Arduino Hacking Village THOTCON 0x9

Transcription

1 Arduino Hacking Village THOTCON 0x9 Logic Analyzer Lab Use a Logic Analyzer to inspect common embedded system protocols Lab time: 5-20 minutes Overview Embedded systems use a variety of protocols to communicate between different components or different devices. In this lab we use a Logic Analyzer to capture and decode these communication protocols. Lab 1: Serial Communication TTL (transistor to transistor logic) serial communication is very common for configuring and debugging embedded systems. The lab board has an Arduino Nano connected to an NFC card reader. Whenever you swipe an NFC card, the Arduino reads the card and transmits the card data via its serial port. To start, find the Arduino and NFC card reader (labeled RFID-RC522) Step 1: Connections Connect the Logic Analyzer GND lead to the black ground wire Connect the Logic Analyzer Channel 3 Gray wire to the Grey Arduino TX pin wire Connect the Logic Analyzer Channel 2 White wire to the White Arduino RX pin wire Note the physical wires are labeled starting with channel 1, while the software starts with Channel 0. So wire 3 is channel 2 in the application, and so forth. Step 2: Set Up Logic Software Launch Saleae Logic from the desktop 1

2 Click the down arrow next to Start and set the capture for 1MS/s (1 million samples per second) and the duration for 5 seconds Step 3: Capture Data Grab an NFC badge or key tag and be ready to scan it on the RFID-RC522 Reader Click Start Hold the badge over the RFID reader until the capture window stops Step 4: Find the Captured Data Use the scrollbar on the bottom of the Logic Analyzer application window to find transmitted data. Use the wheel on the mouse to zoom in and out. Your results should look like: What you are seeing is the raw data signal, oscillating between High (5 volts) and Low (Ground) 2

3 Step 5: Decode the data On the right, click on the gear next to Analyzers. Add an Async Serial analyzer. Configure the analyzer on Channel 02, and enable Use Autobaud Click Save The screen will show the decoded Serial data above the data signal. 3

4 If you d like, you can export and inspect the full capture by clicking on the gear next to your analyzer and choosing Export as text/csv file 4

5 Arduino Hacking Village THOTCON 0x9 Lab 2: SPI Communication SPI (Serial Peripheral Interface Bus) uses four wires to transmit data between components. SS (or Slave Select or Enable) SCK (or SCL or Clock) MOSI (Master-Out-Slave-In) MISO (Master-In-Slave-Out) The lab board has an Arduino Nano connected to an NFC card reader. Whenever you swipe an NFC card, the NFC reader communicates with the Arduino via SPI. To start, find the Arduino and NFC card reader (labeled RFID-RC522) Step 1: Connections Connect the Logic Analyzer GND lead to the black ground wire Connect the four wires coming off the RFID-RC522 board (Purple, Blue, Green, Yellow) to the same colors on the logic analyzer o Purple Channel 4 o Blue Channel 5 o Green Channel 6 o Yellow Channel 7 Step 2: Capture Data Capture Data. The output should resemble the following Notice the Arduino and the RFID board are always communicating, even when there is not a key tag present. Step 3: Decode the data On the right, click on the gear next to Analyzers. Add an SPI analyzer. 5

6 Configure the analyzer as follows Click save and view the data Try multiple captures, including captures where you swipe a keytag on the RFID-RC522 reader to see how the capture changes. 6

7 Arduino Hacking Village THOTCON 0x9 Lab 3: I2C Communication I2C is a serial communication protocol that uses two wires. SDA (Serial Data SCL (Serial Clock) The clock signal is always controlled by the Master end of the communication, but both ends transmit data over the SDA data line. The lab board has an RFID lock reader that stores badge codes and other configurations on a serial EEPROM chip. The processor on the RFID reader uses I2C to talk to the EEPROM memory chip. We will intercept this communication. This Lab uses the RFID Lock: Step 1: Set Up I2C requires at least 2MS/s (2 million samples per second), so click the down arrow next to Start and change your settings to the following. Step 2: Connections Connect the Logic Analyzer GND lead to the black ground wire Connect the RFID lock to the logic analyzer as follows: o Blue to Blue Channel 5 wire o Green to Green Channel 6 wire 7

8 Step 3: Capture Data Capture Data, the signals should resemble the following Step 4: Decode the data On the right, click on the gear next to Analyzers. Add an I2C analyzer as follows View the result 8

9 Arduino Hacking Village THOTCON 0x9 Lab 4: Manchester Encoded RFID tag On the RFID lock, there is a line that feeds the RFID key signal into the processor for decoding. We re going to capture and analyze that signal. This Lab uses the RFID Lock: Step 1: Connections Connect the Logic Analyzer GND lead to the black ground wire Connect the RFID lock to the logic analyzer as follows: o White to White Channel 2 wire o Gray to Gray Channel 3 wire Step 2: Capture Data Scan an RFID Lock keyfob while capturing data. Scroll through the data to the area where the key was scanned, zooming in and out as needed. When the key is scanned you should see a more dense area of data signal, as shown here: Step 3: Decode the data On the right, click on the gear next to Analyzers. Do Show more analyzers and click Manchester 9

10 Configure as follows Your decode should look like: This is a string of 1 s and 0 s. If were to inspect it you d see a repeating sequence of 64 bits, representing the code on the RFID transponder as follows. Here is the breakout for that 64-bit transponder code format in more detail. 10

11 Lab 5: Magnetic Card Reader Magnetic Card Readers such as those seen in gas pumps send a raw data signal to other embedded systems for processing. The reader has a pinout as follows. We can capture and analyze this track1 and track2 data in transit from the reader to other components. Many gas pump skimmers work in this manner by splicing into pump cables. To start, find the magnetic card reader: 11

12 Step 1: Connections Connect the Logic Analyzer GND lead to the black ground wire Connect to the card reader as follows: o Orange to Orange Channel 8 wire Step 2: Capture Data Capture Data. The output should resemble the following You should see two separate data signals that mirror each other, one on the insert and one when you pull out the card. Step 3: Decode the data There is no built-in decoder in the software for magnetic card data. However the data we captured is a representation of the magnetic stripe and could easily be decoded to recover the Track1 card data. 12