Code Monkey home page Code Monkey logo

urh's Introduction

URH image

CI Code style: black PyPI version Packaging status Blackhat Arsenal 2017 Blackhat Arsenal 2018

The Universal Radio Hacker (URH) is a complete suite for wireless protocol investigation with native support for many common Software Defined Radios. URH allows easy demodulation of signals combined with an automatic detection of modulation parameters making it a breeze to identify the bits and bytes that fly over the air. As data often gets encoded before transmission, URH offers customizable decodings to crack even sophisticated encodings like CC1101 data whitening. When it comes to protocol reverse-engineering, URH is helpful in two ways. You can either manually assign protocol fields and message types or let URH automatically infer protocol fields with a rule-based intelligence. Finally, URH entails a fuzzing component aimed at stateless protocols and a simulation environment for stateful attacks.

Getting started

In order to get started

If you like URH, please โญ this repository and join our Slack channel. We appreciate your support!

Citing URH

We encourage researchers working with URH to cite this WOOT'18 paper or directly use the following BibTeX entry.

URH BibTeX entry for your research paper
@inproceedings {220562,
author = {Johannes Pohl and Andreas Noack},
title = {Universal Radio Hacker: A Suite for Analyzing and Attacking Stateful Wireless Protocols},
booktitle = {12th {USENIX} Workshop on Offensive Technologies ({WOOT} 18)},
year = {2018},
address = {Baltimore, MD},
url = {https://www.usenix.org/conference/woot18/presentation/pohl},
publisher = {{USENIX} Association},
}

Installation

URH runs on Windows, Linux and macOS. See below for OS specific installation instructions.

Windows

On Windows, URH can be installed with its Installer. No further dependencies are required.

If you get an error about missing api-ms-win-crt-runtime-l1-1-0.dll, run Windows Update or directly install KB2999226.

Linux

Installation with pipx

URH is available on PyPi so you can install it, for example, with pipx:

pipx install urh

This is the recommended way to install URH on Linux because it comes with all native extensions precompiled.

In order to access your SDR as non-root user, install the according udev rules. You can find them in the wiki.

Install via Package Manager

URH is included in the repositories of many linux distributions such as Arch Linux, Gentoo, Fedora, openSUSE or NixOS. There is also a package for FreeBSD. If available, simply use your package manager to install URH.

Note: For native support, you must install the according -dev package(s) of your SDR(s) such as hackrf-dev before installing URH.

Docker Images

The official URH docker image is available here. It has all native backends included and ready to operate.

macOS

Using DMG

It is recommended to use at least macOS 12 when using the DMG available here.

With brew

URH is available as a homebrew formula so you can install it with

brew install urh

Running from source (OS-agnostic)

Without installation

To execute the Universal Radio Hacker without installation, just run:

git clone https://github.com/jopohl/urh/
cd urh/src/urh
./main.py

Note, before first usage the C++ extensions will be built.

Installing from source

To install URH from source you need to have python-setuptools installed. You can get them with python3 -m pip install setuptools. Once the setuptools are installed execute:

git clone https://github.com/jopohl/urh/
cd urh
python setup.py install

And start the application by typing urh in a terminal.

Articles

Hacking stuff with URH

General presentations and tutorials on URH

External decodings

See wiki for a list of external decodings provided by our community! Thanks for that!

Screenshots

Get the data out of raw signals

Interpretation phase

Keep an overview even on complex protocols

Analysis phase

Record and send signals

Record

urh's People

Contributors

ad1217 avatar adminiuga avatar andynoack avatar brianclemens avatar chrisvisitgit avatar delta512 avatar dkozel avatar elafargue avatar friedri1970 avatar jirjirjir avatar jopohl avatar jpacov avatar kadamski avatar mnhauke avatar n8henrie avatar nilswint avatar orensbruli avatar randeraad avatar rffontenelle avatar shadowlightning avatar sophiekovalevsky avatar splotz90 avatar tirkarthi avatar yarda avatar zuckschwerdt avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

urh's Issues

signalFunctions cannot be imported

/usr/bin/python-wrapper "/home/ryu/util/Eigene Dateien/Subversion/urh/bin/urh"
Time for generating UI: 1.24 seconds
Using modules from /home/ryu/util/Eigene Dateien/Subversion/urh/src
Traceback (most recent call last):
File "/home/ryu/util/Eigene Dateien/Subversion/urh/bin/urh", line 72, in
os._exit(main(sys.argv)) # sys.exit() is not enough on Windows and will result in crash on exit
File "/home/ryu/util/Eigene Dateien/Subversion/urh/bin/urh", line 32, in main
from urh.controller.MainController import MainController
File "/home/ryu/util/Eigene Dateien/Subversion/urh/src/urh/controller/MainController.py", line 12, in
from urh.controller.CompareFrameController import CompareFrameController
File "/home/ryu/util/Eigene Dateien/Subversion/urh/src/urh/controller/CompareFrameController.py", line 12, in
from urh.controller.OptionsController import OptionsController
File "/home/ryu/util/Eigene Dateien/Subversion/urh/src/urh/controller/OptionsController.py", line 6, in
from urh.controller.PluginController import PluginController
File "/home/ryu/util/Eigene Dateien/Subversion/urh/src/urh/controller/PluginController.py", line 4, in
from urh.models.PluginListModel import PluginListModel
File "/home/ryu/util/Eigene Dateien/Subversion/urh/src/urh/models/PluginListModel.py", line 5, in
from urh.plugins import Plugin
File "/home/ryu/util/Eigene Dateien/Subversion/urh/src/urh/plugins/Plugin.py", line 7, in
from urh.signalprocessing.ProtocolAnalyzer import ProtocolAnalyzer
File "/home/ryu/util/Eigene Dateien/Subversion/urh/src/urh/signalprocessing/ProtocolAnalyzer.py", line 10, in
from urh.cythonext import signalFunctions
ImportError: cannot import name 'signalFunctions'

Improve automatic analysis features

  • Find most probable encoding (based on errors) #72
  • Detect participants based on RSSI #73
  • Detect labels automatically (addresses, length, crc, preamble, sync/constants, values, ...) #77
    • How does this harmonize with auto assigning labelsets?
  • Autodetect different message types (length?, type?, timestamp?)
    • Isn't this the same as auto detecting labelsets? yes.

Configuration of analysis plugin to enable/disable different features. Analysis works in different stages, i.e. without any information (from scratch) and with given information (already labeled, chosen encoding, ...).

Add directory in filetree

/home/ryu/Desktop/Subversion/urh/src/urh/signalprocessing/Signal.py:292: RuntimeWarning: invalid value encountered in greater
qad = self.qad[np.where(self.qad > noise_value)] if noise_value < 0 else self.qad
Traceback (most recent call last):
File "/home/ryu/Desktop/Subversion/urh/src/urh/ui/views/DirectoryTreeView.py", line 45, in contextMenuEvent
self.create_directory()
File "/home/ryu/Desktop/Subversion/urh/src/urh/ui/views/DirectoryTreeView.py", line 19, in create_directory
if not self.model().mkdir(index, dir_name).isValid():
AttributeError: 'FileFilterProxyModel' object has no attribute 'mkdir'

Participant has no deepcopy

Traceback (most recent call last):
File "/home/ryu/Desktop/Subversion/urh/src/urh/ui/views/ProtocolTableView.py", line 214, in contextMenuEvent
self.controller.proto_analyzer, view)
File "/home/ryu/Desktop/Subversion/urh/src/urh/plugins/BlockBreak/BlockBreakPlugin.py", line 34, in get_action
self.command = BlockBreakAction(protocol, max_row, end)
File "/home/ryu/Desktop/Subversion/urh/src/urh/plugins/BlockBreak/BlockBreakAction.py", line 15, in init
self.orig_blocks, self.orig_labels = proto_analyzer.copy_data()
File "/home/ryu/Desktop/Subversion/urh/src/urh/signalprocessing/ProtocolAnalyzer.py", line 497, in copy_data
return copy.deepcopy(self.blocks), copy.deepcopy(self.protocol_labels)
File "/usr/lib/python3.5/copy.py", line 155, in deepcopy
y = copier(x, memo)
File "/usr/lib/python3.5/copy.py", line 219, in _deepcopy_list
y.append(deepcopy(a, memo))
File "/usr/lib/python3.5/copy.py", line 182, in deepcopy
y = _reconstruct(x, rv, 1, memo)
File "/usr/lib/python3.5/copy.py", line 298, in _reconstruct
state = deepcopy(state, memo)
File "/usr/lib/python3.5/copy.py", line 155, in deepcopy
y = copier(x, memo)
File "/usr/lib/python3.5/copy.py", line 244, in _deepcopy_dict
y[deepcopy(key, memo)] = deepcopy(value, memo)
File "/usr/lib/python3.5/copy.py", line 182, in deepcopy
y = _reconstruct(x, rv, 1, memo)
File "/usr/lib/python3.5/copy.py", line 299, in _reconstruct
if hasattr(y, 'setstate'):
RuntimeError: super-class init() of type Participant was never called

Improve "New project" dialog

Add following items:

  • free text field
  • number of communication partners
    • names/addresses of communication partners
  • Link to spectrum analyzer for finding right settings

Add recording wizard

Add protocol features, e.g. sequence number, length and LED on/off, (later labels) that should be reverse engineered.

Guided recording task list:

  • Example for sequence number: record n sequential signals
  • Example for 2 LEDs A and B: Record (A=0, B=0), (A=1, B=0), (A=0, B=1), (A=1, B=1)
  • Create GUI
  • Implement logic
  • Link to recording wizard in "New Project" dialog

Participants in Textview

Short aaaaaabcdef0123456789 [...]

  • Short in bold, background color of the participant for "Short".
  • Textcolor magnitude RGB threshold (=50%) -> black or white
  • Tooltips in signal/text view with participant name

Change label concept from groupwise to blockwise

Why this?

Complex protocols have messages with different lengths, groupwise labels do not fulfill this requirement when there are different message types in a block. Separating such messages to different groups would destroy the time connection, therefore this is not a solution.

Additionally blockwise labels make fuzzing more generic. Match exactly labels can be removed, as blockwise labels replace this feature.

ToDos

  • Default label set
  • Remove match exactly labels
  • Remove label per decoding feature: label stays the same for all decodings
  • Fuzz Dialog Controller: Adapt UI to fuzz per block
  • GUI for choosing/editing labelsets (combobox in analysis)
  • Rightclick-menu: label set (choose) -> sets + Add new, Add label, Remove label, Edit labels (this block, ~current widget)
  • Adapt Save/Load in Project Manager

Assignable protocol participants

Assigning Participants

  • in interpretation protocol blocks can be assigned to participants.
  • in analysis protocol blocks can be assigned to participants.

Marking Participants

Interpretation

  • different text colors(?) --> may look bad, and hard to implement, because HTML Colors will break existing sync functionality, as plain text strings become longer
  • overlays in signal view will not work, because barely visible for small blocks and will conflict with selection area
  • different signal colors --> performance may suffer, but only real choice

Analysis

  • blocks from particular participants can be hidden

Attach decoding to blocks

Labelsets

  • Labelsets usually determine a message type, whereby each message type can have different encodings in practice. Therefore combining decoding and labelsets may be ergonomical.
  • Usability (GUI design) is questionable
  • Decoding will normally chosen before thinking about labels

-> No

Blocks

  • GUI design is simpler than with labelsets
  • When several blocks with different encodings are selected, show "..." element in combobox.
  • When nothing is selected, ask for confirmation whether the encoding of all blocks should be changed. At least for 10+ blocks.

-> Yes

Network interface (Socket) as SDR

  • Add network plugin which can be used as alternative input in sniff dialog
  • network plugin options: socket, target address/port, listening (address/)port, ...
  • network plugin creates new button for send [next to save below table] via TCP in generator.
    • Wait pauses when sending via TCP
  • network plugin creates new device in sending dialog (for sending modulated data via TCP).
  • make encoding enforceable in generator via right click menu

Add filter to analysis

Additionally to search/select all add filter which only shows blocks including the searched value.
GUI (preference is alternative 2):

alternative 1

combobox [search/select all/filter] | search field | go button

alternative 2

search field | combobutton [search/select all/filter]

Show prev/next buttons and current number only if search is active.

Mark FuncubeDongle/RTL-SDR as receive only

  • change gnuradio device recognition: *_recv.py or *_send.py (one of them) suffices
  • add additional flags in device class (supports_sending, supports_receiving)
  • add label in options
  • only show according devices in send/recv dialogs (+ proto sniff dialog)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.