API tools faq
paste
Advertisement
Guest User

decode_telt.py

a guest
Dec 10th, 2013
1,202
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 14.38 KB | None | 0 0
raw download clone embed print report
  1. import datetime
  2. from twisted.protocols import portforward
  3. from twisted.internet.protocol import DatagramProtocol
  4. from twisted.internet import reactor
  5. import getopt, sys
  6. import binascii
  7. from random import randint
  8.  
  9.  
  10. lst_full=[]
  11. lst_data=[]
  12. verbose = False
  13. notuntil = 0
  14. request = 0
  15. count = 1
  16. proto = "tcp"
  17. localport = 0
  18. desthost = ""
  19. destport = 0
  20. testclient = 0
  21. testserver = 0
  22. smth_x=0
  23. smth_y=0
  24. x_=20
  25. change=0
  26. pent_c=0
  27. g_count=0
  28. rnd_angle=0
  29. rnd_coord=0
  30. pent = [[600056480,303452580],[598401910,304894530],[599464550,301303380],[599478320,305629240],[598401910,301990020]]
  31. overflowstrings = ["A" * 255, "A" * 256, "A" * 257, "A" * 420, "A" * 511, "A" * 512, "A" * 1023, "A" * 1024, "A" * 2047, "A" * 2048, "A" * 4096, "A" * 4097, "A" * 5000, "A" * 10000, "A" * 20000, "A" * 32762, "A" * 32763, "A" * 32764, "A" * 32765, "A" * 32766, "A" * 32767, "A" * 32768, "A" * 65534, "A" * 65535, "A" * 65536, "%x" * 1024, "%n" * 1025 , "%s" * 2048, "%s%n%x%d" * 5000, "%s" * 30000, "%s" * 40000, "%.1024d", "%.2048d", "%.4096d", "%.8200d", "%99999999999s", "%99999999999d", "%99999999999x", "%99999999999n", "%99999999999s" * 1000, "%99999999999d" * 1000, "%99999999999x" * 1000, "%99999999999n" * 1000, "%08x" * 100, "%%20s" * 1000,"%%20x" * 1000,"%%20n" * 1000,"%%20d" * 1000, "%#0123456x%08x%x%s%p%n%d%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%#0123456x%%x%%s%%p%%n%%d%%o%%u%%c%%h%%l%%q%%j%%z%%Z%%t%%i%%e%%g%%f%%a%%C%%S%%08x"]
  32.  
  33. def crc16(buff, crc = 0, poly = 0xA001):
  34.     l = len(buff)
  35.     i = 0
  36.     while i < l:
  37.         ch = ord(buff[i])
  38.         uc = 0
  39.         while uc < 8:
  40.             if (crc & 1) ^ (ch & 1):
  41.                 crc = (crc >> 1) ^ poly
  42.             else:
  43.                 crc >>= 1
  44.             ch >>= 1
  45.             uc += 1
  46.         i += 1
  47.     return crc
  48.  
  49. def zero_fill(str, count):
  50.     tmp=len(str)
  51.     i=0
  52.     while i<count-tmp:
  53.         str="0"+str
  54.         i=i+1
  55.     return str
  56.  
  57. def bitflipping(data):
  58.     l = len(data)
  59.     n = int(l*7/100)
  60.  
  61.     for i in range(0,n):
  62.         r = randint(0,l-1)
  63.         data = data[0:r] + chr(randint(0,255)) + data[r+1:]
  64.     return data
  65.  
  66. def bofinjection(data):
  67.     l = len(data)
  68.     r = randint(0,len(overflowstrings)-1)
  69.     data = data[0:r] + overflowstrings[r] + data[r-l:]
  70.     return data
  71.  
  72. def fuzz(data):
  73.     print "Fuzz ON"
  74.     r = randint(0,0)
  75.     if r==0:
  76.         data = bitflipping(data)
  77.  
  78.     r = randint(0,0)
  79.     if r==1:
  80.         data = bofinjection(data)
  81.     return data
  82. def add_hex2(hex1, hex2):
  83.     return hex(int(hex1, 16) + int(hex2, 16))
  84.  
  85. def lst_print_data(lst): ##print only data
  86.     all=[]
  87.     str=""
  88.     all.append(lst[2])
  89.     all.append(lst[3])
  90.     for x in lst[4]:
  91.         all.append(x[0])
  92.         all.append(x[1])
  93.         all.append(x[2])
  94.         all.append(x[3])
  95.         all.append(x[4])
  96.         all.append(x[5])
  97.         all.append(x[6])
  98.         all.append(x[7])
  99.         for y in x[8]:
  100.             all.extend(y)
  101.     all.append(lst[5])
  102.     for z in all:
  103.         str=str+z
  104.     return str
  105.  
  106. def lst_print(lst): ##print all packet
  107.     all=[]
  108.     str=""
  109.     all.append(lst[0])
  110.     all.append(lst[1])
  111.     all.append(lst[2])
  112.     all.append(lst[3])
  113.     for x in lst[4]:
  114.         all.append(x[0])
  115.         all.append(x[1])
  116.         all.append(x[2])
  117.         all.append(x[3])
  118.         all.append(x[4])
  119.         all.append(x[5])
  120.         all.append(x[6])
  121.         all.append(x[7])
  122.         for y in x[8]:
  123.             all.extend(y)
  124.     all.append(lst[5])
  125.     all.append(lst[6])
  126.     for z in all:
  127.         str=str+z
  128.     return str
  129.  
  130. def parce_imei(case2):
  131.     global count
  132.     count=0
  133.     lst_imei=[]
  134.     lst_imei.append(case2[:4]) ##[0] - imei size
  135.     lst_imei.append(case2[4:]) ##[1]- imei
  136.     print "===Hello IMEI: "+ lst_imei[1].decode("hex")+"==="
  137.  
  138. def parce_data(case):
  139.     global x_
  140.     global change
  141.     global pent_c
  142.     change=0
  143.     y_=0
  144.     lst_avl=[]
  145.     lst_io_full=[]
  146.     lst_io_1b=[]
  147.     lst_io_2b=[]
  148.     lst_io_4b=[]
  149.     lst_io_8b=[]
  150.     lst_avl.append(case[x_:x_+16])    ## [2][i][0] - timestamp
  151.     lst_avl.append(case[x_+16:x_+18]) ## [2][i][1] - Priority
  152.     lst_avl.append(case[x_+18:x_+26]) ## [2][i][2]- long
  153.     lst_avl.append(case[x_+26:x_+34]) ## [2][i][3]- lat
  154.     lst_avl.append(case[x_+34:x_+38]) ## [2][i][4]- Alt
  155.     lst_avl.append(case[x_+38:x_+42]) ## [2][i][5]- Angle
  156.     lst_avl.append(case[x_+42:x_+44]) ## [2][i][6]- Satellites
  157.     lst_avl.append(case[x_+44:x_+48]) ## [2][i][7]- Speed
  158.     ##io##
  159.     lst_io_full.append(case[x_+48:x_+50]) ## [2][i][8][0]- Event IO ID
  160.     lst_io_full.append(case[x_+50:x_+52]) ## [2][i][8][1] - N of Total IO
  161.     l1b_x=x_+52
  162.     l1b_y=x_+54
  163.     ################
  164.     lst_io_full.append(case[l1b_x:l1b_y]) ## [2][i][8][2] - N1 of One Byte IO
  165.     io_1b=int('0x'+lst_io_full[2],16)
  166.     l2b_x=l1b_x+2+io_1b*4
  167.     l2b_y=l1b_y+2+io_1b*4
  168.     lst_io_full.append(lst_io_1b) ## [2][i][8][3] - List of 1b IO
  169.     lst_io_full.append(case[l2b_x:l2b_y]) ## [2][i][8][4] - N2 of Two Byte IO
  170.     io_2b=int('0x'+lst_io_full[4],16)
  171.     l4b_x=l2b_x+2+io_2b*6
  172.     l4b_y=l2b_y+2+io_2b*6
  173.     lst_io_full.append(lst_io_2b) ## [2][i][8][5] - List of 2b IO
  174.     lst_io_full.append(case[l4b_x:l4b_y]) ## [2][i][8][6] - N4 of Four Byte IO
  175.     io_4b=int('0x'+lst_io_full[6],16)
  176.     l8b_x=l4b_x+2+io_4b*10
  177.     l8b_y=l4b_y+2+io_4b*10
  178.     lst_io_full.append(lst_io_4b) ## [2][i][8][7] - List of 4b IO
  179.     lst_io_full.append(case[l8b_x:l8b_y]) ## [2][i][8][8] - N8 of Eight Byte IO
  180.     io_8b=int('0x'+lst_io_full[8],16)
  181.     lst_io_full.append(lst_io_8b) ## [2][i][8][9] - List of 8b IO
  182.     ################
  183.     dt = datetime.datetime.fromtimestamp(float(str(int('0x'+lst_avl[0],16))[:10])).strftime('%Y-%m-%d %H:%M:%S')
  184.     print "\tTimeStamp: " + lst_avl[0] + " ("+ dt +")"
  185.     print "\tPriority: " + lst_avl[1]
  186.     print "\tGPS Element:"
  187.     lat = float(int('0x'+lst_avl[2],16))/10000000
  188.     print "\t\tLatitude: " + lst_avl[2] + " (" + str(lat) +" E)"
  189.     lon = float(int('0x'+lst_avl[3],16))/10000000
  190.     print "\t\tLatitude: " + lst_avl[3] + " (" + str(lon) +" N)"
  191.     ##change coord
  192.     if rnd_coord:
  193.         #pentagramm
  194.         lst_avl[2]=hex(pent[pent_c][1]).replace('0x','')
  195.         lst_avl[3]=hex(pent[pent_c][0]).replace('0x','')
  196.         #change lat and long (+64)
  197.        # lst_avl[2]=add_hex2('0x'+lst_avl[2],'0x'+str(64*g_count)).replace('0x','')
  198.        # lst_avl[3]=add_hex2('0x'+lst_avl[3],'0x'+str(64*g_count)).replace('0x','')
  199.         lat = float(int('0x'+lst_avl[2],16))/10000000
  200.         print "\t\t--->New Latitude: " + lst_avl[2] + " (" + str(lat) +" E)"
  201.         lon = float(int('0x'+lst_avl[3],16))/10000000
  202.         print "\t\t--->New Latitude: " + lst_avl[3] + " (" + str(lon) +" N)"
  203.         pent_c=pent_c+1
  204.         if pent_c==len(pent):
  205.             pent_c=0
  206.         change=1
  207.     alt =int('0x'+lst_avl[4],16)
  208.     print "\t\tAltitude: "+ lst_avl[4] + " (" + str(alt) +" meters)"
  209.     ang =int('0x'+lst_avl[5],16)
  210.     print "\t\tAngle: "+ lst_avl[5] + " (" + str(ang) +")"
  211.     ##change angle
  212.     if rnd_angle:
  213.          lst_avl[5]=zero_fill(hex(randint(200,300)).replace('0x',''),4)
  214.          ang =int('0x'+lst_avl[5],16)
  215.          print "\t\t--->New Angle: "+ lst_avl[5] + " (" + str(ang) +")"
  216.     sat=int('0x'+lst_avl[6],16)
  217.     print "\t\tSattelites: "+ lst_avl[6] + " (" + str(sat) +" visible sattelites)"
  218.     spd=int('0x'+lst_avl[7],16)
  219.     print "\t\tSpeed: "+ lst_avl[7] + " (" + str(spd) +" km/h)"
  220.     ###change speed
  221.     if smth_x>0 and smth_y>0:
  222.         lst_avl[7]=zero_fill(hex(randint(smth_x,smth_y)).replace('0x',''),4)
  223.         spd=int('0x'+lst_avl[7],16)
  224.         print "\t\t--->New Speed: "+ lst_avl[7] + " (" + str(spd) +" km/h)"
  225.         change=1
  226.     print "\tIO Element:"
  227.     io_id=int('0x'+lst_io_full[0],16)
  228.     print "\t\tEvent IO ID: " + lst_io_full[0] + " (" + str(io_id) +")"
  229.     io_total=int('0x'+lst_io_full[1],16)
  230.     print "\t\tTotal ID:" + lst_io_full[1] + " (" + str(io_total) +" IO elements)"
  231.     x_=x_+50 ## THINK!!! it's correct if all IO counters exist when Global counter eq 0
  232.     print "\t\tCount of 1 byte IO: " + lst_io_full[2] + " (" + str(io_1b) +")"
  233.     x_=l1b_y
  234.     for i in range(io_1b):
  235.         lst_io_1b.append(case[l1b_x+2+i*4:l1b_y+2+i*4]) ## [2][i][8][3][i*2] - N'st IO ID
  236.         lst_io_1b.append(case[l1b_x+4+i*4:l1b_y+4+i*4]) ## [2][i][8][3][i*2+1] - N'st IO value
  237.         tmp_io1=int('0x'+lst_io_1b[i*2],16)
  238.         tmp_io2=int('0x'+lst_io_1b[i*2+1],16)
  239.         print "\t\t\tIO ID: " + lst_io_1b[i*2] + " (" + str(tmp_io1)+ ")"
  240.         print "\t\t\t"+str(tmp_io1) + "'st IO value: " + lst_io_1b[i*2+1] + " (" + str(tmp_io2)+ ")"
  241.         y_=l1b_y+4+i*4
  242.         k=i+1
  243.     print "\t\tCount of 2 byte IO: " + lst_io_full[4] + " (" + str(io_2b) +")"
  244.     x_=l2b_y
  245.     for i in range(io_2b):
  246.         lst_io_2b.append(case[l2b_x+2+i*6:l2b_y+2+i*6]) ##[2][i][8][5][i*2] - N'st IO ID
  247.         lst_io_2b.append(case[l2b_x+4+i*6:l2b_y+6+i*6]) ##[2][i][8][5][i*2+1] - N'st IO value
  248.         tmp_io1=int('0x'+lst_io_2b[i*2],16)
  249.         tmp_io2=int('0x'+lst_io_2b[i*2+1],16)
  250.         print "\t\t\tIO ID: " + lst_io_2b[i*2] + " (" + str(tmp_io1)+ ")"
  251.         print "\t\t\t"+str(tmp_io1) + "'st IO value: " + lst_io_2b[i*2+1] + " (" + str(tmp_io2)+ ")"
  252.         y_=l2b_y+6+i*6
  253.     print "\t\tCount of 4 byte IO: " + lst_io_full[6] + " (" + str(io_4b) +")"
  254.     x_=l4b_y
  255.     for i in range(io_4b):
  256.         lst_io_4b.append(case[l4b_x+2+i*10:l4b_y+2+i*10]) ##[2][i][8][7][i*2] - N'st IO ID
  257.         lst_io_4b.append(case[l4b_x+4+i*10:l4b_y+10+i*10]) ##[2][i][8][7][i*2+1] - N'st IO value
  258.         tmp_io1=int('0x'+lst_io_4b[i*2],16)
  259.         tmp_io2=int('0x'+lst_io_4b[i*2+1],16)
  260.         print "\t\t\tIO ID: " + lst_io_4b[i*2] + " (" + str(tmp_io1)+ ")"
  261.         print "\t\t\t"+str(tmp_io1) + "'st IO value: " + lst_io_4b[i*2+1] + " (" + str(tmp_io2)+ ")"
  262.         y_=l4b_y+10+i*10
  263.     print "\t\tCount of 8 byte IO: " + lst_io_full[8] + " (" + str(io_8b) +")"
  264.     x_=l8b_y
  265.     for i in range(io_8b):
  266.         lst_io_8b.append(case[l4b_x+2+i*18:l4b_y+2+i*18]) ##[2][i][8][9][i*2] - N'st IO ID
  267.         lst_io_8b.append(case[l4b_x+4+i*18:l4b_y+18+i*18]) ##[2][i][8][9][i*2+1] - N'st IO value
  268.         tmp_io1=int('0x'+lst_io_8b[i*2],16)
  269.         tmp_io2=int('0x'+lst_io_8b[i*2+1],16)
  270.         print "\t\t\tIO ID: " + lst_io_8b[i*2] + " (" + str(tmp_io1)+ ")"
  271.         print "\t\t\t"+str(tmp_io1) + "'st IO value: " + lst_io_8b[i*2+1] + " (" + str(tmp_io2)+ ")"
  272.         y_= l4b_y+18+i*18
  273.     if y_>0 and x_<y_:
  274.         x_=y_
  275.     lst_avl.append(lst_io_full)
  276.     lst_data.append(lst_avl)
  277.     print "count:"+str(g_count)
  278.  
  279.  
  280. def parce(case):
  281.     global lst_full
  282.     global lst_data
  283.     global x_
  284.     global change
  285.     global g_count
  286.     x_=20 #data offset
  287.     lst_full=[]
  288.     lst_data=[]
  289.     print("\n==========start parser============")
  290.     lst_full.append(case[:8]) ## [0] - 4 zero bytes
  291.     lst_full.append(case[8:16]) ## [1] - Size of Data
  292.     lst_full.append(case[16:18]) ## [2] - codecID
  293.     lst_full.append(case[18:20]) ## [3] - Number of Data
  294.     lst_full.append(lst_data) ## [4][0] - Data
  295.     lst_full.append(case[-10:-8]) ## [5] - Number of Data2
  296.     lst_full.append(case[-8:]) ## [6] - CRC16
  297.     Dat_S = int('0x'+lst_full[1],16)
  298.     print "Data size: " + lst_full[1]+ " ("+str(Dat_S)+" bytes)"
  299.     print "codecID: " + lst_full[2]
  300.     NoD = int('0x'+lst_full[3],16)
  301.     print "Number of Data: " + lst_full[3] + " ("+str(NoD)+")"
  302.     for i in range(NoD):
  303.         print "Data #" + str(i+1)+":"
  304.         parce_data(case)
  305.     NoD2= int('0x'+lst_full[5],16)
  306.     print "Number of Data2: " + lst_full[5] + " ("+str(NoD2)+")"
  307.     print "CRC16: " + lst_full[6]
  308.     if change==1:
  309.         olo = lst_print_data(lst_full)
  310.         lst_full[6]=zero_fill(hex(crc16(olo.decode("hex"))).replace('0x',''),8)
  311.         print "--->New CRC: "+ lst_full[6]
  312.         change=0
  313.     g_count=g_count+15
  314.     return lst_print(lst_full)
  315.  
  316. def server_dataReceived(self, data):
  317.     global verbose
  318.     global notuntil
  319.     global request
  320.     global count
  321.     global testserver
  322.  
  323.     if testserver:
  324.         if request < notuntil:
  325.             request = request + 1
  326.         else:
  327.             data = fuzz(data)
  328.     if verbose:
  329.         print "Client ------> server"
  330.         print binascii.b2a_hex(data)
  331.         if (count and len(data)<35):
  332.             parce_imei(binascii.b2a_hex(data))
  333.         else:
  334.             print "Start"
  335.             count=1
  336.             data=binascii.a2b_hex(parce(binascii.b2a_hex(data)))
  337.     portforward.Proxy.dataReceived(self, data)
  338.  
  339. portforward.ProxyServer.dataReceived = server_dataReceived
  340.  
  341. def client_dataReceived(self, data):
  342.     global verbose
  343.     global notuntil
  344.     global request
  345.     global testclient
  346.  
  347.     if testclient:
  348.         if request < notuntil:
  349.             request = request + 1
  350.         else:
  351.             data = fuzz(data)
  352.     if verbose:
  353.         print "Server ------> Client"
  354.         print "%r" % data
  355.  
  356.     portforward.Proxy.dataReceived(self, data)
  357.  
  358. portforward.ProxyClient.dataReceived = client_dataReceived
  359.  
  360. def starttcpproxy():
  361.     reactor.listenTCP(localport, portforward.ProxyFactory(desthost, destport))
  362.     reactor.run()
  363.  
  364. def usage():
  365.     #print "###############################################################"
  366.     print "python decode_telt.py -l <localport> -r <remotehost> -p <remoteport> [options]"
  367.     print
  368.     print " [options]"
  369.     print "     -c: Fuzz only client side (both otherwise)"
  370.     print "     -s: Fuzz only server side (both otherwise)"
  371.     print "     -w: Number of requests to send before start fuzzing"
  372.     print "     -v: Verbose (outputs network traffic)"
  373.     print "     -x: Random Speed. From x"
  374.     print "     -y: Random Speed. To y"
  375.     print "     -a: Random angle"
  376.     print "     -k: Pentagram"
  377.     print "     -h: Help page"
  378.  
  379. def main():
  380.     global notuntil
  381.     global proto
  382.     global localport
  383.     global desthost
  384.     global destport
  385.     global testclient
  386.     global testserver
  387.     global verbose
  388.     global smth_x
  389.     global smth_y
  390.     global rnd_angle
  391.     global rnd_coord
  392.     try:
  393.         opts, args = getopt.getopt(sys.argv[1:], "vakhcsl:r:p:w:x:y:", ["help"])
  394.     except getopt.GetoptError:
  395.         usage()
  396.         sys.exit(2)
  397.     try:
  398.         for o, a in opts:
  399.             if o in ("-h", "--help"):
  400.                 usage()
  401.                 sys.exit()
  402.             if o == "-l":
  403.                 localport=int(a)
  404.             if o == "-r":
  405.                 desthost=a
  406.             if o == "-p":
  407.                 destport=int(a)
  408.             if o == "-v":
  409.                 verbose = True
  410.             if o == "-a":
  411.                 rnd_angle = 1
  412.             if o == "-k":
  413.                 rnd_coord = 1
  414.             if o == "-w":
  415.                 notuntil=int(a)
  416.             if o == "-c": # Only client
  417.                 testclient=1
  418.             if o == "-s": # Only server
  419.                 testserver=0
  420.             if o == "-x":
  421.                 smth_x=int(a)
  422.             if o == "-y":
  423.                 smth_y=int(a)
  424.     except:
  425.         usage()
  426.         sys.exit(2)
  427.  
  428.     if localport==0 or desthost=="" or destport==0:
  429.         usage()
  430.         sys.exit(2)
  431.     else:
  432.         if proto=="tcp":
  433.             starttcpproxy()
  434.  
  435. if __name__ == '__main__':
  436.     main()
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!