|
|
@@ -0,0 +1,415 @@
|
|
|
+#include "WiFiScan.h"
|
|
|
+
|
|
|
+
|
|
|
+class bluetoothScanAllCallback: public BLEAdvertisedDeviceCallbacks {
|
|
|
+ void onResult(BLEAdvertisedDevice advertisedDevice) {
|
|
|
+ String display_string = "";
|
|
|
+ String bad_list[bad_list_length] = {"HC-03", "HC-05", "HC-06"};
|
|
|
+ //Serial.printf("Advertised Device: %s \n", advertisedDevice.toString().c_str());
|
|
|
+ if (display_obj.display_buffer->size() >= 0)
|
|
|
+ {
|
|
|
+ display_string.concat(" RSSI: ");
|
|
|
+ display_string.concat(advertisedDevice.getRSSI());
|
|
|
+ Serial.print(" RSSI: ");
|
|
|
+ Serial.print(advertisedDevice.getRSSI());
|
|
|
+
|
|
|
+ display_string.concat(" ");
|
|
|
+ Serial.print(" ");
|
|
|
+
|
|
|
+ Serial.print("Device: ");
|
|
|
+ if(advertisedDevice.getName().length() != 0)
|
|
|
+ {
|
|
|
+ display_string.concat(advertisedDevice.getName().c_str());
|
|
|
+ Serial.print(advertisedDevice.getName().c_str());
|
|
|
+ /*
|
|
|
+ for(int i = 0; i < bad_list_length; i++)
|
|
|
+ {
|
|
|
+ if(strcmp(advertisedDevice.getName().c_str(), bad_list[i].c_str()) == 0)
|
|
|
+ {
|
|
|
+ Serial.println("Found some shit");
|
|
|
+ //digitalWrite(LED, HIGH);
|
|
|
+ }
|
|
|
+ }*/
|
|
|
+
|
|
|
+ }
|
|
|
+ else
|
|
|
+ {
|
|
|
+ display_string.concat(advertisedDevice.getAddress().toString().c_str());
|
|
|
+ Serial.print(advertisedDevice.getAddress().toString().c_str());
|
|
|
+ }
|
|
|
+
|
|
|
+ int temp_len = display_string.length();
|
|
|
+ for (int i = 0; i < 40 - temp_len; i++)
|
|
|
+ {
|
|
|
+ display_string.concat(" ");
|
|
|
+ }
|
|
|
+
|
|
|
+ Serial.println();
|
|
|
+
|
|
|
+ //while (1)
|
|
|
+ //{
|
|
|
+ // if (display_obj.display_buffer->size() == 0)
|
|
|
+ // {
|
|
|
+ // display_obj.display_buffer->add(display_string);
|
|
|
+ // break;
|
|
|
+ // }
|
|
|
+ //}
|
|
|
+ while (display_obj.printing)
|
|
|
+ delay(1);
|
|
|
+ display_obj.loading = true;
|
|
|
+ display_obj.display_buffer->add(display_string);
|
|
|
+ display_obj.loading = false;
|
|
|
+ }
|
|
|
+ }
|
|
|
+};
|
|
|
+
|
|
|
+class bluetoothScanSkimmersCallback: public BLEAdvertisedDeviceCallbacks {
|
|
|
+ void onResult(BLEAdvertisedDevice advertisedDevice) {
|
|
|
+ String bad_list[bad_list_length] = {"HC-03", "HC-05", "HC-06"};
|
|
|
+ //Serial.printf("Advertised Device: %s \n", advertisedDevice.toString().c_str());
|
|
|
+ Serial.print("Device: ");
|
|
|
+ if(advertisedDevice.getName().length() != 0)
|
|
|
+ {
|
|
|
+ Serial.print(advertisedDevice.getName().c_str());
|
|
|
+ for(int i = 0; i < bad_list_length; i++)
|
|
|
+ {
|
|
|
+ if(strcmp(advertisedDevice.getName().c_str(), bad_list[i].c_str()) == 0)
|
|
|
+ {
|
|
|
+ Serial.println("Found some shit");
|
|
|
+ //digitalWrite(LED, HIGH);
|
|
|
+ }
|
|
|
+ }
|
|
|
+ }
|
|
|
+ else
|
|
|
+ Serial.print(advertisedDevice.getAddress().toString().c_str());
|
|
|
+ Serial.print(" RSSI: ");
|
|
|
+ Serial.println(advertisedDevice.getRSSI());
|
|
|
+ }
|
|
|
+};
|
|
|
+
|
|
|
+
|
|
|
+WiFiScan::WiFiScan()
|
|
|
+{
|
|
|
+ //printf("WiFiScan Object initializing...");
|
|
|
+}
|
|
|
+
|
|
|
+// Function to prepare to run a specific scan
|
|
|
+void WiFiScan::StartScan(uint8_t scan_mode)
|
|
|
+{
|
|
|
+ if (scan_mode == WIFI_SCAN_OFF)
|
|
|
+ StopScan(scan_mode);
|
|
|
+ else if (scan_mode == WIFI_SCAN_PROBE)
|
|
|
+ RunProbeScan(scan_mode);
|
|
|
+ else if (scan_mode == WIFI_SCAN_AP)
|
|
|
+ RunBeaconScan(scan_mode);
|
|
|
+ else if (scan_mode == BT_SCAN_ALL)
|
|
|
+ RunBluetoothScan(scan_mode);
|
|
|
+ else if (scan_mode == BT_SCAN_SKIMMERS)
|
|
|
+ RunBluetoothScan(scan_mode);
|
|
|
+
|
|
|
+ WiFiScan::currentScanMode = scan_mode;
|
|
|
+}
|
|
|
+
|
|
|
+// Function to stop all wifi scans
|
|
|
+void WiFiScan::StopScan(uint8_t scan_mode)
|
|
|
+{
|
|
|
+ if ((currentScanMode == WIFI_SCAN_PROBE) ||
|
|
|
+ (currentScanMode == WIFI_SCAN_AP) ||
|
|
|
+ (currentScanMode == WIFI_SCAN_ST) ||
|
|
|
+ (currentScanMode == WIFI_SCAN_ALL))
|
|
|
+ {
|
|
|
+ esp_wifi_set_promiscuous(false);
|
|
|
+ }
|
|
|
+ else if ((currentScanMode == BT_SCAN_ALL) ||
|
|
|
+ (currentScanMode == BT_SCAN_SKIMMERS))
|
|
|
+ {
|
|
|
+ Serial.println("Stopping BLE scan...");
|
|
|
+ pBLEScan->stop();
|
|
|
+ Serial.println("BLE Scan Stopped");
|
|
|
+ }
|
|
|
+
|
|
|
+ display_obj.display_buffer->clear();
|
|
|
+ Serial.print("display_buffer->size(): ");
|
|
|
+ Serial.println(display_obj.display_buffer->size());
|
|
|
+}
|
|
|
+
|
|
|
+// Function for updating scan status
|
|
|
+void WiFiScan::main(uint32_t currentTime)
|
|
|
+{
|
|
|
+ // WiFi operations
|
|
|
+ if ((currentScanMode == WIFI_SCAN_PROBE) ||
|
|
|
+ (currentScanMode == WIFI_SCAN_AP) ||
|
|
|
+ (currentScanMode == WIFI_SCAN_ST) ||
|
|
|
+ (currentScanMode == WIFI_SCAN_ALL))
|
|
|
+ {
|
|
|
+ if (currentTime - initTime >= 1000)
|
|
|
+ {
|
|
|
+ initTime = millis();
|
|
|
+ channelHop();
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ // Bluetooth operations
|
|
|
+ /*
|
|
|
+ else if ((currentScanMode == BT_SCAN_ALL) ||
|
|
|
+ (currentScanMode == BT_SCAN_SKIMMERS))
|
|
|
+ {
|
|
|
+ if (currentTime - initTime >= 2000)
|
|
|
+ {
|
|
|
+ BLEScanResults foundDevices = pBLEScan->start(bluetoothScanTime, false);
|
|
|
+ Serial.print("Devices found: ");
|
|
|
+ Serial.print(foundDevices.getCount());
|
|
|
+ Serial.println(" Scan done!\n\n");
|
|
|
+ pBLEScan->clearResults();
|
|
|
+ initTime = millis();
|
|
|
+ }
|
|
|
+ }
|
|
|
+ */
|
|
|
+}
|
|
|
+
|
|
|
+// Function to start running a beacon scan
|
|
|
+void WiFiScan::RunBeaconScan(uint8_t scan_mode)
|
|
|
+{
|
|
|
+ //Serial.println("Preparing beacon scan...");
|
|
|
+ display_obj.print_delay_1 = 15;
|
|
|
+ display_obj.print_delay_2 = 10;
|
|
|
+ display_obj.clearScreen();
|
|
|
+ display_obj.initScrollValues();
|
|
|
+ display_obj.tft.setTextWrap(false);
|
|
|
+ display_obj.tft.setTextColor(TFT_WHITE, TFT_BLUE);
|
|
|
+ display_obj.tft.fillRect(0,0,240,16, TFT_BLUE);
|
|
|
+ display_obj.tft.drawCentreString(" Beacon Sniffer ",120,0,2);
|
|
|
+ display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK);
|
|
|
+ display_obj.setupScrollArea(TOP_FIXED_AREA, BOT_FIXED_AREA);
|
|
|
+ wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT();
|
|
|
+ esp_wifi_init(&cfg);
|
|
|
+ esp_wifi_set_storage(WIFI_STORAGE_RAM);
|
|
|
+ esp_wifi_set_mode(WIFI_MODE_NULL);
|
|
|
+ esp_wifi_set_promiscuous(true);
|
|
|
+ esp_wifi_set_promiscuous_filter(&filt);
|
|
|
+ esp_wifi_set_promiscuous_rx_cb(&beaconSnifferCallback);
|
|
|
+ esp_wifi_set_channel(set_channel, WIFI_SECOND_CHAN_NONE);
|
|
|
+ initTime = millis();
|
|
|
+ //Serial.println("Finished scan init");
|
|
|
+}
|
|
|
+
|
|
|
+
|
|
|
+// Function for running probe request scan
|
|
|
+void WiFiScan::RunProbeScan(uint8_t scan_mode)
|
|
|
+{
|
|
|
+ //Serial.println("Preparing probe request scan...");
|
|
|
+ display_obj.print_delay_1 = 15;
|
|
|
+ display_obj.print_delay_2 = 10;
|
|
|
+ display_obj.clearScreen();
|
|
|
+ display_obj.initScrollValues();
|
|
|
+ display_obj.tft.setTextWrap(false);
|
|
|
+ display_obj.tft.setTextColor(TFT_BLACK, TFT_MAGENTA);
|
|
|
+ display_obj.tft.fillRect(0,0,240,16, TFT_MAGENTA);
|
|
|
+ display_obj.tft.drawCentreString(" Probe Request Sniffer ",120,0,2);
|
|
|
+ display_obj.tft.setTextColor(TFT_GREEN, TFT_BLACK);
|
|
|
+ display_obj.setupScrollArea(TOP_FIXED_AREA, BOT_FIXED_AREA);
|
|
|
+ wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT();
|
|
|
+ esp_wifi_init(&cfg);
|
|
|
+ esp_wifi_set_storage(WIFI_STORAGE_RAM);
|
|
|
+ esp_wifi_set_mode(WIFI_MODE_NULL);
|
|
|
+ esp_wifi_set_promiscuous(true);
|
|
|
+ esp_wifi_set_promiscuous_filter(&filt);
|
|
|
+ esp_wifi_set_promiscuous_rx_cb(&probeSnifferCallback);
|
|
|
+ esp_wifi_set_channel(set_channel, WIFI_SECOND_CHAN_NONE);
|
|
|
+ initTime = millis();
|
|
|
+ //Serial.println("Finished scan init");
|
|
|
+}
|
|
|
+
|
|
|
+// Function to start running any BLE scan
|
|
|
+void WiFiScan::RunBluetoothScan(uint8_t scan_mode)
|
|
|
+{
|
|
|
+ display_obj.print_delay_1 = 50;
|
|
|
+ display_obj.print_delay_2 = 20;
|
|
|
+ BLEDevice::init("");
|
|
|
+ pBLEScan = BLEDevice::getScan(); //create new scan
|
|
|
+ if (scan_mode == BT_SCAN_ALL)
|
|
|
+ {
|
|
|
+ display_obj.clearScreen();
|
|
|
+ display_obj.initScrollValues();
|
|
|
+ display_obj.tft.setTextWrap(false);
|
|
|
+ display_obj.tft.setTextColor(TFT_BLACK, TFT_GREEN);
|
|
|
+ display_obj.tft.fillRect(0,0,240,16, TFT_GREEN);
|
|
|
+ display_obj.tft.drawCentreString(" Bluetooth Sniff ",120,0,2);
|
|
|
+ display_obj.tft.setTextColor(TFT_CYAN, TFT_BLACK);
|
|
|
+ display_obj.setupScrollArea(TOP_FIXED_AREA, BOT_FIXED_AREA);
|
|
|
+ pBLEScan->setAdvertisedDeviceCallbacks(new bluetoothScanAllCallback());
|
|
|
+ }
|
|
|
+ else if (scan_mode == BT_SCAN_SKIMMERS)
|
|
|
+ {
|
|
|
+ display_obj.clearScreen();
|
|
|
+ display_obj.initScrollValues();
|
|
|
+ display_obj.tft.setTextWrap(false);
|
|
|
+ display_obj.tft.setTextColor(TFT_BLACK, TFT_MAGENTA);
|
|
|
+ display_obj.tft.fillRect(0,0,240,16, TFT_MAGENTA);
|
|
|
+ display_obj.tft.drawCentreString(" Detect Card Skimmers ",120,0,2);
|
|
|
+ display_obj.tft.setTextColor(TFT_ORANGE, TFT_BLACK);
|
|
|
+ display_obj.setupScrollArea(TOP_FIXED_AREA, BOT_FIXED_AREA);
|
|
|
+ pBLEScan->setAdvertisedDeviceCallbacks(new bluetoothScanSkimmersCallback());
|
|
|
+ }
|
|
|
+ pBLEScan->setActiveScan(true); //active scan uses more power, but get results faster
|
|
|
+ pBLEScan->setInterval(100);
|
|
|
+ pBLEScan->setWindow(99); // less or equal setInterval value
|
|
|
+ pBLEScan->start(0, scanCompleteCB);
|
|
|
+ Serial.println("Started BLE Scan");
|
|
|
+ initTime = millis();
|
|
|
+}
|
|
|
+
|
|
|
+// Function that is called when BLE scan is completed
|
|
|
+void WiFiScan::scanCompleteCB(BLEScanResults scanResults) {
|
|
|
+ printf("Scan complete!\n");
|
|
|
+ printf("Found %d devices\n", scanResults.getCount());
|
|
|
+ scanResults.dump();
|
|
|
+} // scanCompleteCB
|
|
|
+
|
|
|
+
|
|
|
+// Function to extract MAC addr from a packet at given offset
|
|
|
+void WiFiScan::getMAC(char *addr, uint8_t* data, uint16_t offset) {
|
|
|
+ sprintf(addr, "%02x:%02x:%02x:%02x:%02x:%02x", data[offset+0], data[offset+1], data[offset+2], data[offset+3], data[offset+4], data[offset+5]);
|
|
|
+}
|
|
|
+
|
|
|
+void WiFiScan::beaconSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type)
|
|
|
+{
|
|
|
+ wifi_promiscuous_pkt_t *snifferPacket = (wifi_promiscuous_pkt_t*)buf;
|
|
|
+ WifiMgmtHdr *frameControl = (WifiMgmtHdr*)snifferPacket->payload;
|
|
|
+ wifi_pkt_rx_ctrl_t ctrl = (wifi_pkt_rx_ctrl_t)snifferPacket->rx_ctrl;
|
|
|
+ int len = snifferPacket->rx_ctrl.sig_len;
|
|
|
+
|
|
|
+ String display_string = "";
|
|
|
+
|
|
|
+ if (type == WIFI_PKT_MGMT)
|
|
|
+ {
|
|
|
+ int fctl = ntohs(frameControl->fctl);
|
|
|
+ const wifi_ieee80211_packet_t *ipkt = (wifi_ieee80211_packet_t *)snifferPacket->payload;
|
|
|
+ const WifiMgmtHdr *hdr = &ipkt->hdr;
|
|
|
+
|
|
|
+ // If we dont the buffer size is not 0, don't write or else we get CORRUPT_HEAP
|
|
|
+ if ((snifferPacket->payload[0] == 0x80) && (display_obj.display_buffer->size() == 0))
|
|
|
+ {
|
|
|
+ delay(random(0, 10));
|
|
|
+ Serial.print("RSSI: ");
|
|
|
+ Serial.print(snifferPacket->rx_ctrl.rssi);
|
|
|
+ Serial.print(" Ch: ");
|
|
|
+ Serial.print(snifferPacket->rx_ctrl.channel);
|
|
|
+ Serial.print(" BSSID: ");
|
|
|
+ char addr[] = "00:00:00:00:00:00";
|
|
|
+ getMAC(addr, snifferPacket->payload, 10);
|
|
|
+ Serial.print(addr);
|
|
|
+ display_string.concat(addr);
|
|
|
+ Serial.print(" ESSID: ");
|
|
|
+ display_string.concat(" -> ");
|
|
|
+ for (int i = 0; i < snifferPacket->payload[37]; i++)
|
|
|
+ {
|
|
|
+ Serial.print((char)snifferPacket->payload[i + 38]);
|
|
|
+ display_string.concat((char)snifferPacket->payload[i + 38]);
|
|
|
+ }
|
|
|
+
|
|
|
+ for (int i = 0; i < 19 - snifferPacket->payload[37]; i++)
|
|
|
+ {
|
|
|
+ display_string.concat(" ");
|
|
|
+ }
|
|
|
+
|
|
|
+ Serial.print(" ");
|
|
|
+
|
|
|
+ //while (display_obj.display_buffer->get(0) != "")
|
|
|
+ // delay(10);
|
|
|
+ //while (display_obj.display_buffer->size() > 0)
|
|
|
+ // delay(10);
|
|
|
+
|
|
|
+ if (display_obj.display_buffer->size() == 0)
|
|
|
+ {
|
|
|
+ //while (display_obj.printing)
|
|
|
+ // delay(1);
|
|
|
+ display_obj.loading = true;
|
|
|
+ display_obj.display_buffer->add(display_string);
|
|
|
+ display_obj.loading = false;
|
|
|
+ }
|
|
|
+ //display_obj.display_buffer->add(0, display_string);
|
|
|
+
|
|
|
+ //Serial.print(display_obj.display_buffer->size());
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ Serial.println();
|
|
|
+ }
|
|
|
+ }
|
|
|
+}
|
|
|
+
|
|
|
+void WiFiScan::probeSnifferCallback(void* buf, wifi_promiscuous_pkt_type_t type) {
|
|
|
+ wifi_promiscuous_pkt_t *snifferPacket = (wifi_promiscuous_pkt_t*)buf;
|
|
|
+ WifiMgmtHdr *frameControl = (WifiMgmtHdr*)snifferPacket->payload;
|
|
|
+ wifi_pkt_rx_ctrl_t ctrl = (wifi_pkt_rx_ctrl_t)snifferPacket->rx_ctrl;
|
|
|
+ int len = snifferPacket->rx_ctrl.sig_len;
|
|
|
+
|
|
|
+ String display_string = "";
|
|
|
+
|
|
|
+ if (type == WIFI_PKT_MGMT)
|
|
|
+ {
|
|
|
+ int fctl = ntohs(frameControl->fctl);
|
|
|
+ const wifi_ieee80211_packet_t *ipkt = (wifi_ieee80211_packet_t *)snifferPacket->payload;
|
|
|
+ const WifiMgmtHdr *hdr = &ipkt->hdr;
|
|
|
+
|
|
|
+
|
|
|
+ // If we dont the buffer size is not 0, don't write or else we get CORRUPT_HEAP
|
|
|
+ if ((snifferPacket->payload[0] == 0x40) && (display_obj.display_buffer->size() == 0))
|
|
|
+ {
|
|
|
+ delay(random(0, 10));
|
|
|
+ Serial.print("RSSI: ");
|
|
|
+ Serial.print(snifferPacket->rx_ctrl.rssi);
|
|
|
+ Serial.print(" Ch: ");
|
|
|
+ Serial.print(snifferPacket->rx_ctrl.channel);
|
|
|
+ Serial.print(" Client: ");
|
|
|
+ char addr[] = "00:00:00:00:00:00";
|
|
|
+ getMAC(addr, snifferPacket->payload, 10);
|
|
|
+ Serial.print(addr);
|
|
|
+ display_string.concat(addr);
|
|
|
+ Serial.print(" Requesting: ");
|
|
|
+ display_string.concat(" -> ");
|
|
|
+ for (int i = 0; i < snifferPacket->payload[25]; i++)
|
|
|
+ {
|
|
|
+ Serial.print((char)snifferPacket->payload[26 + i]);
|
|
|
+ display_string.concat((char)snifferPacket->payload[26 + i]);
|
|
|
+ }
|
|
|
+
|
|
|
+ // Print spaces because of the rotating lines of the hardware scroll.
|
|
|
+ // The same characters print from previous lines so I just overwrite them
|
|
|
+ // with spaces.
|
|
|
+ for (int i = 0; i < 19 - snifferPacket->payload[25]; i++)
|
|
|
+ {
|
|
|
+ display_string.concat(" ");
|
|
|
+ }
|
|
|
+
|
|
|
+ if (display_obj.display_buffer->size() == 0)
|
|
|
+ {
|
|
|
+ //while (display_obj.printing)
|
|
|
+ // delay(1);
|
|
|
+ display_obj.loading = true;
|
|
|
+ display_obj.display_buffer->add(display_string);
|
|
|
+ display_obj.loading = false;
|
|
|
+ }
|
|
|
+
|
|
|
+ Serial.println();
|
|
|
+ }
|
|
|
+ }
|
|
|
+}
|
|
|
+
|
|
|
+//void WiFiScan::sniffer_callback(void* buf, wifi_promiscuous_pkt_type_t type) {
|
|
|
+// wifi_promiscuous_pkt_t *snifferPacket = (wifi_promiscuous_pkt_t*)buf;
|
|
|
+// showMetadata(snifferPacket, type);
|
|
|
+//}
|
|
|
+
|
|
|
+// Function to cycle to the next channel
|
|
|
+void WiFiScan::channelHop()
|
|
|
+{
|
|
|
+ set_channel = set_channel + 1;
|
|
|
+ if (set_channel > 13) {
|
|
|
+ set_channel = 1;
|
|
|
+ }
|
|
|
+ esp_wifi_set_channel(set_channel, WIFI_SECOND_CHAN_NONE);
|
|
|
+ //Serial.println(set_channel);
|
|
|
+ delay(1);
|
|
|
+}
|