Thursday, April 17, 2014

Fixing Touchpad on Acer 720p Chromebook for Kali 1.06

I updated my kali 1.05 install to kali 1.06 by using the apt-get dist-upgrade.  I ran into a few problems but was able to follow the error message output to fix it.  Now I'm ready to patch some kernel drivers to support the touchpad.  Specifically
  • drivers/platform/x86/chromeos_laptop.c
  • drivers/i2c/busses/i2c_designware-pci.c
The script also copies i2c_designware-core.ko and tries to copy i2c_designware-platform.ko .  The first file did not seem to be patches, and the second did not exist on my machine.

There are good directions here, which also deal with suspend problems.  I haven't tried to suspend yet, but I can guess that there may be problems.  The script here was set up for Ubuntu 13.10 or newer, so it did not work.  It failed trying to download the linux kernel source.

Here's the script for reference. 

# Create a temp directory for our work
tempbuild=`mktemp -d`
cd $tempbuild

# Determine kernel version (with and without Ubuntu-specific suffix)
mykern=${1:-$(uname -r)}
mykernver=linux-$(echo $mykern | cut -d'-' -f 1)

# Install necessary deps to build a kernel
sudo apt-get build-dep -y --no-install-recommends linux-image-$mykern

# Grab Ubuntu kernel source
apt-get source linux-image-$mykern
cd $mykernver

if [ -f drivers/platform/x86/chromeos_laptop.c ]; then
  platform_folder=x86
elif [ -f drivers/platform/chrome/chromeos_laptop.c ]; then
  platform_folder=chrome
fi

# Use Benson Leung's post-Pixel Chromebook patches:
# https://patchwork.kernel.org/bundle/bleung/chromeos-laptop-deferring-and-haswell/
for patch in 3078491 3078481 3074391 3074441 3074421 3074401 3074431 3074411; do
  wget -O - https://patchwork.kernel.org/patch/$patch/raw/ \
  | sed "s/drivers\/platform\/x86\/chromeos_laptop.c/drivers\/platform\/$platform_folder\/chromeos_laptop.c/g" \
  | patch -p1
done

# Need this
cp /usr/src/linux-headers-$mykern/Module.symvers .

# Prep tree
cp /boot/config-$mykern ./.config
make oldconfig
make prepare
make modules_prepare

# Build only the needed directories
make SUBDIRS=drivers/platform/$platform_folder modules
make SUBDIRS=drivers/i2c/busses modules

# switch to using our new chromeos_laptop.ko module
# preserve old as .orig
sudo mv /lib/modules/$mykern/kernel/drivers/platform/$platform_folder/chromeos_laptop.ko /lib/modules/$mykern/kernel/drivers/platform/$platform_folder/chromeos_laptop.ko.orig
sudo cp drivers/platform/$platform_folder/chromeos_laptop.ko /lib/modules/$mykern/kernel/drivers/platform/$platform_folder/

# switch to using our new designware i2c modules
# preserve old as .orig
sudo mv /lib/modules/$mykern/kernel/drivers/i2c/busses/i2c-designware-core.ko /lib/modules/$mykern/kernel/drivers/i2c/busses/i2c-designware-core.ko.orig
sudo mv /lib/modules/$mykern/kernel/drivers/i2c/busses/i2c-designware-pci.ko /lib/modules/$mykern/kernel/drivers/i2c/busses/i2c-designware-pci.ko.orig
sudo mv /lib/modules/$mykern/kernel/drivers/i2c/busses/i2c-designware-platform.ko /lib/modules/$mykern/kernel/drivers/i2c/busses/i2c-designware-platform.ko.orig
sudo cp drivers/i2c/busses/i2c-designware-*.ko /lib/modules/$mykern/kernel/drivers/i2c/busses/
sudo depmod -a $mykern
echo "Finished building Chromebook modules in $tempbuild. Reboot to use them."
 

I had problems with this, so I basically went through the commands one at a time manually.  The tricky part was patching.  I have never done this before.  When I finished, my chromeos_laptop.c file had some structs inserted inside of other structs.  I copy/pasted them outside the structs and then the make command worked.  After that, I copied chromeos_laptop.ko, i2c_designware-core.ko, and i2c_designware-pci.ko to the right directories, ran depmod -a 3.12-kali1-amd64, and rebooted.

The trackpad worked, but sporadically.  I followed the next part of the directions and had to paste these lines into my  /usr/share/X11/xorg.conf.d/50-synaptics.conf  file in the "InputClass" section.
Section "InputClass"
        Identifier "touchpad catchall"
        Driver "synaptics"
        MatchIsTouchpad "on"
        MatchDevicePath "/dev/input/event*"
        Option "FingerLow" "10"
        Option "FingerHigh" "16"
EndSection

Most of the lines were there, so I just had to add:

        MatchDevicePath "/dev/input/event*"
        Option "FingerLow" "10"
        Option "FingerHigh" "16"
 
Now, I have to figure out how to get tap-to-click to work.  Currently, I have to click the touchpad to get right and left clicks.

Well...that was easy.  Applications | System Tools | Preferences | System Settings.  In that window, click on the Touchpad tab.  Check "Enable mouse clicks with touchpad" to enable tap-to-click.


 

Tuesday, April 15, 2014

Kali Screen Resolution on Acer c720 Chromebook

I installed kali 1.05 on my Chromebook and had two issues.  The first is known: the touchpad drivers aren't installed.  The second was a slightly off screen resolution.  The fix was simply to go to System Tools | Preferences | System Settings.  Select Displays.  My resolution was set to 1368 x 768.  There was another option for 1366 x 768.  I selected that, and the screen was fine.

Next step, try to compile touchpad drivers.

Install Kali 1.05 x64 on Acer Chromebook c720p

I picked up a refurbished Acer c720 Chromebook for $150.  My goal was to install Kali on it.  I heard that it was a fast (relatively) machine and the price was right.  I've always run Kali in virtual machines, and I thought that it would be nice to have it on actual hardware for a change.  This machine is so cheap that I don't mind if it gets trashed.

My first decision was to decide if I was going to use chrouton (runs Ubuntu and some others using a chroot environment) or install it directly.  This (and recent) models of chromebook support a legacy bios that allows you to boot from the usb.  That makes it a lot easier.

I decided to wipe out the 16Gb ssd, but first I made a backup image of chrome.  To do this, use chrome://imageburner in the browser with a 4Gb usb/SD card.

Then I followed the directions here to enable developer mode and boot the usb.  I used kali 1.05 because 1.06 is still downloading, and I didn't feel like waiting.  To create a bootable usb, I used the kali 1.05 iso file with unetbootin. 

I set up developer mode per the directions and booted.  I hit <ctrl-l> at the splash screen (legacy?) and it booted off the usb.  The trick here was to edit the boot options and add the parameter 'mem=1536m' at the end!  Without that, it would fail to boot kali.

I booted the live image and then installed from there.  I had a problem connecting to my wireless network until I unhid the SSID.  After installing, I rebooted.  I didn't hit <ctrl-l> at the developer splash screen, which takes you to a different splash screen saying that the chrome installation is corrupt.

Just reboot and hit <ctrl-l> at the developer mode screen!

There are a couple of issues that I need to sort out.
  1. The touchpad doesn't work.  This is a known issue, and it should be possible to compile the correct drivers.
  2. The screen resolution seems to be a few pixels bigger than the screen, so it pans a little when I get to the edge.  I'll have to look into the display drivers and/or screen resolution.
It's running an apt-get upgrade now and seems to be working fine!

Saturday, April 5, 2014

Installing kismet for ubertooth















Last time, I got the ubertooth tools installed and made sure that the real-time spectrum analysis was working.  Now, I want to install the kismet plugin and wireshark plugin so that I can sniff bluetooth traffic.
I started by following the kismet guide on the getting started page.  I already had some of the packages installed, but that was ok.  I downloaded the latest kismet manually rather than using wget.  Then I followed the directions.  kistmet.conf was in /etc/kismet on my kali 1.04 machine.

I haven't used kismet much at all, so the next step was to read the readme for the ubertooth plugin.  The readme in in the ubertooth tools source, specifically ./ubertooth-2014-02-R2/host/kismet/plugin-ubertooth.

















Kismet-Ubertooth

0.  NOT COMPLETE

1.  What is Kismet-Ubertooth
2.  Caveats
3.  Compiling
4.  Installing
5.  Using

0.  NOT COMPLETE

*** THIS CODE IS CURRENTLY NOT COMPLETE ***

What it does:

* Control one (and only one) Ubertooth Zero or Ubertooth One
* Monitor one Bluetooth channel
* Display the LAP of Bluetooth packets
* Determine and display the UAP of Bluetooth packets
* Log to pcap file

What it should be able to do in the future:

* Determine the clock of a target piconets
* Hop along with a target piconet through all channels
* Control more than one Ubertooth Zero or Ubertooth One
* Read pcap files
* Print debug info about packets

1.  What is Kismet-Ubertooth

    Kismet-Ubertooth is a Kismet plugin which provides Bluetooth support in
    Kismet.  It relies on the Bluetooth baseband library, libbtbb
    (http://libbtbb.sourceforge.net/). Kismet-Ubertooth performs passive
    monitoring of Bluetooth networks using the Ubertooth platform
    (http://ubertooth.sourceforge.net/).

    It CAN NOT BE USED with 802.11 wi-fi cards, it is a completely different
    protocol.  If you do not have an Ubertooth but have a Bluetooth adapter,
    try the btscan plugin instead.  It performs active scanning of discoverable
    Bluetooth devices.  Better yet, build yourself an Ubertooth One.

    Kismet-Ubertooth defines the decoders, loggers, and UI controls for
    Bluetooth networks in a common fashion, and supports reading and writing
    Bluetooth baseband pcap files.

    The Bluetooth baseband protocol is the air interface of Bluetooth.  It
    operates in the 2.4 GHz ISM band.  There is a separate interface known as
    HCI (Host Controller Interface) that operates between a host computer and
    an attached Bluetooth adapter.  Kismet-Ubertooth uses special hardware to
    directly access the baseband layer.  It does not operate at the HCI layer.
    Try hcidump if you want to access HCI.

2.  Caveats

    This code is currently only partially developed and may not provide full
    functionality.

    This code has only been tested on Linux.  This code MAY work on other
    platforms, but currently it is only developed with Linux as a target.

3.  Compiling

    Compiling the Kismet-Ubertooth plugin requires the Kismet source be
    installed and configured.  The libbtbb library (0.5 or higher) and libusb
    (1.0 or higher) must also be installed.

    By default, Kismet-Ubertooth expects the Kismet source to be in
    /usr/src/kismet; this can be overridden by setting the KIS_SRC_DIR
    environment variable:

        cd plugin-ubertooth
        KIS_SRC_DIR=/home/foo/src/kismet make

4.  Installing

    Kismet plugins may be installed system-wide in the plugins directory (by
    default, /usr/local/lib/kismet/) or in the users home directory
    (~/.kismet/plugins).

    To install in the system-wide directory:

        cd plugin-ubertooth
        KIS_SRC_DIR=/home/foo/src/kismet make install

    Plugins can be installed in the current users home directory with:

        cd plugin-ubertooth
        make userinstall

5.  Using

    Once the plugin is loaded, Kismet will automatically understand and
    decode pcap files with the Bluetooth link data.

    To capture from an Ubertooth Zero or Ubertooth One, plug in the USB device,
    and define a capture source in Kismet using the interface 'ubertooth'.  The
    device will be automatically detected.

    If you have multiple Ubertooth devices connected, Kismet-Ubertooth uses the

    first one it finds.  Kismet-Ubertooth currently is not capable of using

The editor is acting pretty crazy now, so this post is done!













    multiple Ubertooth devices simultaneously.
    To enable pcap logging, the logfile must be turned on by adding
    'pcapbtbb' to the logtypes= line of the kismet.conf.





So after that, I started kismet.  That started the server, and eventually it asked for a new interface.  I typed in "ubertooth" and gave it the descriptive name "ubertooth".  After that, kistmet started listening.

Then, I had my table search for devices.  If things work properly, I should see lots of packets with LAP 0x9e8b33.

Kismet captured 9e8b33!


Thursday, April 3, 2014

New Toy - Ubertooth One

I felt like exploring and learning some different wireless technologies, so I ordered an Ubertooth One from SparkFun.com.  I wanted to try it with Kali because I knew that there would be some tools and maybe even the Ubertooth software.  I already had Kali 1.04 (1.05 is released) as a VirtualBox VM, so I fired it up. 

I connected the antenna to the Ubertooth One, then plugged it in.  My Windows 7 host didn't recognize the usb device, but I didn't expect it to.  I connect the device to the VM and looked for ubertooth software. 
 
root@kali-vbox:~# ubertooth-
ubertooth-btle    ubertooth-hop     ubertooth-specan  ubertooth-util
ubertooth-dump    ubertooth-lap     ubertooth-uap  


I ranubertooth-dump and saw a lot of random stuff.  I then went to the getting started guide and saw that they suggested running ubertooth-specan-ui, which should give a nice graphical representation of wireless activity.  I did not have that program, so I headed to the build guide.

The first thing that I did was to uninstall the current ubertooth software.  It was the 2012.10.r1 version.  They are currently on 2014-02-R2.  

I pretty much followed the directions on the build guide.  Install some compile tools and libraries first.  I already had gcc and make installed.
#sudo apt-get install cmake libusb-1.0-0-dev make gcc
 
Then I dowloaded the latest pyusb (1.0.0b1) from the project page and installed it per the readme.  I noted that 1.0.0a3 was preinstalled.  Probably should have uninstalled it first.  I also learned about the "j" flag for tar to deal with *.xz files.

root@kali-vbox:~# tar xf pyusb-1.0.0b1.tar.gz
root@kali-vbox:~# cd pyusb-1.0.0b1/
root@kali-vbox:~/pyusb-1.0.0b1# ls
root@kali-vbox:~/pyusb-1.0.0b1# python setup.py install


Then I downloaded libbtbb per the directions, made it, and installed it.

Finally, I downloaded the ubertooth code, made it, and installed it.  Then I had the ubertooth-specan-ui binary.

root@kali-vbox:~# ubertooth-
ubertooth-btle       ubertooth-dump       ubertooth-scan
ubertooth-debug      ubertooth-follow     ubertooth-specan-ui
ubertooth-dfu        ubertooth-rx         ubertooth-util





And here's the proof!
















The next step will be to build the kismet plugin and try to add it.  Kali 1.04 had kismet 2013.03.R1b already installed.  It might understand the ubertooth plugin.  It will probably be safer to uninstall it and get the latest source code.