src/patch.c
__attribute__((at(0x00218A00, "", CHIP_VER_BCM4375B1_BT, FW_VER_S20)))
void decode(uint8_t *output_buffer, uint32_t *length, uint8_t * packet) {

	for (int i=0;i<50;i++) output_buffer[i] = 0;
	// index of the current Zigbee symbol
	uint32_t index = 0;
	// indicator of current 4 bits position (1 = 4 MSB, 0 = 4 LSB)
	uint32_t part = 1;
	// indicator of start frame delimiter
	uint32_t sfd = 0;
	// Hamming distance
	uint32_t hamming_dist = 0;
	// Thresold Hamming distance
	uint32_t hamming_thresold = 8;

	// Align the buffer with the SFD
	output_buffer[0] |= (0x0F & 0x07);
	hamming_dist = 32;
	while (hamming_dist > hamming_thresold) {
		hamming_dist = hamming(packet,SYMBOL_TO_CHIP_MAPPING[0]);
		if (hamming_dist > hamming_thresold) {
			shift_buffer(packet,255);
		}
	}

	hamming_dist = 0;
	while (hamming_dist <= hamming_thresold) {
		int symbol = -1;
		// Compute the hamming distance for every zigbee symbol
		for (int i=0;i<16;i++) {
			hamming_dist = hamming(packet,SYMBOL_TO_CHIP_MAPPING[i]);
			if (hamming_dist <= hamming_thresold) {
				symbol = i;
				break;
			}
		}

		// If a zigbee symbol has been found ...
		if (symbol != -1) {
			// If it matches the SFD next symbol, start the frame decoding
			if (sfd == 0 && symbol == 10) {
				sfd = 1;
			}
			
			// If we are in the frame decoding state ...
			if (sfd == 1) {
				// Fill the output buffer with the selected symbol
				output_buffer[index] |= (symbol & 0x0F) << 4*part;

				// Select the next 4 bits free space in the output buffer
				part = part == 1 ? 0 : 1;
				if (part == 0) index++;
			}
			// Shift the buffer (31 bits shift)
			for (int i=0;i<32;i++) shift_buffer(packet,255);
		}
	}

	// Export of the effective length of the Zigbee frame
	*length = index;
}
/*
Function allowing to convert a GFSK frame to the corresponding Zigbee frame (see WazaBee attack: https://hal.archives-ouvertes.fr/hal-03193299/)
*/
Function allowing to convert a GFSK frame to the corresponding Zigbee frame
Function allowing to convert a GFSK frame to the corresponding Zigbee frame
__attribute__((at(0x00218A00, "", CHIP_VER_BCM4375B1_BT, FW_VER_S20)))
void decode(uint8_t *output_buffer, uint32_t *length, uint8_t * packet) {
	for (int i=0;i<50;i++) output_buffer[i] = 0;
	uint32_t index = 0;
	uint32_t part = 1;
	uint32_t sfd = 0;
	uint32_t hamming_dist = 0;
	uint32_t hamming_thresold = 8;
	output_buffer[0] |= (0x0F & 0x07);
	hamming_dist = 32;
	while (hamming_dist > hamming_thresold) {
		hamming_dist = hamming(packet,SYMBOL_TO_CHIP_MAPPING[0]);
		if (hamming_dist > hamming_thresold) {
			shift_buffer(packet,255);
		}
	}
	hamming_dist = 0;
	while (hamming_dist <= hamming_thresold) {
		int symbol = -1;
		for (int i=0;i<16;i++) {
			hamming_dist = hamming(packet,SYMBOL_TO_CHIP_MAPPING[i]);
			if (hamming_dist <= hamming_thresold) {
				symbol = i;
				break;
			}
		}
		if (symbol != -1) {
			if (sfd == 0 && symbol == 10) {
				sfd = 1;
			}
			if (sfd == 1) {
				output_buffer[index] |= (symbol & 0x0F) << 4*part;
				part = part == 1 ? 0 : 1;
				if (part == 0) index++;
			}
			for (int i=0;i<32;i++) shift_buffer(packet,255);
		}
	}
	*length = index;
}
__attribute__ ( ( at ( 0x00218A00 , " " , CHIP_VER_BCM4375B1_BT , FW_VER_S20 ) ) ) void decode ( uint8_t * output_buffer , uint32_t * length , uint8_t * packet ) { for ( int i = 0 ; i < 50 ; i ++ ) output_buffer [ i ] = 0 ; uint32_t index = 0 ; uint32_t part = 1 ; uint32_t sfd = 0 ; uint32_t hamming_dist = 0 ; uint32_t hamming_thresold = 8 ; output_buffer [ 0 ] |= ( 0x0F & 0x07 ) ; hamming_dist = 32 ; while ( hamming_dist > hamming_thresold ) { hamming_dist = hamming ( packet , SYMBOL_TO_CHIP_MAPPING [ 0 ] ) ; if ( hamming_dist > hamming_thresold ) { shift_buffer ( packet , 255 ) ; } } hamming_dist = 0 ; while ( hamming_dist <= hamming_thresold ) { int symbol = -1 ; for ( int i = 0 ; i < 16 ; i ++ ) { hamming_dist = hamming ( packet , SYMBOL_TO_CHIP_MAPPING [ i ] ) ; if ( hamming_dist <= hamming_thresold ) { symbol = i ; break ; } } if ( symbol != -1 ) { if ( sfd == 0 && symbol == 10 ) { sfd = 1 ; } if ( sfd == 1 ) { output_buffer [ index ] |= ( symbol & 0x0F ) << 4 * part ; part = part == 1 ? 0 : 1 ; if ( part == 0 ) index ++ ; } for ( int i = 0 ; i < 32 ; i ++ ) shift_buffer ( packet , 255 ) ; } } * length = index ; }
Function allowing to convert a GFSK frame to the corresponding Zigbee frame (see WazaBee attack: https://hal.archives-ouvertes.fr/hal-03193299/)
Function allowing to convert a GFSK frame to the corresponding Zigbee frame ( see WazaBee attack : https : // hal . archives - ouvertes . fr / hal - 03193299 / )
// index of the current Zigbee symbol // indicator of current 4 bits position (1 = 4 MSB, 0 = 4 LSB) // indicator of start frame delimiter // Hamming distance // Thresold Hamming distance // Align the buffer with the SFD // Compute the hamming distance for every zigbee symbol // If a zigbee symbol has been found ... // If it matches the SFD next symbol, start the frame decoding // If we are in the frame decoding state ... // Fill the output buffer with the selected symbol // Select the next 4 bits free space in the output buffer // Shift the buffer (31 bits shift) // Export of the effective length of the Zigbee frame