Compare commits

..

45 Commits

Author SHA1 Message Date
oopsbagel 431a97ca65 chore: bump all Cargo.toml versions to 0.2.6 2025-03-25 17:02:01 -07:00
Will Greenberg 0364bfbc98 bump version number
we uhh forgot to do this for every release lol
2025-03-25 16:53:20 -07:00
Ben Brown 996e47684c Fix typo on readme
sensetive -> sensitive
2025-03-25 16:52:16 -07:00
Cooper Quintin 266f2b2e53 more nesting 2025-03-25 16:49:08 -07:00
Will Greenberg 2080cd7845 web ui: fix issue causing no entries
We weren't correctly handling all possible events from the heuristics
list
2025-03-25 16:49:08 -07:00
oopsbagel 9af8e006b0 fix(serial): use tokio's timeout with USB bulk in/out
Replace futures_lite::future::block_on (which will block indefinitely) with
tokio::time::timeout to restore the original behaviour of this utility, where
communication over USB interface bulk endpoints times out after 1 second.
2025-03-25 16:46:35 -07:00
oopsbagel e841e22774 refactor(serial): replace rusb with nusb
nusb is a pure Rust library providing the same low level access to USB devices
that rusb/libusb provide.

This commit removes rusb (and thus the dependence on libusb) and replaces it
with nusb in the serial utility.

The only functional change is that nusb does not support timeouts for bulk data
commands. nusb is async. This commit contains a naïve implementation that simply
blocks on bulk reads and writes in send_command().
2025-03-25 16:46:35 -07:00
Will Greenberg 0d9f53f602 Update make.sh
reboot the orbic instead of starting up the process again, since rootshell seems to have insufficient privileges to start rayhunter
2025-03-25 16:34:23 -07:00
Will Greenberg c9dcbbe5d6 daemon: if we fail to parse the QMDL manifest, make a new one
If rayhunter doesn't exit cleanly (e.g. during a battery outage), the
QMDL manifest may end up in a corrupted state. If that's the case,
rayhunter should try to recover by creating a new manifest. This'll let
it continue, and will preserve previous recordings, but they won't be
visible through the UI.
2025-03-25 15:36:12 -07:00
Will Greenberg 61d6ff6510 Add an update section 2025-03-25 15:14:54 -07:00
Will Greenberg e79dc4a8f0 lib: diable null-cipher heuristic due to false positives
Due to an upstream hampi bug (https://github.com/ystero-dev/hampi/issues/133),
our RRC parser is reporting false-positives for the null cipher
heuristic.
2025-03-25 15:13:36 -07:00
Will Greenberg 6204bc0195 update installer script for macOS Intel 2025-03-24 16:42:58 -07:00
Will Greenberg 65b9843e39 test macOS intel builds 2025-03-24 16:42:58 -07:00
Sashanoraa d0d01089dd Fix various clippy warnings
This commit fixes various clippy warnings that do not affect the
function of the code and aren't stylistic in nature.
2025-03-24 13:47:20 -07:00
Sashanoraa 9c26e89b24 Modify config load to use serde default
This commit refactors the config loading code to no longer require a
separate ConfigFile struct by taking advantage of serde's `default`
attribute. This causes serde to use the Config struct's default value
for that attribute for any missing attributes, which is what the
existing code was doing anyway.

This also fixes several clippy warnings.

Serde docs: https://serde.rs/container-attrs.html#default
2025-03-24 13:47:20 -07:00
Sashanoraa 1f4786db19 Have rootshell print errors and exit 1 if exec fails
Previously was ignoring the possible error retuned by exec, this commit
has rootshell print the error if exec returns and have the process exit
with a code of 1 instead of 0.
2025-03-24 13:47:20 -07:00
Kirk Strauser 88f81d86fa Remove the quarantine bit from the serial command on macOS 2025-03-20 10:49:07 -07:00
oopsbagel 0b3c0de481 fix(lib/util): use better names for runtime metadata
- document RuntimeMetadata fields
- rename RayhunterMetadata to RuntimeMetadata
- rename RuntimeMetadata.os to RuntimeMetadata.system_os
- remove unpopulated hardware field
- remove unnecessary duplication of datastructure in analyzer harness
2025-03-19 11:48:54 -07:00
oopsbagel 188e9f436b fix(qmdl-manifest): store os/arch/hardware in qmdl manifest.toml
Do not superfluously prefix these names with rayhunter_, as they describe the
hardware and not the binary.
2025-03-19 11:48:54 -07:00
oopsbagel f2b5aa2743 feat: show rayhunter version/os/arch in pcap, ndjson, qmdl manifest
Create a util mod to provide information about the rayhunter binary and
system.
2025-03-19 11:48:54 -07:00
oopsbagel b785a7f21c feat(qmdl): add rayhunter version and os to manifest.toml 2025-03-19 11:48:54 -07:00
oopsbagel 09d35ccec7 feat(pcap): add operating system kernel name and release
Display the uname sysname and release as the OS option in the pcap Section
Header Block, falling back on just the std::env::consts::OS name ("linux") in
the case of runtime errors.

Co-authored-by: Nat Budin <natbudin@gmail.com>
2025-03-19 11:48:54 -07:00
oopsbagel 5ae186bc73 feat(pcap): add rayhunter name and version to metadata
Add the compile-time name and version to the pcap's Section Header Block
as the shb_userappl option, the canonical place for storing the name of
the application used to create the pcap.[0]

[0] https://ietf-opsawg-wg.github.io/draft-ietf-opsawg-pcap/draft-ietf-opsawg-pcapng.html#section-4.1-10
2025-03-19 11:48:54 -07:00
Inhishonor c765a40426 Improve grammer. 2025-03-19 09:27:01 -07:00
Inhishonor 93cfbea361 Fix various sentences in README. 2025-03-19 09:27:01 -07:00
Cooper Quintin 8e6bed97b7 Merge branch 'allpoints-132_Merge_OS_variant_install_scripts' 2025-03-18 18:22:33 -07:00
Cooper Quintin 4214b27c0f fix nits in install.sh and update readme with new instructions 2025-03-18 18:21:43 -07:00
rbomze f69487853a minimized the binary size 2025-03-18 17:59:07 -07:00
Jeremy 7eb61748d7 Update readme: Add link to PGP key for contact email address 2025-03-18 17:59:07 -07:00
Will Greenberg ca4e560e92 Update README.md 2025-03-18 17:59:07 -07:00
Alexis 2ffb1d4620 Update SECURITY.md
Just fixing the relative link to this project
2025-03-18 17:59:07 -07:00
Cooper Quintin 77944dd17c add security file 2025-03-18 17:59:07 -07:00
rbomze 50301076f0 minimized the binary size 2025-03-18 17:37:24 -07:00
Jeremy 21c839678b Update readme: Add link to PGP key for contact email address 2025-03-17 11:24:19 -07:00
Will Greenberg 332a7ffbd0 Update README.md 2025-03-12 11:56:12 -07:00
Alexis 8d250553b7 Update SECURITY.md
Just fixing the relative link to this project
2025-03-11 15:35:47 -07:00
Cooper Quintin fa897e73fa add security file 2025-03-11 14:53:28 -07:00
Paul Beltrani c3494e338f Merge install scripts into a single, isntall.sh 2025-03-09 22:27:48 -04:00
Cooper Quintin f9b2cd6a59 add link to code of conduct 2025-03-07 11:40:37 -08:00
Will Greenberg eb072fb38c fix various typos 2025-03-07 11:28:29 -08:00
Will Greenberg 91f82fc71d add curl to apt install list 2025-03-07 11:21:36 -08:00
Will Greenberg 6fda8450dc a few more FAQ adjustments 2025-03-07 11:21:36 -08:00
Cooper Quintin bbfe5877fe More FAQ work 2025-03-07 11:21:36 -08:00
Will Greenberg 75d3740f66 Add FAQ to readme 2025-03-07 11:21:36 -08:00
oopsbagel 94c576fd96 fix(tools): add pycrate dependency to requirements.txt
nasparse.py and nasparse_test.py require the pycrate_mobile and
pycrate_core libraries provided by the pycrate package.

This commit adds the required package to requirements.txt.
2025-03-07 11:08:20 -08:00
32 changed files with 412 additions and 255 deletions
+8
View File
@@ -1,3 +1,11 @@
[target.armv7-unknown-linux-gnueabihf] [target.armv7-unknown-linux-gnueabihf]
linker = "arm-linux-gnueabihf-gcc" linker = "arm-linux-gnueabihf-gcc"
rustflags = ["-C", "target-feature=+crt-static"] rustflags = ["-C", "target-feature=+crt-static"]
# optimizations to reduce the binary size
[profile.release]
strip = true
opt-level = "z"
lto = true
codegen-units = 1
panic = "abort"
+9 -9
View File
@@ -12,12 +12,12 @@ jobs:
strategy: strategy:
matrix: matrix:
platform: platform:
- os: ubuntu-latest - name: ubuntu-24
serial_build_name: serial os: ubuntu-latest
check_build_name: rayhunter-check - name: macos-arm
- os: macos-latest os: macos-latest
serial_build_name: serial - name: macos-intel
check_build_name: rayhunter-check os: macos-13
runs-on: ${{ matrix.platform.os }} runs-on: ${{ matrix.platform.os }}
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
@@ -25,8 +25,8 @@ jobs:
run: cargo build --bin serial --release run: cargo build --bin serial --release
- uses: actions/upload-artifact@v4 - uses: actions/upload-artifact@v4
with: with:
name: serial-${{ matrix.platform.os }} name: serial-${{ matrix.platform.name }}
path: ./target/release/${{ matrix.platform.serial_build_name }} path: ./target/release/serial
if-no-files-found: error if-no-files-found: error
- uses: actions/checkout@v4 - uses: actions/checkout@v4
- name: Build check - name: Build check
@@ -34,7 +34,7 @@ jobs:
- uses: actions/upload-artifact@v4 - uses: actions/upload-artifact@v4
with: with:
name: rayhunter-check-${{ matrix.platform.os }} name: rayhunter-check-${{ matrix.platform.os }}
path: ./target/release/${{ matrix.platform.check_build_name }} path: ./target/release/rayhunter-check
if-no-files-found: error if-no-files-found: error
build_rootshell_and_rayhunter: build_rootshell_and_rayhunter:
runs-on: ubuntu-latest runs-on: ubuntu-latest
+1
View File
@@ -0,0 +1 @@
This project is governed by [EFF's Public Projects Code of Conduct](https://www.eff.org/pages/eppcode).
Generated
+70 -29
View File
@@ -492,6 +492,16 @@ dependencies = [
"windows-sys 0.52.0", "windows-sys 0.52.0",
] ]
[[package]]
name = "core-foundation"
version = "0.9.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
dependencies = [
"core-foundation-sys",
"libc",
]
[[package]] [[package]]
name = "core-foundation-sys" name = "core-foundation-sys"
version = "0.8.6" version = "0.8.6"
@@ -786,6 +796,19 @@ version = "0.3.30"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1" checksum = "a44623e20b9681a318efdd71c299b6b222ed6f231972bfe2f224ebad6311f0c1"
[[package]]
name = "futures-lite"
version = "2.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f5edaec856126859abb19ed65f39e90fea3a9574b9707f13539acf4abf7eb532"
dependencies = [
"fastrand",
"futures-core",
"futures-io",
"parking",
"pin-project-lite",
]
[[package]] [[package]]
name = "futures-macro" name = "futures-macro"
version = "0.3.30" version = "0.3.30"
@@ -1107,6 +1130,16 @@ dependencies = [
"syn 2.0.50", "syn 2.0.50",
] ]
[[package]]
name = "io-kit-sys"
version = "0.4.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "617ee6cf8e3f66f3b4ea67a4058564628cde41901316e19f559e14c7c72c5e7b"
dependencies = [
"core-foundation-sys",
"mach2",
]
[[package]] [[package]]
name = "is-terminal" name = "is-terminal"
version = "0.4.12" version = "0.4.12"
@@ -1177,18 +1210,6 @@ dependencies = [
"once_cell", "once_cell",
] ]
[[package]]
name = "libusb1-sys"
version = "0.6.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f9d0e2afce4245f2c9a418511e5af8718bcaf2fa408aefb259504d1a9cb25f27"
dependencies = [
"cc",
"libc",
"pkg-config",
"vcpkg",
]
[[package]] [[package]]
name = "linux-raw-sys" name = "linux-raw-sys"
version = "0.4.14" version = "0.4.14"
@@ -1220,6 +1241,15 @@ dependencies = [
"imgref", "imgref",
] ]
[[package]]
name = "mach2"
version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "19b955cdeb2a02b9117f121ce63aa52d08ade45de53e48fe6a38b39c10f6f709"
dependencies = [
"libc",
]
[[package]] [[package]]
name = "matchit" name = "matchit"
version = "0.7.3" version = "0.7.3"
@@ -1394,6 +1424,25 @@ dependencies = [
"libc", "libc",
] ]
[[package]]
name = "nusb"
version = "0.1.13"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "99a726776e551f3ee9b467fe47202f26e64b9bbf715df5443b0904df6f2dcc41"
dependencies = [
"atomic-waker",
"core-foundation",
"core-foundation-sys",
"futures-core",
"io-kit-sys",
"libc",
"log",
"once_cell",
"rustix",
"slab",
"windows-sys 0.48.0",
]
[[package]] [[package]]
name = "object" name = "object"
version = "0.32.2" version = "0.32.2"
@@ -1409,6 +1458,12 @@ version = "1.19.0"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92" checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
[[package]]
name = "parking"
version = "2.2.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
[[package]] [[package]]
name = "parking_lot" name = "parking_lot"
version = "0.12.1" version = "0.12.1"
@@ -1694,6 +1749,7 @@ dependencies = [
"futures-core", "futures-core",
"libc", "libc",
"log", "log",
"nix",
"pcap-file-tokio", "pcap-file-tokio",
"serde", "serde",
"telcom-parser", "telcom-parser",
@@ -1802,16 +1858,6 @@ dependencies = [
"nix", "nix",
] ]
[[package]]
name = "rusb"
version = "0.9.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "45fff149b6033f25e825cbb7b2c625a11ee8e6dac09264d49beb125e39aa97bf"
dependencies = [
"libc",
"libusb1-sys",
]
[[package]] [[package]]
name = "rustc-demangle" name = "rustc-demangle"
version = "0.1.23" version = "0.1.23"
@@ -1915,7 +1961,8 @@ dependencies = [
name = "serial" name = "serial"
version = "0.1.0" version = "0.1.0"
dependencies = [ dependencies = [
"rusb", "futures-lite",
"nusb",
] ]
[[package]] [[package]]
@@ -2349,12 +2396,6 @@ dependencies = [
"wasm-bindgen", "wasm-bindgen",
] ]
[[package]]
name = "vcpkg"
version = "0.2.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
[[package]] [[package]]
name = "version-compare" name = "version-compare"
version = "0.2.0" version = "0.2.0"
+50 -25
View File
@@ -5,34 +5,57 @@
Rayhunter is an IMSI Catcher Catcher for the Orbic mobile hotspot. Rayhunter is an IMSI Catcher Catcher for the Orbic mobile hotspot.
**THIS CODE IS PROOF OF CONCEPT AND SHOULD NOT BE RELIED UPON IN HIGH RISK SITUATIONS** **THIS CODE IS A PROOF OF CONCEPT AND SHOULD NOT BE RELIED UPON IN HIGH RISK SITUATIONS!**
## The Hardware ## The Hardware
Code is built and tested for the Orbic RC400L mobile hotspot, it may work on other orbics and other Rayhunter has been built and tested for the Orbic RC400L mobile hotspot. It may work on other orbics and other
linux/qualcom devices but this is the only one we have tested on. linux/qualcom devices, but this is the only one we have tested on.
Buy the orbic [using bezos bucks](https://www.amazon.com/Orbic-Verizon-Hotspot-Connect-Enabled/dp/B08N3CHC4Y) Buy the orbic [using bezos bucks](https://www.amazon.com/Orbic-Verizon-Hotspot-Connect-Enabled/dp/B08N3CHC4Y),
Or on [Ebay](https://www.ebay.com/sch/i.html?_nkw=orbic+rc400l) or on [Ebay](https://www.ebay.com/sch/i.html?_nkw=orbic+rc400l).
## Setup ## Setup
*NOTE: We don't currently support automated installs on windows, you will have to follow the manual install instructions below*
1. Download the latest [rayhunter release bundle](https://github.com/EFForg/rayhunter/releases) and extract it. 1. Download the latest [Rayhunter release bundle](https://github.com/EFForg/rayhunter/releases) and extract it.
**If you are installing from the cloned github repository please see the development instructions below, running `install-linux.sh` from the git tree will not work.** **If you are installing from the cloned github repository please see the development instructions below, running `install.sh` from the git tree will not work.**
2. Run the install script inside the bundle corresponding to your platform (`install-linux.sh`, `install-mac.sh`). The Linux installer has only been tested on the latest version of Ubuntu. If it fails you will need to follow the install steps outlined in **Development** below. 2. Turn on the Orbic device and plug it into your computer using a USB-C Cable.
3. Once finished, rayhunter should be running! You can verify this by visiting the web UI as described below. 3. On MacOS or Linux run the install script `install.sh`.
4. Once finished, Rayhunter should be running! You can verify this by visiting the web UI as described below.
### Notes
* The install script has only been tested for Linux on the latest version of Ubuntu. If it fails you will need to follow the install steps outlined in **Development** below.
* The install script also won't work on older macs with intel chips, for those macs you will need to follow the instructions at https://github.com/EFForg/rayhunter/wiki/Install-Rayhunter-on-Mac-Intel-devices
* We don't currently support automated installs on windows, you will have to follow the manual install instructions below*
## Updating
Great news: if you've successfully installed rayhunter, you already know how to update it! Our update process is identical to the setup process: simply download the latest release and follow the steps in the [setup section](#Setup).
## Usage ## Usage
Once installed, rayhunter will run automatically whenever your Orbic device is running. It serves a web UI that provides some basic controls, such as being able to start/stop recordings, download captures, and view heuristic analyses of captures. You can access this UI in one of two ways: Once installed, Rayhunter will run automatically whenever your Orbic device is running. It serves a web UI that provides some basic controls, such as being able to start/stop recordings, download captures, and view heuristic analyses of captures. You can access this UI in one of two ways:
1. Over wifi: Connect your phone/laptop to the Orbic's wifi network and visit `http://192.168.1.1:8080` (click past your browser warning you about the connection not being secure, rayhunter doesn't have HTTPS yet!) 1. Over wifi: Connect your phone/laptop to the Orbic's wifi network and visit `http://192.168.1.1:8080` (click past your browser warning you about the connection not being secure, Rayhunter doesn't have HTTPS yet!).
* Note that you'll need the Orbic's wifi password for this, which can be retrieved by pressing the "MENU" button on the device and opening the 2.4 GHz menu. * Note that you'll need the Orbic's wifi password for this, which can be retrieved by pressing the "MENU" button on the device and opening the 2.4 GHz menu.
2. Over usb: Connect the Orbic device to your laptop via usb. Run `adb forward tcp:8080 tcp:8080`, then visit `http://localhost:8080`. For this you will need to install the Android Debug Bridge (ADB) on your computer, you can copy the version that was downloaded inside the releases/platform-tools/` folder to somewhere else in your path or you can install it manually. You can find instructions for doing so on your platform [here](https://www.xda-developers.com/install-adb-windows-macos-linux/#how-to-set-up-adb-on-your-computer), (don't worry about instructions for installing it on a phone/device yet). 2. Over usb: Connect the Orbic device to your laptop via usb. Run `adb forward tcp:8080 tcp:8080`, then visit `http://localhost:8080`. For this you will need to install the Android Debug Bridge (ADB) on your computer, you can copy the version that was downloaded inside the releases/platform-tools/` folder to somewhere else in your path or you can install it manually. You can find instructions for doing so on your platform [here](https://www.xda-developers.com/install-adb-windows-macos-linux/#how-to-set-up-adb-on-your-computer), (don't worry about instructions for installing it on a phone/device yet).
## Frequently Asked Questions
### Do I need an active SIM card to use Rayhunter?
**It Depends**. Operation of Rayhunter does require the insertion of a SIM card into the device, but whether that SIM card has to be currently active for our tests to work is still under investigation. If you want to use the device as a hotspot in addition to a research device an active plan would of course be necessary, however we have not done enough testing yet to know whether an active subscription is required for detection. If you want to test the device with an inactive SIM card, we would certainly be interested in seeing any data you collect, and especially any runs that trigger an alert!
### Help, Rayhunter's line is red! What should I do?
Unfortunately, the circumstances that might lead to a positive CSS signal are quite varied, so we don't have a universal recommendation for how to deal with the a positive signal. You might also want to turn off your phone until you are out of the area (or put it on airplane mode,) and tell your friends to do the same!
Please feel free to contact an EFF technologist with more information & a copy of the QMDL in question at [info@eff.org](mailto:info@eff.org). Please note that this file may contain sensitive information such as your IMSI and the unique IDs of cell towers you were near which could be used to ascertain your location at the time. We encourage you to use PGP encryption when sending your message. You can find the [PGP public key for info@eff.org here](https://www.eff.org/about/contact#main-content).
### Does Rayhunter work outside of the US?
**Probably**. Some Rayhunter users have reported successfully using it in other countries with unlocked devices and SIM cards from local telcos. We can't guarantee whether or not it will work for you though.
### Should I get a locked or unlocked orbic device? What is the difference?
If you want to use a non verizon SIM card you will probably need an unlocked device. But it's not clear how locked the locked devices are nor how to unlock them, we welcome any experimentation and information regarding the use of unlocked devices.
### Does Rayhunter work on any other devices besides the Orbic RC400L?
**Maybe**. We have not tested Rayhunter on any other hardware but we would love to expand the supported platforms. We will consider giving official support to any hardware platform that can be bought for around $20-30USD. The Rayhunter daemon should theoretically work on any linux/android device that has a qualcomm chip with a /dev/diag interface and root access, though our installer script has only been tested with an Orbic. If you get it working on another device, please let us know!
## Development ## Development
* Install ADB on your computer using the instructions above, and make sure it's in your terminal's PATH * Install ADB on your computer using the instructions above, and make sure it's in your terminal's PATH
* You can verify if ADB is in your PATH by running `which adb` in a terminal. If it prints the filepath to where ADB is installed, you're set! Otherwise, try following one of these guides: * You can verify if ADB is in your PATH by running `which adb` in a terminal. If it prints the filepath to where ADB is installed, you're set! Otherwise, try following one of these guides:
@@ -40,28 +63,26 @@ Once installed, rayhunter will run automatically whenever your Orbic device is r
* [macOS](https://www.repeato.app/setting-up-adb-on-macos-a-step-by-step-guide/) * [macOS](https://www.repeato.app/setting-up-adb-on-macos-a-step-by-step-guide/)
* [Windows](https://medium.com/@yadav-ajay/a-step-by-step-guide-to-setting-up-adb-path-on-windows-0b833faebf18) * [Windows](https://medium.com/@yadav-ajay/a-step-by-step-guide-to-setting-up-adb-path-on-windows-0b833faebf18)
### If your are on x86 linux ### If you're on x86 linux
* on your linux laptop install rust the usual way and then install cross compiling dependences. Install rust the usual way and then install cross compiling dependences:
* run `sudo apt install build-essential libc6-armhf-cross libc6-dev-armhf-cross gcc-arm-linux-gnueabihf`
* set up cross compliing for rust:
``` ```
sudo apt install curl build-essential libc6-armhf-cross libc6-dev-armhf-cross gcc-arm-linux-gnueabihf
rustup target add x86_64-unknown-linux-gnu rustup target add x86_64-unknown-linux-gnu
rustup target add armv7-unknown-linux-gnueabihf rustup target add armv7-unknown-linux-gnueabihf
``` ```
Now you can root your device and install rayhunter by running `./tools/install-dev.sh` Now you can root your device and install Rayhunter by running `./tools/install-dev.sh`
### If you are on windows or can't run the install scripts ### If you're on windows or can't run the install scripts
* Root your device on windows using the instructions here: https://xdaforums.com/t/resetting-verizon-orbic-speed-rc400l-firmware-flash-kajeet.4334899/#post-87855183 * Root your device on windows using the instructions here: https://xdaforums.com/t/resetting-verizon-orbic-speed-rc400l-firmware-flash-kajeet.4334899/#post-87855183
* Build for arm using `cargo build` * Build for arm using `cargo build`
* Run tests using `cargo test_pc` * Run tests using `cargo test_pc`
* Push the scripts in `scripts/` to /etc/init.d on device and make a directory called /data/rayhunter using `adb shell` (and sshell for your root shell if you followed the steps above) * Push the scripts in `scripts/` to `/etc/init.d` on device and make a directory called `/data/rayhunter` using `adb shell` (and sshell for your root shell if you followed the steps above)
* you also need to copy `config.toml.example` to /data/rayhunter/config.toml * you also need to copy `config.toml.example` to `/data/rayhunter/config.toml`
* Then run `./make.sh` this will build the binary and push it over adb. Restart your device or run `/etc/init.d/rayhunter_daemon start` on the device and you are good to go. * Then run `./make.sh` this will build the binary and push it over adb. Restart your device or run `/etc/init.d/rayhunter_daemon start` on the device and you are good to go.
@@ -73,9 +94,13 @@ Now you can root your device and install rayhunter by running `./tools/install-d
* push to the device with `./make.sh` * push to the device with `./make.sh`
## Documentation ## Support and Discussion
* Build docs locallly using `RUSTDOCFLAGS="--cfg docsrs" cargo doc --no-deps --all-features --open`
**LEGAL DISCLAIMER:** Use this program at your own risk. We beilieve running this program does not currently violate any laws or regulations in the United States. However, we are not responsible for civil or criminal liability resulting from the use of this software. If you are located outside of the US please consult with an attorney in your country to help you assess the legal risks of running this program. If you're having issues installing or using Rayhunter, please open an issue in this repo. Join us in the `#rayhunter` channel of [EFF's Mattermost](https://opensource.eff.org/signup_user_complete/?id=6iqur37ucfrctfswrs14iscobw&md=link&sbr=su) instance to chat!
## Documentation
* Build docs locally using `RUSTDOCFLAGS="--cfg docsrs" cargo doc --no-deps --all-features --open`
**LEGAL DISCLAIMER:** Use this program at your own risk. We believe running this program does not currently violate any laws or regulations in the United States. However, we are not responsible for civil or criminal liability resulting from the use of this software. If you are located outside of the US please consult with an attorney in your country to help you assess the legal risks of running this program.
*Good Hunting!* *Good Hunting!*
+5
View File
@@ -0,0 +1,5 @@
# Security Policy
## Reporting a Vulnerability
Security vulnerabilities can be reported using GitHub's [private vulnerability reporting tool](https://github.com/EFForg/rayhunter/security/advisories/new).
+1 -1
View File
@@ -1,6 +1,6 @@
[package] [package]
name = "rayhunter-daemon" name = "rayhunter-daemon"
version = "0.1.0" version = "0.2.6"
edition = "2021" edition = "2021"
[[bin]] [[bin]]
+3 -5
View File
@@ -88,11 +88,9 @@ async fn pcapify(qmdl_path: &PathBuf) {
let mut pcap_writer = GsmtapPcapWriter::new(pcap_file).await.unwrap(); let mut pcap_writer = GsmtapPcapWriter::new(pcap_file).await.unwrap();
pcap_writer.write_iface_header().await.unwrap(); pcap_writer.write_iface_header().await.unwrap();
while let Some(container) = qmdl_reader.get_next_messages_container().await.expect("failed to get container") { while let Some(container) = qmdl_reader.get_next_messages_container().await.expect("failed to get container") {
for maybe_msg in container.into_messages() { for msg in container.into_messages().into_iter().flatten() {
if let Ok(msg) = maybe_msg { if let Ok(Some((timestamp, parsed))) = gsmtap_parser::parse(msg) {
if let Ok(Some((timestamp, parsed))) = gsmtap_parser::parse(msg) { pcap_writer.write_gsmtap_message(parsed, timestamp).await.expect("failed to write");
pcap_writer.write_gsmtap_message(parsed, timestamp).await.expect("failed to write");
}
} }
} }
} }
+5 -20
View File
@@ -2,17 +2,9 @@ use crate::error::RayhunterError;
use serde::Deserialize; use serde::Deserialize;
#[derive(Deserialize)]
struct ConfigFile {
qmdl_store_path: Option<String>,
port: Option<u16>,
debug_mode: Option<bool>,
ui_level: Option<u8>,
enable_dummy_analyzer: Option<bool>,
colorblind_mode: Option<bool>,
}
#[derive(Debug)] #[derive(Debug)]
#[derive(Deserialize)]
#[serde(default)]
pub struct Config { pub struct Config {
pub qmdl_store_path: String, pub qmdl_store_path: String,
pub port: u16, pub port: u16,
@@ -36,18 +28,11 @@ impl Default for Config {
} }
pub fn parse_config<P>(path: P) -> Result<Config, RayhunterError> where P: AsRef<std::path::Path> { pub fn parse_config<P>(path: P) -> Result<Config, RayhunterError> where P: AsRef<std::path::Path> {
let mut config = Config::default();
if let Ok(config_file) = std::fs::read_to_string(&path) { if let Ok(config_file) = std::fs::read_to_string(&path) {
let parsed_config: ConfigFile = toml::from_str(&config_file) Ok(toml::from_str(&config_file).map_err(RayhunterError::ConfigFileParsingError)?)
.map_err(RayhunterError::ConfigFileParsingError)?; } else {
parsed_config.qmdl_store_path.map(|v| config.qmdl_store_path = v); Ok(Config::default())
parsed_config.port.map(|v| config.port = v);
parsed_config.debug_mode.map(|v| config.debug_mode = v);
parsed_config.ui_level.map(|v| config.ui_level = v);
parsed_config.enable_dummy_analyzer.map(|v| config.enable_dummy_analyzer = v);
parsed_config.colorblind_mode.map(|v| config.colorblind_mode = v);
} }
Ok(config)
} }
pub struct Args { pub struct Args {
+27 -7
View File
@@ -22,6 +22,7 @@ use analysis::{get_analysis_status, run_analysis_thread, start_analysis, Analysi
use axum::response::Redirect; use axum::response::Redirect;
use diag::{get_analysis_report, start_recording, stop_recording, DiagDeviceCtrlMessage}; use diag::{get_analysis_report, start_recording, stop_recording, DiagDeviceCtrlMessage};
use log::{info, error}; use log::{info, error};
use qmdl_store::RecordingStoreError;
use rayhunter::diag_device::DiagDevice; use rayhunter::diag_device::DiagDevice;
use axum::routing::{get, post}; use axum::routing::{get, post};
use axum::Router; use axum::Router;
@@ -90,13 +91,31 @@ async fn server_shutdown_signal(server_shutdown_rx: oneshot::Receiver<()>) {
info!("Server received shutdown signal, exiting..."); info!("Server received shutdown signal, exiting...");
} }
// Loads a QmdlStore if one exists, and if not, only create one if we're not in // Loads a RecordingStore if one exists, and if not, only create one if we're
// debug mode. // not in debug mode. If we fail to parse the manifest AND we're not in debug
// mode, try to recover by making a new (empty) manifest in the same directory.
async fn init_qmdl_store(config: &config::Config) -> Result<RecordingStore, RayhunterError> { async fn init_qmdl_store(config: &config::Config) -> Result<RecordingStore, RayhunterError> {
match (RecordingStore::exists(&config.qmdl_store_path).await?, config.debug_mode) { let store_exists = RecordingStore::exists(&config.qmdl_store_path).await?;
(true, _) => Ok(RecordingStore::load(&config.qmdl_store_path).await?), if config.debug_mode {
(false, false) => Ok(RecordingStore::create(&config.qmdl_store_path).await?), if store_exists {
(false, true) => Err(RayhunterError::NoStoreDebugMode(config.qmdl_store_path.clone())), Ok(RecordingStore::load(&config.qmdl_store_path).await?)
} else {
Err(RayhunterError::NoStoreDebugMode(config.qmdl_store_path.clone()))
}
} else {
if store_exists {
match RecordingStore::load(&config.qmdl_store_path).await {
Ok(store) => Ok(store),
Err(RecordingStoreError::ParseManifestError(err)) => {
error!("failed to parse QMDL manifest: {}", err);
info!("creating new empty manifest...");
Ok(RecordingStore::create(&config.qmdl_store_path).await?)
},
Err(err) => Err(err.into()),
}
} else {
Ok(RecordingStore::create(&config.qmdl_store_path).await?)
}
} }
} }
@@ -195,7 +214,8 @@ fn update_ui(task_tracker: &TaskTracker, config: &config::Config, mut ui_shutdo
fb.draw_line(framebuffer::Color565::Pink, 50); fb.draw_line(framebuffer::Color565::Pink, 50);
fb.draw_line(framebuffer::Color565::Cyan, 25); fb.draw_line(framebuffer::Color565::Cyan, 25);
}, },
1 | _ => { _ => { // this branch id for ui_level 1, which is also the default if an
// unknown value is used
fb.draw_line(display_color, 2); fb.draw_line(display_color, 2);
}, },
}; };
+5 -6
View File
@@ -104,7 +104,7 @@ pub fn run_diag_read_thread(
} }
let mut qmdl_store = qmdl_store_lock.write().await; let mut qmdl_store = qmdl_store_lock.write().await;
let index = qmdl_store.current_entry.expect("DiagDevice had qmdl_writer, but QmdlStore didn't have current entry???"); let index = qmdl_store.current_entry.expect("DiagDevice had qmdl_writer, but QmdlStore didn't have current entry???");
qmdl_store.update_entry_analysis_size(index, analysis_file_len as usize).await qmdl_store.update_entry_analysis_size(index, analysis_file_len).await
.expect("failed to update analysis file size"); .expect("failed to update analysis file size");
} }
}, },
@@ -130,12 +130,11 @@ pub async fn start_recording(State(state): State<Arc<ServerState>>) -> Result<(S
state.diag_device_ctrl_sender.send(DiagDeviceCtrlMessage::StartRecording((qmdl_writer, analysis_file))).await state.diag_device_ctrl_sender.send(DiagDeviceCtrlMessage::StartRecording((qmdl_writer, analysis_file))).await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("couldn't send stop recording message: {}", e)))?; .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("couldn't send stop recording message: {}", e)))?;
let display_state: framebuffer::DisplayState; let display_state = if state.colorblind_mode {
if state.colorblind_mode { framebuffer::DisplayState::RecordingCBM
display_state = framebuffer::DisplayState::RecordingCBM;
} else { } else {
display_state = framebuffer::DisplayState::Recording; framebuffer::DisplayState::Recording
} };
state.ui_update_sender.send(display_state).await state.ui_update_sender.send(display_state).await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("couldn't send ui update message: {}", e)))?; .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("couldn't send ui update message: {}", e)))?;
+22
View File
@@ -1,3 +1,4 @@
use rayhunter::util::RuntimeMetadata;
use chrono::{DateTime, Local}; use chrono::{DateTime, Local};
use serde::{Deserialize, Serialize}; use serde::{Deserialize, Serialize};
use std::path::{Path, PathBuf}; use std::path::{Path, PathBuf};
@@ -43,17 +44,24 @@ pub struct ManifestEntry {
pub last_message_time: Option<DateTime<Local>>, pub last_message_time: Option<DateTime<Local>>,
pub qmdl_size_bytes: usize, pub qmdl_size_bytes: usize,
pub analysis_size_bytes: usize, pub analysis_size_bytes: usize,
pub rayhunter_version: Option<String>,
pub system_os: Option<String>,
pub arch: Option<String>,
} }
impl ManifestEntry { impl ManifestEntry {
fn new() -> Self { fn new() -> Self {
let now = Local::now(); let now = Local::now();
let metadata = RuntimeMetadata::new();
ManifestEntry { ManifestEntry {
name: format!("{}", now.timestamp()), name: format!("{}", now.timestamp()),
start_time: now, start_time: now,
last_message_time: None, last_message_time: None,
qmdl_size_bytes: 0, qmdl_size_bytes: 0,
analysis_size_bytes: 0, analysis_size_bytes: 0,
rayhunter_version: Some(metadata.rayhunter_version),
system_os: Some(metadata.system_os),
arch: Some(metadata.arch),
} }
} }
@@ -321,6 +329,20 @@ mod tests {
)); ));
} }
#[tokio::test]
async fn test_create_on_existing_store() {
let dir = make_temp_dir();
let mut store = RecordingStore::create(dir.path()).await.unwrap();
let _ = store.new_entry().await.unwrap();
let entry_index = store.current_entry.unwrap();
store
.update_entry_qmdl_size(entry_index, 1000)
.await
.unwrap();
let store = RecordingStore::create(dir.path()).await.unwrap();
assert_eq!(store.manifest.entries.len(), 0);
}
#[tokio::test] #[tokio::test]
async fn test_repeated_new_entries() { async fn test_repeated_new_entries() {
let dir = make_temp_dir(); let dir = make_temp_dir();
+1 -1
View File
@@ -29,7 +29,7 @@ pub struct ServerState {
pub async fn get_qmdl(State(state): State<Arc<ServerState>>, Path(qmdl_name): Path<String>) -> Result<Response, (StatusCode, String)> { pub async fn get_qmdl(State(state): State<Arc<ServerState>>, Path(qmdl_name): Path<String>) -> Result<Response, (StatusCode, String)> {
let qmdl_idx = qmdl_name.trim_end_matches(".qmdl"); let qmdl_idx = qmdl_name.trim_end_matches(".qmdl");
let qmdl_store = state.qmdl_store_lock.read().await; let qmdl_store = state.qmdl_store_lock.read().await;
let (entry_index, entry) = qmdl_store.entry_for_name(&qmdl_idx) let (entry_index, entry) = qmdl_store.entry_for_name(qmdl_idx)
.ok_or((StatusCode::NOT_FOUND, format!("couldn't find qmdl file with name {}", qmdl_idx)))?; .ok_or((StatusCode::NOT_FOUND, format!("couldn't find qmdl file with name {}", qmdl_idx)))?;
let qmdl_file = qmdl_store.open_entry_qmdl(entry_index).await let qmdl_file = qmdl_store.open_entry_qmdl(entry_index).await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("error opening QMDL file: {}", e)))?; .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("error opening QMDL file: {}", e)))?;
+6 -4
View File
@@ -80,10 +80,12 @@ async function updateEntryAnalysisResult(entry) {
entry.analysis_result = `0 warnings!`; entry.analysis_result = `0 warnings!`;
} else { } else {
entry.analysis_result = `!!! ${entry.analysis.warnings.length} warnings !!!`; entry.analysis_result = `!!! ${entry.analysis.warnings.length} warnings !!!`;
for(warning of entry.analysis.warnings){ for (const warning of entry.analysis.warnings) {
msg = `${warning.timestamp}: ${warning.warning.events[1].message}` for (const event of warning.warning.events) {
console.log(msg) if (event === null) continue;
entry.analysis_result += `<br>${msg}` msg = `${warning.timestamp}: ${event.message}`
entry.analysis_result += `<br>${msg}`
}
} }
} }
} }
-23
View File
@@ -1,23 +0,0 @@
#!/bin/env bash
set -e
export SERIAL_PATH="./serial-ubuntu-latest/serial"
if [ ! -x "$SERIAL_PATH" ]; then
echo "The serial binary cannot be found at $SERIAL_PATH. If you are running this from the git tree please instead run it from the latest release bundle https://github.com/EFForg/rayhunter/releases"
exit 1
fi
if ! command -v adb &> /dev/null; then
if [ ! -d ./platform-tools ] ; then
echo "adb not found, downloading local copy"
curl -O "https://dl.google.com/android/repository/platform-tools-latest-linux.zip"
unzip platform-tools-latest-linux.zip
fi
export ADB="./platform-tools/adb"
else
export ADB=`which adb`
fi
. "$(dirname "$0")"/install-common.sh
install
-22
View File
@@ -1,22 +0,0 @@
#!/usr/bin/env bash
set -e
export SERIAL_PATH="./serial-macos-latest/serial"
if [ ! -x "$SERIAL_PATH" ]; then
echo "The serial binary cannot be found at $SERIAL_PATH. If you are running this from the git tree please instead run it from the latest release bundle at https://github.com/EFForg/rayhunter/releases"
exit 1
fi
if ! command -v adb &> /dev/null; then
if [ ! -d ./platform-tools ]; then
echo "adb not found, downloading local copy"
curl -O "https://dl.google.com/android/repository/platform-tools-latest-darwin.zip"
unzip platform-tools-latest-darwin.zip
fi
export ADB="./platform-tools/adb"
else
export ADB=`which adb`
fi
. "$(dirname "$0")"/install-common.sh
install
+41 -14
View File
@@ -1,18 +1,5 @@
#!/usr/bin/env bash #!/usr/bin/env bash
install() { set -e
if [[ -z "${SERIAL_PATH}" ]]; then
echo "\$SERIAL_PATH not set, did you run this from install-linux.sh or install-mac.sh?"
exit 1
fi
if [[ -z "${ADB}" ]]; then
echo "\$ADB not set, did you run this from install-linux.sh or install-mac.sh?"
exit 1
fi
force_debug_mode
setup_rootshell
setup_rayhunter
test_rayhunter
}
force_debug_mode() { force_debug_mode() {
echo "Using adb at $ADB" echo "Using adb at $ADB"
@@ -108,3 +95,43 @@ test_rayhunter() {
done done
echo "timeout reached! failed to reach rayhunter url $URL, something went wrong :(" echo "timeout reached! failed to reach rayhunter url $URL, something went wrong :("
} }
##### ##### #####
##### Main #####
##### ##### #####
if [[ `uname -s` == "Linux" ]]; then
export SERIAL_PATH="./serial-ubuntu-latest/serial"
export PLATFORM_TOOLS="platform-tools-latest-linux.zip"
elif [[ `uname -s` == "Darwin" ]]; then
if [[ `uname -m` == "arm64" ]]; then
export SERIAL_PATH="./serial-macos-arm/serial"
elif [[ `uname -m` == "x86_64" ]]; then
export SERIAL_PATH="./serial-macos-intel/serial"
fi
export PLATFORM_TOOLS="platform-tools-latest-darwin.zip"
xattr -d com.apple.quarantine "$SERIAL_PATH"
else
echo "This script only supports Linux or macOS"
exit 1
fi
if [ ! -x "$SERIAL_PATH" ]; then
echo "The serial binary cannot be found at $SERIAL_PATH. If you are running this from the git tree please instead run it from the latest release bundle https://github.com/EFForg/rayhunter/releases"
exit 1
fi
if ! command -v adb &> /dev/null; then
if [ ! -d ./platform-tools ] ; then
echo "adb not found, downloading local copy"
curl -O "https://dl.google.com/android/repository/${PLATFORM_TOOLS}"
unzip $PLATFORM_TOOLS
fi
export ADB="./platform-tools/adb"
else
export ADB=`which adb`
fi
force_debug_mode
setup_rootshell
setup_rayhunter
test_rayhunter
+2 -1
View File
@@ -1,6 +1,6 @@
[package] [package]
name = "rayhunter" name = "rayhunter"
version = "0.1.0" version = "0.2.6"
edition = "2021" edition = "2021"
description = "Realtime cellular data decoding and analysis for IMSI catcher detection" description = "Realtime cellular data decoding and analysis for IMSI catcher detection"
@@ -17,6 +17,7 @@ deku = { version = "0.16.0", features = ["logging"] }
env_logger = "0.10.1" env_logger = "0.10.1"
libc = "0.2.150" libc = "0.2.150"
log = "0.4.20" log = "0.4.20"
nix = { version = "0.29.0", features = ["feature"] }
pcap-file-tokio = "0.1.0" pcap-file-tokio = "0.1.0"
thiserror = "1.0.50" thiserror = "1.0.50"
telcom-parser = { path = "../telcom-parser" } telcom-parser = { path = "../telcom-parser" }
+13 -6
View File
@@ -3,6 +3,7 @@ use chrono::{DateTime, FixedOffset};
use serde::Serialize; use serde::Serialize;
use crate::{diag::MessagesContainer, gsmtap_parser}; use crate::{diag::MessagesContainer, gsmtap_parser};
use crate::util::RuntimeMetadata;
use super::{ use super::{
imsi_requested::ImsiRequestedAnalyzer, imsi_requested::ImsiRequestedAnalyzer,
@@ -73,6 +74,7 @@ pub struct AnalyzerMetadata {
#[derive(Serialize, Debug)] #[derive(Serialize, Debug)]
pub struct ReportMetadata { pub struct ReportMetadata {
pub analyzers: Vec<AnalyzerMetadata>, pub analyzers: Vec<AnalyzerMetadata>,
pub rayhunter: RuntimeMetadata,
} }
#[derive(Serialize, Debug, Clone)] #[derive(Serialize, Debug, Clone)]
@@ -95,11 +97,9 @@ impl AnalysisRow {
pub fn contains_warnings(&self) -> bool { pub fn contains_warnings(&self) -> bool {
for analysis in &self.analysis { for analysis in &self.analysis {
for maybe_event in &analysis.events { for event in analysis.events.iter().flatten() {
if let Some(event) = maybe_event { if matches!(event.event_type, EventType::QualitativeWarning { .. }) {
if matches!(event.event_type, EventType::QualitativeWarning { .. }) { return true;
return true;
}
} }
} }
} }
@@ -121,7 +121,11 @@ impl Harness {
harness.add_analyzer(Box::new(ImsiRequestedAnalyzer::new())); harness.add_analyzer(Box::new(ImsiRequestedAnalyzer::new()));
harness.add_analyzer(Box::new(ConnectionRedirect2GDowngradeAnalyzer{})); harness.add_analyzer(Box::new(ConnectionRedirect2GDowngradeAnalyzer{}));
harness.add_analyzer(Box::new(LteSib6And7DowngradeAnalyzer{})); harness.add_analyzer(Box::new(LteSib6And7DowngradeAnalyzer{}));
harness.add_analyzer(Box::new(NullCipherAnalyzer{}));
// FIXME: our RRC parser is reporting false positives for this due to an
// upstream hampi bug (https://github.com/ystero-dev/hampi/issues/133).
// once that's fixed, we should regenerate our parser and re-enable this
// harness.add_analyzer(Box::new(NullCipherAnalyzer{}));
harness harness
} }
@@ -205,8 +209,11 @@ impl Harness {
}); });
} }
let rayhunter = RuntimeMetadata::new();
ReportMetadata { ReportMetadata {
analyzers, analyzers,
rayhunter,
} }
} }
} }
@@ -31,7 +31,7 @@ impl Analyzer for ConnectionRedirect2GDowngradeAnalyzer {
match carrier_info { match carrier_info {
RedirectedCarrierInfo::Geran(_carrier_freqs_geran) => Some(Event { RedirectedCarrierInfo::Geran(_carrier_freqs_geran) => Some(Event {
event_type: EventType::QualitativeWarning { severity: Severity::High }, event_type: EventType::QualitativeWarning { severity: Severity::High },
message: format!("Detected 2G downgrade"), message: "Detected 2G downgrade".to_owned(),
}), }),
_ => Some(Event { _ => Some(Event {
event_type: EventType::Informational, event_type: EventType::Informational,
+1 -1
View File
@@ -50,7 +50,7 @@ impl Analyzer for ImsiRequestedAnalyzer {
event_type: EventType::QualitativeWarning { event_type: EventType::QualitativeWarning {
severity: Severity::High severity: Severity::High
}, },
message: format!("NAS IMSI identity request detected"), message: "NAS IMSI identity request detected".to_owned(),
}) })
} }
} }
+10 -10
View File
@@ -29,18 +29,18 @@ impl NullCipherAnalyzer {
} }
// Use map/flatten to dig into a long chain of nested Option types // Use map/flatten to dig into a long chain of nested Option types
let maybe_v1250 = c1.non_critical_extension.as_ref() let maybe_v1250 = c1.non_critical_extension.as_ref()
.map(|v890| v890.non_critical_extension.as_ref()).flatten() .and_then(|v890| v890.non_critical_extension.as_ref())
.map(|v920| v920.non_critical_extension.as_ref()).flatten() .and_then(|v920| v920.non_critical_extension.as_ref())
.map(|v1020| v1020.non_critical_extension.as_ref()).flatten() .and_then(|v1020| v1020.non_critical_extension.as_ref())
.map(|v1130| v1130.non_critical_extension.as_ref()).flatten(); .and_then(|v1130| v1130.non_critical_extension.as_ref());
let Some(v1250) = maybe_v1250 else { let Some(v1250) = maybe_v1250 else {
return false; return false;
}; };
if let Some(SCG_Configuration_r12::Setup(scg_setup)) = v1250.scg_configuration_r12.as_ref() { if let Some(SCG_Configuration_r12::Setup(scg_setup)) = v1250.scg_configuration_r12.as_ref() {
let maybe_cipher = scg_setup.scg_config_part_scg_r12.as_ref() let maybe_cipher = scg_setup.scg_config_part_scg_r12.as_ref()
.map(|scg| scg.mobility_control_info_scg_r12.as_ref()).flatten() .and_then(|scg| scg.mobility_control_info_scg_r12.as_ref())
.map(|mci| mci.ciphering_algorithm_scg_r12.as_ref()).flatten(); .and_then(|mci| mci.ciphering_algorithm_scg_r12.as_ref());
if let Some(cipher) = maybe_cipher { if let Some(cipher) = maybe_cipher {
if cipher.0 == CipheringAlgorithm_r12::EEA0 { if cipher.0 == CipheringAlgorithm_r12::EEA0 {
return true; return true;
@@ -49,10 +49,10 @@ impl NullCipherAnalyzer {
} }
let maybe_v1530_security_config = v1250.non_critical_extension.as_ref() let maybe_v1530_security_config = v1250.non_critical_extension.as_ref()
.map(|v1310| v1310.non_critical_extension.as_ref()).flatten() .and_then(|v1310| v1310.non_critical_extension.as_ref())
.map(|v1430| v1430.non_critical_extension.as_ref()).flatten() .and_then(|v1430| v1430.non_critical_extension.as_ref())
.map(|v1510| v1510.non_critical_extension.as_ref()).flatten() .and_then(|v1510| v1510.non_critical_extension.as_ref())
.map(|v1530| v1530.security_config_ho_v1530.as_ref()).flatten(); .and_then(|v1530| v1530.security_config_ho_v1530.as_ref());
let Some(v1530_security_config) = maybe_v1530_security_config else { let Some(v1530_security_config) = maybe_v1530_security_config else {
return false; return false;
}; };
+1
View File
@@ -7,6 +7,7 @@ pub mod gsmtap;
pub mod gsmtap_parser; pub mod gsmtap_parser;
pub mod pcap; pub mod pcap;
pub mod analysis; pub mod analysis;
pub mod util;
// re-export telcom_parser, since we use its types in our API // re-export telcom_parser, since we use its types in our API
pub use telcom_parser; pub use telcom_parser;
+16 -2
View File
@@ -9,8 +9,9 @@ use chrono::prelude::*;
use deku::prelude::*; use deku::prelude::*;
use pcap_file_tokio::pcapng::blocks::enhanced_packet::EnhancedPacketBlock; use pcap_file_tokio::pcapng::blocks::enhanced_packet::EnhancedPacketBlock;
use pcap_file_tokio::pcapng::blocks::interface_description::InterfaceDescriptionBlock; use pcap_file_tokio::pcapng::blocks::interface_description::InterfaceDescriptionBlock;
use pcap_file_tokio::pcapng::blocks::section_header::{SectionHeaderBlock, SectionHeaderOption};
use pcap_file_tokio::pcapng::PcapNgWriter; use pcap_file_tokio::pcapng::PcapNgWriter;
use pcap_file_tokio::PcapError; use pcap_file_tokio::{Endianness, PcapError};
use thiserror::Error; use thiserror::Error;
#[derive(Error, Debug)] #[derive(Error, Debug)]
@@ -60,7 +61,20 @@ struct UdpHeader {
impl<T> GsmtapPcapWriter<T> where T: AsyncWrite + Unpin + Send { impl<T> GsmtapPcapWriter<T> where T: AsyncWrite + Unpin + Send {
pub async fn new(writer: T) -> Result<Self, GsmtapPcapError> { pub async fn new(writer: T) -> Result<Self, GsmtapPcapError> {
let writer = PcapNgWriter::new(writer).await?; let metadata = crate::util::RuntimeMetadata::new();
let package = format!("{} {}", env!("CARGO_PKG_NAME").to_owned(), metadata.rayhunter_version);
let section = SectionHeaderBlock {
endianness: Endianness::Big,
major_version: 1,
minor_version: 0,
section_length: -1,
options: vec![
SectionHeaderOption::Hardware(Cow::from(metadata.arch)),
SectionHeaderOption::OS(Cow::from(metadata.system_os)),
SectionHeaderOption::UserApplication(Cow::from(package)),
],
};
let writer = PcapNgWriter::with_section_header(writer, section).await?;
Ok(GsmtapPcapWriter { writer, ip_id: 0 }) Ok(GsmtapPcapWriter { writer, ip_id: 0 })
} }
+37
View File
@@ -0,0 +1,37 @@
use nix::sys::utsname::uname;
use serde::Serialize;
/// Expose binary and system information.
#[derive(Serialize, Debug)]
pub struct RuntimeMetadata {
/// The cargo package version from this library's cargo.toml, e.g., "1.2.3".
pub rayhunter_version: String,
/// The operating system `sysname` and optionally `release`. e.g., "Linux 3.18.48" or "linux".
pub system_os: String,
/// The CPU architecture in use. e.g., "armv7l" or "arm".
pub arch: String,
}
impl RuntimeMetadata {
/// Return the binary and system information, attempting to retrieve
/// attributes from `uname(2)` and falling back to values from
/// `std::env::consts`.
pub fn new() -> Self {
match uname() {
Ok(utsname) => RuntimeMetadata {
rayhunter_version: env!("CARGO_PKG_VERSION").to_owned(),
arch: format!("{}", utsname.machine().to_string_lossy()),
system_os: format!(
"{} {}",
utsname.sysname().to_string_lossy(),
utsname.release().to_string_lossy(),
),
},
Err(_) => RuntimeMetadata {
rayhunter_version: env!("CARGO_PKG_VERSION").to_owned(),
arch: std::env::consts::ARCH.to_string(),
system_os: std::env::consts::OS.to_string(),
},
}
}
}
+2 -1
View File
@@ -2,4 +2,5 @@
cargo build --release --target="armv7-unknown-linux-gnueabihf" #--features debug cargo build --release --target="armv7-unknown-linux-gnueabihf" #--features debug
adb shell '/bin/rootshell -c "/etc/init.d/rayhunter_daemon stop"' adb shell '/bin/rootshell -c "/etc/init.d/rayhunter_daemon stop"'
adb push target/armv7-unknown-linux-gnueabihf/release/rayhunter-daemon /data/rayhunter/rayhunter-daemon adb push target/armv7-unknown-linux-gnueabihf/release/rayhunter-daemon /data/rayhunter/rayhunter-daemon
adb shell '/bin/rootshell -c "/etc/init.d/rayhunter_daemon start"' echo "rebooting the device..."
adb shell '/bin/rootshell -c "reboot"'
+1 -1
View File
@@ -1,6 +1,6 @@
[package] [package]
name = "rootshell" name = "rootshell"
version = "0.1.0" version = "0.2.6"
edition = "2021" edition = "2021"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+4 -1
View File
@@ -25,9 +25,12 @@ fn main() {
// discard argv[0] // discard argv[0]
let _ = args.next(); let _ = args.next();
Command::new("/bin/bash") // This call will only return if there is an error
let error = Command::new("/bin/bash")
.args(args) .args(args)
.uid(0) .uid(0)
.gid(0) .gid(0)
.exec(); .exec();
eprintln!("Error running command: {error}");
std::process::exit(1);
} }
+3 -2
View File
@@ -1,9 +1,10 @@
[package] [package]
name = "serial" name = "serial"
version = "0.1.0" version = "0.2.6"
edition = "2021" edition = "2021"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
[dependencies] [dependencies]
rusb = { version = "0.9.3", features = ["vendored"] } nusb = "0.1.13"
tokio = { version = "1.44.1", features = ["macros", "rt", "time"] }
+65 -62
View File
@@ -7,24 +7,14 @@
//! //!
//! No device found - make sure your device is plugged in and turned on. If it is, it's possible you have a device with a different //! No device found - make sure your device is plugged in and turned on. If it is, it's possible you have a device with a different
//! usb id, file a bug with the output of `lsusb` attached. //! usb id, file a bug with the output of `lsusb` attached.
//!
//! # Examples
//! ```
//! match rusb::Context::new() {
//! Ok(mut context) => match open_orbic(&mut context) {
//! Some(mut handle) => {
//! send_command(&mut handle, &args[1])
//! },
//! None => panic!("No Orbic device found"),
//! },
//! Err(e) => panic!("Failed to initialize libusb: {0}", e),
//! ````
use std::str; use std::str;
use std::time::Duration; use std::time::Duration;
use rusb::{Context, DeviceHandle, UsbContext}; use nusb::transfer::{Control, ControlType, Recipient, RequestBuffer};
use nusb::{Device, Interface};
fn main() { #[tokio::main(flavor = "current_thread")]
async fn main() {
let args: Vec<String> = std::env::args().collect(); let args: Vec<String> = std::env::args().collect();
if args.len() != 2 { if args.len() != 2 {
@@ -32,50 +22,58 @@ fn main() {
return; return;
} }
match Context::new() { if args[1] == "--root" {
Ok(mut context) => { enable_command_mode();
if args[1] == "--root" { } else {
enable_command_mode(&mut context); match open_orbic() {
} else { Some(interface) => send_command(interface, &args[1]).await,
match open_orbic(&mut context) { None => panic!("No Orbic device found"),
Some(mut handle) => send_command(&mut handle, &args[1]), }
None => panic!("No Orbic device found"),
}
}
},
Err(e) => panic!("Failed to initialize libusb: {0}", e),
} }
} }
/// Sends an AT command to the usb device over the serial port /// Sends an AT command to the usb device over the serial port
/// ///
/// First establish a USB handle and context by calling `open_orbic(<T>) /// First establish a USB handle and context by calling `open_orbic(<T>)
fn send_command<T: UsbContext>(handle: &mut DeviceHandle<T>, command: &str) { async fn send_command(interface: Interface, command: &str) {
let mut data = String::new(); let mut data = String::new();
data.push_str("\r\n"); data.push_str("\r\n");
data.push_str(command); data.push_str(command);
data.push_str("\r\n"); data.push_str("\r\n");
let timeout = Duration::from_secs(1); let timeout = Duration::from_secs(1);
let mut response = [0; 256];
let enable_serial_port = Control {
control_type: ControlType::Class,
recipient: Recipient::Interface,
request: 0x22,
value: 3,
index: 1,
};
// Set up the serial port appropriately // Set up the serial port appropriately
handle interface
.write_control(0x21, 0x22, 3, 1, &[], timeout) .control_out_blocking(enable_serial_port, &[], timeout)
.expect("Failed to send control request"); .expect("Failed to send control request");
// Send the command // Send the command
handle tokio::time::timeout(timeout, interface.bulk_out(0x2, data.as_bytes().to_vec()))
.write_bulk(0x2, data.as_bytes(), timeout) .await
.expect("Timed out writing command")
.into_result()
.expect("Failed to write command"); .expect("Failed to write command");
// Consume the echoed command // Consume the echoed command
handle tokio::time::timeout(timeout, interface.bulk_in(0x82, RequestBuffer::new(256)))
.read_bulk(0x82, &mut response, timeout) .await
.expect("Timed out reading submitted command")
.into_result()
.expect("Failed to read submitted command"); .expect("Failed to read submitted command");
// Read the actual response // Read the actual response
handle let response = tokio::time::timeout(timeout, interface.bulk_in(0x82, RequestBuffer::new(256)))
.read_bulk(0x82, &mut response, timeout) .await
.expect("Timed out reading response")
.into_result()
.expect("Failed to read response"); .expect("Failed to read response");
// For some reason, on macOS the response buffer gets filled with garbage data that's // For some reason, on macOS the response buffer gets filled with garbage data that's
@@ -91,18 +89,26 @@ fn send_command<T: UsbContext>(handle: &mut DeviceHandle<T>, command: &str) {
/// Send a command to switch the device into generic mode, exposing serial /// Send a command to switch the device into generic mode, exposing serial
/// ///
/// If the device reboots while the command is still executing you may get a pipe error here, not sure what to do about this race condition. /// If the device reboots while the command is still executing you may get a pipe error here, not sure what to do about this race condition.
fn enable_command_mode<T: UsbContext>(context: &mut T) { fn enable_command_mode() {
if open_orbic(context).is_some() { if open_orbic().is_some() {
println!("Device already in command mode. Doing nothing..."); println!("Device already in command mode. Doing nothing...");
return; return;
} }
let timeout = Duration::from_secs(1); let timeout = Duration::from_secs(1);
if let Some(handle) = open_device(context, 0x05c6, 0xf626) {
if let Err(e) = handle.write_control(0x40, 0xa0, 0, 0, &[], timeout) { if let Some(interface) = open_device(0x05c6, 0xf626) {
let enable_command_mode = Control {
control_type: ControlType::Vendor,
recipient: Recipient::Device,
request: 0xa0,
value: 0,
index: 0,
};
if let Err(e) = interface.control_out_blocking(enable_command_mode, &[], timeout) {
// If the device reboots while the command is still executing we // If the device reboots while the command is still executing we
// may get a pipe error here // may get a pipe error here
if e == rusb::Error::Pipe { if e == nusb::transfer::TransferError::Stall {
return; return;
} }
panic!("Failed to send device switch control request: {0}", e) panic!("Failed to send device switch control request: {0}", e)
@@ -113,41 +119,38 @@ fn enable_command_mode<T: UsbContext>(context: &mut T) {
panic!("No Orbic device found"); panic!("No Orbic device found");
} }
/// Get a handle and contet for the orbic device /// Get an Interface for the orbic device
fn open_orbic<T: UsbContext>(context: &mut T) -> Option<DeviceHandle<T>> { fn open_orbic() -> Option<Interface> {
// Device after initial mode switch // Device after initial mode switch
if let Some(mut handle) = open_device(context, 0x05c6, 0xf601) { if let Some(device) = open_device(0x05c6, 0xf601) {
handle.set_auto_detach_kernel_driver(true).expect("set_auto_detach_kernel_driver failed"); let interface = device
handle.claim_interface(1).expect("claim_interface(1) failed"); .detach_and_claim_interface(1) // will reattach drivers on release
return Some(handle); .expect("detach_and_claim_interface(1) failed");
return Some(interface);
} }
// Device with rndis enabled as well // Device with rndis enabled as well
if let Some(mut handle) = open_device(context, 0x05c6, 0xf622) { if let Some(device) = open_device(0x05c6, 0xf622) {
handle.set_auto_detach_kernel_driver(true).expect("set_auto_detach_kernel_driver failed"); let interface = device
handle.claim_interface(1).expect("claim_interface(1) failed"); .detach_and_claim_interface(1) // will reattach drivers on release
return Some(handle); .expect("detach_and_claim_interface(1) failed");
return Some(interface);
} }
None None
} }
/// Generic function to open a USB device /// General function to open a USB device
fn open_device<T: UsbContext>(context: &mut T, vid: u16, pid: u16) -> Option<DeviceHandle<T>> { fn open_device(vid: u16, pid: u16) -> Option<Device> {
let devices = match context.devices() { let devices = match nusb::list_devices() {
Ok(d) => d, Ok(d) => d,
Err(_) => return None, Err(_) => return None,
}; };
for device in devices.iter() { for device in devices {
let device_desc = match device.device_descriptor() { if device.vendor_id() == vid && device.product_id() == pid {
Ok(d) => d,
Err(_) => continue,
};
if device_desc.vendor_id() == vid && device_desc.product_id() == pid {
match device.open() { match device.open() {
Ok(handle) => return Some(handle), Ok(d) => return Some(d),
Err(e) => panic!("device found but failed to open: {}", e), Err(e) => panic!("device found but failed to open: {}", e),
} }
} }
+1 -1
View File
@@ -1,6 +1,6 @@
[package] [package]
name = "telcom-parser" name = "telcom-parser"
version = "0.1.0" version = "0.2.6"
edition = "2021" edition = "2021"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+1
View File
@@ -1,4 +1,5 @@
asn1tools==0.166.0 asn1tools==0.166.0
bitstruct==8.19.0 bitstruct==8.19.0
diskcache==5.6.3 diskcache==5.6.3
pycrate==0.7.8
pyparsing==3.1.2 pyparsing==3.1.2