| 4665 | } |
| 4666 | |
| 4667 | void runProtocolFuzzer(NimBLEAddress target) { |
| 4668 | AutoCleanup cleanup([]() { BLEStateManager::deinitBLE(true); }); |
| 4669 | |
| 4670 | if (!confirmAttack("Fuzz BLE protocol with random data?")) return; |
| 4671 | |
| 4672 | String connectionMethod = ""; |
| 4673 | NimBLEClient *pClient = attemptConnectionWithStrategies(target, connectionMethod); |
| 4674 | if (!pClient) { |
| 4675 | showAttackResult(false, "Failed to connect"); |
| 4676 | return; |
| 4677 | } |
| 4678 | |
| 4679 | BLEStateManager::registerClient(pClient); |
| 4680 | showAttackProgress("Connected! Fuzzing protocol...", TFT_GREEN); |
| 4681 | |
| 4682 | NimBLERemoteService *pService = pClient->getService(NimBLEUUID((uint16_t)0xFE2C)); |
| 4683 | if (!pService) { |
| 4684 | showAttackResult(false, "No FastPair service found"); |
| 4685 | pClient->disconnect(); |
| 4686 | BLEStateManager::unregisterClient(pClient); |
| 4687 | NimBLEDevice::deleteClient(pClient); |
| 4688 | return; |
| 4689 | } |
| 4690 | |
| 4691 | NimBLERemoteCharacteristic *pChar = nullptr; |
| 4692 | const std::vector<NimBLERemoteCharacteristic *> &chars = pService->getCharacteristics(true); |
| 4693 | for (auto &ch : chars) { |
| 4694 | if (ch->canWrite()) { |
| 4695 | pChar = ch; |
| 4696 | break; |
| 4697 | } |
| 4698 | } |
| 4699 | |
| 4700 | if (!pChar) { |
| 4701 | showAttackResult(false, "No writable characteristic"); |
| 4702 | pClient->disconnect(); |
| 4703 | BLEStateManager::unregisterClient(pClient); |
| 4704 | NimBLEDevice::deleteClient(pClient); |
| 4705 | return; |
| 4706 | } |
| 4707 | |
| 4708 | bool anySent = false; |
| 4709 | for (int i = 0; i < 10; i++) { |
| 4710 | uint8_t fuzzPacket[64]; |
| 4711 | switch (i % 4) { |
| 4712 | case 0: memset(fuzzPacket, 0xFF, sizeof(fuzzPacket)); break; |
| 4713 | case 1: memset(fuzzPacket, 0x00, sizeof(fuzzPacket)); break; |
| 4714 | case 2: |
| 4715 | for (int j = 0; j < sizeof(fuzzPacket); j++) fuzzPacket[j] = random(256); |
| 4716 | break; |
| 4717 | case 3: |
| 4718 | fuzzPacket[0] = 0x00; |
| 4719 | memset(&fuzzPacket[1], 0x41, sizeof(fuzzPacket) - 1); |
| 4720 | break; |
| 4721 | } |
| 4722 | bool sent = pChar->writeValue(fuzzPacket, sizeof(fuzzPacket), true); |
| 4723 | if (sent) anySent = true; |
| 4724 | delay(100); |
no test coverage detected