Menú
Reverse-engineer binary protocols — CRC detection with crcbeagle, CRC calculation, packet structure analysis
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Run sustained security assessment campaigns against targets using the Ralph Wiggum autonomous loop pattern. Use when asked to start, continue, or manage a pentest campaign.
Control a Flipper Zero and scan BLE targets for authorized security research. Use when asked to interact with Flipper hardware, scan BLE devices, or control RF/IR/NFC/RFID.
Start an autonomous pentest loop. Spawns fresh-context subagents for each phase. Use: /ralph-loop
BLE GATT exploitation methodology — scanning, enumeration, characteristic analysis, payload crafting, and write attacks against Bluetooth Low Energy devices
Run a sustained security assessment campaign — a real pentest, not a simulation
Credential testing methodology — default credential checking, password spraying, credential reuse, and OSINT for leaked credentials
| name | protocol-analysis |
| description | Reverse-engineer binary protocols — CRC detection with crcbeagle, CRC calculation, packet structure analysis |
Reverse-engineer checksums (CRC) from captured packets and analyze binary protocol structures. Uses crcbeagle for automated CRC parameter detection.
The crcbeagle library is available locally at ./crcbeagle/.
pip install crccheck # For CRC calculation with custom parameters
crcbeagle is bundled locally. Reference it via path when importing.
Automatically detect the CRC algorithm (polynomial, init value, XOR output) from captured packets. Provide at least 2-3 example packets where only one field changes (e.g., same command with different data values).
python3 -c "
import sys
sys.path.insert(0, './crcbeagle')
from crcbeagle.crcbeagle import CRCBeagle
# Example hex packets (replace with your captured data)
packets_hex = [
'aa0800a823704201501165660000f226a8bd',
'aa0800a82370420150116566000072579a5c',
'aa0800a823704201501165660000b2875b1e',
]
crc_size = 4 # CRC size in bytes: 1 (CRC-8), 2 (CRC-16), or 4 (CRC-32)
# Parse hex to bytes, split data from CRC
packets = [bytes.fromhex(h.replace(' ', '')) for h in packets_hex]
data_parts = [p[:-crc_size] for p in packets]
crc_parts = [p[-crc_size:] for p in packets]
crc = CRCBeagle()
# Call the appropriate search function based on CRC size
if crc_size == 1:
result = crc.search_crc8(data_parts, crc_parts)
elif crc_size == 2:
result = crc.search_crc16(data_parts, crc_parts)
else:
result = crc.search_crc32(data_parts, crc_parts)
if result:
print(f'CRC-{crc_size*8} algorithm detected:')
print(f' Result: {result}')
else:
print('Could not detect CRC algorithm. Try more packets or different CRC size.')
"
Tips for CRC detection:
crc_size=2 if crc_size=4 fails -- many IoT protocols use CRC-16.p[:crc_size] for CRC and p[crc_size:] for data.Calculate a CRC checksum for given data using known parameters (e.g., after detection).
python3 -c "
from crccheck.crc import Crc32Base
# Parameters from crc_detect or protocol documentation
class CustomCRC(Crc32Base):
_poly = 0x04C11DB7 # CRC polynomial
_initvalue = 0xFFFFFFFF # Initial value
_xor_output = 0xFFFFFFFF # XOR applied to final CRC
_reflect_input = True # Reflect input bytes
_reflect_output = True # Reflect output CRC
data_hex = 'aa0800a8237042015011656600' # Data without CRC
data = bytes.fromhex(data_hex)
crc = CustomCRC.calc(data)
crc_size = 4 # bytes
crc_hex = format(crc, f'0{crc_size*2}x')
crc_le = bytes.fromhex(crc_hex)[::-1].hex()
print(f'Data: {data_hex}')
print(f'CRC (big-endian): 0x{crc_hex}')
print(f'CRC (little-endian): 0x{crc_le}')
print(f'Full packet (LE CRC): {data_hex}{crc_le}')
"
For CRC-8 or CRC-16, use Crc8Base or Crc16Base from crccheck.crc respectively.
Analyze a binary packet structure byte-by-byte, or decode with a known field format.
python3 -c "
packet_hex = 'aa0800a823704201501165660000f226a8bd'
raw = bytes.fromhex(packet_hex.replace(' ', ''))
print(f'Packet: {packet_hex} ({len(raw)} bytes)')
print()
print('Byte-by-byte analysis:')
for i, b in enumerate(raw):
ascii_char = chr(b) if 32 <= b < 127 else '.'
print(f' [{i:3d}] 0x{b:02X} {b:3d} \"{ascii_char}\"')
print()
print('Integer interpretations:')
if len(raw) >= 2:
print(f' uint16 LE [0:2]: {int.from_bytes(raw[0:2], \"little\")}')
print(f' uint16 BE [0:2]: {int.from_bytes(raw[0:2], \"big\")}')
if len(raw) >= 4:
print(f' uint32 LE [0:4]: {int.from_bytes(raw[0:4], \"little\")}')
print(f' uint32 BE [0:4]: {int.from_bytes(raw[0:4], \"big\")}')
print(f' uint32 LE [-4:]: {int.from_bytes(raw[-4:], \"little\")}')
print(f' uint32 BE [-4:]: {int.from_bytes(raw[-4:], \"big\")}')
"
Decode a packet with a known format specification (name:bytes pairs).
python3 -c "
packet_hex = 'aa0800a823704201501165660000f226a8bd'
fmt = 'header:1,length:1,flags:1,addr:4,counter:2,data:4,crc:4'
raw = bytes.fromhex(packet_hex.replace(' ', ''))
print(f'Packet: {packet_hex} ({len(raw)} bytes)')
print()
print('Field breakdown:')
offset = 0
for field_spec in fmt.split(','):
name, size = field_spec.strip().split(':')
size = int(size)
if offset + size > len(raw):
print(f' {name}: OVERFLOW (packet too short)')
break
field_bytes = raw[offset:offset+size]
hex_val = field_bytes.hex()
int_le = int.from_bytes(field_bytes, 'little')
int_be = int.from_bytes(field_bytes, 'big')
line = f' {name:15s} [{offset}:{offset+size}] = 0x{hex_val}'
if size <= 4:
line += f' (LE:{int_le}, BE:{int_be})'
try:
text = field_bytes.decode('utf-8')
if text.isprintable():
line += f' \"{text}\"'
except:
pass
print(line)
offset += size
if offset < len(raw):
remaining = raw[offset:]
print(f' {\"(remaining)\":15s} [{offset}:{len(raw)}] = 0x{remaining.hex()} ({len(remaining)} bytes)')
"
0x04C11DB7 (Ethernet, ZIP)0x10210x80050x31