btlejack中的crc_init的获取

最新推荐文章于 2022-12-11 19:21:18 发布

北地的树

最新推荐文章于 2022-12-11 19:21:18 发布

阅读量130

点赞数

本文链接：https://blog.csdn.net/beidideshu/article/details/125116656

版权

蓝牙通信 CRC校验数据恢复 btle_reverse_crc 空包

关键词由CSDN通过智能技术生成

原理

利用空包去计算crc_init非常合适，这里的空包是蓝牙的空包哦

btlejack c++recover_crc的  radio中断对应动作源码
其中btle_reverse_crc()就是其提取crc_init的
 		case RECOVER_CRC:
            {
              /* Extract crc and recover CRCInit */
              if (((rx_buffer[0]&0xF3) == 1) && (rx_buffer[1]==0))
              {
                  crc = rx_buffer[2] | rx_buffer[3]<<8 | rx_buffer[4]<<16;
                  crc_rev = btle_reverse_crc(crc, rx_buffer, 2);
                  if (crc_rev != g_sniffer.crcinit)
                  {
                      g_sniffer.crcinit = crc_rev;
                      g_sniffer.n = 0;

                      if (measures > g_sniffer.max_interval)
                        g_sniffer.max_interval = measures;
                      measures = 0;
                  }
                  else
                  {
                      if (g_sniffer.n > 5)
                      {
                          g_sniffer.max_interval = (g_sniffer.max_interval * 3)/2;

                          /* Notify CRC. */
                          pLink->notifyCrc(
                            g_sniffer.access_address,
                            g_sniffer.crcinit
                          );
#if 0
                          if (!g_sniffer.chm_provided)
                            recover_chm();
                          else if (!g_sniffer.interval_provided)
                            recover_hop_interval();
                          else
                            recover_hop_inc();
#endif
                      }
                      else
                      {
                        if (measures > g_sniffer.max_interval)
                          g_sniffer.max_interval = measures;
                        measures = 0;
                        g_sniffer.n++;
                      }
                  }
              }

/**
 * BTLE CRC reverse routine, originally written by Mike Ryan,
 * Dominic Spill and Michael Ossmann, taken from ubertooth_le.
 **/
//ble crc校验计算
uint32_t btle_reverse_crc(uint32_t crc, uint8_t *data, int len)
{
	uint32_t state = crc;
	uint32_t lfsr_mask = 0xb4c000;
	uint32_t ret;
    uint8_t cur;
	int i, j, top_bit;

	for (i = len - 1; i >= 0; --i) {
		cur = data[i];
		for (j = 0; j < 8; ++j) {
			top_bit = state >> 23;
			state = (state << 1) & 0xffffff;
			state |= top_bit ^ ((cur >> (7 - j)) & 1);
			if (top_bit)
				state ^= lfsr_mask;
		}
	}

	ret = 0;
	for (i = 0; i < 24; ++i)
		ret |= ((state >> i) & 1) << (23 - i);

	return ret;
}

//一直到keil，基本上没改什么
#if 1			//RECOVER_CRC   
					// Extract crc and recover CRCInit
					case RECOVER_CRC:{	
              if (((rx_buffer[0]&0xF3) == 1) && (rx_buffer[1]==0)){
                  crc = rx_buffer[2] | rx_buffer[3]<<8 | rx_buffer[4]<<16;
                  crc_rev = btle_reverse_crc(crc, rx_buffer, 2);
									
                  if (crc_rev != g_sniffer.crcinit){
                      g_sniffer.crcinit = crc_rev;
                      g_sniffer.n = 0;
											printf("true crcInit   %x\r\n",crc_rev);
                      if (measures > g_sniffer.max_interval)
                        g_sniffer.max_interval = measures;
                      measures = 0;
                  }else{
										printf("the same  %x\r\n",crc_rev);
                      if (g_sniffer.n > 5)
                      {
                          g_sniffer.max_interval = (g_sniffer.max_interval * 3)/2;

                          // Notify CRC. 
                         Link_notifyCrc(
                            g_sniffer.access_address,
                            g_sniffer.crcinit
                          );
#if 0
                          if (!g_sniffer.chm_provided)
                            recover_chm();
                          else if (!g_sniffer.interval_provided)
                            recover_hop_interval();
                          else
                            recover_hop_inc();
#endif
                      }
                      else
                      {
                        if (measures > g_sniffer.max_interval)
                          g_sniffer.max_interval = measures;
                        measures = 0;
                        g_sniffer.n++;
                      }
                  }
              }

              //如果到达一定事件没有抓取到，就换一个信道  Change channel if chm is not provided. 
              if ((!g_sniffer.chm_provided) && (measures >= 3200))
              {
                // 重置时间 Reset measures.
                measures = 0;

                //转化到下一个信道  Switch to next channel. 
                g_sniffer.channel = (g_sniffer.channel + 1)%37;
                radio_sniff_aa(g_sniffer.access_address, g_sniffer.channel);
              }

              //继续接受 Continue to receive. 
              NRF_RADIO->TASKS_START = 1;
						}
						break;
#endif