/* * aaplfwdump - pretends to be keyboard to acquire firmware * * version 1.0 * * tested at least once with A1255 and Apple Keyboard Update 1.0 * * Copyright (C) 2009-2010 Michael Ossmann * Copyright (C) 2003-2009 Marcel Holtmann * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ #include #include #include #include #include #include #include #include #define L2CAP_PSM_FIRMWARE 62221 #define BUFLEN 65536 static bdaddr_t bdaddr_a; // remote HID host static bdaddr_t bdaddr_b; // local interface that connects (as device) to host static const char* FD_NAMES[] = { "FW out", "FW in" }; /* copied from BlueZ's hidd.c */ static int l2cap_connect(bdaddr_t *src, bdaddr_t *dst, unsigned short psm) { struct sockaddr_l2 addr; struct l2cap_options opts; int sk; if ((sk = socket(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP)) < 0) return -1; memset(&addr, 0, sizeof(addr)); addr.l2_family = AF_BLUETOOTH; bacpy(&addr.l2_bdaddr, src); if (bind(sk, (struct sockaddr *) &addr, sizeof(addr)) < 0) { close(sk); return -1; } memset(&opts, 0, sizeof(opts)); //opts.imtu = 185; //opts.omtu = 32767; opts.omtu = 185; opts.imtu = 32767; opts.flush_to = 0xffff; setsockopt(sk, SOL_L2CAP, L2CAP_OPTIONS, &opts, sizeof(opts)); memset(&addr, 0, sizeof(addr)); addr.l2_family = AF_BLUETOOTH; bacpy(&addr.l2_bdaddr, dst); addr.l2_psm = htobs(psm); if (connect(sk, (struct sockaddr *) &addr, sizeof(addr)) < 0) { close(sk); return -1; } return sk; } /* copied from BlueZ's hidd.c */ static int l2cap_listen(const bdaddr_t *bdaddr, unsigned short psm, int lm, int backlog) { struct sockaddr_l2 addr; struct l2cap_options opts; int sk; if ((sk = socket(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP)) < 0) return -1; memset(&addr, 0, sizeof(addr)); addr.l2_family = AF_BLUETOOTH; bacpy(&addr.l2_bdaddr, bdaddr); addr.l2_psm = htobs(psm); if (bind(sk, (struct sockaddr *) &addr, sizeof(addr)) < 0) { close(sk); return -1; } //setsockopt(sk, SOL_L2CAP, L2CAP_LM, &lm, sizeof(lm)); memset(&opts, 0, sizeof(opts)); //opts.imtu = 32767; //opts.omtu = 185; opts.omtu = 32767; opts.imtu = 185; opts.flush_to = 0xffff; setsockopt(sk, SOL_L2CAP, L2CAP_OPTIONS, &opts, sizeof(opts)); if (listen(sk, backlog) < 0) { close(sk); return -1; } return sk; } /* copied from BlueZ's hidd.c */ static int l2cap_accept(int sk, bdaddr_t *bdaddr) { struct sockaddr_l2 addr; socklen_t addrlen; int nsk; memset(&addr, 0, sizeof(addr)); addrlen = sizeof(addr); if ((nsk = accept(sk, (struct sockaddr *) &addr, &addrlen)) < 0) return -1; if (bdaddr) bacpy(bdaddr, &addr.l2_bdaddr); return nsk; } static void fwdump() { struct sockaddr_l2 addr; socklen_t optlen; unsigned char *buf; char local[18]; char remote[18]; int i, j; int ask_listener = -1; // socket to a (host) int ask = -1; // socket to a (host) struct pollfd pf[1]; buf = malloc(BUFLEN); if (!buf) { perror("can't allocate buffer"); exit(1); } printf("waiting for FW connection from host\n"); while (ask_listener < 0) { ask_listener = l2cap_listen(&bdaddr_b, L2CAP_PSM_FIRMWARE, 0, 10); if (ask_listener < 0) { perror("listen failed"); sleep(1); } } while (ask < 0) { ask = l2cap_accept(ask_listener, NULL); if (ask < 0) { perror("accept failed"); sleep(1); } printf("accepted\n"); } pf[0].fd = ask; pf[0].events = POLLIN | POLLERR | POLLHUP | POLLNVAL | POLLPRI; while (1) { ssize_t len; int numrdy; int k; numrdy = poll(pf, 1, -1); if (numrdy < 0) { perror("poll failed"); goto error; } if (pf[0].revents & (POLLIN | POLLPRI)) { /* receive data */ len = recv(ask, buf, BUFLEN, 0); if (len < 0) { perror("recv failed"); goto error; } else if (len == 0) { printf("disconnected\n"); goto error; } /* print to screen */ printf("%-7s:", FD_NAMES[0]); for (j = 0; j < len; j++) printf(" %02x", buf[j]); printf("\n"); if (buf[0] == 0xd1) { printf("FW in : d2 00\n"); buf[0] = 0xd2; buf[1] = 0x00; len = 2; } else if (buf[0] == 0xd4) { printf("FW in : d5 00\n"); buf[0] = 0xd5; buf[1] = 0x00; len = 2; } else if (buf[0] == 0xd6) { printf("FW in : d7 00\n"); buf[0] = 0xd7; buf[1] = 0x00; len = 2; //} else if (buf[0] == 0xd8) { // guessing here //printf("FW in : d9 00\n"); //buf[0] = 0xd9; //buf[1] = 0x00; //len = 2; } else if (buf[0] == 0xda) { printf("FW in : db 00\n"); buf[0] = 0xdb; buf[1] = 0x00; len = 2; } else { continue; } /* reply */ if (send(ask, buf, len, 0) <= 0) { perror("send failed"); goto error; } } if (pf[0].revents & (POLLERR | POLLHUP | POLLNVAL)) { printf("event: %x\n", pf[0].revents); goto error; } } error: if (ask >= 0) close(ask); if (ask_listener >= 0) close(ask_listener); free(buf); exit(1); } static void usage(void) { printf("aaplfwdump - pretends to be keyboard to acquire firmware\n"); printf("Usage:\n"); printf("\taaplfwdump -a bdaddr_a -b bdaddr_b\n"); printf("\n\tbdaddr_a is the address of the remote host\n"); printf("\tbdaddr_b is the local interface that connects (as a device) to host\n"); printf("\n\tbdaddr_b may be specified by interface (hciX) or bdaddr\n"); } int main(int argc, char *argv[]) { int opt; int count = 0; while ((opt=getopt(argc,argv,"a:b:")) != EOF) { switch(opt) { case 'a': count++; str2ba(optarg, &bdaddr_a); break; case 'b': count++; if (!strncasecmp(optarg, "hci", 3)) hci_devba(atoi(optarg + 3), &bdaddr_b); else str2ba(optarg, &bdaddr_b); break; default: usage(); exit(1); } } if (count < 2) { usage(); exit(1); } fwdump(); return 0; }