TLF：通过总线级拦截快速表征嵌入式系统中射频收发器参数的框架
TLF: Rapid Characterization of RF Transceiver Parameters in Embedded Systems via Bus-Level Interception
浏览论文内容
中文总结 AI 辅助
该研究提出TLF工具，可通过总线级拦截从微控制器与射频收发器间的迹线恢复射频参数、密钥、跳频序列等，在两个Semtech系列目标上验证，无需预先了解固件即可快速恢复配置以开发对策。
中文摘要 AI 辅助
我们提出了TLF（Transceiver Lifter Framework，收发器提升框架），这是一种用于从微控制器与其射频（RF）收发器集成电路之间捕获的总线级迹线中恢复射频收发器配置和运行时行为的工具。针对收发器的寄存器和数据接口构建的有状态协议解码器，可从拦截到的寄存器写入和先进先出（FIFO）传输中重构运行中的射频参数和行为。对于通过被拦截的主机接口加载硬件加密密钥的总线连接收发器，还可恢复密钥材料。当固件驱动跳频时——无论是通过硬件辅助引擎还是自定义调度——解码器都会提取信道表、跳频序列和时序。我们在两个来自不同Semtech系列的目标上评估了该方法：基于SX1233的无人机（UAV）指挥与控制调制解调器，其采用固件级跳频扩频（FHSS）技术，每个数据包都有同步字轮换；以及基于SX1276的Meshtastic节点，其使用LoRa寄存器覆盖层。通过一次总线捕获（在数秒内处理完成），TLF可在无需预先了解目标固件的情况下，恢复完整的寄存器暴露射频配置（调制、频段规划、相位行为），足以配置匹配的接收器或开发针对性对策。在芯片层之上，可插拔协议解码器将恢复的FIFO有效载荷解释为应用协议数据单元（PDU），并在Meshtastic上展示了端到端的应用。如预期，固件级加密状态仍为不透明状态。该方法需要对目标硬件进行物理访问或仿真，其恢复深度受限于收发器的寄存器接口：完全在固件中实现的参数（自定义前向纠错、白化、加密）仅可作为不透明的FIFO有效载荷被观测。
英文摘要
We present TLF (Transceiver Lifter Framework), a tool for recovering RF transceiver configuration and runtime behavior from bus-level traces captured between a microcontroller and its transceiver IC. A stateful protocol decoder, built against the transceiver's register and data interface, reconstructs operating RF parameters and behavior from intercepted register writes and FIFO transfers. For bus-attached transceivers whose hardware-cryptography keys are loaded through the intercepted host interface, key material is also recoverable. Where the firmware drives frequency hopping -- either through a hardware-assisted engine or a custom schedule -- the decoder extracts the channel table, hop sequence, and timing. We evaluate the approach on two targets from different Semtech families: an SX1233-based UAV C2 modem employing firmware-level FHSS with per-packet sync word rotation, and an SX1276-based Meshtastic node exercising the LoRa register overlay. From a single bus capture, processed in seconds, TLF recovers the complete register-exposed RF configuration (modulation, band plan, phase behavior) without prior knowledge of the target firmware -- sufficient to configure a matched receiver or develop targeted countermeasures. Above the chip layer, a pluggable protocol decoder interprets recovered FIFO payloads as application PDUs, demonstrated end-to-end on Meshtastic. Firmware-level cryptographic state remains, as expected, opaque. The approach requires physical access or emulation of the target hardware, and its recovery depth is bounded by the transceiver's register interface: parameters implemented entirely in firmware (custom FEC, whitening, encryption) are observable only as opaque FIFO payloads.
