Rapid Radio Reversing

### Overview In this presentation at Troopers, Mike Ossmann discusses practical methodologies for rapidly reverse engineering low-speed digital radio control and communication systems. Ossmann emphasizes that while standardized protocols like Wi-Fi generally implement security mechanisms, low-speed proprietary wireless links used in consumer or industrial hardware typically have no security features at all. While Software-Defined Radio (SDR) is a versatile tool for analyzing the physical (PHY) layer, working up the protocol stack to parse packets and the MAC layer can be slow and steepen the learning curve. To overcome these limitations, Ossmann advocates for a hybrid methodology combining SDR tools for initial signal reconnaissance with non-SDR transceiver IC platforms to rapidly dissect packets and extract protocol structures.

### Key Topics - **Hybrid Reversing Methodology:** Leveraging the complementary strengths of SDR platforms (e.g., HackRF One) for physical-layer analysis and dedicated RF transceiver ICs (e.g., Yardstick One with RF Cat) for packet decoding and MAC-layer reverse engineering. - **Signal Reconnaissance:** Utilizing regulatory FCC filing databases (via fcc.io) to obtain authorized operating frequencies (such as 315 MHz) and equipment details before intercepting transmissions. - **Physical Layer Analysis:** Capturing raw RF using SDR tools such as osmocom_fft and Inspectrum to determine center frequency, modulation type (Amplitude Shift Keying / On-Off Keying), pulse timings, and symbol rate. - **Transceiver IC Configuration & Packet Decoding:** Programming integrated radio chips (Texas Instruments CC1111) via the RF Cat Python shell to overcome non-standard preambles, set synchronization words, filter out misaligned frames, and decode pulse-width-modulated (PWM) data down to logical bits. - **Case Study Target:** Demonstrating the workflow against the "Stealth Lock," a commercial radio-controlled cabinet lock marketed for securing personal documents.

### Technical Details Ossmann demonstrates the entire workflow against the Stealth Lock remote control: 1. **FCC Lookup & Spectrum Observation:** Searching the device FCC ID on fcc.io identified an authorized frequency of 315 MHz. Using HackRF One and `osmocom_fft`, the actual transmission was observed slightly below 315 MHz. Capturing the transmission at 2 MSPS and opening it in Inspectrum revealed an On-Off Keying (OOK) signal composed of continuous wave pulses. 2. **Timing & Modulation Characterization:** Inspectrum revealed distinct short and long pulses repeating on consistent intervals. A short pulse occupied one-third of the symbol period (high-low-low, representing binary `100`), while a long pulse occupied two-thirds (high-high-low, representing `110`). The effective baud rate for these time units was 2450 bps. 3. **Yardstick One / RF Cat Setup:** Ossmann configured the CC1111 radio on a Yardstick One to OOK/ASK modulation (`d.mod_ask_ook()`) and set the modem rate to 2450 bps. Because the target’s preamble used repeated long pulses (`110110...`) rather than alternating `1010...`, the hardware preamble quality threshold was disabled (`pq_thresh = 0`). A custom sync word (`0x06DB`) corresponding to the binary pattern was set. 4. **Packet Demodulation:** By inspecting captured repetitive sequences, packet length was constrained to 30 bytes. A short Python validation function filtered out corrupted or unaligned packets caused by short sync-word correlation. 5. **PWM Decoding & Protocol Extraction:** By discarding redundant high/low framing bits and keeping only the middle bit of each 3-bit pulse unit, the data was compressed into hexadecimal. The resulting structure revealed a preamble, a 4-digit PIN encoded in 4-bit nibbles, a lock/unlock command byte (1 or 2), and a simple single-byte additive/subtractive checksum.

### Takeaways - **Efficiency through Combined Tooling:** Using SDR for PHY layer analysis (frequency, modulation, baud rate) followed by a radio transceiver IC for packet processing significantly speeds up reverse engineering. - **Lack of Link Security:** Proprietary RF devices frequently rely on security through obscurity, using repeated unencrypted packets without rolling codes or forward error correction. - **Attack Feasibility:** Once the packet format and simple checksum are reverse-engineered, creating replay attacks or automated brute-force attacks against 4-digit PINs requires only a few lines of Python script.