mirror of
https://github.com/mytechnotalent/Embedded-Hacking.git
synced 2026-10-22 07:18:47 +02:00
Add 0x0026a custom AES-128-CMAC secure bootloader, Week 11a notebook, and README links
This commit is contained in:
Kevin Thomas committed
1 parent
b85aaf72d6
commit
bec685d573
33 files changed
+3451
No files matched your search
@@ -0,0 +1,54 @@
|
||||
/**
|
||||
* @file app_main.c
|
||||
* @brief Application entry point: IR receiver drives the LED controller.
|
||||
* @author Kevin Thomas
|
||||
* @date 2026
|
||||
*
|
||||
* MIT License
|
||||
* Copyright (c) 2026 Kevin Thomas
|
||||
*
|
||||
* -----------------------------------------------------------------------------
|
||||
*
|
||||
* This file is deliberately thin: it only wires the modules together and runs
|
||||
* the poll loop. The NEC IR decoder lives in ir.c, the LED controller lives in
|
||||
* led.c, and the AES-128-CBC protected banner lives in secret.c.
|
||||
*
|
||||
* Wiring:
|
||||
* GPIO5 -> IR receiver OUT
|
||||
* GPIO16 -> LED1 anode (with current-limiting resistor to GND)
|
||||
* GPIO17 -> LED2 anode (with current-limiting resistor to GND)
|
||||
* GPIO18 -> LED3 anode (with current-limiting resistor to GND)
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdbool.h>
|
||||
#include "pico/stdlib.h"
|
||||
#include "ir.h"
|
||||
#include "led.h"
|
||||
#include "secret.h"
|
||||
|
||||
/** @brief GPIO pin number for the IR receiver. */
|
||||
#define IR_PIN 5
|
||||
|
||||
/**
|
||||
* @brief Poll the IR receiver and dispatch decoded keys forever.
|
||||
* @param leds Pointer to the LED controller to drive.
|
||||
* @return void Does not return.
|
||||
*/
|
||||
static void ir_poll_loop(simple_led_ctrl_t *leds) {
|
||||
while (true) {
|
||||
int key = ir_getkey();
|
||||
if (key >= 0) led_handle_ir(leds, key);
|
||||
else sleep_ms(1);
|
||||
}
|
||||
}
|
||||
|
||||
int main(void) {
|
||||
stdio_init_all();
|
||||
secret_print_banner();
|
||||
simple_led_ctrl_t leds = led_default();
|
||||
led_init(&leds);
|
||||
ir_init(IR_PIN);
|
||||
printf("IR receiver on GPIO %d ready\n", IR_PIN);
|
||||
ir_poll_loop(&leds);
|
||||
}
|
||||
@@ -0,0 +1,131 @@
|
||||
/**
|
||||
* @file ir.c
|
||||
* @brief Implementation of NEC IR receiver (decoder)
|
||||
* @author Kevin Thomas
|
||||
* @date 2025
|
||||
*
|
||||
* MIT License
|
||||
*
|
||||
* Copyright (c) 2025 Kevin Thomas
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
* of this software and associated documentation files (the "Software"), to deal
|
||||
* in the Software without restriction, including without limitation the rights
|
||||
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
* copies of the Software, and to permit persons to whom the Software is
|
||||
* furnished to do so, subject to the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be included in all
|
||||
* copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
* SOFTWARE.
|
||||
*/
|
||||
|
||||
#include "ir.h"
|
||||
#include "pico/stdlib.h"
|
||||
#include "pico/time.h"
|
||||
#include "hardware/gpio.h"
|
||||
|
||||
/** @brief GPIO pin connected to the IR receiver */
|
||||
static unsigned int ir_pin = 0;
|
||||
|
||||
/**
|
||||
* @brief Wait for a GPIO pin to reach a given logic level
|
||||
*
|
||||
* Spins until the pin matches the requested level or a microsecond timeout
|
||||
* is exceeded. Returns the elapsed time in microseconds, or -1 on timeout.
|
||||
*
|
||||
* @param gpio GPIO pin to monitor
|
||||
* @param level Desired logic level (true = HIGH, false = LOW)
|
||||
* @param timeout_us Maximum wait in microseconds
|
||||
* @return int64_t Elapsed microseconds, or -1 on timeout
|
||||
*/
|
||||
static int64_t wait_for_level(unsigned int gpio, bool level, uint32_t timeout_us) {
|
||||
absolute_time_t start = get_absolute_time();
|
||||
while (gpio_get(gpio) != level) {
|
||||
if (absolute_time_diff_us(start, get_absolute_time()) > (int64_t)timeout_us)
|
||||
return -1;
|
||||
}
|
||||
return absolute_time_diff_us(start, get_absolute_time());
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Wait for the NEC 9 ms leader pulse and 4.5 ms space
|
||||
*
|
||||
* @param void No parameters.
|
||||
* @return bool true if a valid leader was detected, false on timeout
|
||||
*/
|
||||
static bool wait_leader(void) {
|
||||
if (wait_for_level(ir_pin, 0, 150000) < 0) return false;
|
||||
int64_t t = wait_for_level(ir_pin, 1, 12000);
|
||||
if (t < 8000 || t > 10000) return false;
|
||||
t = wait_for_level(ir_pin, 0, 7000);
|
||||
if (t < 3500 || t > 5000) return false;
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Read a single NEC-encoded bit from the IR receiver
|
||||
*
|
||||
* Measures the mark/space timing and shifts the result into the
|
||||
* appropriate byte of the data array.
|
||||
*
|
||||
* @param data 4-byte array accumulating received bits
|
||||
* @param i Bit index (0-31)
|
||||
* @return bool true on success, false on timeout or protocol error
|
||||
*/
|
||||
static bool read_nec_bit(uint8_t *data, int i) {
|
||||
if (wait_for_level(ir_pin, 1, 1000) < 0) return false;
|
||||
int64_t t = wait_for_level(ir_pin, 0, 2500);
|
||||
if (t < 200) return false;
|
||||
int byte_idx = i / 8;
|
||||
int bit_idx = i % 8;
|
||||
if (t > 1200) data[byte_idx] |= (1 << bit_idx);
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Read all 32 data bits of an NEC frame
|
||||
*
|
||||
* @param data 4-byte array filled with the received address and command
|
||||
* @return bool true if all 32 bits were read, false on timeout
|
||||
*/
|
||||
static bool read_32_bits(uint8_t *data) {
|
||||
for (int i = 0; i < 32; ++i)
|
||||
if (!read_nec_bit(data, i)) return false;
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Validate an NEC frame and extract the command byte
|
||||
*
|
||||
* Checks that the address and command pairs are bitwise-inverted.
|
||||
*
|
||||
* @param data 4-byte NEC frame (addr, ~addr, cmd, ~cmd)
|
||||
* @return int Command byte (0-255) on success, -1 on validation failure
|
||||
*/
|
||||
static int validate_nec_frame(const uint8_t *data) {
|
||||
if ((uint8_t)(data[0] + data[1]) == 0xFF && (uint8_t)(data[2] + data[3]) == 0xFF)
|
||||
return data[2];
|
||||
return -1;
|
||||
}
|
||||
|
||||
void ir_init(uint8_t pin) {
|
||||
ir_pin = pin;
|
||||
gpio_init(pin);
|
||||
gpio_set_dir(pin, GPIO_IN);
|
||||
gpio_pull_up(pin);
|
||||
}
|
||||
|
||||
int ir_getkey(void) {
|
||||
if (!wait_leader()) return -1;
|
||||
uint8_t data[4] = {0, 0, 0, 0};
|
||||
if (!read_32_bits(data)) return -1;
|
||||
return validate_nec_frame(data);
|
||||
}
|
||||
@@ -0,0 +1,103 @@
|
||||
/**
|
||||
* @file led.c
|
||||
* @brief LED controller driven by decoded NEC IR commands.
|
||||
* @author Kevin Thomas
|
||||
* @date 2026
|
||||
*
|
||||
* MIT License
|
||||
* Copyright (c) 2026 Kevin Thomas
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include "pico/stdlib.h"
|
||||
#include "led.h"
|
||||
|
||||
/**
|
||||
* @brief Map an NEC command code to a logical LED number.
|
||||
* @param ir_command Decoded NEC command byte.
|
||||
* @return int Logical LED number 1-3, or 0 when the command is unmapped.
|
||||
*/
|
||||
static int led_number_for_command(int ir_command) {
|
||||
if (ir_command == 0x0C) return 1;
|
||||
if (ir_command == 0x18) return 2;
|
||||
if (ir_command == 0x5E) return 3;
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Return the GPIO pin backing a logical LED number.
|
||||
* @param leds Pointer to the LED controller.
|
||||
* @param led_num Logical LED number (1-3).
|
||||
* @return uint8_t GPIO pin number for the requested LED.
|
||||
*/
|
||||
static uint8_t led_pin_for(simple_led_ctrl_t *leds, int led_num) {
|
||||
if (led_num == 1) return leds->led1_pin;
|
||||
if (led_num == 2) return leds->led2_pin;
|
||||
return leds->led3_pin;
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Turn every LED output off.
|
||||
* @param leds Pointer to the LED controller.
|
||||
* @return void No return value.
|
||||
*/
|
||||
static void led_all_off(simple_led_ctrl_t *leds) {
|
||||
gpio_put(leds->led1_pin, false);
|
||||
gpio_put(leds->led2_pin, false);
|
||||
gpio_put(leds->led3_pin, false);
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Toggle a GPIO on and off for a number of blink cycles.
|
||||
* @param pin GPIO pin to blink.
|
||||
* @param count Number of on/off cycles.
|
||||
* @param delay_ms Milliseconds to hold each phase.
|
||||
* @return void No return value.
|
||||
*/
|
||||
static void led_blink(uint8_t pin, uint8_t count, uint32_t delay_ms) {
|
||||
for (uint8_t i = 0; i < count; i++) {
|
||||
gpio_put(pin, true);
|
||||
sleep_ms(delay_ms);
|
||||
gpio_put(pin, false);
|
||||
sleep_ms(delay_ms);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Blink an LED, then leave it lit.
|
||||
* @param leds Pointer to the LED controller.
|
||||
* @param led_num Logical LED number to activate.
|
||||
* @return void No return value.
|
||||
*/
|
||||
static void led_activate(simple_led_ctrl_t *leds, int led_num) {
|
||||
uint8_t pin = led_pin_for(leds, led_num);
|
||||
led_blink(pin, 3, 50);
|
||||
gpio_put(pin, true);
|
||||
printf("LED %d activated on GPIO %d\n", led_num, pin);
|
||||
}
|
||||
|
||||
simple_led_ctrl_t led_default(void) {
|
||||
simple_led_ctrl_t leds = {
|
||||
.led1_pin = 16, .led2_pin = 17, .led3_pin = 18,
|
||||
.led1_state = false, .led2_state = false, .led3_state = false
|
||||
};
|
||||
return leds;
|
||||
}
|
||||
|
||||
void led_init(simple_led_ctrl_t *leds) {
|
||||
gpio_init(leds->led1_pin);
|
||||
gpio_set_dir(leds->led1_pin, GPIO_OUT);
|
||||
gpio_init(leds->led2_pin);
|
||||
gpio_set_dir(leds->led2_pin, GPIO_OUT);
|
||||
gpio_init(leds->led3_pin);
|
||||
gpio_set_dir(leds->led3_pin, GPIO_OUT);
|
||||
}
|
||||
|
||||
void led_handle_ir(simple_led_ctrl_t *leds, int key) {
|
||||
if (key < 0) return;
|
||||
printf("NEC command: 0x%02X\n", key);
|
||||
led_all_off(leds);
|
||||
int led_num = led_number_for_command(key);
|
||||
if (led_num == 0) return;
|
||||
led_activate(leds, led_num);
|
||||
}
|
||||
@@ -0,0 +1,88 @@
|
||||
/**
|
||||
* @file secret.c
|
||||
* @brief Decrypts a runtime banner with the SDK Mbed TLS AES-128-CBC API.
|
||||
* @author Kevin Thomas
|
||||
* @date 2026
|
||||
*
|
||||
* MIT License
|
||||
* Copyright (c) 2026 Kevin Thomas
|
||||
*
|
||||
* -----------------------------------------------------------------------------
|
||||
*
|
||||
* This module shows how to use the AES implementation that ships with the Pico
|
||||
* SDK. A short banner is stored in flash only as AES-128-CBC ciphertext; the
|
||||
* key and IV live in the same image. At startup secret_print_banner() rebuilds
|
||||
* the plaintext with mbedtls_aes_crypt_cbc() and writes it to the console.
|
||||
*
|
||||
* The plaintext is exactly APP_BANNER_LEN bytes (two whole AES blocks), so no
|
||||
* padding routine is required. The ciphertext was produced on the host with the
|
||||
* matching key and IV, for example:
|
||||
*
|
||||
* printf '%s' 'SECRET: IR LINK SECURED ONLINE ' \
|
||||
* | openssl enc -aes-128-cbc -K 49726f6e4e6574426f6f744b65792121 \
|
||||
* -iv 41707053656372657449563132333435 -nopad | xxd -p
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include "mbedtls/aes.h"
|
||||
#include "secret.h"
|
||||
|
||||
/** @brief AES-128 key, the same 16 bytes the bootloader uses for CMAC. */
|
||||
static const uint8_t banner_key[APP_AES_BLOCK] = {
|
||||
0x49, 0x72, 0x6F, 0x6E, 0x4E, 0x65, 0x74, 0x42,
|
||||
0x6F, 0x6F, 0x74, 0x4B, 0x65, 0x79, 0x21, 0x21
|
||||
};
|
||||
|
||||
/** @brief Initialization vector used when the banner was encrypted. */
|
||||
static const uint8_t banner_iv[APP_AES_BLOCK] = {
|
||||
0x41, 0x70, 0x70, 0x53, 0x65, 0x63, 0x72, 0x65,
|
||||
0x74, 0x49, 0x56, 0x31, 0x32, 0x33, 0x34, 0x35
|
||||
};
|
||||
|
||||
/** @brief AES-128-CBC ciphertext of the runtime banner. */
|
||||
static const uint8_t banner_ct[APP_BANNER_LEN] = {
|
||||
0xBA, 0xEC, 0x4A, 0x19, 0x25, 0x86, 0x1B, 0xB9,
|
||||
0x2D, 0xFD, 0x9F, 0x13, 0xF7, 0x9B, 0x3E, 0x80,
|
||||
0xCF, 0x12, 0xB6, 0x98, 0xDB, 0x91, 0x65, 0xBE,
|
||||
0x8F, 0xD7, 0xC3, 0x47, 0x7B, 0xB2, 0xE7, 0x6E
|
||||
};
|
||||
|
||||
/**
|
||||
* @brief Run the AES-128-CBC decrypt in place over a working buffer.
|
||||
* @param aes Pointer to an AES context holding an already-expanded key.
|
||||
* @param iv Pointer to a mutable copy of the initialization vector.
|
||||
* @param buf Pointer to the buffer holding ciphertext, then plaintext.
|
||||
* @return int Zero on success, non-zero on failure.
|
||||
*/
|
||||
static int secret_cbc(mbedtls_aes_context *aes, uint8_t *iv, uint8_t *buf) {
|
||||
int rc = mbedtls_aes_crypt_cbc(aes, MBEDTLS_AES_DECRYPT, APP_BANNER_LEN,
|
||||
iv, buf, buf);
|
||||
return rc;
|
||||
}
|
||||
|
||||
/**
|
||||
* @brief Decrypt the banner ciphertext into a working buffer.
|
||||
* @param buf Buffer of at least APP_BANNER_LEN bytes.
|
||||
* @return int Zero on success, non-zero on failure.
|
||||
*/
|
||||
static int secret_decrypt(uint8_t *buf) {
|
||||
mbedtls_aes_context aes;
|
||||
uint8_t iv[APP_AES_BLOCK];
|
||||
memcpy(iv, banner_iv, APP_AES_BLOCK);
|
||||
mbedtls_aes_init(&aes);
|
||||
mbedtls_aes_setkey_dec(&aes, banner_key, 128);
|
||||
int rc = secret_cbc(&aes, iv, buf);
|
||||
mbedtls_aes_free(&aes);
|
||||
return rc;
|
||||
}
|
||||
|
||||
int secret_print_banner(void) {
|
||||
uint8_t buf[APP_BANNER_LEN + 1];
|
||||
memcpy(buf, banner_ct, APP_BANNER_LEN);
|
||||
buf[APP_BANNER_LEN] = '\0';
|
||||
int rc = secret_decrypt(buf);
|
||||
if (rc != 0) return rc;
|
||||
printf("app banner: %s\n", (char *)buf);
|
||||
return 0;
|
||||
}
|
||||
Reference in new issue
Block a user