Skip to content

Commit

Permalink
Merge pull request #8 from leedave/feature/subghz_updates
Browse files Browse the repository at this point in the history
Can finally send, correctly control LEDs and return to menu when done
  • Loading branch information
leedave authored Jan 3, 2024
2 parents 3ea8078 + 31f62b8 commit e6689e7
Show file tree
Hide file tree
Showing 13 changed files with 96 additions and 24 deletions.
26 changes: 19 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,23 +6,35 @@ This app triggers restaurant pagers in a brute force manner, useful to test if d

## Supported Pagers
- Retekess T119
- Retekess TD157
- Retekess TD165
- Retekess TD174
- Retekess TD157 (coming soon)
- Retekess TD165 (coming soon)
- Retekess TD174 (coming soon)

### Features
- Select range of stations
- Select range of pagers
- Select range of stations (needs improving for full range)
- Select range of pagers (needs improving for full range)

## How to install on Flipper Zero
- If you do not have one, download a firmware<br>
- If you do not have one, download a firmware onto your PC via git<br>
- Plug your Flipper Zero in via USB. <br>
- Copy the contents of this folder into the applications_user folder of your firmware. <br>

## What does the blinking mean

### Yellow Blinking LED
Means that the SubGhz Code is being generated for the configured range

### Purple Blinking LED
Means that SubGhz Signals are being sent

## Can this Brute-Force Attacks
In Theory yes, but I wouldn't recommend trying it. Most pagers support 8191 Stations. Triggering ~30 Pagers per station would easily take over 2h. That when only sending each trigger once. It is recommended is to repeat the signal approx 10x, so that would already take all day.
This is a Proof-of-Concept. In Theory it could, but I wouldn't recommend trying it. Its annoying for people targeted and it could get you into trouble. Seriously, don't be that person, nobody will like your for it.
Appart from that, most pagers support 8191 Stations. Triggering ~30 Pagers per station would easily take a long time. That when only sending each trigger once. It is recommended is to repeat the signal approx 10x (currently not possible, but possible that stations don't react to a single call), so that would already take all day.
Chances are also, that your Flipper Zero will crash in that time.

## Does this even work
I don't know. It's based on intel collected from other people. The Flipper sends data, I checked that with a second flipper. But if the data actually triggers something is not sure.

Then run the command:
```
.\fbt launch APPSRC=applications_user/meal_pager
Expand Down
4 changes: 4 additions & 0 deletions docs/changelog.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
## v0.5

Compiled .sub data is read out and sent via SubGhz. Currently only support for T119.

## v0.1

Can now generate a temporary .sub file for Retekess T119 Pager triggers. Must still be run via SubGhz App
4 changes: 4 additions & 0 deletions helpers/meal_pager_custom_event.h
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,10 @@ typedef enum {
Meal_PagerCustomEventScene2Right,
Meal_PagerCustomEventScene2Ok,
Meal_PagerCustomEventScene2Back,
Meal_PagerCustomEventViewTransmitterBack,
Meal_PagerCustomEventViewTransmitterSendStart,
Meal_PagerCustomEventViewTransmitterSendStop,
Meal_PagerCustomEventViewTransmitterError,
} Meal_PagerCustomEvent;

enum Meal_PagerCustomEventType {
Expand Down
1 change: 1 addition & 0 deletions helpers/meal_pager_storage.c
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ static void meal_pager_close_storage() {

static void meal_pager_close_config_file(FlipperFormat* file) {
if (file == NULL) return;
flipper_format_rewind(file);
flipper_format_file_close(file);
flipper_format_free(file);
}
Expand Down
2 changes: 1 addition & 1 deletion helpers/retekess/meal_pager_retekess_t119.c
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,7 @@ bool meal_pager_retekess_t119_generate_all(void* context) {
bool success = meal_pager_save_subghz_buffer_file_start(app, ff, storage);

if (!success) {
FURI_LOG_D(TAG, "failed to save buffer");
FURI_LOG_D(TAG, "failed to save to buffer");
meal_pager_save_subghz_buffer_stop(app, ff);
furi_record_close(RECORD_STORAGE);
return success;
Expand Down
37 changes: 30 additions & 7 deletions helpers/subghz/subghz.c
Original file line number Diff line number Diff line change
@@ -1,9 +1,11 @@
/* Reduced variant of the Flipper Zero SubGhz Class */

#include "subghz_i.h"
#include "../../helpers/meal_pager_custom_event.h"
#include "../../helpers/meal_pager_led.h"
//#include "../meal_pager_storage.h"

static SubGhz* subghz_alloc() {
SubGhz* subghz_alloc() {
SubGhz* subghz = malloc(sizeof(SubGhz));

subghz->file_path = furi_string_alloc();
Expand All @@ -13,7 +15,7 @@ static SubGhz* subghz_alloc() {
return subghz;
}

static void subghz_free(SubGhz* subghz) {
void subghz_free(SubGhz* subghz) {
//TxRx
subghz_txrx_free(subghz->txrx);

Expand All @@ -24,11 +26,23 @@ static void subghz_free(SubGhz* subghz) {
free(subghz);
}


void subghz_scene_transmit_callback_end_tx(void* context) {
furi_assert(context);
//UNUSED(context);
FURI_LOG_D(TAG, "callback end");
Meal_Pager* app = context;
view_dispatcher_send_custom_event(
app->view_dispatcher, Meal_PagerCustomEventViewTransmitterSendStop);
}

void subghz_send(void* context) {
UNUSED(context);
SubGhz* subghz = subghz_alloc();
//UNUSED(context);
Meal_Pager* app = context;
//SubGhz* subghz = subghz_alloc();

subghz_load_protocol_from_file(subghz);
FURI_LOG_D(TAG, "loading protocol from file");
subghz_load_protocol_from_file(app->subghz);

/*Storage* storage = furi_record_open(RECORD_STORAGE);
FlipperFormat* ff = flipper_format_file_alloc(storage);
Expand All @@ -41,7 +55,14 @@ void subghz_send(void* context) {
}*/

//subghz_txrx_tx_start(subghz->txrx, ff);
subghz_txrx_tx_start(subghz->txrx, subghz_txrx_get_fff_data(subghz->txrx)); //Seems like it must be done this way

FURI_LOG_D(TAG, "Starting Transmission");
subghz_txrx_tx_start(app->subghz->txrx, subghz_txrx_get_fff_data(app->subghz->txrx)); //Seems like it must be done this way

FURI_LOG_D(TAG, "setting sugbhz raw file encoder worker callback");
subghz_txrx_set_raw_file_encoder_worker_callback_end(
app->subghz->txrx, subghz_scene_transmit_callback_end_tx, app);
app->state_notifications = SubGhzNotificationStateTx;

/*flipper_format_rewind(ff);
flipper_format_file_close(ff);
Expand All @@ -50,5 +71,7 @@ void subghz_send(void* context) {
furi_record_close(RECORD_STORAGE);*/


subghz_free(subghz);
//subghz_free(subghz);
FURI_LOG_D(TAG, "Finished Transmitting");
//meal_pager_blink_stop(app);
}
4 changes: 3 additions & 1 deletion helpers/subghz/subghz.h
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

#include "subghz_i.h"

//typedef struct SubGhz SubGhz;
typedef struct SubGhz SubGhz;

SubGhz* subghz_alloc();
void subghz_free(SubGhz* subghz);
void subghz_send(void* context);
4 changes: 2 additions & 2 deletions helpers/subghz/subghz_txrx.c
Original file line number Diff line number Diff line change
Expand Up @@ -556,15 +556,15 @@ SubGhzProtocolDecoderBase* subghz_txrx_get_decoder(SubGhzTxRx* instance) {
subghz_receiver_set_rx_callback(instance->receiver, callback, context);
}*/

/*void subghz_txrx_set_raw_file_encoder_worker_callback_end(
void subghz_txrx_set_raw_file_encoder_worker_callback_end(
SubGhzTxRx* instance,
SubGhzProtocolEncoderRAWCallbackEnd callback,
void* context) {
subghz_protocol_raw_file_encoder_worker_set_callback_end(
(SubGhzProtocolEncoderRAW*)subghz_transmitter_get_protocol_instance(instance->transmitter),
callback,
context);
}*/
}

bool subghz_txrx_radio_device_is_external_connected(SubGhzTxRx* instance, const char* name) {
furi_assert(instance);
Expand Down
4 changes: 2 additions & 2 deletions helpers/subghz/subghz_txrx.h
Original file line number Diff line number Diff line change
Expand Up @@ -285,10 +285,10 @@ SubGhzSetting* subghz_txrx_get_setting(SubGhzTxRx* instance);
* @param callback Callback for Raw decoder, end of data transfer
* @param context Context for callback
*/
/*void subghz_txrx_set_raw_file_encoder_worker_callback_end(
void subghz_txrx_set_raw_file_encoder_worker_callback_end(
SubGhzTxRx* instance,
SubGhzProtocolEncoderRAWCallbackEnd callback,
void* context);*/
void* context);

/* Checking if an external radio device is connected
*
Expand Down
4 changes: 4 additions & 0 deletions meal_pager.c
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,8 @@ Meal_Pager* meal_pager_app_alloc() {
app->dialogs = furi_record_open(RECORD_DIALOGS);
app->file_path = furi_string_alloc();

app->subghz = subghz_alloc();

// Load configs
meal_pager_read_settings(app);

Expand Down Expand Up @@ -97,6 +99,8 @@ void meal_pager_app_free(Meal_Pager* app) {
furi_record_close(RECORD_DIALOGS);
furi_string_free(app->file_path);

subghz_free(app->subghz);

//Remove whatever is left
free(app);
}
Expand Down
5 changes: 5 additions & 0 deletions meal_pager_i.h
Original file line number Diff line number Diff line change
Expand Up @@ -18,19 +18,24 @@
#include "views/meal_pager_startscreen.h"
#include "views/meal_pager_transmit.h"
#include "helpers/meal_pager_storage.h"
#include "helpers/subghz/subghz_types.h"
#include "helpers/subghz/subghz.h"

#define TAG "Meal_Pager"

#define SUBGHZ_APP_EXTENSION ".sub"
#define SUBGHZ_APP_FOLDER ANY_PATH("subghz")

typedef struct Meal_PagerTransmit Meal_PagerTransmit;
typedef struct SubGhz SubGhz;

typedef struct {
Gui* gui;
NotificationApp* notification;
SubGhzNotificationState state_notifications;
ViewDispatcher* view_dispatcher;
Submenu* submenu;
SubGhz* subghz;
SceneManager* scene_manager;
VariableItemList* variable_item_list;
Meal_PagerStartscreen* meal_pager_startscreen;
Expand Down
3 changes: 2 additions & 1 deletion scenes/meal_pager_scene_settings.c
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,8 @@ void meal_pager_scene_settings_on_enter(void* context) {
item = variable_item_list_add(
app->variable_item_list,
"Pager Type:",
4,
//4,
1,
meal_pager_scene_settings_set_pager_type,
app);
value_index = value_index_uint32(app->pager_type, pager_type_value, 4);
Expand Down
22 changes: 19 additions & 3 deletions scenes/meal_pager_scene_transmit.c
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
#include "../views/meal_pager_transmit.h"
#include "../helpers/meal_pager_led.h"
#include "../helpers/subghz/subghz.h"
#include <dolphin/dolphin.h>

void meal_pager_transmit_callback(Meal_PagerCustomEvent event, void* context) {
furi_assert(context);
Expand All @@ -30,13 +31,16 @@ void meal_pager_scene_transmit_on_enter(void* context) {
return;
}
FURI_LOG_D(TAG, "Generated tmp.sub");
meal_pager_blink_start_subghz(app);
//meal_pager_blink_start_subghz(app);
FURI_LOG_D(TAG, "Start Transmitting");
subghz_send(app);
FURI_LOG_D(TAG, "Finished Transmitting");
meal_pager_blink_stop(app);

dolphin_deed(DolphinDeedSubGhzSend);
//FURI_LOG_D(TAG, "Finished Transmitting");
//meal_pager_blink_stop(app);
}


bool meal_pager_scene_transmit_on_event(void* context, SceneManagerEvent event) {
Meal_Pager* app = context;
bool consumed = false;
Expand All @@ -61,7 +65,19 @@ bool meal_pager_scene_transmit_on_event(void* context, SceneManagerEvent event)
}
consumed = true;
break;
case Meal_PagerCustomEventViewTransmitterSendStop:
app->state_notifications = SubGhzNotificationStateIDLE;
subghz_txrx_stop(app->subghz->txrx);
meal_pager_blink_stop(app);
scene_manager_next_scene(app->scene_manager, Meal_PagerSceneMenu);
FURI_LOG_D(TAG, "Stop Event");
break;
}
} else if(event.type == SceneManagerEventTypeTick) {
if(app->state_notifications == SubGhzNotificationStateTx) {
notification_message(app->notification, &sequence_blink_magenta_10);
}
return true;
}

return consumed;
Expand Down

0 comments on commit e6689e7

Please sign in to comment.