Elvis Wiki - User contributions [en]

Mobile-Security-Framework-MobSF

2023-01-13T16:34:03Z

Bnagl:

[[File:MobSF Logo.png|450px|thumb|right|Mobile-Security-Framework]]
== Summary ==
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The Dynamic Analyzer helps you to perform runtime security assessment and interactive instrumented testing.

== Requirements ==

* Follow the [[Install Mobile-Security-Framework-MobSF]] guide for static analysis.

* Optional: Follow the [[Install Genymotion]] guide for dynamic analysis.

== Description ==

=== Step 1: Open the Webpage ===

http://localhost:8000

[[File:MobSF_startpage.PNG|1200px]]

=== Step 2: Upload Mobile Application ===
Select the upload button. This could take a while, because MobSF will decompile the apk and analyze all the files and dependencies.

=== Step 3: Static Analysis ===
After uploading our Mobile Application the Report will be generated and we can see the resulting information.
On the starting page we can see a general overview about the results:
[[File:modsf_Static_1.png|1200px]]

If MobSF finds CWE's during the code analysis, the results will be shown like this:
[[File:modsf_Static_2.png|1200px]]

MobSF also gives the user the opportunity to compare different apks.

[[File:modsf_Static_3.png|1200px]]

[[File:modsf_Static_4.png|1200px]]

[[File:modsf_Static_5.png|1200px]]

=== Optional Step 4: Dynamic Analysis ===
If the dynamic analysis is started, a emulation of the app will be started and it is possible to monitor the behaviour and possibly load some Java scripts.
[[File:modsf_Dynamic_1.png|1200px]]

[[File:modsf_Dynamic_2.png|1200px]]

[[File:modsf_Dynamic_3.png|1200px]]

[[File:modsf_Dynamic_4.png|1200px]]

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==

[[Category:Documentation]]

Mobile-Security-Framework-MobSF

2023-01-13T13:05:56Z

Bnagl: Added/removed some content.

[[File:MobSF Logo.png|450px|thumb|right|Mobile-Security-Framework]]
== Summary ==
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The Dynamic Analyzer helps you to perform runtime security assessment and interactive instrumented testing.

== Requirements ==

* Follow the [[Install Mobile-Security-Framework-MobSF]] guide for static analysis.

* Optional: Follow the [[Install Genymotion]] guide for dynamic analysis.

== Description ==

=== Step 1: Open the Webpage ===

http://localhost:8000

[[File:MobSF_startpage.PNG|1200px]]

=== Step 2: Upload Mobile Application ===
Select the upload button. This could take a while, because MobSF will decompile the apk and analyze all the files and dependencies.

=== Step 3: Static Analysis ===
After uploading our Mobile Application the Report will be generated and we can see the resulting information.
On the starting page we can see a general overview about the results:
[[File:modsf_Static_1.png|1200px]]

If MobSF finds CWE's during the code analysis, the results will be shown like this:
[[File:modsf_Static_2.png|1200px]]

MobSF also gives the user the opportunity to compare different apks.
[[File:modsf_Static_3.png|1200px]]

[[File:modsf_Static_4.png|1200px]]

[[File:modsf_Static_5.png|1200px]]

=== Optional Step 4: Dynamic Analysis ===
If the dynamic analysis is started, a emulation of the app will be started and it is possible to monitor the behaviour and possibly load some Java scripts.
[[File:modsf_Dynamic_1.png|1200px]]

[[File:modsf_Dynamic_2.png|1200px]]

[[File:modsf_Dynamic_3.png|1200px]]

[[File:modsf_Dynamic_4.png|1200px]]

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* Sichere Softwareentwicklung (IT-Security 22/23)

== References ==

[[Category:Documentation]]

2021-03-10T12:37:29Z

Bnagl: /* Description */ Added Tortle.

== Summary ==
[[File:LANTurtle.jpg |thumb|right|400px||LAN Turtle and Field Guide]]
The LAN turtle is a tool for penetration testers and system administrators disguised as a simple USB Ethernet adapter. It provides possibilities to perform remote access, man-in-the-middle and information gathering attacks. These functions are provided by the turtle modules which are preinstalled on the LAN turtle. The modules are based on the OpenWRT platform which allow users to add customized modules. The turtle itself is covert by a generic USB to Ethernet adapter and can therefore be placed unnoticed in IT infrastructures.

== Description ==

=== Setting up the LAN Turtle ===

# Plug the LAN turtle into one of the USB ports of your computer.
# Your computer will get an 172.16.84.x address as soon as the startup sequence of the turtle finished. If not, then you have to statically configure an IP out of the 172.16.84.0/24 range.
# Connect to the turtle with <code>ssh root@172.16.84.1</code> and enter the password <code>sh3llz</code>
# The simplistic graphical shell interface will prompt you to change the password but the old one is also allowed.
# Then the LAN turtle can be configured and modules can be installed within the interface.
# If you end the interface you will be greeted with an normal Linux shell but you can open it again with the <code>turtle</code> command

=== Updating firmware (optional) ===
To ensure the best performance and compatability you should update the firmware regularly. This requires an internet conneciton.

# Select <code>Config</code> in the Main Menu and press select.
# Go to <code>Check for updates</code> and press select to start the update process.
# Wait till the update finishes.

=== Factory Reset (optional)===
In the extreme case that a LAN Turtle has become permanently inaccessible or inoperative, there is a quick method for recovery using a special web interface.
# Download the latest LAN Turtle factory image from the [https://downloads.hak5.org/ official download center]. Note: Choose the factory recovery image.
# Open the LAN Turtle carefully. There are 2 screws under the sticker.
# Now you need to find the reset button/jumper contact. You can find a video on how to locate [https://www.youtube.com/watch?v=ubNin_79wxE here].
# Hold down the button/jumper while you're plugging the LAN Turtle in your PC and keep holding it for 5 more seconds.
# Go to http://192.168.1.1 for the firmware web recovery tool and upload the image to the LAN Turtle.
# Wait 5-10 minutes for the recovery to finish, the LAN Turtle will indicate it with a special LED blink pattern. Watch the video for the LED Pattern to know when the recovery has finished.

=== Using the turtle modules ===

The LAN turtle comes packed with pre-installed tools. Furthermore it is possible to program your own or download them from the internet and configure them with the module manager as well.

[[File:LANTurtleModules.jpg|400px||LAN Turtle configuration shell interface]]

==== Manually download turtle modules ====
If the module manager doesn't work you need to manually download turtle modules. You can do that in the console of the lan turtle, just exit the main menu.
You can download modules from the [https://github.com/hak5/lanturtle-modules/tree/gh-pages/modules official hak5 github].

# Change directory to <code>/etc/turtle/modules</code>
# Download modules with <code>wget <link></code>
# Make the file an executeable <code>chmod +x <file></code>

==== AutoSSH ====

AutoSSH is a service which provides persistent SSH connections. If an SSH session drops, it will be quickly re-established by AutoSSH. This service is typically used to provide a convenient and persistent reverse shell into the LAN Turtle on the standard SSH port 22 - though it may be configured with any standard SSH parameters to forward any arbitrary port.
*<code>host</code> - The username and hostname (DNS or IP) separated by @ for which to establish the SSH connection.
*<code>port</code> - The port number from which the remote server will bind.
*<code>listen port</code> - The port number to which the remote port will bind.

Example: Per the defaults, the remote server will bind its local port 2222 back to the LAN Turtle port 22. In this scenario one may establish a persistent connection to their LAN Turtle from this reverse shell by first connecting to the public server, and then from there establishing an SSH connection to port 2222.

==== Cron ====
Cron is a job scheduler which can be used to start and stop modules at specific times or regular intervals using the 'start' and 'stop' commands.

==== DNSSpoof ====
DNSSpoof forges replies to arbitrary DNS address / pointer queries on the LAN. This is useful in bypassing hostname-based access controls, or in implementing a variety of man-in-the-middle attacks. For example, the IP address returned for a client lookup of the domain \"example.com\" can be replaced with that of the LAN Turtle itself, or a 3rd party server. In this scenario, the computer connected to the Internet through the LAN Turtle attempting to browse to this domain may be redirected to the spoofed IP.

==== Keymanager ====
With this tool you can create RSA keypairs and copy them to the public server. This is needed when AutoSSH is configured.

==== Meterpreter ====
This module deploys an persistent shell to the Metasploit Framework of an other Machine.

==== Nmap-Scan ====
This module uses <code>nmap</code> for discovering running devices and their port of the current LAN network.

==== OpenVPN ====
OpenVPN enables remote access the LAN Turtle and optionally the network on which it resides. It allows to send the captured data to your operating network.

==== SSHFS====
SSHFS (Secure SHell FileSystem) is a file system for Linux (and other operating systems with a FUSE implementation, such as Mac OS X or FreeBSD) capable of operating on files on a remote computer using just a secure shell login on the remote computer. On the local computer where the SSHFS is mounted, the implementation makes use of the FUSE (Filesystem in Userspace) kernel module. The practical effect of this is that the end user can seamlessly interact with remote files being securely served over SSH just as if they were local files on his/her computer. On the remote computer the SFTP subsystem of SSH is used.

==== URLSnarf ====
URLSnarf allows you to capture which websites were accessed by the plugged in computer. URLSnarf only works with HTTP webpages which are hard to find today.

==== NetCat Reverse Shell ====
The netcat reverse shell provides you with remote access to the lan turtle and thus persistent access to the network.

==== Tortle ====
Tortle makes the turtle act as an TOR Gateway. It enables you to setup several services.

== Use Cases==

The LAN turtle can be deployed in various use cases, which can be divided into three categories:
* remote access attacks with AutoSSH or OpenVPN or NetCat Reverse Shell
* man-in-the-middle attacks with URLSnarf or DNSSpoof
* information gathering with Nmap-Scan

Remote access attacks are used to gain access to a private network from a remote place in order to start further attacks from the inside network. This makes it a lot more easier because the attack itself does not have to bypass a router or firewall. All the attacker needs is the pre-configured LAN turtle inside the network and a remote server on the internet. To perform a remote access, the LAN turtle builds up a tunnel to the remote server so the firewall cannot capture the traffic. Finally the attacker can access the LAN turtle through the tunnel from the remote server. This attack can be performed with the modules AutoSSH or OpenVPN.

The LAN turtle also allows man-in-the-middle attacks, where the turtle can intercept the communication between two parties. To perform such an attack, the LAN turtle must be connected to an USB port of the victim host and to a network cable which connects the host to the internal LAN. Now the whole traffic of the victim host goes over the LAN turtle and can be logged or altered. An attacker can use URLSnarf or DNSSpoof to perform such an attack.

The last use case is information gathering. The aim of this attack is to receive information about the topology, the hosts and the protocols of an internal network in order to perform further attacks. This can be done with the modules like Nmap-Scan.

The following step-by-step instructions will outline how to configure the LAN turtle in order to perform the different types of attacks.

=== Remote access attacks with AutoSSH ===
In this example consider an internal network which is secured by a firewall and a public server in the internet controlled by the attacker.

==== Step 1: Generate RSA keypairs with Keymanager ====
# Open the Keymanager module and select <code>generate_key</code>
# Select <code>copy_key</code> and insert
#* <code>host</code> remote SSH server
#* <code>port</code> remote SSH server port (typically 22)
#* <code>user</code> user on the remote SSH server
#* <code>password</code> password for the user on the remote host

==== Step 2: Configure AutoSSH ====
# Open AutoSSH and insert the following parameters:
#* <code>user@host</code> user and host to establish the SSH tunnel
#* <code>remote port</code> remote port to bind through the SSH tunnel (default 2222)
#* <code>local port</code> local port to bind tunnel (default 22)
# Submit the changes and start AutoSSH (or enable it for autostart)

==== Step 2: Access LAN turtle from remote server ====
# Connect to the remote server
# Connect locally to the remote port of the AutoSSH configuration by <code>ssh root@localhost:2222</code>
# You are now on the LAN turtle, continue with further attacks

=== Remote access attacks with NetCat Reverse Shell ===
==== Step 1: Start NetCat server on your host machine ====
* First you need to setup a netcat connection on your host machine that listens to incoming connections. To start NetCat server execute <code>nc -lvp 4444</code>

==== Step 2: Configure NetCat Reverse Shell ====
# Open the NetCat Reverse Shell module and go to "Configure"
# Enter your host machines ip address and the port of the nc server. In our case 4444.
# Start the module on the LAN Turtle.

==== Step 3: Exploit ====
When the reverse shell connected to your host machine you can execute commands on the lan turtle over the reverse shell.

=== Man-in-the-middle attacks with DNSSpoof ===

==== Step 1: Configure the spoofhost file ====
# Open the DNSSpoof module and go to "Configure"
# Add the DNS entries that the LAN turtle should spoof by entering the IP address and the spoofed DNS name

==== Step 2: Place the LAN turtle in the network ====
After configuring the spoofed hosts, place the LAN turtle on the victim computer by simply plugging the turtle into an USB port of the computer and the network cable into the LAN turtle.

=== Information Gathering with nmap ===
As an example project we use the following modules:
* Cron to periodically start the attack
* SSHFS to save the caputred information in a file on the remote server
* Nmap-Scan to sniff the configuration and devices of the network

==== Step 1: Configure SSHFS ====
# Access the SSHFS module via the module manager
# Go to the configure tab and insert
#* <code>host</code> IP address of the remote server
#* <code>port</code> 22
#* <code>user</code> the username
#* <code>path</code> This can be left blank if you want to use the users home directory
# Start SSHFS and enable it for start up

==== Step 2: nmap-scan ====
# Access the nmap-scan module via the module manager
# Go to the configure tab and insert
#* target: <code>192.168.0.1-255</code> (This may differ for our network)
#* logflie: <code>/sshfs/</code>
#* use the desired attack profile
#* save the configuration with execute

==== Step 3: cron job ====
# add in the con config <code>*/15 * * * * start nmap-scan</code>
This line start an nmap-scan every 15 minutes.

== Used Hardware ==

[[LAN Turtle]]

== References ==

* https://docs.hak5.org/hc/en-us/categories/360000979313-LAN-Turtle

[[Category:Pentesting]]

Hak5 Packet Squirrel

2021-03-09T15:43:12Z

Bnagl: /* References */ added references

== Summary ==
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]

The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts. It's stealthy pocket-size enables it to be placed without notice, this can come in handy for penetration testers. The efficient energy usage makes it possible to power it with a battery pack to run over a week.
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.

== Description ==
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]

The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.

In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.

It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgoing Ethernet interface as well.

==== Basic Cable Setup ====

# Plug the victims Ethernet cable into the "Ethernet In" Port
# Plug the gateway Ethernet cable into the "Ethernet Out" Port
# Power the device by plugging in the power cable

==== Firmware Upgrade ====

Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.

The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.

Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel.

The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blue blinking LED.

Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".

== Payloads ==

=== Logging Network Traffic ===

This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.
Just follow these easy steps:

# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up.
# Flip the first position (which is nearest to the micro USB power in).
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].

After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.

=== DNS Spoofing Mode ===

This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.

# For this mode we have to start in arming mode (switch at fourth position)
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at
# Unplug the Packet Squirrel and shift the switch to the second position.
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.

By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.

=== OpenVPN Mode ===
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]

The VPN payload implements VPN access mode and VPN tunnelling mode.
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org].
# Start by selecting the desired server and download the the OVPN access certificate.
# Set the Packet Squirrel in Arming Mode and connect to its shell
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code>
# Steer to the directory with <code> cd /root/payloads/switch3/</code>
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code>
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:
## <code>freeopenvpn</code>
## <code><the displayed password></code>
# Before starting the VPN we choose the VPN mode:
## Open the <code>payload.sh</code>
## Set the <code>For_Clients=</code> to
### <code>0</code> for Access Mode
### <code>1</code> for Tunneling Mode
# Now set the Switch the the third Position and plug power out and in again
# You are good to go, if the yellow LED starts to flash after the boot up sequence
==== Access Mode ====

Access mode allows the squirrel to access the VPN Network via the Secure Shell
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.
tun0
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)

The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.

==== Tunneling Mode ====

The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].

You can also install an simple openVPN Server on a linux machine with
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code>
and press Enter 6 times.
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position.
=== Meterpreter-via-SSH ===
[[File:Packet squirrel meterpreter ssh.PNG |thumb|right|400px||Packet Squirrel Payload Meterpreter-via-SSH settings]]
This payload starts the Packet Squirrel in NAT mode and waits for user input. When the button is pressed, the payload connects to a remote SSH server and creates a local port tunnel. It then launches a meterpreter shell over the tunnel.
The intent is to hide the meterpreter network traffic behind a legitimate SSH activity.
You can download this payload from the offical [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/remote-access/Meterpreter-via-SSH hak5 github].
==== Getting Started ====
Copy the playload to the Packet Squirrel into the desired switch folder. Now edit the scirpt to configure your server options:
* SSH_USER - username on remote SSH server
* SSH_HOST - ip address of remote SSH Server

'''Note:''' If you changed the default meterpreter port don't forget to change it on the metasploit side as well.
* MSF_PORT

===== Generate SSH Key on Squirrel =====
Now you have to generate an ssh key-pair (just use default location and empty password) on your Packet Squirrel:
root@squirrel:~# ssh-keygen
===== Allow Squirrel on SSH Server =====
Then you have to copy the contents of /root/.ssh/id_rsa.pub from Packet Squirrel to the SSH Server authorized file:

user@server:~# mkdir ~/.ssh
user@server:~# echo 'paste id_rsa.pub contents inside this quote' > ~/.ssh/authorized_keys
===== Run Metasploit with Resource =====
msf@server:~# msfconsole -r server.rc

==== LED Definitions ====
# Configure NETMODE
#* Solid Magenta
# Connect to SSH Server
#* SUCCESS - Blink Amber 5 Times
#* FAIL - Blink Red 2 Times
# Launch meterpreter
#* SUCESS - Blink Cyan 1 Time
#* FAIL - Blink Red 1 Time

==== Hardening Recommendations ====
# Use an accout with limited privileges for SSH acces on the server.
# User a dedicated account for Packet Squirrel device (audit usage with SSH access logs).
# Disable PasswordAuthentication in sshd_config on the server.

=== ISpyintel ===
[[File:Packet squirrel ispyintel.PNG |thumb|right|400px||Packet Squirrel Payload ISpyIntel settings]]
This payload will automate gathering various recon data on whatever passes between it's Ethernet ports. You can download this payload from the [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/sniffing/ispyintel official hak5 github].
'''Note:''' This payload requires a usb stick to store loot.
==== Setup ====
# Edit the config variables at the top. The main variables are:
## <code>lootPath="/mnt/loot/intel" # Path to loot</code>
## <code>mode="TRANSPARENT" # Network mode we want to use</code>
## <code>interface="br-lan" # Interface to listen on</code>
# Copy payload.sh into the ~/payloads/switch folder you wish to deploy on.
# Connect into a target machine with access to the LAN.
# Set switch to the spot and power up.
# Leave, get coffee, take a nap while everything is recorded and parsed for future use.
# When done; hit the button. The LED will rapidly flash white to let you know it is finishing up.
# When all is done the LED will just go blank. It is now safe to unplug and go about your day.

==== Tasks that are started ====
* tcpdump - records every packet that was send and received
* urlsnarf - collects all websites that were visited
* dsniff - attempts to acquire passwords and what not
* ngrep - on ports 80 and 21 with the filter for common password fields
* ngrep - on ports 80 and 21 with the filter for common session id fields
* log.txt - logs the progress of the payload for troubleshooting

==== Clean Up ====
Once the button is pressed the payload will automatically parse the TCPDump log file for the following items and store the results in seperate files.
As this process can take some time the LED will change to a rapid white blink letting you know the button command was recieved and the payload is in the process of shutting down.
* ipv4found.txt Will contain a unique list of all the ipv4 which the pcap file contains
* maybeEmails.txt Is a very loose search for possible email addresses that came across the wire in plain text.

=== Creating your own Payloads ===

The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.
Bash scripts can access the following pre-installed tools:
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget

The featured Squirrel Script offers the following additional commands:

* NETMODE
specifies which network mode Packet Sqirrel uses and how traffic is routed

{| class="wikitable"
|-
! Command !! Description
|-
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel
|-
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address
|-
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel
|-
| NETMODE VPN || same as NAT with VPN interface for client tunneling
|-
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN
|}

* LED
with this command the multi-color LED can be controlled

{| class="wikitable"
|-
! Possible configurations !! Description
|-
| LED Colors || red, green, blue, yellow, cyan, magenta, white
|-
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000
|-
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH
|}

* BUTTON
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed

* SWITCH
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".

==== Example ====
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]

Here is an example for the usage of Squirrel Script.

<syntaxhighlight lang="bash">
# Title: Caternet
# Author: Hak5Darren
# Version: 1.0
# Description: Forwards all traffic to local webserver hosting cat photos.
# Props: In loving memory of Hak5Kerby

LED SETUP
NETMODE NAT
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address
/etc/init.d/dnsmasq restart

LED ATTACK
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53
python -m SimpleHTTPServer 80
</syntaxhighlight>

For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].

== with Cloud C2 ==

The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".

To connect the Packet Squirrel with your C2 Cloud, click on the plus button in the lower right corner and choose the device. On the dashboard, open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it.
In the Overview tab you can also Edit, Reboot, Wipe and Remove your device.

In the Clients tab you can see all clients which were connected to your Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.

== Used Hardware ==

[[Packet Squirrel]]

== References ==

* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2
* https://docs.hak5.org/hc/en-us/articles/360010554613-Ducky-Script-for-Packet-Squirrel
* https://downloads.hak5.org/
* https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library

[[Category:Pentesting]]

2021-03-09T15:22:22Z

Bnagl:

Hak5 Packet Squirrel

2021-03-09T14:34:50Z

Bnagl: /* Meterpreter-via-SSH */ added picture of payload settings

== Summary ==
[[File:Packet Squirrel Connectors.jpg |thumb|right|400px||Packet Squirrel device]]

The Packet Squirrel operates as an Ethernet Man in the Middle and comes preloaded with three exploit scripts. These three attack modes are Logging Network Traffic, Spoofing DNS and OpenVPN Tunnel. These can also be modified and exchanged with other scripts.
The Packet Squirrel can also be combined with the [[Hak5 Cloud C2]], a command and control server specially for Hak5 devices.

== Description ==
[[File:Hak5_Squirrel_version.jpg|thumb|right|400px||SSH connect]]
[[File:Hak5_Squirrel_spoofhost.jpg|thumb|right|400px||spoofhost file]]
[[File:Hak5_Squirrel_browser.jpg|thumb|right|400px||Spoofed browser warning]]

The Packet Squirrel has an switch to choose between the three exploit payloads for logging the TCP dump, Using VPN Tunnelling and for DNS spoofing, or Arming Mode.

In '''Arming Mode''' (switch in 4th position, nearest to the USB port) you can easily access the device with ssh <code>root@172.16.32.1</code> with the password <code>hak5squirrel</code>. Therefore Packet Squirrel acts as DHCP server. If you don't get an IP address, manually configure an IP from the 172.16.32.0/24 network on your ethernet interface. Arming Mode is indicated by a blue blinking LED an allows to configure the different payloads.

It is also possible to gain ssh access to the device during the attack modes with the IP address of the outgiong Ethernet interface as well.

==== Basic Cable Setup ====

# Plug the victims Ethernet cable into the "Ethernet In" Port
# Plug the gateway Ethernet cable into the "Ethernet Out" Port
# Power the device by plugging in the power cable

==== Firmware Upgrade ====

Shiped devices are installed with version 1.0, which can be seen in the VERSION file in the Packet Squirrel root folder. The current version 3.2 can be downloaded from the Hak5 website.

The file has to be named upgrade-version.bin (where version stands for the version number) and copied to the root directory of an NTFS or EXT4 formatted USB drive.

Plug in the USB drive in the Packet Squirrel and set the select switch to Arming Mode. Then power on the Packet Squirrel.

The upgrade process needs 5 minutes and is indicated by a solid red or blue LED light. When the firmware upgrade is finished, Packet Squirrel reboots and goes in Arming Mode. Shown by a blud blinking LED.

Then you can connect again with SSH and verify the new version, shown in Figure "SSH connect".

== Payloads ==

=== Logging Network Traffic ===

This mode creates TCP/UDP dumps and saves them on the USB drive to analyse later on.
Just follow these easy steps:

# A USB Stick with an NTFS file system needs to be plugged in the USB-A Port before the Squirrel is Powered up.
# Flip the first position (which is nearest to the micro USB power in).
# Connect the Ethernet cable of the victim into the Ethernet port, which is at the same side as the power in USB connector and Connect the Gateway Ethernet cable to the other Port.
# Plug the power cable in and wait the one minute long start up sequence. The device can be either powered by the victim machine or by an USB power bank.
# The data traffic will be captured, if the LED starts blinking Yellow. If otherwise the LED circles between red, green and blue, then the USB stick has the wrong file system.
# Stop the capturing process by pressing the Button. Then the device takes some seconds to write the tcpdum to the USB Storage. As soon as the LED glows red the saving process has ended and you are good to go.
# You can now analyse the captured pcap file, located in \loot\tcpdump with [[Wireshark]].

After that, the connection trough the Packet Squirrel is shut down. To allow the client to connect to the network again, Packet Squirrel has to be rebooted.

=== DNS Spoofing Mode ===

This mode spoofs the client with DNS entries to redirect traffic to other IP addresses.

# For this mode we have to start in arming mode (switch at fourth position)
# After gaining access with ssh we change to the DNS spoofing directory with <code>cd /payloads/switch2</code>.
# There we can define the Spoofed domain names by editing the file spoofhost with <code>nano spoofhost</code>.
# In the file add entrys like <code>address=/myspoofdomain.at/194.232.104.140</code> as shown in figure "spoofhost file". The example IP belongs to orf.at
# Unplug the Packet Squirrel and shift the switch to the second position.
# Plug it in and wait until the startup sequence is finished and the LED starts blinking yellow.

By browsing to the spoofed domain, the request gets redirected to the given IP. As shown in figure "Spoofed browser warning" browsers show certificate alerts because the domain and certificate do not match. But this mode can still be used to attack other applications which use domains with no validation.

=== OpenVPN Mode ===
[[File:Packet Squirrel VPN1.jpg |thumb|right|400px||OpenVPN Access Mode]]
[[File:Packet Squirrel VPN2.jpg |thumb|right|400px||OpenVPN Tunneling Mode]]

The VPN payload implements VPN access mode and VPN tunnelling mode.
If you want to Setup your own OpenVPN (OVPN) server follow the instructions at the [https://docs.hak5.org/hc/en-us/articles/360010554013-OpenVPN-Payload hak5 webpage]. For the purpose of testing we use use an existing server from [https://www.freeopenvpn.org/en/ freeopenvpn.org].
# Start by selecting the desired server and download the the OVPN access certificate.
# Set the Packet Squirrel in Arming Mode and connect to its shell
# Copy the certificate with <code>scp user@server:downloadfolder/filename.ovpn /root/payloads/switch3/config.ovpn</code>
# Steer to the directory with <code> cd /root/payloads/switch3/</code>
# Edit the config.ovpn at line 30 to <code>auth-user-pass credentials.txt</code>
# Add an credentials file with <code> nano credentials.txt</code> and add the two lines:
## <code>freeopenvpn</code>
## <code><the displayed password></code>
# Before starting the VPN we choose the VPN mode:
## Open the <code>payload.sh</code>
## Set the <code>For_Clients=</code> to
### <code>0</code> for Access Mode
### <code>1</code> for Tunneling Mode
# Now set the Switch the the third Position and plug power out and in again
# You are good to go, if the yellow LED starts to flash after the boot up sequence
==== Access Mode ====

Access mode allows the squirrel to access the VPN Network via the Secure Shell
If the connection was established if the command <code>ifconfig tun0</code> show the following output when it is issued at the Packet Squirrels Shell.
tun0
Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.231.245 P-t-P:192.168.231.245 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1404 (1.3 KiB) TX bytes:608 (608.0 B)

The Access Mode can be used to access an Private network that is used for testing and pen testing purposes like an honeypot virtual machine.

==== Tunneling Mode ====

The Tunnelling mode encapsulates all the traffic and sends it to the VPN Server, from where it is send to the internet. VPN Tunnelling allows users to disguise their IP address you can check your current IP address with [https://www.ipchicken.com ipchicken.com].

You can also install an simple openVPN Server on a linux machine with
<code>wget https://git.io/vpn -O openvpn.sh && bash openvpn.sh</code>
and press Enter 6 times.
Then copy the generated client.ovpn file to Packet Squirrel in the /payload/switch3 folder and restart it with the switch on third position.
=== Meterpreter-via-SSH ===
[[File:Packet squirrel meterpreter ssh.PNG |thumb|right|400px||Packet Squirrel Payload settings]]
This payload starts the Packet Squirrel in NAT mode and waits for user input. When the button is pressed, the payload connects to a remote SSH server and creates a local port tunnel. It then launches a meterpreter shell over the tunnel.
The intent is to hide the meterpreter network traffic behind a legitimate SSH activity.
You can download this payload from the offical [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/remote-access/Meterpreter-via-SSH hak5 github].
==== Getting Started ====
Copy the playload to the Packet Squirrel into the desired switch folder. Now edit the scirpt to configure your server options:
* SSH_USER - username on remote SSH server
* SSH_HOST - ip address of remote SSH Server

'''Note:''' If you changed the default meterpreter port don't forget to change it on the metasploit side as well.
* MSF_PORT

===== Generate SSH Key on Squirrel =====
Now you have to generate an ssh key-pair (just use default location and empty password) on your Packet Squirrel:
root@squirrel:~# ssh-keygen
===== Allow Squirrel on SSH Server =====
Then you have to copy the contents of /root/.ssh/id_rsa.pub from Packet Squirrel to the SSH Server authorized file:

user@server:~# mkdir ~/.ssh
user@server:~# echo 'paste id_rsa.pub contents inside this quote' > ~/.ssh/authorized_keys
===== Run Metasploit with Resource =====
msf@server:~# msfconsole -r server.rc

==== LED Definitions ====
# Configure NETMODE
#* Solid Magenta
# Connect to SSH Server
#* SUCCESS - Blink Amber 5 Times
#* FAIL - Blink Red 2 Times
# Launch meterpreter
#* SUCESS - Blink Cyan 1 Time
#* FAIL - Blink Red 1 Time

==== Hardening Recommendations ====
# Use an accout with limited privileges for SSH acces on the server.
# User a dedicated account for Packet Squirrel device (audit usage with SSH access logs).
# Disable PasswordAuthentication in sshd_config on the server.

=== ISpyintel ===
This payload will automate gathering various recon data on whatever passes between it's Ethernet ports. You can download this payload from the [https://github.com/hak5/packetsquirrel-payloads/tree/master/payloads/library/sniffing/ispyintel official hak5 github].
'''Note:''' This payload requires a usb stick to store loot.
==== Setup ====
# Edit the config variables at the top. The main variables are:
## <code>lootPath="/mnt/loot/intel" # Path to loot</code>
## <code>mode="TRANSPARENT" # Network mode we want to use</code>
## <code>interface="br-lan" # Interface to listen on</code>
# Copy payload.sh into the ~/payloads/switch folder you wish to deploy on.
# Connect into a target machine with access to the LAN.
# Set switch to the spot and power up.
# Leave, get coffee, take a nap while everything is recorded and parsed for future use.
# When done; hit the button. The LED will rapidly flash white to let you know it is finishing up.
# When all is done the LED will just go blank. It is now safe to unplug and go about your day.

==== Tasks that are started ====
* tcpdump - records every packet that was send and received
* urlsnarf - collects all websites that were visited
* dsniff - attempts to acquire passwords and what not
* ngrep - on ports 80 and 21 with the filter for common password fields
* ngrep - on ports 80 and 21 with the filter for common session id fields
* log.txt - logs the progress of the payload for troubleshooting

==== Clean Up ====
Once the button is pressed the payload will automatically parse the TCPDump log file for the following items and store the results in seperate files.
As this process can take some time the LED will change to a rapid white blink letting you know the button command was recieved and the payload is in the process of shutting down.
* ipv4found.txt Will contain a unique list of all the ipv4 which the pcap file contains
* maybeEmails.txt Is a very loose search for possible email addresses that came across the wire in plain text.

=== Creating your own Payloads ===

The Packet Squirrel allows us to create our own attack payloads by loading them to the USB stick and naming them Switch1 to Switch3.
It allows as to create payload in python, bash or PHP. For Python and Bash it is important to use the interpreter directive Python: <code>#!/usr/bin/python</code>, bash: <code>#!/usr/bin/bash</code>.
Bash scripts can access the following pre-installed tools:
openvpn, autossh, tcpdump, meterpreter-https, cron, nmap, ncat-ssl, ncat, sshfs, tcpdump and wget

The featured Squirrel Script offers the following additional commands:

* NETMODE
specifies which network mode Packet Sqirrel uses and how traffic is routed

{| class="wikitable"
|-
! Command !! Description
|-
| NETMODE BRIDGE || Creates a bridge between the IN and OUT ehternet interface, with an own IP address for Packet Sqirrel
|-
| NETMODE TRANSPARENT || Also creates a bridge between the interfaces but with no own IP address
|-
| NETMODE NAT || Packet Squirrel gets an IP address from the target network, the client gets an IP from Packet Squirrel
|-
| NETMODE VPN || same es NAT with VPN interface for client tunneling
|-
| NETMODE CLONE || Clones the MAC address from the target client and uses it to connect to the LAN
|}

* LED
with this command the multi-color LED can be controlled

{| class="wikitable"
|-
! Possible configurations !! Description
|-
| LED Colors || red, green, blue, yellow, cyan, magenta, white
|-
| LED Patterns || SOLID, SLOW, FAST, SINGLE, DOUBLE, TRIPLE, SUCCESS, 1-10000
|-
| LED State || SETUP, FAIL, ATTACK, STAGE, SPECIAL, CLEANUP, FINISH
|}

* BUTTON
The BUTTON command pauses the paylpoad until the hardware button is pressed or a specified time has passed

* SWITCH
The SWITCH command returns the current position of the hardware payload selection switch. Output is "switch1", "switch2", "switch3" or "switch4".

==== Example ====
[[File:Hak5 C2 start.jpg |thumb|right|400px||C2 server start]]
[[File:Hak5 c2 dashboard.jpg |thumb|right|400px||C2 Dashboard]]
[[File:Hak5 c2 sqirrel.jpg |thumb|right|400px||C2 Packet Squirrel]]

Here is an example for the usage of Squirrel Script.

<syntaxhighlight lang="bash">
# Title: Caternet
# Author: Hak5Darren
# Version: 1.0
# Description: Forwards all traffic to local webserver hosting cat photos.
# Props: In loving memory of Hak5Kerby

LED SETUP
NETMODE NAT
echo "address=/#/172.16.32.1" > /tmp/dnsmasq.address
/etc/init.d/dnsmasq restart

LED ATTACK
iptables -A PREROUTING -t nat -i eth0 -p udp --dport 53 -j REDIRECT --to-port 53
python -m SimpleHTTPServer 80
</syntaxhighlight>

For more information go to the [https://docs.hak5.org/hc/en-us/sections/360002180414-Payload-Development hak5.org webpage].

== with Cloud C2 ==

The [[Hak5 Cloud C2]] is a command and control server for Hak5 devices. Installation and startup is shown in figure "C2 server start". By browsing to the configured address you can login to the dashboard, shown in figure "C2 dashboard".

To connect the Packet Squirrel with your C2 Cloud, click on the plus button in the lower right corner and choose the device. On the dashboard, open the added device and click on Setup, as shown in figure "C2 Packet Sqirrel". Then copy the downloaded file to the Packet Squirrel's /etc folder and reboot it.
In the Overview tab you can also Edit, Reboot, Wipe and Remove your device.

In the Clients tab you can see all clients which were connected to your Packet Squirrel with hostname, MAC and IP address. In the Loot tab, you can open the current loot from your Packet Squirrel directly on your C2 server. And in the Terminal tab you can open a ssh session to your device.

== Used Hardware ==

[[Packet Squirrel]]

== References ==

* https://docs.hak5.org/hc/en-us/categories/360000982574-Packet-Squirrel
* https://docs.hak5.org/hc/en-us/categories/360001177114-Cloud-C2
* https://downloads.hak5.org/

[[Category:Pentesting]]

2021-03-01T17:48:22Z

Bnagl:

== Summary ==

This guide explains how to configure a static IP-Address and setup a ssh server on raspbian Lite.

== Requirements ==

* Operating system: Raspberry Pi

== Description ==

=== Setting a static IP ===

This guide uses the ''/etc/network/interfaces'' file to configure a static IP.
Edit the file with:
sudo nano /etc/network/interfaces
Enter the following lines with your desired IP-Address and network configurations:
auto eth0
allow-hotplug eth0
iface eth0 inet static
address 192.168.0.133
netmask 255.255.255.0
gateway 192.168.0.1

'''Note:''' Don't choose a IP-Address from your dhcppool.

=== Enable SSH ===

I am going to use the terminal to enable the SSH server.
To enable the SSH server enter the following two commands:
sudo systemctl enable ssh
sudo systemctl start ssh
== Used Hardware ==

[[Raspberry Pi 3 Model B+]]

== References ==

* https://www.raspberrypi.org/documentation/remote-access/ssh/

[[Category:Documentation]]

SSH Server on Raspberry Pi with Raspbian Lite: Setup

2021-03-01T17:46:20Z

Bnagl: Create the page.

Install Raspbian OS on a Raspberry Pi

2021-03-01T17:32:08Z

Bnagl: Added installation guide for windows.

== Summary ==

Install Raspbian OS on a Raspberry Pi using a 16 GB SD card

== Requirements ==

* PC with SD card reader
* Operating system: Ubuntu 18.04 bionic amd64 / Windows 10

== Description ==
=== Ubuntu ===
==== Check device id ====
Insert the SD card in the SD card reader and determine the devices on the machine by issuing following command in a terminal

lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 477G 0 disk
├─sda1 8:1 0 953M 0 part
├─.....
mmcblk0 179:0 0 14,6G 0 disk
└─mmcblk0p1 179:1 0 14,6G 0 part

SD card is device mmcblk0 which contains a partition mmcblk0p1, in the case this partition is autmatically mountet unmount the partition with

umount /media/<username>/<dev-id>

==== Download image ====

Download newest raspbian desktop from https://www.raspberrypi.org/downloads/raspbian/
The current version at time of the documentation was 2019-09-26-raspbian-buster-full.zip

==== Unzip and install ====

* Copying a zipped image to the SD card and showing the progress by using following command

unzip -p 2019-09-26-raspbian-buster-full.zip | sudo dd of=/dev/mmcblk0 status=progress conv=fsync
6799950336 bytes (6,8 GB, 6,3 GiB) copied, 555 s, 12,3 MB/s
13303808+0 records in
13303808+0 records out
6811549696 bytes (6,8 GB, 6,3 GiB) copied, 569,647 s, 12,0 MB/s

==== Verify image [optional] ====
This is done by copying back the image with dd from the SD card into another file and compare that file to the original image with diff.

* The output of the first copying dd command shows the number of written blocks, so you need only to copy this number

xxx+0 records in

* then copy these xxx=13303808 blocks from the image to a new file

sudo dd bs=4M if=/dev/mmcblk0 of=from-sd-card.img count=13303808

* Unzipp the original image

unzip 2019-09-26-raspbian-buster-full.zip

* truncate to the other size

sudo truncate --reference 2019-09-26-raspbian-buster-full.img from-sd-card.img

* and compare
diff -s 2019-09-26-raspbian-buster-full.img from-sd-card.img
Files 2019-09-26-raspbian-buster-full.img and from-sd-card.img are identical

=== Windows ===
Download your prefered image from the [https://www.raspberrypi.org/software/operating-systems/#raspberry-pi-os-32-bit offical raspberrypi website].
For this guide we're going to use the Raspberry Pi Imager. You can download it [https://www.raspberrypi.org/software/ here].

Start Raspberry Pi Imager. Select your OS from the harddisk, SD-Card and press write. After the Imager is done you can plug the SD-Card in your Raspberry Pi.
The standard login for raspbian is:
Username: pi
Password: raspberry

'''Note:''' The raspbian uses the english keyboard layout.

== Hardware ==
[[Kingston 16GB micro SD-HC class 10 Accessory]]
[[Raspberry Pi 3 Model B+]]

== References ==

* https://www.raspberrypi.org/documentation/installation/installing-images/linux.md

[[Category:Documentation]]

Keyestudio 4WD Bluetooth multifunctional car kit

2021-03-01T15:42:03Z

Bnagl: Added Bluetooth Module code

== Summary ==

This documentation is about the keyestudio 4WD Bluetooth Multi-functional Car Kit. The documentation contains schematics, tipps and code for the car.

== Requirements ==

* Arduino IDE
* 18650 Batteries (not included in kit)

== Description ==
=== Component list ===
<table style="border: solid 1px black; width:50% border-collapse: collapse; border-spacing: 0;">
<tr style="border: solid 1px black; padding: 5px 10px;">
<th style="border: solid 1px black; width:30%; padding: 5px 10px; text-align: center;">Product Name</th>
<th style="border: solid 1px black; width:20%; text-align: center; padding: 5px 10px;">Quantity</th>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio UNO R3</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio Shield V5</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio L298N Motor Shield</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio Bluetooh HC-06</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">I2C 1602 LCD</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio Line Tracking Sensor</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">3</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">HC-SR04 Ultrasonic Sensor</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio Digital IR Receiver Module</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4WD Top PCB</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4WD Bottom PCB</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Servo Motor</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Servo Plastic Platform</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">IR Remote Control</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Toggle Switch + Wire</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">18650 Battery Holder</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">DC Motor</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Motor Fixed Part</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Plastic Tire</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Copper Pillar 40MM</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">6</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Copper Pillar 10MM</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">USB Cable</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Jumper Wire</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">30</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">M3*6MM Round Head Screw</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">60</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">M3*8MM Flat Head Screw</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">2</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">M3*30MM Round Head Screw</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">8</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">3MM Nut</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Connector Wire (150mm, Black)</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">6</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Connector Wire (150mm, Red)</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">6</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Winding Wire (12CM)</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
</table>

== Assembly ==

Follow the User Manual. If something is unclear then watch a assembly video. Be careful when installing the motors, make sure they’re all properly aligned, if not the car will pull to one side.
Especially take care that no cables sticks into the motors.

== Motor control ==
We control the motor using a H-Bridge L298N Motor Driver. Use a exxternal 5V logic supply when using more than 12V driving voltage.

[[File:Motor_Driver.png|500px]]

In our case we need to plug two motors to each motorA and motorB. Connect the power from the battery pack VSS and GND.

[[File:Motor_Driver_schematics.png|500px]]

Wire the motor to the Arduino/Sensor Shield as adviced in the user manual.

=== Specification: ===
* Working Mode: H bridge (double lines)
* Control Chip: L298N (ST)
* Logical Voltage: 5V
* Driving Voltage: 5V-35V
* Logical Current: 0mA-36mA>
* Driving Current: 2A (MAX single bridge)
* Storage Temperature: (-20 °C)-(+135 °C)
* Maximum Power: 25W
* Weight: 30g
* Periphery Dimension: 43 x 43 x 27 mm(L x W x H)

=== Code ===
==== Initiation ====
//define the output pins.
int IN1=5;
int IN2=6;
int IN3=7;
int IN4=8;
int ENA=9;
int ENB=10;
void setup() {
//set up the pins to act as output.
for (int i = 5; i < 11;i++)
{
pinMode(i,OUTPUT);
}
delay(5000);
}
==== Rotate Counter Clockwise ====

void turnCounterClockwise()
{
analogWrite(ENA,0);
analogWrite(ENB,0);
digitalWrite(IN1,LOW);
digitalWrite(IN2,HIGH);

digitalWrite(IN3,LOW);
digitalWrite(IN4,HIGH);
delay(150);
analogWrite(ENA,200);
analogWrite(ENB,200);
}

==== Rotate Clockwise ====
void turnClockwise()
{
analogWrite(ENA,0);
analogWrite(ENB,0);
digitalWrite(IN1,HIGH);
digitalWrite(IN2,LOW);

digitalWrite(IN3,HIGH);
digitalWrite(IN4,LOW);
delay(150);
analogWrite(ENA,200);
analogWrite(ENB,200);
}

==== Drive Forward ====

void driveForward()
{
analogWrite(ENA,0);
analogWrite(ENB,0);
digitalWrite(IN1,LOW);
digitalWrite(IN2,HIGH);

digitalWrite(IN3,HIGH);
digitalWrite(IN4,LOW);
delay(150);
analogWrite(ENA,100);
analogWrite(ENB,100);
}

==== Drive Reverse ====

void driveReverse()
{
analogWrite(ENA,0);
analogWrite(ENB,0);
digitalWrite(IN1,HIGH);
digitalWrite(IN2,LOW);

digitalWrite(IN3,LOW);
digitalWrite(IN4,HIGH);
delay(150);
analogWrite(ENA,100);
analogWrite(ENB,100);
}

==== Brake ====
void brake()
{
analogWrite(ENA,0);
analogWrite(ENB,0);
}

== I2C Display ==
The display is controlled with I2C. I am using the Wire and LiquidCrystal_I2C library to control the display.

=== Specification ===

* I2C Address: 0x27
* Back Lit (Blue with white char color)
* Supply Voltage: 5V
* Interface:I2C/TWI x1,Gadgeteer interface x2
* Adjustable Contrast
* Size:82x35x18 mm

=== Schematics ===
[[File:I2C_Display_Schematics.png|800px]]
=== Code ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Don't use the library link that is in the manual, it contains a bug where only the first character of the strings is displayed on the I2C display. Download the latest version from https://www.arduinolibraries.info/libraries/liquid-crystal-i2-c.
</div>
#include <Wire.h>
#include <LiquidCrystal_I2C.h>
//set the LCD address to 0x27 for a 16 chars and 2 line display
LiquidCrystal_I2C lcd(0x27,16,2);
void setup()
{
//initialize the lcd
lcd.init();
//enable the backlight
lcd.backlight();
//set the cursor to the first line.
lcd.setCursor(3,0);
//print text
lcd.print("Hello");
//set the cursor in the next line.
lcd.setCursor(3,1);
//print text
lcd.print("world!");
}

void loop()
{}

== Servo Motor ==
The Servo Motor is controlled with PWM. The Sketch rotates the motor in an angle between 110 and 180 degres.

=== Schematics ===
[[File:Servo_Motor_Schematics.png|400px]]

=== Code ===

int servopin=2;// select digital pin 9 for servomotor signal line
int myangle;// initialize angle variable
int pulsewidth;// initialize width variable
int val;

void servopulse(int servopin,int myangle)// define a servo pulse function
{
pulsewidth=(myangle*11)+500;// convert angle to 500-2480 pulse width
digitalWrite(servopin,HIGH);// set the level of servo pin as “high”
delayMicroseconds(pulsewidth);// delay microsecond of pulse width
digitalWrite(servopin,LOW);// set the level of servo pin as “low”
delay(20-pulsewidth/1000);
}

void setup()
{
pinMode(servopin,OUTPUT);// set servo pin as “output”
Serial.begin(9600);// connect to serial port, set baud rate at “9600”
Serial.println("ready" ) ;
}

void loop(){
val = 180;
Serial.print("moving servo to ");
Serial.print(val);
Serial.println();
for(int i=0;i<=25;i++) // giving the servo time to rotate to commanded position
{
servopulse(servopin,val);// use the pulse function
}
val = 110;
Serial.print("moving servo to ");
Serial.print(val);
Serial.println();
for(int i=0;i<=25;i++) // giving the servo time to rotate to commanded position
{
servopulse(servopin,val);// use the pulse function
}
}

== Ultra Sonic Sensor ==
I used the pins: echoPin 3 and trigPin 4 because 7 and 8 is already taken by the motordriver.
If you don't understand the line: distance = duration/58.3;.
The speed of sound is 343 m/s. We messure the round trip so we need to divide the 343 with 2 which gives us 171.5 m/s. But we don’t want to deal with meters and seconds we want centimeters and microseconds. 17150 cm/s = 0.017150 cm/us = 1cm/58.3 us.

=== Specification ===
* Working Voltage: DC 5V
* Working Current: 15mA
* Working Frequency: 40Hz
* Max Range: 4m
* Min Range: 2cm
* Measuring Angle: 15 degree
* Trigger Input Signal: 10µS TTL pulse
* Echo Output Signal Input TTL lever signal and the range in proportion
* Size: 46*20.4mm
* Weight: 9g

=== Schematics ===
[[File:Ultra_Sonic_Schematics.png|650px]]

=== Code ===

#define echoPin 7 // Echo Pin
#define trigPin 8 // Trigger Pin
#define LEDPin 13 // Onboard LED

int maximumRange = 200; // Maximum range needed
int minimumRange = 0; // Minimum range needed
long duration, distance; // Duration used to calculate distance

void setup() {
Serial.begin (9600);
pinMode(trigPin, OUTPUT);
pinMode(echoPin, INPUT);
pinMode(LEDPin, OUTPUT); // Use LED indicator (if required)
}

void loop() {
/* The following trigPin/echoPin cycle is used to determine the
distance of the nearest object by bouncing soundwaves off of it. */
digitalWrite(trigPin, LOW);
delayMicroseconds(2);

digitalWrite(trigPin, HIGH);
delayMicroseconds(10);
digitalWrite(trigPin, LOW);
duration = pulseIn(echoPin, HIGH);

//Calculate the distance (in cm) based on the speed of sound.
distance = duration/58.3;

if (distance >= maximumRange || distance <= minimumRange){
/* Send a negative number to computer and Turn LED ON
to indicate "out of range" */
Serial.println("-1");
digitalWrite(LEDPin, HIGH);
}
else {
/* Send the distance to the computer using Serial protocol, and
turn LED OFF to indicate successful reading. */
Serial.println(distance);
digitalWrite(LEDPin, LOW);
}
//Delay 50ms before next reading.
delay(50);
}

== Line Tracking Sensor ==

=== Specification ===
* Power Supply: +5V
* Operating Current: <10mA
* Operating Temperature Range: 0°C ~ + 50°C
* Output Interface: 3-wire interface (1 - signal, 2 - power, 3 - power supply negative)
* Output Level: TTL level

=== Schematics ===
[[File:Line_Tracking_Sensor_Schematics.png|600px]]

=== Code ===
I used the pins 0-2 for the 3 line tracking sensors. This sketch is used to test the line tracking sensors.
const int sensorPin1 = 0;
const int sensorPin2 = 1;
const int sensorPin3 = 2; // the number of the sensor pin
const int ledPin = 13; // the number of the LED pin
int sensorState = 0; // variable for reading the sensor status
void setup()
{
pinMode(ledPin, OUTPUT);
pinMode(sensorPin1, INPUT);
pinMode(sensorPin2, INPUT);
pinMode(sensorPin3, INPUT);
}
void loop()
{
// read the state of the sensor value:
sensorState = digitalRead(sensorPin1);
// if the sensorState is HIGH:
if (sensorState == HIGH)
{
digitalWrite(ledPin, HIGH);
}
else
{
digitalWrite(ledPin, LOW);
}
}

== Digital IR Receiver Module ==
=== Specification ===
* Power Supply: 5V
* Interface: Digital
* Modulate Frequency: 38kHz
* Module Interface Socket: JST PH2.0

<table style="border: solid 1px black; width:50% border-collapse: collapse; border-spacing: 0;">
<tr style="border: solid 1px black; padding: 5px 10px;">
<th style="border: solid 1px black; width:30%; padding: 5px 10px; text-align: center;">Button</th>
<th style="border: solid 1px black; width:20%; text-align: center; padding: 5px 10px;">HexValue</th>
<th style="border: solid 1px black; width:20%; text-align: center; padding: 5px 10px;">DecValue</th>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">ArrowUp</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF629D</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16736925</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">ArrowDown</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FFA857</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16754775</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">ArrowRight</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FFC23D</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16761405</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">ArrowLeft</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF22DD</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16720605</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF6897</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16738455</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">2</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF9867</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16750695</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">3</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FFB04F</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16756815</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF30CF</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16724175</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">5</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF18E7</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16718055</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">6</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF7A85</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16743045</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">7</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF10EF</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16716015</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">8</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF38C7</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16726215</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">9</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF5AA5</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16734885</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">0</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF4AB5</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16730805</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">OK</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF02FD</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16712445</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">*</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF32BD</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16728765</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">#</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF52AD</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16732845</td>
</tr>
</table>

=== Schematics ===
[[File:IR_Receiver_Schematics.png|600px]]
=== Code ===
==== Output IR-Remote control values ====
My intention is to steer the car with the IR-Remote-Control included in the kit. This sketch outputs the values the IR-Receiver gets from the remote control so I know the values I'm working with.

# include <IRremote.h>
int RECV_PIN = 11;
IRrecv irrecv(RECV_PIN);
decode_results results;
void setup()
{
Serial.begin(9600);
irrecv.enableIRIn(); // Start the receiver
}
void loop()
{
if (irrecv.decode(&results))
{
Serial.println(results.value, HEX);
irrecv.resume(); // Receive the next value
}
}
==== Steer car with IR-Remote control ====
# include <IRremote.h>
int IN1 = 5;
int IN2 = 6;
int IN3 = 7;
int IN4 = 8;
int ENA = 9;
int ENB = 10;
int RECV_PIN = 11;
IRrecv irrecv(RECV_PIN);
decode_results results;
decode_results lastResult;
void setup()
{
for (int i = 5; i < 11; i++)
{
pinMode(i, OUTPUT);
}
Serial.begin(9600);
irrecv.enableIRIn(); // Start the receiver
}
void loop()
{
if (irrecv.decode(&results))
{
if (results.value != lastResult.value)
{
switch (results.value)
{
//ArrowUp
case 16736925:
driveForward();
break;
//ArrowDown
case 16754775:
driveReverse();
break;
//ArrowRight
case 16761405:
turnClockwise();
break;
//ArrowLeft
case 16720605:
turnCounterClockwise();
break;
//Ok
case 16712445:
brake();
break;
}
lastResult = results;
}
irrecv.resume(); // Receive the next value
}
}

void driveForward()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, LOW);
digitalWrite(IN2, HIGH);

digitalWrite(IN3, HIGH);
digitalWrite(IN4, LOW);
delay(150);
analogWrite(ENA, 100);
analogWrite(ENB, 100);
}

void driveReverse()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, HIGH);
digitalWrite(IN2, LOW);

digitalWrite(IN3, LOW);
digitalWrite(IN4, HIGH);
delay(150);
analogWrite(ENA, 100);
analogWrite(ENB, 100);
}

void turnClockwise()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, HIGH);
digitalWrite(IN2, LOW);

digitalWrite(IN3, HIGH);
digitalWrite(IN4, LOW);
delay(150);
analogWrite(ENA, 150);
analogWrite(ENB, 150);
}

void turnCounterClockwise()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, LOW);
digitalWrite(IN2, HIGH);

digitalWrite(IN3, LOW);
digitalWrite(IN4, HIGH);
delay(150);
analogWrite(ENA, 150);
analogWrite(ENB, 150);
}

void brake()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
}

== Bluetooth Module ==
=== Specification ===
* Bluetooth Protocol: Bluetooth 2.1+ EDR Standard
* USB Protocol: USB v1.1/2.0
* Operating Frequency: 2.4GHz ISM Frequency Band
* Modulation Mode: Gauss Frequency Shift Keying
* Transmit Power: ≤ 4dBm, Second Stage
* Sensitivity: ≤-84dBm at 0.1% Bit Error Rate
* Transmission Speed: 2.1Mbps(Max)/160 kbps(Asynchronous)； 1Mbps/1Mbps(Synchronous)
* Safety Feature: Authentication and Encryption
* Supported Configuration: Bluetooth Serial Port (major and minor)
* Supply Voltage: 5V DC 50mA
* Operating Temperature: -20 to 55℃
=== Schematics ===
[[File:Bluetooth_Module_Schematics.png|600px]]
=== Code ===
int val;
int ledpin = 13;
void setup()
{
Serial.begin(9600);
pinMode(ledpin, OUTPUT);
}
void loop()
{
val = Serial.read();
if (val == 'a')
{
digitalWrite(ledpin, HIGH);
delay(250);
digitalWrite(ledpin, LOW);
delay(250);
Serial.println("keyestudio");
}
}

== Obstacle Avoidance ==
This code measures the distance between the car and the object in front of it. If the distance between both is under 15cm the car will turn 180° and continue to drive forward. I used the Ultra-Sonic Sensor to measure the distance and the I2C-Display to display the current distance.
=== Code ===
#define echoPin 3 // Echo Pin
#define trigPin 4 // Trigger Pin

#include <Wire.h>
#include <LiquidCrystal_I2C.h>
int maximumRange = 200; // Maximum range needed
int minimumRange = 0; // Minimum range needed
long duration, distance; // Duration used to calculate distance
LiquidCrystal_I2C lcd(0x27,3,1);
bool state = true;
int IN1 = 5;
int IN2 = 6;
int IN3 = 7;
int IN4 = 8;
int ENA = 9;
int ENB = 10;

void setup()
{
Serial.begin(9600);
pinMode(trigPin, OUTPUT);
pinMode(echoPin, INPUT);
for (int i = 5; i < 11; i++)
{
pinMode(i, OUTPUT);
}
lcd.init();
lcd.backlight();
delay(5000);
driveForward();
}

void loop()
{
/* The following trigPin/echoPin cycle is used to determine the
distance of the nearest object by bouncing soundwaves off of it. */
digitalWrite(trigPin, LOW);
delayMicroseconds(2);

digitalWrite(trigPin, HIGH);
delayMicroseconds(10);
digitalWrite(trigPin, LOW);
duration = pulseIn(echoPin, HIGH);

//Calculate the distance (in cm) based on the speed of sound.
distance = duration / 58.3;

if (distance >= maximumRange || distance <= minimumRange)
{
/* Send a negative number to computer and Turn LED ON
to indicate "out of range" */
lcd.clear();
lcd.setCursor(3, 0);
lcd.print("-1");
Serial.println("-1");
}
else
{
/* Send the distance to the computer using Serial protocol, and
turn LED OFF to indicate successful reading. */
if (distance <= 15 && state != false)
{
state = false;
brake();
delay(200);
turnClockwise();
delay(780);
state = true;
driveForward();
}
else if (distance >= 30 && state != true)
{
state = true;
driveForward();
}
lcd.clear();
lcd.setCursor(3, 0);
lcd.print(distance);
Serial.println(distance);
}
//Delay 50ms before next reading.
delay(50);
}

void driveForward()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, LOW);
digitalWrite(IN2, HIGH);

digitalWrite(IN3, HIGH);
digitalWrite(IN4, LOW);
delay(150);
analogWrite(ENA, 100);
analogWrite(ENB, 100);
}

void driveReverse()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, HIGH);
digitalWrite(IN2, LOW);

digitalWrite(IN3, LOW);
digitalWrite(IN4, HIGH);
delay(150);
analogWrite(ENA, 100);
analogWrite(ENB, 100);
}

void turnClockwise()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, LOW);
digitalWrite(IN2, HIGH);

digitalWrite(IN3, LOW);
digitalWrite(IN4, HIGH);
delay(150);
analogWrite(ENA, 200);
analogWrite(ENB, 200);
}

void brake()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
}
== Used Hardware ==

[[Smart Robot Car Kit Bluetooth 4WD keyestudio]]

== References ==

* https://wiki.keyestudio.com/Ks0192_keyestudio_4WD_Bluetooth_Multi-functional_Car
* https://www.youtube.com/watch?v=GAqvzCXEUSw

[[Category:Documentation]]

Bluetooth Sniffing with Ubertooth: A Step-by-step guide

2021-02-27T22:04:37Z

Bnagl: /* Demo Project */

== Summary ==

This is a tutorial on how to sniff Bluetooth Low Energy (BLE) packets using the [[Ubertooth One, 2.4 GHz wireless development platform]] device.
This guide will detail the setup process and outline every step to capture a BLE connection. Furthermore, it will provide methods of bluetooth hacking, i.e cracking the encryption of a BLE connection and overwriting characteristics of a device.
This tutorial is created in regard to the seminar paper: [[File:Pentesting in IoT Bluetooth Sniffing.pdf]]

== Requirements ==

* Linux-based Operating system: this test used [https://www.kali.org/downloads/ Kali Linux 64-Bit v2019.4 native install]
* BLE devices
* Tools: crackle, gatttool

== BLE Fundamentals ==

Fundamentals of the BLE Standard can be found at the [[BLE Fundamentals]] documentation.

== Capturing BLE packets ==

=== Step 1 - Prerequisites ===

Ubertooth One offers a well-documented GitHub-repository [https://github.com/greatscottgadgets/ubertooth/wiki]. Follwowing its instructions, the device's tools require several components. To fulfill the demands, one has to install:

<code>sudo apt-get install cmake libusb-1.0-0-dev make gcc g++ libbluetooth-dev pkg-config python3-numpy python3-qtpy</code>

In contrast to the guide, the ''python-pyside'' component needs to be installed separately using the ''pip-installer'':

<code>pip install pyside3</code>

In order to for Ubertooth tools to decode Bluetooth packets the Bluetooth baseband library (''libbtbb'') needs to be downloaded and installed:

wget <nowiki>https://github.com/greatscottgadgets/libbtbb/archive/2018-12-R1.tar.gz -O libbtbb-2018-12-R1.tar.gz</nowiki>
tar -xf libbtbb-2018-12-R1.tar.gz
cd libbtbb-2018-12-R1
mkdir build
cd build
cmake ..
make
sudo make install
sudo ldconfig

Following that, the Ubertooth tools can be downloaded from the GitHub repository. They include host code, which enables sniffing Bluetooth packets. Additionally, they provide means to configure the Ubertooth device, including a simplified method for a firmware update.

wget <nowiki>https://github.com/greatscottgadgets/ubertooth/releases/download/2018-12-R1/ubertooth-2018-12-R1.tar.xz</nowiki>
tar xf ubertooth-2018-12-R1.tar.xz
cd ubertooth-2018-12-R1/host
mkdir build
cd build
cmake ..
make
sudo make install
sudo ldconfig

The Wireshark Bluetooth Baseband (''BTBB'') and Basic Rate/Enhanced Data Rate (''BR/EDR'') plugins facilitate the analysis of Bluetooth baseband traffic that has been captured within the Wireshark GUI.
The plugins need to be installed both separately from the ''libbtbb'' library. For the BTBB plugin the following commands have been used:

sudo apt-get install wireshark wireshark-dev libwireshark-dev cmake
cd libbtbb-2018-12-R1/wireshark/plugins/btbb
mkdir build
cd build
cmake -DCMAKE_INSTALL_LIBDIR=/usr/lib/x86_64-linux-gnu/wireshark/libwireshark3/plugins ..
make
sudo make install

It is important to state that the ''MAKE_INSTALL_LIBDIR'' directory can vary depending on the OS used and the wireshark installation. However, it should be the directory of existing Wireshark plugins.
The procedure needs to be repeated for the ''BR/EDR'' plugin.

cd libbtbb-2018-12-R1/wireshark/plugins/btbredr
mkdir build
cd build
cmake -DCMAKE_INSTALL_LIBDIR=/usr/lib/x86_64-linux-gnu/wireshark/libwireshark3/plugins ..
make
sudo make install

=== Step 2 - Verification & Firmware Update ===

After installing the prerequisits, the Ubertooth One device was plugged in through a USB port. It is of utmost importance to operate the Ubertooth One with the antenna attached to it. Otherwise, there is a risk of damaging the device. After inserting the device, verify that the system detects it:

<code>lsusb</code>

This will display information about USB buses in the system and the devices connected to them:

Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 005: ID 04f2:b595 Chicony Electronics Co., Camera
Bus 001 Device 004: ID 138a:003f Validity Sensors, Inc. VFS495
Bus 001 Device 003: ID 8087:0a2b Intel Corp.
Bus 001 Device 002: ID 1ea7:0064 SHARKOON Technologies 2.4G Mouse
Bus 001 Device 014: ID 1d50:6002 '''OpenMoko, Inc. Ubertooth One'''
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Upon first operation of the Ubertooth One it is necessary to update its firmware. The tools, which were downloaded before, facilitate a simplified way to achieve this task. Change the directory to the firmware directory of Ubertooth and execute the following command:

<code>ubertooth-dfu -d bluetooth_rxtx.dfu -r</code>

If the update is successful, this output will be produced:

Switching to DFU mode...
Checking firmware signature
........................................
........................................
........................................
Detached

To verify the firmware-version enter the following command:

<code>ubertooth-util -v</code>

=== Step 3 - Ubertooth Spectrum Analyzer ===

It is recommended to validate the functionality of the Ubertooth device via the spectrum analyzer, which is a tool to analyze the 2.4GHz band.
Specifically, it provides a Graphical User Interface (GUI) tool named ubertooth-specan-ui, which visually monitors the frequencies. This command will start the spectrum analyzer:

<code>ubertooth-specan-ui</code>

Once successful, you can see the analyzer work its task through a powerful GUI:

[[File:Ubertooth Spectrum Analyzer.png]]

In this case the figure shows several 802.11b networks in different channels, represented by green amplitudes.
The white amplitudes depict beacons that are visible during scanning. The red lines adjust to different centers of frequency channels in the 2.4GHz radio band.

=== Step 4 - Intercepting Lower Address Part (LAP) Packets ===

The ''BD_ADDR'' makes the allocation of sniffed Bluetooth packets possible. The Ubertooth One can start the LAP scan with this command:

<code>ubertooth-rx</code>

A continuous output will follow on the console:

systime=1578428685 ch=26 LAP=3a5138 err=1 clkn=8355 clk_offset=5199 s=-80 n=-55 snr=-25
systime=1578428688 ch=26 LAP=3a5138 err=1 clkn=18479 clk_offset=5628 s=-81 n=-55 snr=-26
systime=1578428692 ch=43 LAP=3a5138 err=2 clkn=28967 clk_offset=6029 s=-80 n=-55 snr=-25
systime=1578428692 ch=47 LAP=3a5138 err=2 clkn=30327 clk_offset=6069 s=-81 n=-55 snr=-26
systime=1578428694 ch=52 LAP=3a5138 err=1 clkn=36948 clk_offset=87 s=-79 n=-55 snr=-24
systime=1578428696 ch=53 LAP=3a5138 err=0 clkn=42360 clk_offset=302 s=-77 n=-55 snr=-22

In the output '''ch''' represents the channel used by the device referenced in the LAP value.
The channel hopping is clearly comprehensible. '''Clkn''' indicates the master`s clock, while '''s''' references the signal strength and '''n''' states the value of noise.
Following that the '''snr''' value represents the signal-to-noise ratio.
This mode is especially helpful for undiscoverable devices, because it can calculate a BD_ADDR through the LAP in combination with the other parameters.

Alternatively, if the devices are discoverable, you can use the BLE scan of hcitools:

<code>sudo hcitool lescan</code>

Among eventual other devices you should see the BLE devices you are testing, in this case the thermostat and the fitness tracker:

D5:AA:D0:41:A3:60 Mi Smart Band 4
78:A5:04:62:71:3D TepHeatB
[...]

=== Step 5 - The Ubertooth-BTLE Tool ===

One of the most powerful tools the Ubertooth One provides is the Bluetooth Low Energy sniffing mode.
Among other things, it can sniff and follow connections and even interfere with them.
In the "follow" mode, Ubertooth listens on one of the three advertising channels.
Once a BLE connection is established (on the advertising channel the device has been listenting to), Ubertooth will follow the hops along the data channels capturing the transmissions between the devices.
Per default, Ubertooth can be used to follow any connection it observes randomly.
Naturally, the device can be restricted to observe a specific device by providing the ''BD_ADDR'' of the device in question.
The general syntax of the corresponding command for "follow" mode looks like:

<code>ubertooth-btle -f <nowiki><BD_ADDR></nowiki></code>

Simply replace the ''BD_ADDR'' with the address you found out earlier:

<code>ubertooth-btle -f 78:A5:04:62:71:3D</code>

This will produce a continuous output in the console.

Furthermore, it is possible to redirect the output into a file or a pipe.
To achieve this, the syntax requires this generic command:

<code>ubertooth-btle -f <nowiki><BD_ADDR> -c <file or pipe></nowiki></code>

=== Step 6 - Wireshark Analysis ===

It is also possible to analyze the captured BLE packets in Wireshark.
For this purpose create a pipe via:

<code>mkfifo /tmp/pipe</code>

Following that, a new interface needs to be added to Wireshark in order to use the just created pipe.

[[File:Wireshark manage interface.png|frameless|450px]]

For this, the custom pipe ''/tmp/mypipe'' was added to the list of interfaces.

[[File:Wireshark add pipe.png|frameless|450px]]

Now repeat the command from Step 5, but now with a redirected ouput to the pipe:

<code>ubertooth-btle -f 78:A5:04:62:71:3D -c /tmp/pipe</code>

Select the custom interface you have just created in Wireshark to be able to analyze packtets with enhanced visibility and additional information.

[[File:Wireshark Thermo ConnectReq.png|frameless|1000px]]

== Exploiting BLE ==

After capturing the data it is possible to use additional third party tools in combination with Ubertooth to obtain critical information.
In the following this is outlined through the utilization of the tools ''crackle'' and ''gatttool''.

=== Crackle ===

Crackle is a tool that attempts to decrypt BLE Encryption.
Crackle is the right tool if you have captured a connection based on BLE Legacy Pairing.
It can not decrypt LE Secure Connections based transmissions.
Note that even if you are using Kali Linux the pre-installed version of crackle may be out of date without any possibility to update it through the respective repositories.
It is recommended that you use the master branch from crackle GitHub-repository [https://github.com/mikeryan/crackle].

git clone <nowiki>https://github.com/mikeryan/crackle.git</nowiki>
cd crackle
make

Now you can use the latest version of the tool by executing this command:

<code>./crackle -i <nowiki><your_file.pcap></nowiki></code>

In this test, the captured connection revealed that the thermostat used no encryption and the fitness tracker used LE Secure Connections.
In this regard, crackle was unsuccessful in both instances.
When applied to the thermostat connection the output looked like this:

[[File:Crackle thermostat.png|frameless|600px]]

This is due to the fact that the thermostat connection has no encryption. Naturally, there is nothing to break. Note that you can receive a similar result if the connection uses some form of encryption but ubertooth fails to capture the respective packets. Ubertooth cannot track 100% of the transmissions.
In the case of the fitness tracker the output clearly states that the device is running LE Secure Connections.

[[File:Crackle fitnesstracker.png|frameless|600px]]

To show that crackle can indeed decrypt keys of Legacy Pairing connections we run the tool on the sample data provided [https://lacklustre.net/bluetooth/crackle-sample.tgz here].

[[File:Crackle sampledata.png|frameless|600px]]

=== Gatttool ===

The utility ''gatttool'' can be used to manipulate characteristics attribute-values.
In the following we change the temperature value of the thermostat.

Connect to your device using the following command:

<code>gatttool -b 78:A5:04:62:71:3D -I</code>

This will give you a prompt. Type "connect" to innitiate pairing with the device:

[78:A5:04:62:71:3D][LE]> connect
Attempting to connect to 78:A5:04:62:71:3D
Connection successful
'''[78:A5:04:62:71:3D]'''[LE]>

Now you can use a variety of commands to send read/write requests to your connected device:
:* <code>characteristics</code> will list all characteristics and their respective handles available on the device
:* <code>char-read-hnd 25</code> will read the characteristics value of handle 0x0025
:* <code>char-write-req 25 <nowiki><value></nowiki></code> will write ''value'' to handle 0x0025

Find out the handles you need to address by analyzing the captured BLE connection.

== Student Project ==
=== Summary ===
These are the results of a student project on Bluetooth hacking using an [[Ubertooth One, 2.4 GHz wireless development platform]]
=== Requirements ===

To produce the results, the book [[Hacking Internet of Things]] was used.

The [[Ubertooth One, 2.4 GHz wireless development platform|Ubertooth]] was tested on the following devices:

* [[Osram Ledvance Smart+ Multicolor HomeKit Classic A60 10W E27]]
* [[DOG&BONE® Bluetooth-Vorhängeschloss, Rot]]
* [[EQIVA Bluetooth Smart Türschlossantrieb]]

=== Authors ===

The project was conducted for the course [[Einführendes Wahlfachprojekt]] in the summer term 2018 by the bachelor students:

* Stefan Buschbeck
* Stefan Trinko
* Sebastian Ukleja

=== Used Hardware ===

* [[Ubertooth One, 2.4 GHz wireless development platform]]
* [[Room Thermostat Bluetooth ]]
* [[Mi band 4 fitness tracker]]

=== Results ===

* A [[:File:BLE Hacking Buschbeck Trinko Ukleja.pdf|documentation]] about the Bluetooth protocol itself and the analysis of the students
* The [[:File:Capture Files BLE.zip|capture files]] produced with the [[Ubertooth One, 2.4 GHz wireless development platform|Ubertooth]]

== References ==

* https://www.bluetooth.com/specifications/bluetooth-core-specification/
* https://github.com/greatscottgadgets/ubertooth/wiki
* https://github.com/mikeryan/crackle
*
[[File:Pentesting in IoT Bluetooth Sniffing.pdf]]

[[Category:Documentation]]

Bluetooth Sniffing with Ubertooth: A Step-by-step guide

2021-02-27T22:04:16Z

Bnagl: Integrated the Bluetooth Hacking Ubertooth Page content.

== Summary ==

This is a tutorial on how to sniff Bluetooth Low Energy (BLE) packets using the [[Ubertooth One, 2.4 GHz wireless development platform]] device.
This guide will detail the setup process and outline every step to capture a BLE connection. Furthermore, it will provide methods of bluetooth hacking, i.e cracking the encryption of a BLE connection and overwriting characteristics of a device.
This tutorial is created in regard to the seminar paper: [[File:Pentesting in IoT Bluetooth Sniffing.pdf]]

== Requirements ==

* Linux-based Operating system: this test used [https://www.kali.org/downloads/ Kali Linux 64-Bit v2019.4 native install]
* BLE devices
* Tools: crackle, gatttool

== BLE Fundamentals ==

Fundamentals of the BLE Standard can be found at the [[BLE Fundamentals]] documentation.

== Capturing BLE packets ==

=== Step 1 - Prerequisites ===

Ubertooth One offers a well-documented GitHub-repository [https://github.com/greatscottgadgets/ubertooth/wiki]. Follwowing its instructions, the device's tools require several components. To fulfill the demands, one has to install:

<code>sudo apt-get install cmake libusb-1.0-0-dev make gcc g++ libbluetooth-dev pkg-config python3-numpy python3-qtpy</code>

In contrast to the guide, the ''python-pyside'' component needs to be installed separately using the ''pip-installer'':

<code>pip install pyside3</code>

In order to for Ubertooth tools to decode Bluetooth packets the Bluetooth baseband library (''libbtbb'') needs to be downloaded and installed:

wget <nowiki>https://github.com/greatscottgadgets/libbtbb/archive/2018-12-R1.tar.gz -O libbtbb-2018-12-R1.tar.gz</nowiki>
tar -xf libbtbb-2018-12-R1.tar.gz
cd libbtbb-2018-12-R1
mkdir build
cd build
cmake ..
make
sudo make install
sudo ldconfig

Following that, the Ubertooth tools can be downloaded from the GitHub repository. They include host code, which enables sniffing Bluetooth packets. Additionally, they provide means to configure the Ubertooth device, including a simplified method for a firmware update.

wget <nowiki>https://github.com/greatscottgadgets/ubertooth/releases/download/2018-12-R1/ubertooth-2018-12-R1.tar.xz</nowiki>
tar xf ubertooth-2018-12-R1.tar.xz
cd ubertooth-2018-12-R1/host
mkdir build
cd build
cmake ..
make
sudo make install
sudo ldconfig

The Wireshark Bluetooth Baseband (''BTBB'') and Basic Rate/Enhanced Data Rate (''BR/EDR'') plugins facilitate the analysis of Bluetooth baseband traffic that has been captured within the Wireshark GUI.
The plugins need to be installed both separately from the ''libbtbb'' library. For the BTBB plugin the following commands have been used:

sudo apt-get install wireshark wireshark-dev libwireshark-dev cmake
cd libbtbb-2018-12-R1/wireshark/plugins/btbb
mkdir build
cd build
cmake -DCMAKE_INSTALL_LIBDIR=/usr/lib/x86_64-linux-gnu/wireshark/libwireshark3/plugins ..
make
sudo make install

It is important to state that the ''MAKE_INSTALL_LIBDIR'' directory can vary depending on the OS used and the wireshark installation. However, it should be the directory of existing Wireshark plugins.
The procedure needs to be repeated for the ''BR/EDR'' plugin.

cd libbtbb-2018-12-R1/wireshark/plugins/btbredr
mkdir build
cd build
cmake -DCMAKE_INSTALL_LIBDIR=/usr/lib/x86_64-linux-gnu/wireshark/libwireshark3/plugins ..
make
sudo make install

=== Step 2 - Verification & Firmware Update ===

After installing the prerequisits, the Ubertooth One device was plugged in through a USB port. It is of utmost importance to operate the Ubertooth One with the antenna attached to it. Otherwise, there is a risk of damaging the device. After inserting the device, verify that the system detects it:

<code>lsusb</code>

This will display information about USB buses in the system and the devices connected to them:

Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 005: ID 04f2:b595 Chicony Electronics Co., Camera
Bus 001 Device 004: ID 138a:003f Validity Sensors, Inc. VFS495
Bus 001 Device 003: ID 8087:0a2b Intel Corp.
Bus 001 Device 002: ID 1ea7:0064 SHARKOON Technologies 2.4G Mouse
Bus 001 Device 014: ID 1d50:6002 '''OpenMoko, Inc. Ubertooth One'''
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Upon first operation of the Ubertooth One it is necessary to update its firmware. The tools, which were downloaded before, facilitate a simplified way to achieve this task. Change the directory to the firmware directory of Ubertooth and execute the following command:

<code>ubertooth-dfu -d bluetooth_rxtx.dfu -r</code>

If the update is successful, this output will be produced:

Switching to DFU mode...
Checking firmware signature
........................................
........................................
........................................
Detached

To verify the firmware-version enter the following command:

<code>ubertooth-util -v</code>

=== Step 3 - Ubertooth Spectrum Analyzer ===

It is recommended to validate the functionality of the Ubertooth device via the spectrum analyzer, which is a tool to analyze the 2.4GHz band.
Specifically, it provides a Graphical User Interface (GUI) tool named ubertooth-specan-ui, which visually monitors the frequencies. This command will start the spectrum analyzer:

<code>ubertooth-specan-ui</code>

Once successful, you can see the analyzer work its task through a powerful GUI:

[[File:Ubertooth Spectrum Analyzer.png]]

In this case the figure shows several 802.11b networks in different channels, represented by green amplitudes.
The white amplitudes depict beacons that are visible during scanning. The red lines adjust to different centers of frequency channels in the 2.4GHz radio band.

=== Step 4 - Intercepting Lower Address Part (LAP) Packets ===

The ''BD_ADDR'' makes the allocation of sniffed Bluetooth packets possible. The Ubertooth One can start the LAP scan with this command:

<code>ubertooth-rx</code>

A continuous output will follow on the console:

systime=1578428685 ch=26 LAP=3a5138 err=1 clkn=8355 clk_offset=5199 s=-80 n=-55 snr=-25
systime=1578428688 ch=26 LAP=3a5138 err=1 clkn=18479 clk_offset=5628 s=-81 n=-55 snr=-26
systime=1578428692 ch=43 LAP=3a5138 err=2 clkn=28967 clk_offset=6029 s=-80 n=-55 snr=-25
systime=1578428692 ch=47 LAP=3a5138 err=2 clkn=30327 clk_offset=6069 s=-81 n=-55 snr=-26
systime=1578428694 ch=52 LAP=3a5138 err=1 clkn=36948 clk_offset=87 s=-79 n=-55 snr=-24
systime=1578428696 ch=53 LAP=3a5138 err=0 clkn=42360 clk_offset=302 s=-77 n=-55 snr=-22

In the output '''ch''' represents the channel used by the device referenced in the LAP value.
The channel hopping is clearly comprehensible. '''Clkn''' indicates the master`s clock, while '''s''' references the signal strength and '''n''' states the value of noise.
Following that the '''snr''' value represents the signal-to-noise ratio.
This mode is especially helpful for undiscoverable devices, because it can calculate a BD_ADDR through the LAP in combination with the other parameters.

Alternatively, if the devices are discoverable, you can use the BLE scan of hcitools:

<code>sudo hcitool lescan</code>

Among eventual other devices you should see the BLE devices you are testing, in this case the thermostat and the fitness tracker:

D5:AA:D0:41:A3:60 Mi Smart Band 4
78:A5:04:62:71:3D TepHeatB
[...]

=== Step 5 - The Ubertooth-BTLE Tool ===

One of the most powerful tools the Ubertooth One provides is the Bluetooth Low Energy sniffing mode.
Among other things, it can sniff and follow connections and even interfere with them.
In the "follow" mode, Ubertooth listens on one of the three advertising channels.
Once a BLE connection is established (on the advertising channel the device has been listenting to), Ubertooth will follow the hops along the data channels capturing the transmissions between the devices.
Per default, Ubertooth can be used to follow any connection it observes randomly.
Naturally, the device can be restricted to observe a specific device by providing the ''BD_ADDR'' of the device in question.
The general syntax of the corresponding command for "follow" mode looks like:

<code>ubertooth-btle -f <nowiki><BD_ADDR></nowiki></code>

Simply replace the ''BD_ADDR'' with the address you found out earlier:

<code>ubertooth-btle -f 78:A5:04:62:71:3D</code>

This will produce a continuous output in the console.

Furthermore, it is possible to redirect the output into a file or a pipe.
To achieve this, the syntax requires this generic command:

<code>ubertooth-btle -f <nowiki><BD_ADDR> -c <file or pipe></nowiki></code>

=== Step 6 - Wireshark Analysis ===

It is also possible to analyze the captured BLE packets in Wireshark.
For this purpose create a pipe via:

<code>mkfifo /tmp/pipe</code>

Following that, a new interface needs to be added to Wireshark in order to use the just created pipe.

[[File:Wireshark manage interface.png|frameless|450px]]

For this, the custom pipe ''/tmp/mypipe'' was added to the list of interfaces.

[[File:Wireshark add pipe.png|frameless|450px]]

Now repeat the command from Step 5, but now with a redirected ouput to the pipe:

<code>ubertooth-btle -f 78:A5:04:62:71:3D -c /tmp/pipe</code>

Select the custom interface you have just created in Wireshark to be able to analyze packtets with enhanced visibility and additional information.

[[File:Wireshark Thermo ConnectReq.png|frameless|1000px]]

== Exploiting BLE ==

After capturing the data it is possible to use additional third party tools in combination with Ubertooth to obtain critical information.
In the following this is outlined through the utilization of the tools ''crackle'' and ''gatttool''.

=== Crackle ===

Crackle is a tool that attempts to decrypt BLE Encryption.
Crackle is the right tool if you have captured a connection based on BLE Legacy Pairing.
It can not decrypt LE Secure Connections based transmissions.
Note that even if you are using Kali Linux the pre-installed version of crackle may be out of date without any possibility to update it through the respective repositories.
It is recommended that you use the master branch from crackle GitHub-repository [https://github.com/mikeryan/crackle].

git clone <nowiki>https://github.com/mikeryan/crackle.git</nowiki>
cd crackle
make

Now you can use the latest version of the tool by executing this command:

<code>./crackle -i <nowiki><your_file.pcap></nowiki></code>

In this test, the captured connection revealed that the thermostat used no encryption and the fitness tracker used LE Secure Connections.
In this regard, crackle was unsuccessful in both instances.
When applied to the thermostat connection the output looked like this:

[[File:Crackle thermostat.png|frameless|600px]]

This is due to the fact that the thermostat connection has no encryption. Naturally, there is nothing to break. Note that you can receive a similar result if the connection uses some form of encryption but ubertooth fails to capture the respective packets. Ubertooth cannot track 100% of the transmissions.
In the case of the fitness tracker the output clearly states that the device is running LE Secure Connections.

[[File:Crackle fitnesstracker.png|frameless|600px]]

To show that crackle can indeed decrypt keys of Legacy Pairing connections we run the tool on the sample data provided [https://lacklustre.net/bluetooth/crackle-sample.tgz here].

[[File:Crackle sampledata.png|frameless|600px]]

=== Gatttool ===

The utility ''gatttool'' can be used to manipulate characteristics attribute-values.
In the following we change the temperature value of the thermostat.

Connect to your device using the following command:

<code>gatttool -b 78:A5:04:62:71:3D -I</code>

This will give you a prompt. Type "connect" to innitiate pairing with the device:

[78:A5:04:62:71:3D][LE]> connect
Attempting to connect to 78:A5:04:62:71:3D
Connection successful
'''[78:A5:04:62:71:3D]'''[LE]>

Now you can use a variety of commands to send read/write requests to your connected device:
:* <code>characteristics</code> will list all characteristics and their respective handles available on the device
:* <code>char-read-hnd 25</code> will read the characteristics value of handle 0x0025
:* <code>char-write-req 25 <nowiki><value></nowiki></code> will write ''value'' to handle 0x0025

Find out the handles you need to address by analyzing the captured BLE connection.

== Demo Project ==
=== Summary ===
These are the results of a student project on Bluetooth hacking using an [[Ubertooth One, 2.4 GHz wireless development platform]]
=== Requirements ===

To produce the results, the book [[Hacking Internet of Things]] was used.

The [[Ubertooth One, 2.4 GHz wireless development platform|Ubertooth]] was tested on the following devices:

* [[Osram Ledvance Smart+ Multicolor HomeKit Classic A60 10W E27]]
* [[DOG&BONE® Bluetooth-Vorhängeschloss, Rot]]
* [[EQIVA Bluetooth Smart Türschlossantrieb]]

=== Authors ===

The project was conducted for the course [[Einführendes Wahlfachprojekt]] in the summer term 2018 by the bachelor students:

* Stefan Buschbeck
* Stefan Trinko
* Sebastian Ukleja

=== Used Hardware ===

* [[Ubertooth One, 2.4 GHz wireless development platform]]
* [[Room Thermostat Bluetooth ]]
* [[Mi band 4 fitness tracker]]

=== Results ===

* A [[:File:BLE Hacking Buschbeck Trinko Ukleja.pdf|documentation]] about the Bluetooth protocol itself and the analysis of the students
* The [[:File:Capture Files BLE.zip|capture files]] produced with the [[Ubertooth One, 2.4 GHz wireless development platform|Ubertooth]]

== References ==

* https://www.bluetooth.com/specifications/bluetooth-core-specification/
* https://github.com/greatscottgadgets/ubertooth/wiki
* https://github.com/mikeryan/crackle
*
[[File:Pentesting in IoT Bluetooth Sniffing.pdf]]

[[Category:Documentation]]

Lightbulb Worm

2021-02-27T21:58:49Z

Bnagl: Added the reference

== Introduction ==

The Lightbulb Worm can attack all Smart Lightbulbs but in this example everything is done with the Philips Hue System.In this System one or more Lightbulbs are communicating over the ZigBee Light Link Protocol with a Bridge that is connected to the Internet.

[[File:HueSystem.jpg]]

The Lightbulb Worm itself is purely theoretical but all the parts that make it possible have been practically carried out.

== Attack Overview ==

At first, modified Hardware is used to bypass a proximity check so that the full 70 - 400m Range (Indoor - Outdoor) can be used to reconnect the Lightbulb to another Network.
The Firmware Update Process was reverse engineered, allowing the attacker to install any homemade firmware on the Lightbulb.
This Firmware can now theoretically block other Updates, thus bricking the Lamp, and run any arbitrary code, including infecting other Lightbulbs in Range.
With the proximity check disabled, there is now a approxiomately 100m range in which other Lightbulbs can be infected thus there is a possibility to infect a whole city worth of Lamps if they are in close range to each other.

== Bypassing the Proximity Check ==
The Proximity check is carried out on every ZigBee Ligt Link compliant stack and product to ensure that only a very close (~1m) Device can reset and start a new Network connection for another Device.
This is made possible by checking the received signal strength indication (RSSI) and if this value is above a certain threshold, the Device saves the Message Parameters as Transaction ID.
Upon receiving any other Message, it checks the Transaction ID and drops the Message if the ID is not present. A Transaction ID of 0 does not need to be checked because there is a basic sanity check that rules it out beforehand.

This sanity check is only done with scan Requests.

Any other Message with a Transaction ID of 0 is received and processed as valid. That means if a Broadcast with a Transaction ID of 0 and the content: "Reset to Factory default" is sent, the Lightbulb will process it. Broadcasts of this Message are normally not allowed but the Lightbulbs do not care about that. After the reset only a ZigBee Beacon Message needs to be sent to connect them to the attackers Network. Now the Lightbulbs are ready for a custom firmware.

== Reverse Engineering the Firmware Update Process ==
A side channel power analysis of a disassembeled Lightbulb and Bridge confirmed that the Firmware for a Lightbulb has to be encrypted and authenticated with AES-CCM (CTR mode with CBC-MAC).
It also deduced that the same Key is used to encrypt and authenticate. Also the Lightbulbs all use the same global Key which was of course leaked.
Through all of this the Firmware Update Process is now clear and a Firmware File can be obtained and modified

== Firmware from Scratch ==
The first Test was just a few changes to the Update File which was then re-encrypted to see if the Lightbulb accepts it, which it did. After that a Program was written to read the Flash Memory so that the File Layout of the Update File can be deduced. With the Layout known, any arbitratry Code can be implemented in the Firmware.

== Possible Effects ==

;Bricking the Bulb
:Any Effect will be permanent (Blackout, constant Flickering)
:Can only be reprogrammed at the PCB Level
;Wireless Network Jamming
:High Power Transmissions over 2,4GHz
;Data infiltration and exfiltration
:by changing and reading data such as Model or Version
;Epileptic Seizures

== Countermeasures ==
Philips has already provided a patch to the Proximity Check to ensure it only works over a Distance of approximately 1m

;Other Countermeasures which should be taken
:Each Lightbulb should have a unique key
:Asymmetric Cryptography should be used for Software Verification

== Hardware ==

[[Philips Hue Bridge 2.0, Gateway]]

[[Philips Hue White LED E27 9.5W/827, white]]

== Reference ==
* https://www.blackhat.com/docs/us-16/materials/us-16-OFlynn-A-Lightbulb-Worm.pdf
* http://colinoflynn.com/wp-content/uploads/2016/08/us-16-OFlynn-A-Lightbulb-Worm-wp.pdf

[[Category:Documentation]]
[[Category:Basic]]

Pineapple Setup

2021-02-27T21:53:03Z

Bnagl:

== Summary ==

Setup and Firmware upgrade [optional] of Wifi Pineapple Nano

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64

== Description ==

=== Basic setup ===
* Connect antennas and USB Y cable, WiFi Pineapple NANO needs a stable USB power supply capable of providing 9W for initial setup. Therefore plug both USB Ports of USB Y cable into the Laptop. After that he blue led should have solid light.

[[File:Pineapplenanothings.jpg|500px|WiFi Pineapple Nano]]

* Use lusb to verify that pineapple ASIX Electronics is recognized by your laptop

lsusb
...
Bus 001 Device 004: ID 0b95:772a ASIX Electronics Corp. AX88772A Fast Ethernet
...

* Check networking interface and ip address

sudo ifconfig
enx00c0ca91b581: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.16.42.107 netmask 255.255.255.0 broadcast 172.16.42.255
inet6 fe80::d2b0:568c:b39b:4c44 prefixlen 64 scopeid 0x20<link>
ether 00:c0:ca:91:b5:81 txqueuelen 1000 (Ethernet)
RX packets 15 bytes 1589 (1.5 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 40 bytes 5589 (5.4 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

* Browse to the determined IP address 172.16.42.1:1471

The Web interface should appear.
The interface then appearing is the main User Interface (UI) where the user is able to work with the WiFi Pineapple Nano. This UI is further described in: https://wiki.elvis.science/index.php?title=Wifi_Pineapple_Nano

=== User Interface ===
After connecting the Pineapple Nano to your device correctly as can be seen above, a User Interface (UI) opens under the IP address 172.16.42.1:1471

The User Interface is the main working space for the penetration tester. The UI includes:
* Dashboard - shows the uptime of the device, the clients connected and the SSIDs in the pool
* Recon - scanning the Network
* Clients - List of Clients connected
* Tracking
* Modules - List of downloadable Modules
* Filters - Filtering Clients and connections
* PineAP - Main part of creating a new WiFi where youc an see the SSID pool, add and remove them and start it in order for the SSIDs to be public
* Logging
* Reporting
* Networking
* Configuration
* Advances
* Notes
* Help

=== Upgrade to newest firmware version 2.5.4 [optional] ===

* Download newest firmware from https://www.wifipineapple.com/downloads and verify shasum:

sha256sum upgrade-2.5.4.bin
98b6190393ed3bc270966645f94a4fdbe21ea8f2d74dec88d88267fe60d3dc85 upgrade-2.5.4.bin

* Select file with newest firmware upgrade-2.5.4.bin in the Web interface
** press reset button
** wait until firmware upgrade successfully verified appears
* After upgrade connect again to 172.16.42.107:1471 and get into Device Configuration
** Set root password for ssh and web interface access
** pwd: <ask for>
* Management AP Setup
** Management SSID:
** WPA2 pwd: <ask for>
** check Hide Management AP
* Open AP Setup
is used for the target to connect to: f.e. **netlab**

* Run with wp6.sh script

gwget wifipineapple.com/wp6.sh
chmod +x wp6.sh
./wp6.sh

== Used Hardware ==

[[Wifi Pineapple Nano]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

== References ==

* https://docs.hak5.org/hc/en-us/articles/360010555313-Setup-Basics
* https://www.youtube.com/watch?v=CrHbEZd4t00

[[Category:Documentation]]

Pineapple Setup

2021-02-27T21:52:41Z

Bnagl: Relocated documentation from WiFi Pineapple Nano Hardware Page

== Summary ==

Setup and Firmware upgrade [optional] of Wifi Pineapple Nano

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64

== Description ==

=== Basic setup ===
* Connect antennas and USB Y cable, WiFi Pineapple NANO needs a stable USB power supply capable of providing 9W for initial setup. Therefore plug both USB Ports of USB Y cable into the Laptop. After that he blue led should have solid light.

[[File:Pineapplenanothings.jpg|500px|WiFi Pineapple Nano]]

* Use lusb to verify that pineapple ASIX Electronics is recognized by your laptop

lsusb
...
Bus 001 Device 004: ID 0b95:772a ASIX Electronics Corp. AX88772A Fast Ethernet
...

* Check networking interface and ip address

sudo ifconfig
enx00c0ca91b581: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.16.42.107 netmask 255.255.255.0 broadcast 172.16.42.255
inet6 fe80::d2b0:568c:b39b:4c44 prefixlen 64 scopeid 0x20<link>
ether 00:c0:ca:91:b5:81 txqueuelen 1000 (Ethernet)
RX packets 15 bytes 1589 (1.5 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 40 bytes 5589 (5.4 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

* Browse to the determined IP address 172.16.42.1:1471

The Web interface should appear.
The interface then appearing is the main User Interface (UI) where the user is able to work with the WiFi Pineapple Nano. This UI is further described in: https://wiki.elvis.science/index.php?title=Wifi_Pineapple_Nano

== User Interface ==
After connecting the Pineapple Nano to your device correctly as can be seen above, a User Interface (UI) opens under the IP address 172.16.42.1:1471

The User Interface is the main working space for the penetration tester. The UI includes:
* Dashboard - shows the uptime of the device, the clients connected and the SSIDs in the pool
* Recon - scanning the Network
* Clients - List of Clients connected
* Tracking
* Modules - List of downloadable Modules
* Filters - Filtering Clients and connections
* PineAP - Main part of creating a new WiFi where youc an see the SSID pool, add and remove them and start it in order for the SSIDs to be public
* Logging
* Reporting
* Networking
* Configuration
* Advances
* Notes
* Help

=== Upgrade to newest firmware version 2.5.4 [optional] ===

* Download newest firmware from https://www.wifipineapple.com/downloads and verify shasum:

sha256sum upgrade-2.5.4.bin
98b6190393ed3bc270966645f94a4fdbe21ea8f2d74dec88d88267fe60d3dc85 upgrade-2.5.4.bin

* Select file with newest firmware upgrade-2.5.4.bin in the Web interface
** press reset button
** wait until firmware upgrade successfully verified appears
* After upgrade connect again to 172.16.42.107:1471 and get into Device Configuration
** Set root password for ssh and web interface access
** pwd: <ask for>
* Management AP Setup
** Management SSID:
** WPA2 pwd: <ask for>
** check Hide Management AP
* Open AP Setup
is used for the target to connect to: f.e. **netlab**

* Run with wp6.sh script

gwget wifipineapple.com/wp6.sh
chmod +x wp6.sh
./wp6.sh

== Used Hardware ==

[[Wifi Pineapple Nano]]

== Courses ==

* [[Campus Cyber Security Team]] WiFi Hacking 21.06.2019

== References ==

* https://docs.hak5.org/hc/en-us/articles/360010555313-Setup-Basics
* https://www.youtube.com/watch?v=CrHbEZd4t00

[[Category:Documentation]]

Lightbulb Worm

2021-02-27T21:47:26Z

Bnagl: Added the reference

== Introduction ==

The Lightbulb Worm can attack all Smart Lightbulbs but in this example everything is done with the Philips Hue System.In this System one or more Lightbulbs are communicating over the ZigBee Light Link Protocol with a Bridge that is connected to the Internet.

[[File:HueSystem.jpg]]

The Lightbulb Worm itself is purely theoretical but all the parts that make it possible have been practically carried out.

== Attack Overview ==

At first, modified Hardware is used to bypass a proximity check so that the full 70 - 400m Range (Indoor - Outdoor) can be used to reconnect the Lightbulb to another Network.
The Firmware Update Process was reverse engineered, allowing the attacker to install any homemade firmware on the Lightbulb.
This Firmware can now theoretically block other Updates, thus bricking the Lamp, and run any arbitrary code, including infecting other Lightbulbs in Range.
With the proximity check disabled, there is now a approxiomately 100m range in which other Lightbulbs can be infected thus there is a possibility to infect a whole city worth of Lamps if they are in close range to each other.

== Bypassing the Proximity Check ==
The Proximity check is carried out on every ZigBee Ligt Link compliant stack and product to ensure that only a very close (~1m) Device can reset and start a new Network connection for another Device.
This is made possible by checking the received signal strength indication (RSSI) and if this value is above a certain threshold, the Device saves the Message Parameters as Transaction ID.
Upon receiving any other Message, it checks the Transaction ID and drops the Message if the ID is not present. A Transaction ID of 0 does not need to be checked because there is a basic sanity check that rules it out beforehand.

This sanity check is only done with scan Requests.

Any other Message with a Transaction ID of 0 is received and processed as valid. That means if a Broadcast with a Transaction ID of 0 and the content: "Reset to Factory default" is sent, the Lightbulb will process it. Broadcasts of this Message are normally not allowed but the Lightbulbs do not care about that. After the reset only a ZigBee Beacon Message needs to be sent to connect them to the attackers Network. Now the Lightbulbs are ready for a custom firmware.

== Reverse Engineering the Firmware Update Process ==
A side channel power analysis of a disassembeled Lightbulb and Bridge confirmed that the Firmware for a Lightbulb has to be encrypted and authenticated with AES-CCM (CTR mode with CBC-MAC).
It also deduced that the same Key is used to encrypt and authenticate. Also the Lightbulbs all use the same global Key which was of course leaked.
Through all of this the Firmware Update Process is now clear and a Firmware File can be obtained and modified

== Firmware from Scratch ==
The first Test was just a few changes to the Update File which was then re-encrypted to see if the Lightbulb accepts it, which it did. After that a Program was written to read the Flash Memory so that the File Layout of the Update File can be deduced. With the Layout known, any arbitratry Code can be implemented in the Firmware.

== Possible Effects ==

;Bricking the Bulb
:Any Effect will be permanent (Blackout, constant Flickering)
:Can only be reprogrammed at the PCB Level
;Wireless Network Jamming
:High Power Transmissions over 2,4GHz
;Data infiltration and exfiltration
:by changing and reading data such as Model or Version
;Epileptic Seizures

== Countermeasures ==
Philips has already provided a patch to the Proximity Check to ensure it only works over a Distance of approximately 1m

;Other Countermeasures which should be taken
:Each Lightbulb should have a unique key
:Asymmetric Cryptography should be used for Software Verification

== Hardware ==

[[Philips Hue Bridge 2.0, Gateway]]

[[Philips Hue White LED E27 9.5W/827, white]]

== Reference ==
* http://colinoflynn.com/wp-content/uploads/2016/08/us-16-OFlynn-A-Lightbulb-Worm-wp.pdf

[[Category:Documentation]]
[[Category:Basic]]

Keyestudio 4WD Bluetooth multifunctional car kit

2021-02-19T15:58:36Z

Bnagl: Added the code for the Projekts: Line-Tracking, IR-Receiver/IR-Remote controlgmx, Obstacle Avoidance

== Summary ==

This documentation is about the keyestudio 4WD Bluetooth Multi-functional Car Kit. The documentation contains schematics, tipps and code for the car.

== Requirements ==

* Arduino IDE
* 18650 Batteries (not included in kit)

== Description ==
=== Component list ===
<table style="border: solid 1px black; width:50% border-collapse: collapse; border-spacing: 0;">
<tr style="border: solid 1px black; padding: 5px 10px;">
<th style="border: solid 1px black; width:30%; padding: 5px 10px; text-align: center;">Product Name</th>
<th style="border: solid 1px black; width:20%; text-align: center; padding: 5px 10px;">Quantity</th>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio UNO R3</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio Shield V5</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio L298N Motor Shield</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio Bluetooh HC-06</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">I2C 1602 LCD</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio Line Tracking Sensor</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">3</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">HC-SR04 Ultrasonic Sensor</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">keyestudio Digital IR Receiver Module</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4WD Top PCB</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4WD Bottom PCB</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Servo Motor</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Servo Plastic Platform</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">IR Remote Control</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Toggle Switch + Wire</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">18650 Battery Holder</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">DC Motor</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Motor Fixed Part</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Plastic Tire</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Copper Pillar 40MM</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">6</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Copper Pillar 10MM</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">USB Cable</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Jumper Wire</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">30</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">M3*6MM Round Head Screw</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">60</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">M3*8MM Flat Head Screw</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">2</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">M3*30MM Round Head Screw</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">8</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">3MM Nut</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Connector Wire (150mm, Black)</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">6</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Connector Wire (150mm, Red)</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">6</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">Winding Wire (12CM)</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
</tr>
</table>

== Assembly ==

Follow the User Manual. If something is unclear then watch a assembly video. Be careful when installing the motors, make sure they’re all properly aligned, if not the car will pull to one side.
Especially take care that no cables sticks into the motors.

== Motor control ==
We control the motor using a H-Bridge L298N Motor Driver. Use a exxternal 5V logic supply when using more than 12V driving voltage.

[[File:Motor_Driver.png|500px]]

In our case we need to plug two motors to each motorA and motorB. Connect the power from the battery pack VSS and GND.

[[File:Motor_Driver_schematics.png|500px]]

Wire the motor to the Arduino/Sensor Shield as adviced in the user manual.

=== Specification: ===
* Working Mode: H bridge (double lines)
* Control Chip: L298N (ST)
* Logical Voltage: 5V
* Driving Voltage: 5V-35V
* Logical Current: 0mA-36mA>
* Driving Current: 2A (MAX single bridge)
* Storage Temperature: (-20 °C)-(+135 °C)
* Maximum Power: 25W
* Weight: 30g
* Periphery Dimension: 43 x 43 x 27 mm(L x W x H)

=== Code ===
==== Initiation ====
//define the output pins.
int IN1=5;
int IN2=6;
int IN3=7;
int IN4=8;
int ENA=9;
int ENB=10;
void setup() {
//set up the pins to act as output.
for (int i = 5; i < 11;i++)
{
pinMode(i,OUTPUT);
}
delay(5000);
}
==== Rotate Counter Clockwise ====

void turnCounterClockwise()
{
analogWrite(ENA,0);
analogWrite(ENB,0);
digitalWrite(IN1,LOW);
digitalWrite(IN2,HIGH);

digitalWrite(IN3,LOW);
digitalWrite(IN4,HIGH);
delay(150);
analogWrite(ENA,200);
analogWrite(ENB,200);
}

==== Rotate Clockwise ====
void turnClockwise()
{
analogWrite(ENA,0);
analogWrite(ENB,0);
digitalWrite(IN1,HIGH);
digitalWrite(IN2,LOW);

digitalWrite(IN3,HIGH);
digitalWrite(IN4,LOW);
delay(150);
analogWrite(ENA,200);
analogWrite(ENB,200);
}

==== Drive Forward ====

void driveForward()
{
analogWrite(ENA,0);
analogWrite(ENB,0);
digitalWrite(IN1,LOW);
digitalWrite(IN2,HIGH);

digitalWrite(IN3,HIGH);
digitalWrite(IN4,LOW);
delay(150);
analogWrite(ENA,100);
analogWrite(ENB,100);
}

==== Drive Reverse ====

void driveReverse()
{
analogWrite(ENA,0);
analogWrite(ENB,0);
digitalWrite(IN1,HIGH);
digitalWrite(IN2,LOW);

digitalWrite(IN3,LOW);
digitalWrite(IN4,HIGH);
delay(150);
analogWrite(ENA,100);
analogWrite(ENB,100);
}

==== Brake ====
void brake()
{
analogWrite(ENA,0);
analogWrite(ENB,0);
}

== I2C Display ==
The display is controlled with I2C. I am using the Wire and LiquidCrystal_I2C library to control the display.

=== Specification ===

* I2C Address: 0x27
* Back Lit (Blue with white char color)
* Supply Voltage: 5V
* Interface:I2C/TWI x1,Gadgeteer interface x2
* Adjustable Contrast
* Size:82x35x18 mm

=== Schematics ===
[[File:I2C_Display_Schematics.png|800px]]
=== Code ===
<div style="border: 1px solid #31708f; background-color: #d9edf7; color: #31708f; padding: 5px 10px; margin-bottom: 5px; text-align: justify"><b>Note</b>: Don't use the library link that is in the manual, it contains a bug where only the first character of the strings is displayed on the I2C display. Download the latest version from https://www.arduinolibraries.info/libraries/liquid-crystal-i2-c.
</div>
#include <Wire.h>
#include <LiquidCrystal_I2C.h>
//set the LCD address to 0x27 for a 16 chars and 2 line display
LiquidCrystal_I2C lcd(0x27,16,2);
void setup()
{
//initialize the lcd
lcd.init();
//enable the backlight
lcd.backlight();
//set the cursor to the first line.
lcd.setCursor(3,0);
//print text
lcd.print("Hello");
//set the cursor in the next line.
lcd.setCursor(3,1);
//print text
lcd.print("world!");
}

void loop()
{}

== Servo Motor ==
The Servo Motor is controlled with PWM. The Sketch rotates the motor in an angle between 110 and 180 degres.

=== Schematics ===
[[File:Servo_Motor_Schematics.png|400px]]

=== Code ===

int servopin=2;// select digital pin 9 for servomotor signal line
int myangle;// initialize angle variable
int pulsewidth;// initialize width variable
int val;

void servopulse(int servopin,int myangle)// define a servo pulse function
{
pulsewidth=(myangle*11)+500;// convert angle to 500-2480 pulse width
digitalWrite(servopin,HIGH);// set the level of servo pin as “high”
delayMicroseconds(pulsewidth);// delay microsecond of pulse width
digitalWrite(servopin,LOW);// set the level of servo pin as “low”
delay(20-pulsewidth/1000);
}

void setup()
{
pinMode(servopin,OUTPUT);// set servo pin as “output”
Serial.begin(9600);// connect to serial port, set baud rate at “9600”
Serial.println("ready" ) ;
}

void loop(){
val = 180;
Serial.print("moving servo to ");
Serial.print(val);
Serial.println();
for(int i=0;i<=25;i++) // giving the servo time to rotate to commanded position
{
servopulse(servopin,val);// use the pulse function
}
val = 110;
Serial.print("moving servo to ");
Serial.print(val);
Serial.println();
for(int i=0;i<=25;i++) // giving the servo time to rotate to commanded position
{
servopulse(servopin,val);// use the pulse function
}
}

== Ultra Sonic Sensor ==
I used the pins: echoPin 3 and trigPin 4 because 7 and 8 is already taken by the motordriver.
If you don't understand the line: distance = duration/58.3;.
The speed of sound is 343 m/s. We messure the round trip so we need to divide the 343 with 2 which gives us 171.5 m/s. But we don’t want to deal with meters and seconds we want centimeters and microseconds. 17150 cm/s = 0.017150 cm/us = 1cm/58.3 us.

=== Specification ===
* Working Voltage: DC 5V
* Working Current: 15mA
* Working Frequency: 40Hz
* Max Range: 4m
* Min Range: 2cm
* Measuring Angle: 15 degree
* Trigger Input Signal: 10µS TTL pulse
* Echo Output Signal Input TTL lever signal and the range in proportion
* Size: 46*20.4mm
* Weight: 9g

=== Schematics ===
[[File:Ultra_Sonic_Schematics.png|650px]]

=== Code ===

#define echoPin 7 // Echo Pin
#define trigPin 8 // Trigger Pin
#define LEDPin 13 // Onboard LED

int maximumRange = 200; // Maximum range needed
int minimumRange = 0; // Minimum range needed
long duration, distance; // Duration used to calculate distance

void setup() {
Serial.begin (9600);
pinMode(trigPin, OUTPUT);
pinMode(echoPin, INPUT);
pinMode(LEDPin, OUTPUT); // Use LED indicator (if required)
}

void loop() {
/* The following trigPin/echoPin cycle is used to determine the
distance of the nearest object by bouncing soundwaves off of it. */
digitalWrite(trigPin, LOW);
delayMicroseconds(2);

digitalWrite(trigPin, HIGH);
delayMicroseconds(10);
digitalWrite(trigPin, LOW);
duration = pulseIn(echoPin, HIGH);

//Calculate the distance (in cm) based on the speed of sound.
distance = duration/58.3;

if (distance >= maximumRange || distance <= minimumRange){
/* Send a negative number to computer and Turn LED ON
to indicate "out of range" */
Serial.println("-1");
digitalWrite(LEDPin, HIGH);
}
else {
/* Send the distance to the computer using Serial protocol, and
turn LED OFF to indicate successful reading. */
Serial.println(distance);
digitalWrite(LEDPin, LOW);
}
//Delay 50ms before next reading.
delay(50);
}

== Line Tracking Sensor ==

=== Specification ===
* Power Supply: +5V
* Operating Current: <10mA
* Operating Temperature Range: 0°C ~ + 50°C
* Output Interface: 3-wire interface (1 - signal, 2 - power, 3 - power supply negative)
* Output Level: TTL level

=== Schematics ===
[[File:Line_Tracking_Sensor_Schematics.png|600px]]

=== Code ===
I used the pins 0-2 for the 3 line tracking sensors. This sketch is used to test the line tracking sensors.
const int sensorPin1 = 0;
const int sensorPin2 = 1;
const int sensorPin3 = 2; // the number of the sensor pin
const int ledPin = 13; // the number of the LED pin
int sensorState = 0; // variable for reading the sensor status
void setup()
{
pinMode(ledPin, OUTPUT);
pinMode(sensorPin1, INPUT);
pinMode(sensorPin2, INPUT);
pinMode(sensorPin3, INPUT);
}
void loop()
{
// read the state of the sensor value:
sensorState = digitalRead(sensorPin1);
// if the sensorState is HIGH:
if (sensorState == HIGH)
{
digitalWrite(ledPin, HIGH);
}
else
{
digitalWrite(ledPin, LOW);
}
}

== Digital IR Receiver Module ==
=== Specification ===
* Power Supply: 5V
* Interface: Digital
* Modulate Frequency: 38kHz
* Module Interface Socket: JST PH2.0

<table style="border: solid 1px black; width:50% border-collapse: collapse; border-spacing: 0;">
<tr style="border: solid 1px black; padding: 5px 10px;">
<th style="border: solid 1px black; width:30%; padding: 5px 10px; text-align: center;">Button</th>
<th style="border: solid 1px black; width:20%; text-align: center; padding: 5px 10px;">HexValue</th>
<th style="border: solid 1px black; width:20%; text-align: center; padding: 5px 10px;">DecValue</th>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">ArrowUp</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF629D</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16736925</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">ArrowDown</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FFA857</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16754775</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">ArrowRight</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FFC23D</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16761405</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">ArrowLeft</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF22DD</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16720605</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">1</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF6897</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16738455</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">2</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF9867</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16750695</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">3</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FFB04F</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16756815</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">4</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF30CF</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16724175</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">5</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF18E7</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16718055</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">6</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF7A85</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16743045</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">7</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF10EF</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16716015</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">8</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF38C7</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16726215</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">9</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF5AA5</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16734885</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">0</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF4AB5</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16730805</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">OK</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF02FD</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16712445</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">*</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF32BD</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16728765</td>
</tr>
<tr style="border: solid 1px black; padding: 5px 10px;"">
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">#</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">FF52AD</td>
<td style="text-align: center; border: solid 1px black; padding: 5px 10px;">16732845</td>
</tr>
</table>

=== Schematics ===
[[File:IR_Receiver_Schematics.png|600px]]
=== Code ===
==== Output IR-Remote control values ====
My intention is to steer the car with the IR-Remote-Control included in the kit. This sketch outputs the values the IR-Receiver gets from the remote control so I know the values I'm working with.

# include <IRremote.h>
int RECV_PIN = 11;
IRrecv irrecv(RECV_PIN);
decode_results results;
void setup()
{
Serial.begin(9600);
irrecv.enableIRIn(); // Start the receiver
}
void loop()
{
if (irrecv.decode(&results))
{
Serial.println(results.value, HEX);
irrecv.resume(); // Receive the next value
}
}
==== Steer car with IR-Remote control ====
# include <IRremote.h>
int IN1 = 5;
int IN2 = 6;
int IN3 = 7;
int IN4 = 8;
int ENA = 9;
int ENB = 10;
int RECV_PIN = 11;
IRrecv irrecv(RECV_PIN);
decode_results results;
decode_results lastResult;
void setup()
{
for (int i = 5; i < 11; i++)
{
pinMode(i, OUTPUT);
}
Serial.begin(9600);
irrecv.enableIRIn(); // Start the receiver
}
void loop()
{
if (irrecv.decode(&results))
{
if (results.value != lastResult.value)
{
switch (results.value)
{
//ArrowUp
case 16736925:
driveForward();
break;
//ArrowDown
case 16754775:
driveReverse();
break;
//ArrowRight
case 16761405:
turnClockwise();
break;
//ArrowLeft
case 16720605:
turnCounterClockwise();
break;
//Ok
case 16712445:
brake();
break;
}
lastResult = results;
}
irrecv.resume(); // Receive the next value
}
}

void driveForward()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, LOW);
digitalWrite(IN2, HIGH);

digitalWrite(IN3, HIGH);
digitalWrite(IN4, LOW);
delay(150);
analogWrite(ENA, 100);
analogWrite(ENB, 100);
}

void driveReverse()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, HIGH);
digitalWrite(IN2, LOW);

digitalWrite(IN3, LOW);
digitalWrite(IN4, HIGH);
delay(150);
analogWrite(ENA, 100);
analogWrite(ENB, 100);
}

void turnClockwise()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, HIGH);
digitalWrite(IN2, LOW);

digitalWrite(IN3, HIGH);
digitalWrite(IN4, LOW);
delay(150);
analogWrite(ENA, 150);
analogWrite(ENB, 150);
}

void turnCounterClockwise()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, LOW);
digitalWrite(IN2, HIGH);

digitalWrite(IN3, LOW);
digitalWrite(IN4, HIGH);
delay(150);
analogWrite(ENA, 150);
analogWrite(ENB, 150);
}

void brake()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
}

== Bluetooth Module ==
=== Specification ===
* Bluetooth Protocol: Bluetooth 2.1+ EDR Standard
* USB Protocol: USB v1.1/2.0
* Operating Frequency: 2.4GHz ISM Frequency Band
* Modulation Mode: Gauss Frequency Shift Keying
* Transmit Power: ≤ 4dBm, Second Stage
* Sensitivity: ≤-84dBm at 0.1% Bit Error Rate
* Transmission Speed: 2.1Mbps(Max)/160 kbps(Asynchronous)； 1Mbps/1Mbps(Synchronous)
* Safety Feature: Authentication and Encryption
* Supported Configuration: Bluetooth Serial Port (major and minor)
* Supply Voltage: 5V DC 50mA
* Operating Temperature: -20 to 55℃
=== Schematics ===
[[File:Bluetooth_Module_Schematics.png|600px]]
=== Code ===

== Obstacle Avoidance ==
This code measures the distance between the car and the object in front of it. If the distance between both is under 15cm the car will turn 180° and continue to drive forward. I used the Ultra-Sonic Sensor to measure the distance and the I2C-Display to display the current distance.
=== Code ===
#define echoPin 3 // Echo Pin
#define trigPin 4 // Trigger Pin

#include <Wire.h>
#include <LiquidCrystal_I2C.h>
int maximumRange = 200; // Maximum range needed
int minimumRange = 0; // Minimum range needed
long duration, distance; // Duration used to calculate distance
LiquidCrystal_I2C lcd(0x27,3,1);
bool state = true;
int IN1 = 5;
int IN2 = 6;
int IN3 = 7;
int IN4 = 8;
int ENA = 9;
int ENB = 10;

void setup()
{
Serial.begin(9600);
pinMode(trigPin, OUTPUT);
pinMode(echoPin, INPUT);
for (int i = 5; i < 11; i++)
{
pinMode(i, OUTPUT);
}
lcd.init();
lcd.backlight();
delay(5000);
driveForward();
}

void loop()
{
/* The following trigPin/echoPin cycle is used to determine the
distance of the nearest object by bouncing soundwaves off of it. */
digitalWrite(trigPin, LOW);
delayMicroseconds(2);

digitalWrite(trigPin, HIGH);
delayMicroseconds(10);
digitalWrite(trigPin, LOW);
duration = pulseIn(echoPin, HIGH);

//Calculate the distance (in cm) based on the speed of sound.
distance = duration / 58.3;

if (distance >= maximumRange || distance <= minimumRange)
{
/* Send a negative number to computer and Turn LED ON
to indicate "out of range" */
lcd.clear();
lcd.setCursor(3, 0);
lcd.print("-1");
Serial.println("-1");
}
else
{
/* Send the distance to the computer using Serial protocol, and
turn LED OFF to indicate successful reading. */
if (distance <= 15 && state != false)
{
state = false;
brake();
delay(200);
turnClockwise();
delay(780);
state = true;
driveForward();
}
else if (distance >= 30 && state != true)
{
state = true;
driveForward();
}
lcd.clear();
lcd.setCursor(3, 0);
lcd.print(distance);
Serial.println(distance);
}
//Delay 50ms before next reading.
delay(50);
}

void driveForward()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, LOW);
digitalWrite(IN2, HIGH);

digitalWrite(IN3, HIGH);
digitalWrite(IN4, LOW);
delay(150);
analogWrite(ENA, 100);
analogWrite(ENB, 100);
}

void driveReverse()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, HIGH);
digitalWrite(IN2, LOW);

digitalWrite(IN3, LOW);
digitalWrite(IN4, HIGH);
delay(150);
analogWrite(ENA, 100);
analogWrite(ENB, 100);
}

void turnClockwise()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
digitalWrite(IN1, LOW);
digitalWrite(IN2, HIGH);

digitalWrite(IN3, LOW);
digitalWrite(IN4, HIGH);
delay(150);
analogWrite(ENA, 200);
analogWrite(ENB, 200);
}

void brake()
{
analogWrite(ENA, 0);
analogWrite(ENB, 0);
}
== Used Hardware ==

[[Smart Robot Car Kit Bluetooth 4WD keyestudio]]

== References ==

* https://wiki.keyestudio.com/Ks0192_keyestudio_4WD_Bluetooth_Multi-functional_Car
* https://www.youtube.com/watch?v=GAqvzCXEUSw

[[Category:Documentation]]

Keyestudio 4WD Bluetooth multifunctional car kit

2021-02-19T14:21:45Z

Bnagl: /* Rotate Clockwise */

Keyestudio 4WD Bluetooth multifunctional car kit

2021-02-19T14:21:18Z

Bnagl: /* Rotate Counter Clockwise */ Wrong method name

Keyestudio 4WD Bluetooth multifunctional car kit

2021-02-12T15:56:01Z

Bnagl:

File:Bluetooth Module Schematics.png

2021-02-12T15:35:23Z

Bnagl: