after attack completes

    -l Load previously saved device configuration with attack

    -n Your using functionality that does not require a yardstick plugged in

    -u Use saved data in your attack



    Directories Explained:

    ----------------------

    Saved captures get saved to ./captures directory by default!

    Live signal identification captures also saved to ./captures directory in capturedClicks.log

    Device templates are saved and loaded to ./device_templates by default

    Scanning logs are saved to ./scanning_logs named based on date and time of scanning start

    Graph comparison images are saved to imageOutput in 2 formats

     - Live: LiveComparison.png will just be written over on each signal Analysis

     - Log analysis: Comparison1 Comparison2 format is used and written over on each log analysis



    Other Notes:

    ------------------------

    Understand that Rolling code is hit or miss due to its nature with jamming and sniffing

    at the same time, but it works. Just use the keyfob near the yardsticks as if you were

    stalking your target. It will also require 2 yardsticks, one for sniffing while the other

    one is jamming. Yardsticks do not send and receive at the same time.



    And a final note, this is my own test bench for doing research and dev, if you have ideas

    to make RFCrack better based on realistic use case scenarios, feel free to reach out to me If

    the ideas are realistic, well thought out, and re-useable use cases I will implement them.