bitlair/siahsd
8
0
Fork 0
Code Issues Pull requests Activity Actions

Add more Chiron protocol information. Handshake works, though it's hardcoded in proving-correct mode for now.

Browse source
This commit is contained in:
Wilco Baan Hofman 2016-11-28 10:12:19 +01:00
parent 2186300bd2
commit 9d2b9ee61d
2 changed files with 311 additions and 80 deletions
Download patch file Download diff file Expand all files Collapse all files

57
chiron.idl
View file

@ -8,34 +8,31 @@ interface chiron
CHIRON_ACCOUNT = 0x41, /* 'A' */ CHIRON_ACCOUNT = 0x41, /* 'A' */
CHIRON_CHALLENGE = 0x43, /* 'C' */ CHIRON_CHALLENGE = 0x43, /* 'C' */
CHIRON_RESPONSE = 0x52, /* 'R' */ CHIRON_RESPONSE = 0x52, /* 'R' */
CHIRON_KEY = 0x4B, /* 'K' */ CHIRON_HANDSHAKE = 0x4B, /* 'K' */
CHIRON_ACK = 0x55, /* 'U' */ CHIRON_ACK = 0x55, /* 'U' */
CHIRON_HANDSHAKE = 0x48, /* 'H' */ CHIRON_UNKNOWN = 0x48, /* 'H' */
CHIRON_TRANSPARENT = 0x54 /* 'T' */ CHIRON_TRANSPARENT = 0x54 /* 'T' */
} chiron_msg_type; } chiron_msg_type;
typedef [public,enum8bit] enum { typedef [public,enum8bit] enum {
CHIRON_EL_DEVSTATE = 0x0C, CHIRON_EL_DEVSTATE = 0x0C,
CHIRON_EL_DEVICEID = 0x17, CHIRON_EL_UNKNOWN_BOOL1 = 0x16,
CHIRON_EL_UNKNOWN2 = 0x20, CHIRON_EL_DEVICEID1 = 0x17,
CHIRON_EL_UNKNOWN3 = 0x21 CHIRON_EL_DEVICEID2 = 0x18,
CHIRON_EL_MODE_ENABLED = 0x20, /* == 0x13 */
CHIRON_EL_GSM_SETTING_G6 = 0x21,
CHIRON_EL_UNKNOWN_BOOL2 = 0x22,
CHIRON_EL_THREEBYTE_STATUS = 0x26,
CHIRON_EL_GSM_SETTING_G3_G19 = 0x27,
CHIRON_EL_UNKNOWN_BYTE1 = 0x2C,
CHIRON_EL_TROUBLE_MESSAGE1 = 0x2D,
CHIRON_EL_TROUBLE_MESSAGE2 = 0x36,
CHIRON_EL_GSM_SETTING_G4 = 0x40
} chiron_element_tag; } chiron_element_tag;
typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct {
chiron_element_tag el_tag;
uint8 opt_len;
uint8 payload[opt_len];
} chiron_response_element;
typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct {
uint8 mac_octets[3];
// FIXME: TLVs can't be represented in pidl, move to ASN.1 parsing
// chiron_response_element elements[*];
} chiron_msg_inner_response;
typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct { typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct {
uint8 length; uint8 length;
uint8 account_code[4]; uint8 account_code[length];
} chiron_msg_account; } chiron_msg_account;
typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct { typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct {
@ -50,6 +47,16 @@ interface chiron
uint8 payload[length - MD5_HASH_LEN]; uint8 payload[length - MD5_HASH_LEN];
} chiron_msg_response; } chiron_msg_response;
typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct {
uint8 length;
uint8 data[length];
} chiron_msg_handshake;
typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct {
uint8 length; // Always 0
uint8 data[length];
} chiron_msg_ack;
typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct { typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct {
uint8 length; uint8 length;
uint8 data[length]; uint8 data[length];
@ -59,9 +66,23 @@ interface chiron
[case(CHIRON_ACCOUNT)] chiron_msg_account account; [case(CHIRON_ACCOUNT)] chiron_msg_account account;
[case(CHIRON_CHALLENGE)] chiron_msg_challenge challenge; [case(CHIRON_CHALLENGE)] chiron_msg_challenge challenge;
[case(CHIRON_RESPONSE)] chiron_msg_response response; [case(CHIRON_RESPONSE)] chiron_msg_response response;
[case(CHIRON_HANDSHAKE)] chiron_msg_handshake handshake;
[case(CHIRON_ACK)] chiron_msg_ack ack;
[default] chiron_msg_unknown unknown; [default] chiron_msg_unknown unknown;
} chiron_msg_union; } chiron_msg_union;
// Alternative format
typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct {
uint8 something01; // seen only 01
uint8 otherthing01; // seen only 01
uint8 seq;
uint8 someflag; // seen 00 and 01, 01 after the response handshake, and message 0x48 'H' is issued.
uint8 something00; //seen only 00
uint8 length;
chiron_msg_type msg_type;
[switch_is(msg_type)] chiron_msg_union msg;
} chiron_alt_message;
typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct { typedef [public,flag(LIBNDR_FLAG_NOALIGN)] struct {
chiron_msg_type msg_type; chiron_msg_type msg_type;
uint8 seq; uint8 seq;

296
chirond.c
View file

@ -23,11 +23,56 @@
#define CHIRON_PORT "53165" #define CHIRON_PORT "53165"
// Function was licensed WTFPL, origin stack: overflow
// I am too lazy to write this myself, these days.
void hexdump (const char *desc, const void *addr, const int len) {
int i;
unsigned char buff[17];
unsigned char *pc = (unsigned char*)addr;
// Output description if given.
if (desc != NULL)
fprintf(stderr, "%s:\n", desc);
if (len == 0) {
fprintf(stderr, " ZERO LENGTH\n");
return;
}
if (len < 0) {
fprintf(stderr, " NEGATIVE LENGTH: %i\n",len);
return;
}
for (i = 0; i < len; i++) {
if ((i % 16) == 0) {
if (i != 0)
fprintf(stderr, " %s\n", buff);
fprintf(stderr, " %04x ", i);
}
fprintf(stderr, " %02x", pc[i]);
if ((pc[i] < 0x20) || (pc[i] > 0x7e))
buff[i % 16] = '.';
else
buff[i % 16] = pc[i];
buff[(i % 16) + 1] = '\0';
}
while ((i % 16) != 0) {
fprintf(stderr, " ");
i++;
}
fprintf(stderr, " %s\n", buff);
}
struct chiron_context { struct chiron_context {
int clientfd; int clientfd;
struct sockaddr *clientaddr; struct sockaddr *clientaddr;
char *account_code; char *account_code;
char *device_id; char device_id[3];
uint8_t md5_last_out[0x10]; uint8_t md5_last_out[0x10];
uint8_t rc4key[0x10]; uint8_t rc4key[0x10];
}; };
@ -44,21 +89,85 @@ char *ndr_print_chiron_msg_type_enum(TALLOC_CTX *mem_ctx, enum chiron_msg_type m
return ret; return ret;
} }
STATUS handle_chiron_msg_response(struct chiron_context *ctx, struct chiron_message *msg) { struct ll_tlv {
#if 0 // TLV, move to ASN.1 parsing struct ll_tlv *next;
DATA_BLOB crypted, decrypted; enum chiron_msg_type type;
enum ndr_err_code ndr_err; uint8_t length;
struct chiron_msg_inner_response *inner_response; void *data_ptr;
};
STATUS tlv_to_linked_list(TALLOC_CTX *mem_ctx, DATA_BLOB data, struct ll_tlv **first_element) {
uint8_t *tlvptr = data.data;
struct ll_tlv *prev_elem = NULL;
while (tlvptr + 2 < data.data + data.length) {
struct ll_tlv *element = talloc_zero(mem_ctx, struct ll_tlv);
if (prev_elem == NULL) {
*first_element = element;
} else {
prev_elem->next = element;
}
element->type = *tlvptr++;
element->length = *tlvptr++;
if (tlvptr + element->length > data.data + data.length) {
prev_elem->next = NULL;
talloc_free(element);
return ST_PARSE_ERROR;
}
element->data_ptr = tlvptr;
tlvptr += element->length;
prev_elem = element;
}
if (tlvptr < data.data + data.length) {
DEBUG(1, "Error: Left over bytes in TLV");
return ST_PARSE_ERROR;
}
return ST_OK;
}
STATUS handle_chiron_msg_ack(struct chiron_context *ctx, struct chiron_message *msg) {
DEBUG(3, "Received ACK");
return ST_OK;
}
STATUS send_chiron_msg_handshake(struct chiron_context *ctx, struct chiron_message *in) {
struct chiron_message *out = talloc_zero(in, struct chiron_message);
out->msg_type = CHIRON_HANDSHAKE;
out->seq = in->seq;
out->flags = 0xC0; /* FIXME: What does this do? */
const uint8_t payload[] = { 0x27, 0, 0x32, 0, 0x18, 0, 0x2D, 0 };
out->msg.handshake.data = talloc_memdup(out, payload, sizeof(payload));
out->msg.handshake.length = sizeof(payload);
struct arcfour_ctx rc4; struct arcfour_ctx rc4;
char *deviceid_string; arcfour_set_key(&rc4, MD5_HASH_LEN, ctx->rc4key);
arcfour_crypt(&rc4, sizeof(payload), out->msg.handshake.data, payload);
hexdump("Crypted outgoing payload", out->msg.handshake.data, sizeof(payload));
DATA_BLOB raw_out;
enum ndr_err_code ndr_err = ndr_push_struct_blob(&raw_out, out, out, (ndr_push_flags_fn_t)ndr_push_chiron_message);
if (ndr_err != NDR_ERR_SUCCESS) {
DEBUG(0, "Error writing NDR data blob.");
return ST_WRITE_ERROR;
}
write(ctx->clientfd, raw_out.data, raw_out.length);
talloc_free(out);
return ST_OK;
}
STATUS handle_chiron_msg_response(struct chiron_context *ctx, struct chiron_message *msg) {
DATA_BLOB crypted, decrypted;
struct arcfour_ctx rc4;
struct ll_tlv *element;
if (memcmp(msg->msg.response.md5_check, ctx->md5_last_out, 0x10)) { if (memcmp(msg->msg.response.md5_check, ctx->md5_last_out, 0x10)) {
DEBUG(0, "MD5 does not match!\n"); DEBUG(0, "MD5 does not match!\n");
return ST_PARSE_ERROR; return ST_PARSE_ERROR;
} }
DEBUG(0, "Handling the response"); DEBUG(0, "Handling the response");
inner_response = talloc(msg, struct chiron_msg_inner_response);
NO_MEM_RETURN(inner_response);
/* Copy packet to crypted data blob */ /* Copy packet to crypted data blob */
crypted.length = msg->msg.response.length - MD5_HASH_LEN; crypted.length = msg->msg.response.length - MD5_HASH_LEN;
@ -71,22 +180,21 @@ STATUS handle_chiron_msg_response(struct chiron_context *ctx, struct chiron_mess
arcfour_set_key(&rc4, MD5_HASH_LEN, ctx->rc4key); arcfour_set_key(&rc4, MD5_HASH_LEN, ctx->rc4key);
arcfour_crypt(&rc4, crypted.length, decrypted.data, crypted.data); arcfour_crypt(&rc4, crypted.length, decrypted.data, crypted.data);
hexdump("Decrypted", decrypted.data, decrypted.length);
/* Parse the packet */ /* The message starts with 3 bytes device_id, and then the TLV starts */
ndr_err = ndr_pull_struct_blob_all(&decrypted, inner_response, inner_response, (ndr_pull_flags_fn_t)ndr_pull_chiron_msg_inner_response); memcpy(ctx->device_id, decrypted.data, 3);
decrypted.data += 3;
decrypted.length -= 3;
if (ndr_err != NDR_ERR_SUCCESS) { tlv_to_linked_list(msg, decrypted, &element);
DEBUG(0, "Could not parse the inner response"); while (element != NULL) {
return ST_PARSE_ERROR; DEBUG(1, "Type: %x, Length: %d", element->type, element->length);
hexdump("Data", element->data_ptr, element->length);
element = element->next;
} }
DEBUG(0, "%s", ndr_print_struct_string(msg,(ndr_print_fn_t)ndr_print_chiron_msg_inner_response, "chiron payload", inner_response)); send_chiron_msg_handshake(ctx, msg);
deviceid_string = talloc_zero_array(msg, char, inner_response->dev_len + 1);
memcpy(deviceid_string, inner_response->deviceid, inner_response->dev_len);
DEBUG(0, "Remote device: %s", deviceid_string);
#endif
//send_chiron_msg_key
return ST_OK; return ST_OK;
} }
@ -115,6 +223,7 @@ STATUS send_chiron_msg_challenge(struct chiron_context *ctx, struct chiron_messa
out->msg.challenge.md5_check = talloc_array(out, uint8_t, MD5_HASH_LEN); out->msg.challenge.md5_check = talloc_array(out, uint8_t, MD5_HASH_LEN);
NO_MEM_RETURN(out->msg.challenge.md5_check); NO_MEM_RETURN(out->msg.challenge.md5_check);
md5_init(&md5); md5_init(&md5);
md5_update(&md5, in->msg.account.length + 1, md5input); md5_update(&md5, in->msg.account.length + 1, md5input);
md5_digest(&md5, MD5_HASH_LEN, out->msg.challenge.md5_check); md5_digest(&md5, MD5_HASH_LEN, out->msg.challenge.md5_check);
@ -124,6 +233,7 @@ STATUS send_chiron_msg_challenge(struct chiron_context *ctx, struct chiron_messa
out->msg.challenge.length = MD5_HASH_LEN + CHALLENGE_LEN; out->msg.challenge.length = MD5_HASH_LEN + CHALLENGE_LEN;
out->msg.challenge.challenge = talloc_zero_array(out, uint8_t, CHALLENGE_LEN); out->msg.challenge.challenge = talloc_zero_array(out, uint8_t, CHALLENGE_LEN);
NO_MEM_RETURN(out->msg.challenge.challenge); NO_MEM_RETURN(out->msg.challenge.challenge);
#if 0
out->msg.challenge.challenge[0] = 0xd0; out->msg.challenge.challenge[0] = 0xd0;
out->msg.challenge.challenge[1] = 0x8b; out->msg.challenge.challenge[1] = 0x8b;
out->msg.challenge.challenge[2] = 0x29; out->msg.challenge.challenge[2] = 0x29;
@ -133,6 +243,30 @@ STATUS send_chiron_msg_challenge(struct chiron_context *ctx, struct chiron_messa
out->msg.challenge.challenge[6] = 0xb5; out->msg.challenge.challenge[6] = 0xb5;
out->msg.challenge.challenge[7] = 0xc6; out->msg.challenge.challenge[7] = 0xc6;
out->msg.challenge.challenge[8] = 0x1e; out->msg.challenge.challenge[8] = 0x1e;
#endif
//0x04, 0x0d, 0x49, 0xc1, 0x3d, 0xc8, 0x1f, 0x5f, 0x47
#if 0
out->msg.challenge.challenge[0] = 0x04;
out->msg.challenge.challenge[1] = 0x0d;
out->msg.challenge.challenge[2] = 0x49;
out->msg.challenge.challenge[3] = 0xc1;
out->msg.challenge.challenge[4] = 0x3d;
out->msg.challenge.challenge[5] = 0xc8;
out->msg.challenge.challenge[6] = 0x1f;
out->msg.challenge.challenge[7] = 0x5f;
out->msg.challenge.challenge[8] = 0x47;
#endif
// 0x96, 0xf4, 0xc4, 0x86,
// 0xd9, 0x83, 0x4d, 0x87, 0x48
out->msg.challenge.challenge[0] = 0x96;
out->msg.challenge.challenge[1] = 0xf4;
out->msg.challenge.challenge[2] = 0xc4;
out->msg.challenge.challenge[3] = 0x86;
out->msg.challenge.challenge[4] = 0xd9;
out->msg.challenge.challenge[5] = 0x83;
out->msg.challenge.challenge[6] = 0x4d;
out->msg.challenge.challenge[7] = 0x87;
out->msg.challenge.challenge[8] = 0x48;
ndr_err = ndr_push_struct_blob(&raw_out, out, out, (ndr_push_flags_fn_t)ndr_push_chiron_message); ndr_err = ndr_push_struct_blob(&raw_out, out, out, (ndr_push_flags_fn_t)ndr_push_chiron_message);
if (ndr_err != NDR_ERR_SUCCESS) { if (ndr_err != NDR_ERR_SUCCESS) {
@ -140,6 +274,8 @@ STATUS send_chiron_msg_challenge(struct chiron_context *ctx, struct chiron_messa
return ST_WRITE_ERROR; return ST_WRITE_ERROR;
} }
/* Update the md5 check for the next message (last 9 bytes with the seq byte appended). */ /* Update the md5 check for the next message (last 9 bytes with the seq byte appended). */
md5input = talloc_array(in, uint8_t, CHALLENGE_LEN + 1); md5input = talloc_array(in, uint8_t, CHALLENGE_LEN + 1);
NO_MEM_RETURN(md5input); NO_MEM_RETURN(md5input);
@ -147,6 +283,7 @@ STATUS send_chiron_msg_challenge(struct chiron_context *ctx, struct chiron_messa
memcpy(md5input, &raw_out.data[MSG_HDR_LEN + MD5_HASH_LEN], CHALLENGE_LEN); memcpy(md5input, &raw_out.data[MSG_HDR_LEN + MD5_HASH_LEN], CHALLENGE_LEN);
md5input[CHALLENGE_LEN] = in->seq; md5input[CHALLENGE_LEN] = in->seq;
md5_init(&md5); md5_init(&md5);
md5_update(&md5, CHALLENGE_LEN + 1, md5input); md5_update(&md5, CHALLENGE_LEN + 1, md5input);
md5_digest(&md5, MD5_HASH_LEN, ctx->md5_last_out); md5_digest(&md5, MD5_HASH_LEN, ctx->md5_last_out);
@ -179,32 +316,13 @@ STATUS handle_chiron_msg_account(struct chiron_context *ctx, struct chiron_messa
return ST_OK; return ST_OK;
} }
STATUS handle_connection(struct chiron_context *ctx) { STATUS handle_message(struct chiron_context *ctx, DATA_BLOB data) {
int n;
struct chiron_message *msg; struct chiron_message *msg;
enum ndr_err_code ndr_err; enum ndr_err_code ndr_err;
char buf[1024]; /* Purposefully static length */
DATA_BLOB data;
STATUS status; STATUS status;
msg = talloc(data.data, struct chiron_message);
while ((n = read(ctx->clientfd, buf, sizeof(buf)))) {
if (n < 0) {
DEBUG( 0, "Error when storing packet in buffer!");
return ST_PARSE_ERROR;
} else if (n == sizeof(buf)) {
DEBUG(0, "Maximum packet size exceeded!");
return ST_PARSE_ERROR;
}
msg = talloc(ctx, struct chiron_message);
NO_MEM_RETURN(msg); NO_MEM_RETURN(msg);
/* Copy packet to data blob */
data.length = n;
data.data = talloc_memdup(msg, buf, n);
NO_MEM_RETURN(data.data);
/* Parse the packet */ /* Parse the packet */
ndr_err = ndr_pull_struct_blob_all(&data, msg, msg, (ndr_pull_flags_fn_t)ndr_pull_chiron_message); ndr_err = ndr_pull_struct_blob_all(&data, msg, msg, (ndr_pull_flags_fn_t)ndr_pull_chiron_message);
@ -221,6 +339,8 @@ STATUS handle_connection(struct chiron_context *ctx) {
case CHIRON_RESPONSE: case CHIRON_RESPONSE:
status = handle_chiron_msg_response(ctx, msg); status = handle_chiron_msg_response(ctx, msg);
break; break;
case CHIRON_ACK:
status = handle_chiron_msg_ack(ctx, msg);
default: default:
DEBUG(0, "Got unexpected message type: %s.", DEBUG(0, "Got unexpected message type: %s.",
ndr_print_chiron_msg_type_enum(msg, msg->msg_type)); ndr_print_chiron_msg_type_enum(msg, msg->msg_type));
@ -232,6 +352,31 @@ STATUS handle_connection(struct chiron_context *ctx) {
} }
talloc_free(msg); talloc_free(msg);
return ST_OK;
}
STATUS handle_connection(struct chiron_context *ctx) {
int n;
char buf[1024]; /* Purposefully static length */
DATA_BLOB data;
while ((n = read(ctx->clientfd, buf, sizeof(buf)))) {
if (n < 0) {
DEBUG( 0, "Error when storing packet in buffer!");
return ST_PARSE_ERROR;
} else if (n == sizeof(buf)) {
DEBUG(0, "Maximum packet size exceeded!");
return ST_PARSE_ERROR;
}
/* Copy packet to data blob */
data.length = n;
data.data = talloc_memdup(ctx, buf, n);
NO_MEM_RETURN(data.data);
talloc_free(data.data);
} }
return ST_OK; return ST_OK;
} }
@ -246,7 +391,7 @@ static STATUS daemonize(char *pid_file) {
if ((pid = fork())) { if ((pid = fork())) {
/* Write PID file */ /* Write PID file */
pidfile = fopen(pid_file, "w"); pidfile = fopen(pid_file, "w");
if (pidfile < 0) if (pidfile == NULL)
exit(1); exit(1);
fprintf(pidfile, "%d\n", pid); fprintf(pidfile, "%d\n", pid);
@ -354,6 +499,71 @@ int main (int argc, char **argv) {
if (!conf->foreground) { if (!conf->foreground) {
daemonize(conf->pid_file); daemonize(conf->pid_file);
} }
struct chiron_context *client_ctx = talloc_zero(mem_ctx, struct chiron_context);
NO_MEM_RETURN(client_ctx);
client_ctx->clientfd = 1;
client_ctx->clientaddr = (struct sockaddr *)talloc_zero(mem_ctx, struct sockaddr_storage);
#if 0
// Account
const uint8_t in_message1[] = { 0x41, 0x01, 0xa8, 0x04, 0x33, 0x35, 0x30, 0x30 };
// Challenge
const uint8_t out_message1[] = { 0x43, 0x01, 0xa8, 0x19, 0x28, 0xd5, 0xdc, 0x57,
0x44, 0x77, 0x0d, 0xea, 0xc0, 0x03, 0x56, 0xca,
0x42, 0x72, 0x18, 0x30, 0xd0, 0x8b, 0x29, 0xd3,
0x7c, 0xfd, 0xb5, 0xc6, 0x1e };
// Response
const uint8_t in_message2[] = { 0x52, 0x01, 0xa8, 0x37, 0x62, 0x7f, 0xd0, 0xb8, 0xbc, 0x70, 0x6a, 0x44, 0x44, 0x21, 0x15, 0xb4, 0x94, 0x20, 0x62, 0x98, 0x7a, 0xe2, 0xde, 0xc2, 0xed, 0x76, 0x84, 0x5f, 0xe6, 0x16, 0x2b, 0x6b, 0xb9, 0x10, 0xa3, 0x6c, 0x14, 0x44, 0x56, 0xca, 0x45, 0xc6, 0xc2, 0xeb, 0xec, 0x1b, 0xd8, 0x7a, 0xa4, 0x4c, 0xc0, 0xb4, 0x88, 0x64, 0x6e, 0x2b, 0xee, 0x11, 0x54 };
// Handshake
const uint8_t out_message2[] = { 0x4b, 0x01, 0xc0, 0x08, 0x5d, 0x4f, 0x2b, 0xce, 0xf1, 0xde, 0x77, 0xa1 };
// Ack
const uint8_t in_message3[] = { 0x55, 0x01, 0xa8, 0x00 };
#endif
#if 0
const uint8_t in_message1[] = { 0x41, 0x02, 0xa8, 0x04, 0x33, 0x35, 0x30, 0x30 };
const uint8_t out_message1[] = { 0x43, 0x02, 0xa8, 0x19, 0x08, 0x71, 0x4f, 0xad, 0xed, 0xa3, 0xaf, 0x37, 0x88, 0xcc, 0x00, 0x51, 0xe4, 0xcb, 0xad, 0x7c, 0x04, 0x0d, 0x49, 0xc1, 0x3d, 0xc8, 0x1f, 0x5f, 0x47 };
const uint8_t in_message2[] = { 0x52, 0x02, 0xa8, 0x46, 0xc8, 0xa8, 0xb6, 0x50, 0x34, 0xd5, 0x7a, 0x26, 0x90, 0x63, 0x92, 0x56, 0xe5, 0x4d, 0xde, 0xa0, 0x6a, 0x60, 0x19, 0xdc, 0x67, 0xbb, 0xe8, 0x9e, 0x8e, 0xfc, 0x79, 0x55, 0xed, 0x66, 0x26, 0x21, 0x1a, 0x6b, 0x4a, 0x9c, 0x7c, 0xe6, 0x1d, 0x01, 0xab, 0x57, 0xfb, 0xd9, 0x6d, 0x15, 0xbd, 0xe6, 0xe3, 0x94, 0xd6, 0xe7, 0xde, 0xc3, 0x89, 0x52, 0x65, 0x5f, 0x0c, 0x97, 0x4e, 0x4f, 0x6d, 0x9f, 0x5a, 0xb9, 0xc2, 0x12, 0xdd, 0x74 };
const uint8_t out_message2[] = { 0x4b, 0x02, 0xc0, 0x00 };
#endif
const uint8_t in_message1[] = {
0x41, 0x03, 0x88, 0x04, 0x33, 0x35, 0x30, 0x30 };
const uint8_t out_message1[] = {
0x43, 0x03, 0x88, 0x19, 0xaa, 0xd9, 0xaa, 0x5f,
0x30, 0x5d, 0x95, 0x0d, 0x96, 0x8d, 0x4e, 0x26,
0x02, 0x1a, 0x1a, 0xd8, 0x96, 0xf4, 0xc4, 0x86,
0xd9, 0x83, 0x4d, 0x87, 0x48 };
const uint8_t in_message2[] = {
0x52, 0x03, 0x88, 0x1f, 0xe5, 0x65, 0x48, 0x30,
0x56, 0x8e, 0x3b, 0x42, 0x02, 0x6c, 0xcc, 0x9b,
0xdc, 0x82, 0xb0, 0x17, 0xba, 0xef, 0x52, 0x61,
0xe8, 0xce, 0x7b, 0xcb, 0x57, 0x85, 0x2b, 0x18,
0xbf, 0xfa, 0xf1 };
const uint8_t out_message2[] = {
0x4b, 0x03, 0xc0, 0x00 };
DATA_BLOB data;
data.data = talloc_memdup(client_ctx, in_message1, sizeof(in_message1));
data.length = sizeof(in_message1);
handle_message(client_ctx, data);
talloc_free(data.data);
data.data = talloc_memdup(client_ctx, in_message2, sizeof(in_message2));
data.length = sizeof(in_message2);
handle_message(client_ctx, data);
talloc_free(data.data);
struct arcfour_ctx rc4;
arcfour_set_key(&rc4, MD5_HASH_LEN, client_ctx->rc4key);
uint8_t buf[sizeof(out_message2)] = {0};
arcfour_crypt(&rc4, sizeof(out_message2) - 4, buf, out_message2 + 4);
hexdump("Decrypted outgoing payload", buf, sizeof(out_message2) - 4);
return 0;
/* /*
* Open up a TCP socket the Chiron port * Open up a TCP socket the Chiron port