Skip to content

Commit 1ffecd9

Browse files
author
fruss
committed
Initial commit.
1 parent ea66099 commit 1ffecd9

22 files changed

+1673
-1
lines changed

‎README.md‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,21 @@
11
inmarsat-isatphone-demos-eko2012
22
================================
33

4-
This projects is about the analysis and modification of the firmware of the Analog Devices AD6900 (LeMans) Baseband processor used in the Inmarsat IsatPhone Pro satellite terminal.
4+
This projects is about the analysis and modification of the firmware of the Analog Devices AD6900 (LeMans) Baseband processor used in the Inmarsat IsatPhone Pro satellite terminal.
5+
6+
Techniques for code ex- ecution in both the CPU and the DSP are documented, the main result being the instrumentation of functions inside the blackfin DSP with the objective of control, monitoring and emission of Layer-1 GEO- Mobile Radio interface packets.
7+
8+
9+
Content
10+
-------
11+
12+
bfpatch : Directory containing blackfin binary patches
13+
src : Directory containing sources
14+
decodepackets.py : GMR-2 python parser
15+
dopatch_custom_frame.sh : Serial patcher of IsatPhone Pro 4.0.0 firmware, inject custom frame
16+
dopatch_IO.sh : Serial patcher of IsatPhone Pro 4.0.0 firmware, dump packets
17+
dumpIO.py : Python script that decodes and show packets in real-time. Needs to execute dopatch_custom_frame.sh or dopath_IO.sh first.
18+
isat_hax_echo_arm.py : Insert custom shellcode into ARM AT command "echo" (first stage)
19+
isat_hax_echo_bf.py : Use AT command "echo" to insert a custom shellcode into blackfin code
20+
isat_hax.py : Insert custom shellcode into ARM (thumb version)
21+
isat_hook_bf_call.py : Upload a blackfin binary to the provided pointer. Additionally, this function insert a call to the binary into a second address provided.

‎bfpatch/0000.bin‎

2 Bytes
Binary file not shown.

‎bfpatch/copyI.bin‎

942 Bytes
Binary file not shown.

‎bfpatch/copyO.bin‎

812 Bytes
Binary file not shown.

‎bfpatch/customframe.bin‎

17 Bytes
Binary file not shown.

‎decodepackets.py‎

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
######
2+
###### Decode GMRv2 Layer 3 frames
3+
######
4+
#
5+
# Property of Groundworks Technologies
6+
#
7+
#
8+
9+
import sys,math
10+
11+
# Color class
12+
class bcolors:
13+
HEADER = '\033[95m'
14+
OKBLUE = '\033[94m'
15+
OKGREEN = '\033[92m'
16+
WARNING = '\033[93m'
17+
FAIL = '\033[91m'
18+
ENDC = '\033[0m'
19+
20+
## Print hexadecimal buffer
21+
def printHex(buf):
22+
str=""
23+
for c in buf:
24+
str+=" %02X" % ord(c)
25+
str+="|"
26+
for c in buf:
27+
echar=ord(c)
28+
if (echar<32) or (echar>128): echar=ord('.')
29+
str+="%c" % echar
30+
return str
31+
32+
33+
## Return single bit from string
34+
def getbit(buf,bitnum):
35+
bitpos = bitnum % 8
36+
bytepos=math.floor(bitnum/8)
37+
byte = buf[int(bytepos)]
38+
if (ord(byte) & (1<<bitpos)) != 0:
39+
return True
40+
else: return False
41+
42+
## Return arbitrary bits from string
43+
def getbits(buf,start,end):
44+
end+=1
45+
val=0
46+
cnt=0
47+
str=""
48+
for i in range(start,end):
49+
if getbit(buf,i):
50+
val+=1<<cnt
51+
if (cnt!=0):
52+
if (cnt % 7)==0:
53+
str+=chr(val)
54+
val=0
55+
cnt=-1
56+
cnt+=1
57+
if cnt!=0:
58+
str+=chr(val)
59+
return str
60+
61+
62+
## Print packet data
63+
## See GMR-2 04.006 (ETSI TS 101 377-4-5 V1.1.1)
64+
def parseGMR(buf):
65+
# Direction
66+
if buf[0x1f]=='O':
67+
direction="SAT-to-MES"
68+
else: direction="MES-to-SAT"
69+
print "Direction: %s" % direction
70+
#----- ADDRESS FIELD
71+
# Address Field extension bit
72+
EA = ord(getbits(buf[0],0,0))
73+
if (EA==1): EAstr="Final octet"
74+
else: EAstr="extension"
75+
76+
# Command/Response (Assume Received packet)
77+
CR = ord(getbits(buf[0],1,1))
78+
if (CR==1): CRstr="Command"
79+
else: CRstr="Response"
80+
81+
# Service Access Point Identifier (SAPI)
82+
SAPI=ord(getbits(buf[0],2,4))
83+
SAPIstr="Reserved"
84+
if (SAPI==1): SAPIstr="Call control signaling"
85+
if (SAPI==3): SAPIstr="Short message service"
86+
87+
LPD =ord(getbits(buf[0],5,6))
88+
SPAR=ord(getbits(buf[0],7,7))
89+
90+
print "Address Field: EA=%d (%s) CR=%d (%s) SAPI=%d (%s) LPD=%d SPAR=%d" % (EA,EAstr,CR,CRstr,SAPI,SAPIstr,LPD,SPAR)
91+
92+
#----- CONTROL FIELD
93+
CF1 = ord(getbits(buf[1],0,0))
94+
FFormat="I"
95+
if CF1==1:
96+
CF1=ord(getbits(buf[1],0,1))
97+
if CF1==3:
98+
FFormat="U"
99+
else: FFormat="S"
100+
PF=ord(getbits(buf[1],4,4))
101+
NS=0
102+
NR=0
103+
if FFormat=="I":
104+
NS=ord(getbits(buf[1],1,3))
105+
NR=ord(getbits(buf[1],5,7))
106+
if FFormat=="S":
107+
SS=ord(getbits(buf[1],2,3))
108+
NR=ord(getbits(buf[1],5,7))
109+
CMD=""
110+
if SS==0: CMD="Receive Ready"
111+
if SS==1: CMD="Receive not Ready"
112+
if SS==2: CMD="Reject"
113+
if FFormat=="U":
114+
UU=ord(getbits(buf[1],2,3))
115+
UUU=ord(getbits(buf[1],5,7))
116+
117+
if FFormat=="S": cmdStr= " Command: %s" % CMD
118+
else: cmdStr=""
119+
120+
print "Control Field %02x: Format=%s (%d) NS=%d PF=%d NR=%d %s" % (ord(buf[1]),FFormat,CF1,NS,PF,NR,cmdStr)
121+
122+
#----- LENGTH INDICATOR FIELD
123+
124+
# Address Field extension bit
125+
EL = ord(getbits(buf[2],0,0))
126+
if (EL==1): ELstr="Final octet"
127+
else: ELstr="extension"
128+
129+
M = ord(getbits(buf[2],1,1))
130+
Mstr=""
131+
if M==1: Mstr="segmented L3"
132+
133+
LI = ord(getbits(buf[2],2,7))
134+
if LI==0:LIstr="No Information field"
135+
else: LIstr=""
136+
137+
print "Len. Indicator Field %02x: EL=%d (%s) M=%d (%s) Lenght=%d octets (%s)" % (ord(buf[2]),EL,ELstr,M,Mstr,LI,LIstr)
138+
if FFormat=="I":
139+
if LI>0:
140+
datastr = buf[3:3+LI]
141+
fillstr = buf[3+LI:23]
142+
# for printing to screen
143+
dataprint=datastr[:10]
144+
fillprint=fillstr[:10]
145+
print " Data: "+bcolors.FAIL+ printHex(dataprint) + bcolors.ENDC
146+
print " Fill: "+bcolors.FAIL+ printHex(fillprint) + bcolors.ENDC
147+
return (datastr,fillstr)
148+
print " Data: None"
149+
print " Fill: None"
150+
return (False,False)
151+
152+
## Return 7-bit decoded packet data
153+
## See GMR-2 04.006 (ETSI TS 101 377-4-5 V1.1.1)
154+
def parseGMROut(buf):
155+
start=buf.find("\x98\xF8") # alignment hax! horrible, just for demo.
156+
if (start>-1):
157+
buf=buf[start+6:]
158+
r1=0
159+
r2=1
160+
else:
161+
r1=4
162+
r2=5
163+
str=""
164+
for q in range(r1,r2):
165+
bin=""
166+
for i in range(0,len(buf)*8-14,7):
167+
c = getbits(buf,q+i,q+i+6)
168+
bin+=c
169+
if (ord(c)>=32) and (ord(c)<=126):
170+
str+=c
171+
else: str+="."
172+
return str
173+
174+
175+
176+
###### MAIN
177+
def main():
178+
if len(sys.argv)<3:
179+
print "Usage: %s <file> [channel]" % (sys.argv[0])
180+
181+
infile=open(sys.argv[1])
182+
183+
recordlen=0x20
184+
if len(sys.argv)>2:
185+
channel=int(sys.argv[2])
186+
else: channel=0x0d
187+
188+
#buf=infile.read(recordlen-1)
189+
msg=""
190+
buf=infile.read(recordlen-1)
191+
while(True):
192+
packetDir=infile.read(1)
193+
buf=infile.read(recordlen-1)
194+
if len(buf)<(recordlen-1):
195+
break
196+
#print "------------------------------------------------------"
197+
#print packetDir
198+
if packetDir=='O':
199+
if ord(buf[0])==channel:
200+
(data,fill)=parseGMR(buf+packetDir)
201+
if (data!=False):
202+
msg+=data
203+
204+
#print printHex(msg)
205+
print "hex: %s" % printHex(msg)
206+
print "decoded: %s" % parseGMROut(msg)
207+
208+
if __name__ == "__main__":
209+
main()
210+

‎dopatch_IO.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/sh
2+
#
3+
# Property of Groundworks Technologies
4+
#
5+
# Firmware modifications of IsatPhone Pro V 4.0.0 to dump In/Out packets
6+
7+
8+
# Install ARM patcher
9+
./isat_hax_echo_arm.py ./isat_blackfin_patcher_secure.bin
10+
11+
##### Write patches
12+
./isat_hax_echo_bf.py ./bfpatch/0000.bin 0x20FF0000 # zero counter
13+
# place packet copier and hook
14+
./isat_hook_bf_call.py ./bfpatch/copyI.bin 0x20180000 0x206b817A
15+
./isat_hook_bf_call.py ./bfpatch/copyO.bin 0x20180100 0x206b8130
16+
# Install echo-peek command
17+
./isat_hax.py ISATPeek-nice.bin

‎dopatch_custom_frame.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/sh
2+
#
3+
# Property of Groundworks Technologies
4+
#
5+
# Firmware modifications of IsatPhone Pro V 4.0.0 to dump In/Out packets and insert custom frame in the output stage
6+
7+
8+
# Install ARM patcher
9+
./isat_hax_echo_arm.py ./isat_blackfin_patcher_secure.bin
10+
11+
##### Write patches
12+
./isat_hax_echo_bf.py ./bfpatch/0000.bin 0x20FF0000 # zero counter
13+
./isat_hax_echo_bf.py ./bfpatch/customframe.bin 0x20FF9000 # custom frame
14+
# place packet copier and hook
15+
./isat_hook_bf_call.py ./bfpatch/copyI.bin 0x20180000 0x206b817A
16+
./isat_hook_bf_call.py ./bfpatch/copyO.bin 0x20180100 0x206b8130
17+
# Install echo-peek command
18+
./isat_hax.py ISATPeek-nice.bin

0 commit comments

Comments
 (0)