OP25 Add RC4 (ADP) decryption

[Plutonium94]

I'd like to add ADP decryption capability to OP25. I have been doing research for a while about RC4 cipher (a.k.a. Motorola ADP), so I do know how the cipher works. I have some experience programming in C, so I'd like to know where I should start. It would be great if Boatbod gave me a hand with this. Thank you.

 

[boatbod]

You'd need to intercept the codewords after they are received/reconstructed but before they go to the vocoder to be turned into a pcm stream. Look here.

p25p2_tdma.cc::handle_voice_frame()
p25p1_fdma.cc:process_voice()

 

[Plutonium94]

Thank you! I'll see what I can do.

 

[Plutonium94]

if (d_debug >= 9) {
    packed_codeword p_cw;
    imbe_pack(p_cw, u[0], u[1], u[2], u[3], u[4], u[5], u[6], u[7]);
    sprintf(s,"%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
            p_cw[0], p_cw[1], p_cw[2], p_cw[3], p_cw[4], p_cw[5],
            p_cw[6], p_cw[7], p_cw[8], p_cw[9], p_cw[10]);
    fprintf(stderr, "%s IMBE %s errs %lu\n", logts.get(d_msgq_id), s, errs); // print to log in one operation
}

My idea is to apply decryption to p_cw array and then reconstruct the u vectors. To do this I'd need to use an "inverse" imbe_pack function. Then, where is imbe_pack function defined? I couldn't find it anywhere. Do you think my reasoning is ok?

 

[boatbod]

if (d_debug >= 9) {
    packed_codeword p_cw;
    imbe_pack(p_cw, u[0], u[1], u[2], u[3], u[4], u[5], u[6], u[7]);
    sprintf(s,"%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
            p_cw[0], p_cw[1], p_cw[2], p_cw[3], p_cw[4], p_cw[5],
            p_cw[6], p_cw[7], p_cw[8], p_cw[9], p_cw[10]);
    fprintf(stderr, "%s IMBE %s errs %lu\n", logts.get(d_msgq_id), s, errs); // print to log in one operation
}

My idea is to apply decryption to p_cw array and then reconstruct the u vectors. To do this I'd need to use an "inverse" imbe_pack function. Then, where is imbe_pack function defined? I couldn't find it anywhere. Do you think my reasoning is ok?

Sorry, I don't have the time or inclination to walk you through it here. If you study the code and figure out how the pieces fit together you will find what you are looking for.

 

[Plutonium94]

Hi everyone! I've implemented ADP decryption on OP25. If anyone is interested, you can PM me. Thank you!

 

[wdsatg]

Hi, I'm interested in the ADP decryption for P25

 

[remedy44]

I'm interested

 

[reformedMhacker]

Interested… sent you a PM

 

[apacer]

Hi, I'm interested

 

[thedishdoc]

I'm interested

 

[reformedMhacker]

Has anyone gotten a response back from Plutonium94 on this? I hope the Black SUVs didn’t take him away 🧐

 

[remedy44]

no responses

 

[apacer]

no.(

 

[ultrajv]

Has anyone gotten a response back from Plutonium94 on this? I hope the Black SUVs didn’t take him away 🧐

Its very likely he couldnt do it. Many claim its possible theoretically. In practice nope. There are 255 leaked keys that you have to try manually, Even thats not practical.

 

[boatbod]

Its very likely he couldnt do it. Many claim its possible theoretically. In practice nope. There are 255 leaked keys that you have to try manually, Even thats not practical.

My understanding is that he has code to decrypt ADP, but you need to know the key in advance, much like programming a subscriber radio.

 

[Forts]

Its very likely he couldnt do it. Many claim its possible theoretically. In practice nope. There are 255 leaked keys that you have to try manually, Even thats not practical.

ADP has over a trillion keys. Motorola Basic Privacy (DMR) has the 255 pre-defined keys.

 

[Forts]

My understanding is that he has code to decrypt ADP, but you need to know the key in advance, much like programming a subscriber radio.

That being said, it would be handy for those that have the keys. But then the argument could be made that it's easier to just use a radio, so....

 

[ultrajv]

ADP has over a trillion keys. Motorola Basic Privacy (DMR) has the 255 pre-defined keys.

Not going to happen then

 

[Forts]

The intent of his add-on surely wasn't to attempt to crack ADP. It would have been to allow known key entry and decoding after that.