freestyle_bruteforce.py

# -*- coding: utf-8 -*-
#
# SPDX-License-Identifier: MIT
#
# Copyright (c) 2019 Diego Elio Pettenò

import itertools

import serial

all_commands = [
    b'$%b\r\n' % bytes(cmd)
    for cmd in itertools.product(
            range(ord('a'), ord('z')+1), repeat=4)]

first_command = all_commands.index(b'$aaaa\r\n')

def send_command(connection, command):
    connection.write(command)
    connection.flush()
    return connection.readlines()


connection = serial.serial_for_url(
    'hwgrep://1a61:3420',
    baudrate=19200,
    timeout=0.15,
    writeTimeout=None,
    bytesize=serial.EIGHTBITS,
    parity=serial.PARITY_NONE,
    stopbits=serial.STOPBITS_ONE,
    xonxoff=False,
    rtscts=False,
    dsrdtr=False)

send_command(connection, b'$xmem\r\n')


with open('bruteforce.out', 'at') as log:
    for cmd in all_commands[first_command:]:
        print(f'Sending {cmd!r}')
        received = send_command(connection, cmd)
        print(f'{received!r}\n')
        if received != [b'CMD Fail!\r\n']:
            log.write(f'>>> {cmd!r}\n<<< {received!r}\n\n')