Add feature to log live to Wireshark via serial

[emilyboda]

🤝 Attestations

• I have tested that my proposed changes behave as described.
• I have tested that my proposed changes do not cause any obvious regressions on the following devices:
  • Hacker Pager

How to use

The following instructions work on Kali. I welcome people's help figuring out how to route serial to Wireshark on other OSes.

To save the live output of serial to a file:

1. Find the path to your pager with dmesg | grep tty. You may need to unplug and plug back in to see the most recent one.
2. Open up the PCAP tool screen (if you're on any other screen, there will be other logs in serial that will mess up your nice pretty pcap file)
3. Start socat socat -u FILE:/dev/tty<your path>,b9600,raw,echo=0 OPEN:output.pcap,creat,append
4. Click Serial to start logging
5. Ctrl-C to stop socat at any time

To view the live output of serial in Wireshark:

1. Find the path to your pager with dmesg | grep tty. You may need to unplug and plug back in to see the most recent one.
2. Open up the PCAP tool screen (if you're on any other screen, there will be other logs in serial that will mess up your nice pretty pcap file)
3. Make a pipe: mkfifo /tmp/serialpipe
4. Open Wireshark trained on that pipe: wireshark -k -i /tmp/serialpipe
5. In a new terminal window, run: socat -u FILE:<your path>,b9600,raw,echo=0 OPEN:/tmp/serialpipe,creat
6. Click Serial to start logging
7. See your pcaps dissected in Wireshark live

Make sure you open Wireshark and run socat before you start Live Capturing. Otherwise, Wireshark will give you an error about "Magic bytes". If anything happens to your capture, you will need to close Wireshark and stop the Serial capture, and then restart from Step 4.

Notes on code changes made:

When the pcap window on the pager UI is opened, all other logging to the serial console ceases. If you wanted to save the serial console to a file (or tell Wireshark that the following bytes are packets), you'll need a magic byte at the beginning, which is sent when the live Serial capture starts. But if you had other logging still on, then your pcap would be full of nonsense.

Making sure that logging ceased while the pcap UI window was open (and if you exit the window but continue logging) required a lot of (possibly inelegant) "if not logging to serial" statements. I apologize: this is my first time writing in C++, so I welcome any constructive criticism on how to make my code better. I have tested the code in many ways and found lots of bugs that I fixed, but more testing is always welcome.

I changed the Info button to the "Serial" button. And what was previously called "Start" is now called "SD Card". I'm sure there are better names for those, please feel free to change these to something more intuitive, but this is all I could think that would fit in the button.

Do NOT use screen

Do not use screen to display the output. Screen reacts to some characters as “control characters”. Notably the integer 15, which is 0x0F in hex, will not be displayed as 0F but instead tells screen to “delete the last character”. One of the fields, a header length, happens to be equal to 15, so every packet will be malformed if you use screen.

[emilyboda]

Any thoughts on this?