Reverse analysis method and system for physical layer characteristics of radio frequency chip

Abstract

The invention provides a reverse analysis method and system for physical layer characteristics of a radio frequency chip. The method comprises the following steps: configuring a software environment of a radio frequency chip with unknown physical layer configuration characteristic information, after the software environment is configured, performing code burning on two development boards carrying the radio frequency chip, and taking one development board after code burning as a transmitting end and the other development board after code burning as a receiving end; controlling the transmitting end to perform forward operation in the data processing flow, and controlling the receiving end to perform reverse operation in the data processing flow; and performing reverse analysis according to all data generated by the transmitting end and the receiving end in the data processing flow to obtain physical layer characteristic information of the radio frequency chip. According to the technical scheme provided by the invention, the reverse analysis efficiency and accuracy of the physical layer characteristics of the radio frequency chip are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of radio frequency communication technology, and in particular to a method and system for reverse analysis of physical layer characteristics of a radio frequency chip. Background Art

[0002] With the rapid development of the Internet of Things, 5G networks, and dedicated wireless communication systems, it is becoming increasingly important to understand and analyze the physical layer characteristics of these RF chips. For application scenarios such as security assessment, compatibility testing, fault diagnosis, and reverse engineering, being able to accurately obtain the data processing flow inside the RF chip and its physical layer configuration information is a key technical requirement.

[0003] At present, the traditional methods for analyzing the physical layer characteristics of RF chips usually rely on data sheets and technical documents provided by manufacturers, or analyze by disassembling the chips and using specialized hardware testing equipment. In addition, there are also some software-based simulation tools that simulate the behavior of RF chips to infer their physical layer characteristics.

[0004] Existing solutions face several major drawbacks when analyzing the physical layer characteristics of RF chips. First, when faced with unknown or proprietary RF chips, the lack of official documentation makes it impossible to obtain necessary information, rendering traditional document-based analysis methods ineffective. Second, using professional test equipment for physical-level reverse engineering is not only costly, but also complex and unsuitable for large-scale or rapid analysis. Finally, although existing software simulation tools can provide some help, they often cannot fully simulate the behavior in the actual environment, resulting in inaccurate results. Summary of the invention

[0005] The embodiments of the present application provide a method and system for reverse analysis of physical layer characteristics of a radio frequency chip, so as to solve the problems of low efficiency and low accuracy in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a method for reverse analysis of physical layer characteristics of a radio frequency chip, comprising: Configure the software environment of the RF chip with unknown physical layer configuration characteristic information. After the software environment configuration is completed, burn the code to the two development boards carrying the RF chip, and use one development board with the code burned as the transmitter and the other development board with the code burned as the receiver; Controlling the transmitting end to perform forward operation in the data processing flow, and controlling the receiving end to perform reverse operation in the data processing flow; Reverse analysis is performed on all data generated by the transmitting end and the receiving end in the data processing flow to obtain physical layer characteristic information of the radio frequency chip.

[0007] Optionally, the data processing flow includes at least one of the following data processing links: an error detection link, a channel encoding and decoding link, a signal shaping link, a time domain dispersion link and a carrier modulation link; The controlling the transmitting end to perform a forward operation in the data processing flow and the controlling the receiving end to perform a reverse operation in the data processing flow comprises at least one of the following steps: For the error detection link, enable the cyclic redundancy check bit generation function corresponding to the error detection link of the transmitting end, disable the encoding function, whitening function, interleaving function and modulation function, enable the cyclic redundancy check function corresponding to the error detection link of the receiving end, and disable the decoding function, de-whitening function, de-interleaving function and demodulation function; For the channel coding and decoding link, the encoding function corresponding to the transmitting end and the channel coding and decoding link is enabled, and the cyclic redundancy check bit generation function, whitening function, interleaving function and modulation function are not enabled; the decoding function corresponding to the receiving end and the channel coding and decoding link is enabled, and the cyclic redundancy check function, dewhitening function, deinterleaving function and demodulation function are not enabled; For the signal shaping link, the whitening function corresponding to the transmitting end and the signal shaping link is enabled, and the cyclic redundancy check bit generation function, encoding function, interleaving function and modulation function are not enabled; the de-whitening function corresponding to the receiving end and the signal shaping link is enabled, and the cyclic redundancy check function, decoding function, de-interleaving function and demodulation function are not enabled; For the time domain dispersion link, the interleaving function corresponding to the transmitting end and the time domain dispersion link is enabled, and the cyclic redundancy check bit generation function, encoding function, whitening function and modulation function are not enabled; the deinterleaving function corresponding to the receiving end and the signal shaping link is enabled, and the cyclic redundancy check function, decoding function, dewhitening function and demodulation function are not enabled; For the carrier modulation link, the modulation function corresponding to the transmitting end and the carrier modulation link is enabled, and the cyclic redundancy check bit generation function, encoding function, whitening function and interleaving function are not enabled; the demodulation function corresponding to the receiving end and the signal shaping link is enabled, and the cyclic redundancy check function, decoding function, de-whitening function and de-interleaving function are not enabled.

[0008] Optionally, performing reverse parsing according to all data generated by the transmitting end and the receiving end in the data processing flow to obtain physical layer characteristic information of the radio frequency chip includes: In the case where the data processing flow includes a time domain dispersion link, reverse analysis is performed based on the data generated by the transmitting end in the time domain dispersion link and the data generated by the receiving end in the time domain dispersion link to obtain physical layer characteristic information of the RF chip, wherein the physical layer characteristic information includes interleaving block size and interleaving block data position change information.

[0009] Optionally, the reverse parsing is performed according to the data generated by the transmitting end in the time domain dispersion link and the data generated by the receiving end in the time domain dispersion link to obtain the physical layer characteristic information of the radio frequency chip, wherein the physical layer characteristic information includes the interleaving block size and the interleaving block data position change information, including: Step 11, initialize two parameters n and k1, n is the number of bytes, n is an integer greater than or equal to 1, k1 is a coefficient, k1=1; Step 12, generating first repeated data in units of n bytes at the transmitting end as test data, the test data is interleaved when the interleaving function is enabled, and the receiving end obtains the first interleaved data; Step 13, determining whether the first interleaved data is in units of n bytes; if the first interleaved data is not in units of n bytes, executing step 14; or, if the first interleaved data is in units of n bytes, executing step 15; Step 14, update n by accumulation, and repeat steps 12 to 13; Step 15, generating a plurality of groups of second repeated data in units of n bytes at the transmitting end as a plurality of groups of verification data, wherein the plurality of groups of verification data are interleaved when the interleaving function is enabled, and the receiving end obtains a plurality of groups of second interleaved data, and each group of second repeated data is not equal to the first repeated data; Step 16, determining whether the plurality of groups of second interleaved data are all in units of n bytes; if the plurality of groups of second interleaved data are not in units of n bytes, executing step 17; or, if the plurality of groups of second interleaved data are all in units of n bytes, executing step 18; Step 17, update k1 by accumulation, update n by the product of k1 and n, and repeat steps 15 to 16; Step 18: determine that the interleaving block size is n, and trigger the interleaving block data position change process to obtain interleaving block data position change information.

[0010] Optionally, triggering an interleaved block data position change process to obtain interleaved block data position change information includes: Step 21, initialize the interleaving block size to n, parameter k2=1, indicating the first byte, a=1, indicating the first bit; Step 22, at the transmitting end, setting the ath bit of the k2th byte to 1 and the remaining bits to 0 to generate non-repetitive data in units of an interleaving block size n, and performing an interleaving process when the interleaving function is enabled; Step 23, determining the position change information of the value 1 according to the third interleaved data received by the receiving end; Step 24, determine whether k2 is equal to n, and whether a is equal to 8; if not, execute step 25; or, if both, execute step 28; Step 25, determine whether a is less than 8, if a is less than 8, execute step 26; if a is equal to 8, execute step 27; Step 26, update a by accumulating, and repeat steps 22 to 24; Step 27, update k2 by accumulation, reset a to 1, and execute steps 22 to 24; Step 28: Generate interleaved block data position change information according to the position change information of all values ​​1.

[0011] Optionally, performing reverse parsing according to all data generated by the transmitting end and the receiving end in the data processing flow to obtain physical layer characteristic information of the radio frequency chip includes: In the case where the data processing flow includes a channel coding and decoding link, reverse parsing is performed based on all data generated by the transmitting end and the receiving end in the channel coding and decoding link to obtain physical layer characteristic information of the RF chip, where the physical layer characteristic information includes a coding method adopted by a coding function. When the coding method includes a convolutional code, the convolutional code includes a generating polynomial and a code rate.

[0012] Optionally, reverse parsing is performed according to all data generated by the transmitting end and the receiving end in the data processing flow to obtain physical layer characteristic information of the radio frequency chip, including: In the case where the data processing flow includes a signal shaping link, the maximum length is determined according to a preset RF chip manual, all-zero data of the maximum length is sent at the transmitting end, and reverse analysis is performed by comparing the all-zero data with the data received at the receiving end to obtain a whitening sequence of the RF chip; In the case where the data processing flow includes an error detection link, a preset standard length is obtained through a preset RF chip manual, a cyclic redundancy check bit is generated at the transmitting end according to the preset standard length, data with the cyclic redundancy check bit is sent to the receiving end, and the cyclic redundancy check bit of the data sent by the transmitting end is compared with the cyclic redundancy check bit of the data received by the receiving end. If the comparison result is inconsistent, multiple initial values ​​are obtained through an exhaustive method, and the cyclic redundancy check bit generated based on each initial value is compared with the cyclic redundancy check bit of the data sent by the transmitting end to perform reverse analysis to obtain the cyclic redundancy check parameters of the RF chip, and the cyclic redundancy check parameters include: the initial value corresponding to the cyclic redundancy check bit when the comparison is consistent.

[0013] In a second aspect, an embodiment of the present application provides a system for reverse analysis of physical layer characteristics of a radio frequency chip, including: The configuration burning module is used to configure the software environment of the RF chip with unknown physical layer configuration characteristic information. After the software environment configuration is completed, the code is burned into the two development boards carrying the RF chip, and one development board after the code is burned is used as the transmitter, and the other development board after the code is burned is used as the receiver; A control module, used to control the transmitting end to perform a forward operation in the data processing flow, and control the receiving end to perform a reverse operation in the data processing flow; The reverse analysis module is used to perform reverse analysis on all data generated by the transmitting end and the receiving end in the data processing flow to obtain the physical layer characteristic information of the radio frequency chip.

[0014] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a method for reverse parsing physical layer characteristics of a radio frequency chip as described in any one of the first aspects.

[0015] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, a method for reverse analysis of physical layer characteristics of a radio frequency chip as described in any one of the first aspects is implemented.

[0016] In an embodiment of the present application, a software environment for a radio frequency chip with unknown physical layer configuration characteristic information is configured. After the software environment configuration is completed, code is burned into two development boards carrying the radio frequency chip, and one development board after the code is burned is used as a transmitter, and the other development board after the code is burned is used as a receiver; the transmitter is controlled to perform forward operations in the data processing flow, and the receiver is controlled to perform reverse operations in the data processing flow; reverse analysis is performed based on all data generated by the transmitter and the receiver in the data processing flow to obtain the physical layer characteristic information of the radio frequency chip.

[0017] The technical solution of this application has the following beneficial effects: This method provides a systematic means to automatically analyze the unknown physical layer characteristics of RF chips, reducing the complexity and time cost of manual analysis. By controlling the data processing flow of the transmitter and receiver, and performing reverse engineering based on all the generated data, the physical layer configuration information of the RF chip can be obtained more accurately. This method is applicable to various types of RF chips and different data processing links (such as error detection, channel encoding and decoding, signal shaping, etc.), and has wide applicability. Understanding the specific physical layer characteristics of RF chips helps to improve the interoperability and compatibility between different devices, which is of great value for product development and troubleshooting. Compared with traditional physical layer characteristic analysis methods, this method can reduce dependence on dedicated test equipment and reduce R&D costs. It helps security researchers evaluate the security of RF communications and discover potential security vulnerabilities or unexpected behaviors. It provides new tools and methods for the research of RF technology and communication protocols, and promotes technological innovation and development.

[0018] Furthermore, it is stipulated that the data processing flow covers five key links: error detection, channel coding and decoding, signal shaping, time domain dispersion and carrier modulation. For each link, the transmitter and the receiver respectively perform the forward or reverse operation of a specific function: in the error detection link, only the cyclic redundancy check bit generation function and the verification function are enabled; in the channel coding and decoding link, the encoding and decoding functions are enabled respectively; in the signal shaping link, only the whitening and de-whitening functions are activated; in the time domain dispersion link, only the interleaving and de-interleaving functions are enabled; and in the carrier modulation link, the modulation and demodulation functions are enabled separately. The remaining irrelevant functions are not activated in each link to ensure the independence and accuracy of each data processing step.

[0019] Through the above method, different data processing links such as separate error detection, channel coding and decoding, signal shaping, time domain dispersion and carrier modulation are used, and only relevant forward or reverse operation functions are activated in each link, avoiding the interference of other non-related functions, thereby significantly improving the accuracy and reliability of reverse analysis. This method allows researchers to focus on each individual data processing step without considering the impact of multiple parallel processes at the same time. This not only simplifies the analysis process, but also accelerates the process of understanding the physical layer characteristics of RF chips and improves work efficiency. Compared with the traditional method that relies on expensive professional test equipment, this method uses software environment configuration and code burning to the development board to achieve reverse engineering, which reduces hardware requirements and technical barriers, making RF chip analysis more economical and feasible. The detailed information obtained by this method can enhance the understanding of RF communication protocols and technologies, help improve the interoperability between different systems, and also provide an important basis for security assessment. For existing RF systems, this method can help identify potential problem points, such as the effectiveness of error detection mechanisms, the rationality of channel coding strategies, and the optimal settings of signal processing parameters, thereby guiding system improvements and optimizations. This method provides a new tool for research in the field of wireless communications, promoting the research and development of new RF technologies and protocols, especially for proprietary or unknown RF chips that lack public documentation support.

[0020] In summary, this method not only solves the defects of existing solutions, but also brings higher accuracy, efficiency and economy to the analysis of physical layer characteristics of RF chips, which is of great significance for promoting the development of wireless communication technology.

[0021] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0023] Figure 1 A flowchart of a method for reverse analysis of physical layer characteristics of a radio frequency chip provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of a device (or system) for reverse analysis of physical layer characteristics of a radio frequency chip provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0025] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The sequence numbers of the operations, such as 11, 12, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to different types.

[0026] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0027] Figure 1 A flowchart of a method for reverse parsing physical layer characteristics of a radio frequency chip provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes: 101. Configure a software environment for a radio frequency chip with unknown physical layer configuration characteristic information. After the software environment configuration is completed, burn codes to two development boards carrying the radio frequency chip, and use one development board after the code is burned as a transmitter and the other development board after the code is burned as a receiver. Among them, unknown physical layer configuration characteristic information refers to the specific parameters used to process signal transmission and reception inside the radio frequency (RF) chip, including but not limited to modulation mode, coding scheme, error detection mechanism, etc.; when there is a lack of technical documentation or official support provided by the manufacturer, this information is "unknown"; A radio frequency chip is an integrated circuit that is responsible for high-frequency signal processing tasks in wireless communication systems, such as signal transmission, reception, and related processing; The software environment refers to a set of operating systems and application software frameworks built for the operation of RF chips, including necessary drivers, library files, and development tool chains to ensure that they can correctly interact with the hardware and perform the intended functions; Code burning means writing the written control program into the non-volatile memory on the development board so that the program can be directly loaded and executed during subsequent operations; The transmitter is the party responsible for sending data in a communication system, which transmits information to the other end by modulating the signal; The receiving end refers to the party responsible for receiving and decoding the signal and extracting the original data from the received signal.

[0028] In actual operation, first of all, in order to start the reverse analysis process, you need to set up a software environment suitable for the operation of the RF chip. This involves installing a specific operating system and programming interface to ensure that the chip can be programmed and monitored. After completing the construction of the software environment, the next step is to burn the code to the two development boards carrying the RF chip, that is, write the pre-written test program to the development board. One of the development boards is designated as the transmitter and used as the signal transmission source; the other is used as the receiver to capture and analyze the transmitted data packets.

[0029] For example, in a typical wireless sensor network, you may be faced with RF chips from different vendors that do not disclose detailed physical layer characteristics. In order to understand and optimize the behavior of these chips, the Linux embedded operating system was configured according to the above steps, and an open source platform such as GNU Radio was used as the basis of the software environment. Then, two development boards based on the same series but different models of RF chips were selected, and customized firmware codes were burned for them respectively. One of them was used as the transmitter and the other as the receiver, ready to enter the next step of data processing.

[0030] 102. Control the transmitting end to perform a forward operation in the data processing flow, and control the receiving end to perform a reverse operation in the data processing flow; The data processing flow covers all stages from raw data generation to final transmission or reception, including key links such as error detection, channel coding and decoding, signal shaping, time domain dispersion and carrier modulation; Forward operation means that the transmitter processes the data according to preset rules, such as adding redundant check bits, encoding data streams, whitening signals, etc., to make it ready for transmission; The reverse operation refers to the receiving end performing the opposite process, such as removing redundant check bits, decoding data streams, de-whitening signals, etc., to restore the original data.

[0031] In practice, the data processing logic of the transmitter and receiver needs to be configured separately. For the transmitter, this means activating a series of functions used to prepare data for transmission, such as cyclic redundancy check (CRC) generation, channel coding, whitening, etc. The receiver needs to be set up to understand and process the results of these operations, that is, to enable the corresponding CRC check, decoding, de-whitening, etc. In addition, it is necessary to ensure that other irrelevant functions are disabled to avoid interfering with the target data processing link.

[0032] For example, continuing with the embodiment of step 101, in the application scenario of a wireless sensor network, the CRC generation function is enabled at the transmitting end, while unnecessary coding, interleaving and modulation options are turned off. This is done to focus on studying the error detection mechanism. At the same time, the receiving end only enables the CRC check function, and the other functions remain turned off. Next, the transmitting end generates a series of data packets with CRC check bits, and observes how the receiving end processes these data packets, thereby inferring the specific behavior pattern of the RF chip in error detection. The same method can also be applied to the study of other data processing links.

[0033] 103. Perform reverse analysis on all data generated by the transmitting end and the receiving end in the data processing flow to obtain physical layer characteristic information of the radio frequency chip.

[0034] Reverse analysis refers to the process of analyzing known outputs (in this case, the communication data between the transmitter and the receiver) to infer the internal algorithms or configuration parameters that produce these outputs.

[0035] Physical layer characteristic information refers to the specific details about how the RF chip processes and transmits data at the lowest level, such as the modulation technology used, coding strategy, error control method, etc.

[0036] In actual operation, the data collected in the previous steps is used to perform detailed reverse engineering analysis. This process involves comparing the differences between the data sent by the transmitter and the data received by the receiver, and identifying which changes are caused by the data processing mechanism inside the RF chip. In this way, the physical layer configuration information of the RF chip can be gradually restored, including but not limited to the encoding method, error detection mechanism, signal shaping parameters, etc.

[0037] For example, continuing with the above embodiment, by comparing the data packets generated by the transmitting end and the data packets received by the receiving end, it is possible to determine how the RF chip works in the error detection link, such as which type of CRC algorithm it uses and the length of the CRC check bit. Further, this method can be extended to channel coding and decoding, signal shaping and other data processing links, and the behavioral characteristics of the RF chip in each link can be analyzed one by one.

[0038] Through the implementation of steps 101 to 103, the method provides a systematic means to automatically and accurately analyze the physical layer characteristics of RF chips. This method not only improves the analysis efficiency and reduces the dependence on dedicated test equipment, but also enhances the accuracy of the results by separating various data processing links. In addition, it also promotes transparency and technological progress in the field of RF technology, and provides strong support for fault diagnosis, safety assessment and innovative research. Through the demonstration of examples, it can be seen that this method has a high degree of flexibility and adaptability in practical applications, and can effectively analyze different types of RF chips, providing valuable information for subsequent product development and optimization.

[0039] In order to solve the problem of mutual interference among various data processing links during the analysis of the physical layer characteristics of the RF chip and further improve the accuracy and efficiency of the analysis, in some embodiments, the data processing flow in step 102 includes at least one of the following data processing links: an error detection link, a channel encoding and decoding link, a signal shaping link, a time domain dispersion link, and a carrier modulation link; The controlling the transmitting end to perform a forward operation in the data processing flow and the controlling the receiving end to perform a reverse operation in the data processing flow comprises at least one of the following steps: For the error detection link, the cyclic redundancy check bit generation function corresponding to the transmitting end and the error detection link is enabled, and the encoding function, whitening function, interleaving function and modulation function are not enabled; the cyclic redundancy check function corresponding to the error detection link of the receiving end is enabled, and the decoding function, de-whitening function, de-interleaving function and demodulation function are not enabled; for the channel coding and decoding link, the encoding function corresponding to the transmitting end and the channel coding and decoding link is enabled, and the cyclic redundancy check bit generation function, whitening function, interleaving function and modulation function are not enabled; the decoding function corresponding to the receiving end and the channel coding and decoding link is enabled, and the cyclic redundancy check function, de-whitening function, de-interleaving function and demodulation function are not enabled; for the signal shaping link, the whitening function corresponding to the transmitting end and the signal shaping link is enabled, and the cyclic redundancy check bit generation function, encoding function, interleaving function and modulation function are not enabled. The interleaving function and modulation function are enabled, the de-whitening function corresponding to the receiving end and the signal shaping link is enabled, and the cyclic redundancy check function, decoding function, de-interleaving function and demodulation function are not enabled; for the time domain dispersion link, the interleaving function corresponding to the transmitting end and the time domain dispersion link is enabled, the cyclic redundancy check bit generation function, encoding function, whitening function and modulation function are not enabled, the de-interleaving function corresponding to the receiving end and the signal shaping link is enabled, and the cyclic redundancy check function, decoding function, de-whitening function and demodulation function are not enabled; for the carrier modulation link, the modulation function corresponding to the transmitting end and the carrier modulation link is enabled, the cyclic redundancy check bit generation function, encoding function, whitening function and interleaving function are not enabled, the demodulation function corresponding to the receiving end and the signal shaping link is enabled, and the cyclic redundancy check function, decoding function, de-whitening function and de-interleaving function are not enabled.

[0040] In this embodiment, error detection link: This link is intended to ensure the integrity of data transmission by adding additional data (such as cyclic redundancy check bits CRC) at the transmitting end and verifying these data at the receiving end to detect errors that may occur during the transmission process; CRC is a common error detection method, which calculates a remainder of a polynomial division as a check value and appends it to the data packet; Channel encoding and decoding: involves converting the original data into a form suitable for transmission through the communication channel (encoding), and restoring the received data to its original form at the receiving end (decoding); this includes but is not limited to encoding methods such as convolutional codes and Turbo codes; the main purpose of encoding is to improve the reliability and efficiency of data transmission, while decoding refers to the process of extracting the original information from the received modulated signal; Signal shaping: refers to the processing of signals to improve their transmission characteristics, such as reducing interference or improving noise immunity. Whitening is a technique in this process that is used to make the signal spectrum more uniform, that is, by randomizing the data sequence to reduce the possibility of long strings of identical bits, thereby avoiding DC components and low-frequency components in the signal, making the signal more suitable for certain types of transmission channels. Time domain dispersion: Also known as interleaving, it disperses the impact of burst errors by rearranging the data sequence, thereby improving error correction capabilities; interleaving can prevent continuous errors from affecting a large amount of data because the originally adjacent data is now dispersed; deinterleaving refers to the process of restoring the original data order at the receiving end, usually matching the interleaving pattern at the transmitting end; Carrier modulation: responsible for loading information onto a high-frequency carrier for wireless transmission; common modulation methods include ASK (amplitude shift keying), FSK (frequency shift keying), PSK (phase shift keying), etc.; corresponding demodulation refers to extracting the original information from the received modulated signal; modulation and demodulation are the basic processes for wireless communication, which determine how the signal is transmitted on the physical medium; Cyclic redundancy check bit generation function: This is part of the error detection process. The transmitter uses a specific algorithm to generate a check value (usually a polynomial division result based on the input data) and sends it after the data packet. This check value is used by the receiver to verify whether the data packet has been changed during transmission. Decoding function: In the channel encoding and decoding link, the receiving end uses the inverse algorithm corresponding to the transmitting end to decode the received data stream and restore the original information content; for convolutional codes, the receiving end will execute the Viterbi algorithm or other appropriate decoding algorithm to perform maximum likelihood estimation to reconstruct the original data as accurately as possible; Whitening function: In the signal shaping process, the transmitter applies whitening processing to eliminate or reduce redundancy in the signal and make the signal spectrum flatter. Whitening can be achieved through mechanisms such as linear feedback shift registers (LFSRs), which disrupt the data sequence according to certain rules but keep the meaning of the data unchanged. Interleaving function: In the time domain dispersion link, the transmitter reorders the data blocks according to a predetermined rule to increase the data's ability to resist sudden errors; the interleaver disperses continuous data fragments to different time positions, so that even if strong interference occurs for a short period of time, it will not cause a large amount of data damage; Modulation function: In the carrier modulation link, the transmitter maps the binary data into an analog signal suitable for wireless transmission according to the selected modulation scheme; for example, in QPSK modulation, each symbol carries two bits of information and is represented by four different phase angles; De-whitening function: In the signal shaping process, the receiving end performs the opposite operation to the transmitting end, that is, canceling the whitening effect and restoring the original data sequence; this process must be completely synchronized with the whitening algorithm used by the transmitting end to restore the data correctly; Deinterleaving: In the time-domain dispersion phase, the receiver rearranges the expressed data according to the same rules as the transmitter to restore the original data order; the deinterleaver needs to know the interleaving mode used by the transmitter so that it can accurately reverse the interleaving process; Demodulation function: In the carrier modulation link, the receiver extracts the original information from the received modulated signal, that is, reversely performs the modulation operation of the transmitter; the demodulator selects the appropriate algorithm to parse the signal according to the specific modulation type. For example, for QPSK modulation, the demodulator determines the bit combination represented by each symbol based on the received phase information; In the embodiment of the present application, the operating modes of the transmitter and the receiver are configured respectively for the five key links in the data processing flow of the RF chip - error detection, channel coding and decoding, signal shaping, time domain dispersion and carrier modulation; for each link, the transmitter performs a forward operation, that is, enables specific functions related to the link (such as the CRC generation function in the error detection link), and disables other irrelevant functions (such as encoding, whitening, interleaving and modulation); at the same time, the receiver is set to a reverse operation mode, only activating the inspection or decoding function corresponding to the transmitter, and turning off all other irrelevant options; such a design ensures that the data processing of each link can be analyzed independently and accurately, avoiding mutual interference between different functions.

[0041] Here is a specific example: In a real wireless sensor network case, the goal is to analyze the physical layer characteristics of an unknown RF chip. First, the cyclic redundancy check (CRC) generation function of the transmitter is enabled in the error detection link, while the coding, whitening, interleaving and modulation functions are turned off to ensure that only the CRC generation mechanism is focused on. The CRC check function is enabled on the receiving end accordingly, while the rest of the functions remain disabled.

[0042] Next, in the channel encoding and decoding stage, the encoding function (such as convolutional code encoding) of the transmitter is activated, while the decoding function is set accordingly at the receiver, and other non-related functions continue to be disabled. In order to study the signal shaping stage, the transmitter is configured to process the signal only using the whitening function, and the receiver is dedicated to de-whitening, and other factors that may affect the results are also excluded. When it comes to the time domain dispersion stage, the transmitter only applies the interleaving function to change the time distribution of the data stream, and the receiver focuses on de-interleaving to restore the original data order.

[0043] Finally, in the carrier modulation stage, the transmitter is configured to execute a specific modulation scheme (such as QPSK), while the receiver is responsible for the corresponding demodulation operation. By implementing the above-mentioned fine control strategy for each link in turn, not only can the behavioral characteristics of the RF chip in each data processing stage be analyzed one by one, but also the mutual interference between different functions can be effectively avoided, thereby improving the accuracy and reliability of the analysis results. The whole process shows how to systematically separate and analyze each data processing link, so as to fully understand the working principle of the RF chip.

[0044] In order to solve the problem of inaccurate acquisition of physical layer characteristic information of the RF chip and further improve the accuracy and depth of the analysis, in some embodiments, the reverse analysis is performed according to all the data generated by the transmitting end and the receiving end in the data processing flow to obtain the physical layer characteristic information of the RF chip, including: In the case where the data processing flow includes a time domain dispersion link, reverse analysis is performed based on the data generated by the transmitting end in the time domain dispersion link and the data generated by the receiving end in the time domain dispersion link to obtain physical layer characteristic information of the RF chip, wherein the physical layer characteristic information includes interleaving block size and interleaving block data position change information.

[0045] In this embodiment, the time domain dispersion link: also known as interleaving, it disperses the impact of burst errors by rearranging the data sequence, thereby improving the error correction capability; interleaving can prevent continuous errors from affecting a large amount of data because the originally adjacent data is now dispersed; deinterleaving refers to the process of restoring the original data order at the receiving end, which usually matches the interleaving mode of the transmitting end; Interleaving block size: This refers to the size of the units or "blocks" into which the data is processed during the interleaving process; the data in each interleaving block is reordered according to a specific algorithm to achieve temporal dispersion; understanding the interleaving block size is critical to analyzing the physical layer characteristics of the RF chip, as it directly affects the reliability and efficiency of data transmission; Interleaved block data position change information: refers to how the specific position of the original data in the new sequence changes after the interleaving process; this change information reveals the specific details of the interleaving algorithm and is very important for reverse engineering and understanding the internal working principles of RF chips.

[0046] In the embodiment of the present application, in the process of analyzing the physical layer characteristics of the RF chip, when it comes to the time domain dispersion (interleaving) link, reverse analysis is performed using the data generated by the transmitter and the data received by the receiver.

[0047] Specifically, the transmitter will apply interleaving processing to the data before sending it, and reorder the data according to certain rules; while the receiver is responsible for performing the opposite operation - deinterleaving, to restore the original data. By comparing the difference between the data sent by the transmitter and the data received by the receiver, the exact parameters used by the RF chip in the interleaving link can be inferred, such as the interleaving block size and the position change of the data within the interleaving block. This method allows for detailed analysis and understanding of the behavior of the RF chip in this critical data processing step, providing a basis for subsequent technical optimization.

[0048] Here is a specific example: Continuing the implementation steps in the previous wireless sensor network case, after completing the analysis of error detection, channel coding and decoding, signal shaping and carrier modulation, we now turn to the study of time domain dispersion (interleaving). In order to accurately analyze the interleaving mechanism of the RF chip, a test program is configured at the transmitter, which can generate a series of data packets with a known structure and send them out with the interleaving function enabled. The receiver also enables the corresponding deinterleaving function and records the received data.

[0049] Next, the differences between the packets sent by the transmitter and the packets received by the receiver were compared, with particular attention paid to the changes in the data position caused by the interleaving process. This method not only determined the interleaving block size used by the RF chip, but also discovered the specific position changes of the data within the interleaving block.

[0050] For example, it was found that some data bits appeared in new positions after interleaving, which indicated the existence of characteristics of the interleaving algorithm. With further experiments and data analysis, a complete picture of the interleaving characteristics of RF chips was gradually constructed, including important parameters such as the interleaving mode and interleaving depth. This series of analytical work provides valuable insights into the working mechanism of RF chips and lays a solid foundation for further optimizing wireless communication systems.

[0051] In order to solve the problem that it is difficult to accurately obtain the interleaving block size and data position change information of the RF chip, and further improve the accuracy and reliability of the analysis, in some embodiments, the data generated by the transmitting end in the time domain dispersion link and the data generated by the receiving end in the time domain dispersion link are reversely analyzed to obtain the physical layer characteristic information of the RF chip, and the physical layer characteristic information includes the interleaving block size and the interleaving block data position change information, including: Step 11, initialize two parameters n and k1, n is the number of bytes, n is an integer greater than or equal to 1, k1 is a coefficient, k1=1; Step 12, generate first repetitive data in units of n bytes at the transmitting end as test data, the test data is interleaved when the interleaving function is enabled, and the receiving end obtains the first interleaved data; Step 13, determine whether the first interleaved data is in units of n bytes; if the first interleaved data is not in units of n bytes, execute step 14; or, if the first interleaved data is in units of n bytes, execute step 15; Step 14, update n by accumulating, and repeat steps 12 to 13; Step 15, generate multiple groups of second repetitive data in units of n bytes at the transmitting end data, as multiple groups of verification data, the multiple groups of verification data are interleaved when the interleaving function is enabled, and the receiving end obtains multiple groups of second interleaved data, and each group of second repeated data is not equal to the first repeated data; step 16, judging whether the multiple groups of second interleaved data are all in units of n bytes; if the multiple groups of second interleaved data are not in units of n bytes, executing step 17; or, if the multiple groups of second interleaved data are all in units of n bytes, executing step 18; step 17, updating k1 by accumulation, updating n by the product result of k1 and n, and repeating steps 15 to 16; step 18, determining that the interleaved block size is n, and triggering the interleaved block data position change process to obtain the interleaved block data position change information.

[0052] In this embodiment, the number of bytes (n) refers to the basic unit of data, that is, the number of bytes; in radio frequency communication, data is usually processed and transmitted in bytes; here, n represents the assumed interleaving block size, which is the basic unit used to test the interleaving effect; Coefficient (k1): This is a parameter used to adjust the interleaving block size. It is initially set to 1. As the parsing process progresses, if it is found that the currently assumed interleaving block size is incorrect, k1 is updated by accumulation, and the new interleaving block size is redefined by multiplying k1 by n. First repeated data: This refers to a group of data with a specific pattern generated by the transmitter, usually composed of the same or similar data units; this data is sent to the receiver after interleaving to preliminarily verify the assumption of the interleaving block size; Multiple sets of verification data: To further confirm the interleaving block size and ensure the reliability of the results, the transmitter will also generate multiple sets of different repeated data as verification data; these data will also be interleaved and compared with previous results; Interleaved data: refers to the data stream after the interleaving process. Since interleaving changes the location distribution of the original data, it is necessary to conduct a detailed analysis of the interleaved data to determine the specific interleaving algorithm and parameters. Interleaved block data position change information: describes how the specific position of the original data in the new sequence changes after the interleaving process; this is crucial to understanding the interleaving mechanism and its impact.

[0053] In the embodiment of the present application, in order to accurately analyze the behavioral characteristics of the RF chip in the time domain dispersion (interleaving) link, a systematic reverse analysis process is designed.

[0054] First, two key parameters n (number of bytes) and k1 (coefficient) are initialized, where n represents the assumed interleaving block size and k1 is used as a tool to adjust n.

[0055] Next, a series of first repeated data in units of n bytes are generated at the transmitting end as test data, and the interleaving function is enabled to process the data. After receiving the interleaved data, the receiving end checks whether the data still maintains the structure in units of n bytes.

[0056] If the condition is not met, the value of n is increased and the above steps are repeated; otherwise, the next stage is entered to use multiple sets of different verification data for more in-depth testing. If all verification data are as expected, the final interleaving block size is determined to be n, and further processes are triggered to obtain specific changes in the data position within the interleaving block. This series of operations makes it possible to accurately restore the working method of the RF chip in the interleaving link.

[0057] Here is a specific example: Continuing with the implementation steps in the wireless sensor network case, we will now focus on parsing the time domain dispersion (interleaving) characteristics of the RF chip. According to the aforementioned scheme, two parameters n=1 (number of bytes) and k1=1 (coefficient) are first initialized. Then, a set of first repeated data in units of n bytes is generated at the transmitter as test data, which is sent out after the interleaving function is enabled. After receiving the interleaved data, the receiver immediately checks whether the data still maintains the structure in units of n bytes. The results show that the data from the first attempt did not meet expectations, so the value of n was updated by accumulation, and the above steps were repeated until a suitable interleaving block size was found.

[0058] Once the preliminary interleaving block size is determined, multiple different sets of verification data are generated, each of which is also based on the currently assumed n bytes, but the content is different from the initial first repeated data. These verification data are interleaved again and sent to the receiving end. Carefully compare all the second interleaved data obtained by the receiving end to ensure that they all maintain the structure of n bytes. If any set of data does not meet expectations, n is updated by accumulating k1 and using the product of k1 and n, and then repeating the verification process. Finally, when it is confirmed that all verification data meet expectations, it can be determined that the actual interleaving block size of the RF chip is n.

[0059] On this basis, the next step, the interleaving block data position change process, is triggered. This step aims to record in detail the position change of each bit before and after the interleaving process, so as to fully understand the specific implementation of the interleaving algorithm.

[0060] For example, it was observed that certain specific bits appeared in new positions after interleaving, which provided important clues about the interleaving pattern. Through this method, not only the interleaving block size of the RF chip was successfully parsed, but also the position change law of the data within the interleaving block was deeply understood, laying a solid foundation for further optimizing the performance of the wireless communication system. The entire parsing process shows how to gradually reveal the complex data processing mechanism inside the RF chip through scientific methodology and technical means.

[0061] In order to solve the problem that it is difficult to accurately capture the position change information of the interleaved block data of the RF chip and further improve the accuracy and completeness of the analysis, in some embodiments, triggering the interleaved block data position change process to obtain the interleaved block data position change information includes: Step 21, initialize the interleaving block size to n, parameter k2=1, indicating the first byte, a=1, indicating the first bit; Step 22, set the ath bit of the k2th byte to 1 at the transmitting end, and set the remaining bits to 0 to generate non-repeating data in units of the interleaving block size n, and perform interleaving processing when the interleaving function is enabled; Step 23, determine the position change information of the value 1 according to the third interleaved data received by the receiving end; Step 24, determine whether k2 is equal to n, and whether a is equal to 8; if If they are not satisfied at the same time, execute step 25; or, if they are satisfied at the same time, execute step 28; Step 25, determine whether a is less than 8, if a is less than 8, execute step 26; if a is equal to 8, execute step 27; Step 26, update a by accumulation, and repeat steps 22 to 24; Step 27, update k2 by accumulation, reset a to 1, and execute steps 22 to 24; Step 28, generate interleaved block data position change information according to the position change information of all value 1s.

[0062] In this embodiment, parameters k2 and a: k2 indicates the number of the byte currently being processed, counting from 1; a indicates the bit position in the current byte, ranging from 1 to 8; these two parameters are used to activate bits at different positions in the interleaving block one by one, so as to accurately track their changes after interleaving; Third, interleaved data refers to the data received by the receiving end, which has been interleaved by the transmitting end. By analyzing this data, the specific movement path of the original bits in the interleaving process can be determined; Information about the position change of the value 1: When the transmitter sets a specific bit to 1 and sends it, the new position of the bit in the data received by the receiver reflects the effect of the interleaving process. Recording these position changes helps to understand the working mechanism of the interleaving algorithm. Non-repetitive data: This type of data means that the data content generated by the transmitter during each test is different from any previous test; in this way, it can be ensured that each round of testing is independent and verifiable, thereby improving the accuracy of the analysis results.

[0063] In the embodiment of the present application, in order to deeply analyze the interleaved block data position change information of the RF chip, a detailed reverse engineering process is designed. First, the interleaved block size is initialized to the known n, and two parameters k2=1 (indicating the first byte) and a=1 (indicating the first bit) are set.

[0064] Next, the transmitter performs the following operations for each bit position in each interleaved block: set the ath bit of the k2th byte to 1 and all other bits to 0, generate a unique, non-repetitive set of data, and enable the interleaving function to process it. After receiving the interleaved data, the receiver records the specific position change information of the value 1. By gradually increasing the values ​​of k2 and a, every bit position in the entire interleaved block can be traversed until all bits have been tested.

[0065] Finally, based on the collected position change information of all value 1s, a complete interleaved block data position change map can be constructed, which provides detailed insights into the interleaving characteristics of the RF chip.

[0066] Here is a specific example: Continuing with the above embodiment, after successfully determining the interleaving block size of the RF chip, we now turn to analyzing the change in the position of the interleaving block data. According to the above scheme, the interleaving block size is first initialized to the previously determined n, and the parameter k2 is set to 1 (indicating the first byte), and a is set to 1 (indicating the first bit).

[0067] Then, at the transmitting end, the ath bit of the k2th byte is set to 1, and all other bits are set to 0, generating a unique, non-repetitive set of data. This set of data is sent out after the interleaving function is enabled, and the data received by the receiving end is the data after the third interleaving. The data is carefully analyzed and the specific position change information of the value 1 after interleaving is recorded.

[0068] As the test progresses, the values ​​of k2 and a are continuously updated to cover every bit position in the interleaved block. Whenever a is less than 8, a is updated by accumulation and the above steps are repeated; once a reaches 8, it indicates that all bits in a byte have been tested. At this time, k2 is accumulated by 1, a is reset to 1, and the test of the next byte continues. This process continues until k2 equals the interleaved block size n, and a also reaches 8, which means that all bit positions in the entire interleaved block have been exhaustively tested and recorded.

[0069] Finally, a complete map of interleaved block data position changes is generated based on the position change information of all value 1s. This map not only shows the specific movement path of each bit before and after the interleaving process, but also reveals the working details of the interleaving algorithm.

[0070] For example, it was found that some specific bits had regular position changes after interleaving, which provided important clues about the interleaving pattern. This method not only provided a deep understanding of the interleaving characteristics of the RF chip, but also laid a solid foundation for the subsequent optimization of the performance of the wireless communication system. The entire analysis process demonstrated how to gradually reveal the complex data processing mechanism inside the RF chip through systematic experiments and technical means, further promoting the research and development of unknown RF chips.

[0071] In order to solve the problem that it is difficult to directly obtain the physical layer characteristic information of the RF chip and further improve the understanding and optimization capabilities of the internal mechanism of the RF chip, in some embodiments, the physical layer characteristic information of the RF chip is obtained by reverse parsing all the data generated by the transmitting end and the receiving end in the data processing flow, including: In the case where the data processing flow includes a channel coding and decoding link, reverse parsing is performed based on all data generated by the transmitting end and the receiving end in the channel coding and decoding link to obtain physical layer characteristic information of the RF chip, where the physical layer characteristic information includes a coding method adopted by a coding function. When the coding method includes a convolutional code, the convolutional code includes a generating polynomial and a code rate.

[0072] In this embodiment, the channel encoding and decoding link: involves converting the original data into a form suitable for transmission through the communication channel (encoding), and restoring the received data to the original form at the receiving end (decoding); this includes but is not limited to encoding methods such as convolutional codes and Turbo codes; the main purpose of encoding is to improve the reliability and efficiency of data transmission, while decoding refers to the process of extracting the original information from the received modulated signal; Coding method: refers to the specific algorithm or method used to process data to enhance its transmission performance. Different coding methods have their own advantages and disadvantages and are suitable for different types of communication scenarios. For example, convolutional codes are widely used in many wireless communication systems due to their strong error correction capabilities. Convolutional code: A linear block code that depends not only on the current input bit but also on a series of previous input bits to generate an output bit sequence; convolutional codes provide good error detection and correction capabilities and are particularly suitable for channels with burst errors. Generator polynomial: This is a mathematical expression used in the convolutional code encoding process to define how the encoder generates redundant bits based on the input bit stream; the specific form of the generator polynomial determines the structure of the encoded data and its error correction characteristics; Code rate: It indicates the proportional relationship between the amount of data before and after encoding, usually expressed as R=k / n, where k is the number of original information bits and n is the total number of bits after encoding (including redundant bits). A lower code rate means that more redundant information is added, thereby improving error correction capability but reducing transmission efficiency; vice versa.

[0073] In the embodiment of the present application, in order to accurately analyze the behavior characteristics of the radio frequency chip in the channel encoding and decoding link, a reverse engineering method is adopted. First, all data generated by the transmitting end and the receiving end in this link need to be collected.

[0074] Then, by analyzing these data in detail, the specific encoding method used by the RF chip can be inferred. If the encoding method is determined to be a convolutional code, further in-depth research is conducted on key parameters such as its generating polynomial and code rate. This process not only helps to understand the data processing mechanism inside the RF chip, but also provides a valuable reference for optimizing the performance of the communication system. In this way, the working principle of the RF chip at the physical layer can be accurately restored, laying a solid foundation for further technical improvements.

[0075] Here is a specific example: Continuing with the above embodiment, after completing the detailed analysis of the time domain dispersion (interleaving) link, we now turn to the study of the channel coding and decoding link. In order to reveal the physical layer characteristics of the RF chip in this link, first ensure that both the transmitter and the receiver are configured to enable only functions related to channel coding and decoding, that is, the transmitter only activates the coding function, while the receiver is dedicated to decoding. In this way, interference from other functions can be eliminated and the analysis of the coding method can be focused.

[0076] Next, a series of tests were designed to collect data packets sent by the transmitter and received by the receiver. These packets contain information that has been coded, providing key materials for reverse analysis. By comparing and analyzing these data, certain specific patterns and regularities were noticed, which suggested that the RF chip may use convolutional codes as its encoding method. To verify this hypothesis, the structure of the encoded data was further studied, especially the distribution of redundant bits.

[0077] Based on the analysis of the redundant bit positions, the generator polynomial of the convolutional code was successfully identified. In addition, the ratio of the amount of data before and after encoding was calculated to determine the code rate of the convolutional code. For example, it was found that each original information bit was expanded into multiple coded bits, and there was a fixed mathematical relationship between these coded bits, which is the embodiment of the convolutional code generator polynomial. At the same time, the code rate reflects the degree of redundant information addition. A low code rate means stronger error correction capability, but it also sacrifices a certain transmission efficiency.

[0078] Ultimately, this method not only confirmed that the RF chip used convolutional codes, but also accurately analyzed its two key parameters, the generating polynomial and the code rate. This information is crucial for understanding and optimizing the working mechanism of RF chips, and also provides important technical support for the subsequent development of more efficient and reliable wireless communication systems. The entire analysis process shows how to gradually reveal the complex data processing mechanism inside the RF chip through systematic experiments and technical means, further promoting the research and development of unknown RF chips.

[0079] In order to solve the problem that the physical layer characteristic information of the RF chip (such as whitening sequence and cyclic redundancy check parameters) is difficult to obtain accurately and further improve the accuracy and reliability of the analysis, in some embodiments, reverse analysis is performed based on all the data generated by the transmitting end and the receiving end in the data processing flow to obtain the physical layer characteristic information of the RF chip, including: In the case where the data processing flow includes a signal shaping link, the maximum length is determined according to a preset RF chip manual, all-zero data of the maximum length is sent at the transmitting end, and reverse analysis is performed by comparing the all-zero data with the data received at the receiving end to obtain a whitening sequence of the RF chip; in the case where the data processing flow includes an error detection link, the preset standard length is obtained through the preset RF chip manual, a cyclic redundancy check bit is generated at the transmitting end according to the preset standard length, data with the cyclic redundancy check bit is sent to the receiving end, the cyclic redundancy check bit of the data sent by the transmitting end is compared with the cyclic redundancy check bit of the data received by the receiving end, and if the comparison result is inconsistent, multiple initial values ​​are obtained by an exhaustive method, and the cyclic redundancy check bit generated based on each initial value is compared with the cyclic redundancy check bit of the data sent by the transmitting end to perform reverse analysis to obtain the cyclic redundancy check parameters of the RF chip, and the cyclic redundancy check parameters include: the initial value corresponding to the cyclic redundancy check bit when the comparison is consistent.

[0080] In this embodiment, the signal shaping link refers to processing the signal to improve its transmission characteristics, such as reducing interference or improving noise resistance; whitening is a technology in this link, which is used to make the signal spectrum more uniform, that is, by randomizing the data sequence to reduce the possibility of long strings of identical bits, thereby avoiding DC components and low-frequency components in the signal, making the signal more suitable for certain types of transmission channels; Whitening sequence: This refers to a series of pseudo-random bit patterns applied during signal shaping to disrupt the structure of the original data sequence and ensure the flatness of the signal spectrum. Understanding the whitening sequence is very important for analyzing the physical layer characteristics of the RF chip because it directly affects the transmission quality of the signal. All-zero data: refers to a bit stream consisting of a series of consecutive 0s; this data pattern is often used to test the behavior of a system, especially when specific functions (such as whitening) need to be verified, because of its simplicity and predictability; Maximum length: The maximum size of a data block determined by the preset RF chip manual; sending all-zero data of the maximum length ensures that the entire possible data range is covered, thus providing the most comprehensive test results; Error detection: This step aims to ensure the integrity of data transmission by adding additional data (such as cyclic redundancy check bits CRC) at the transmitting end and verifying this data at the receiving end to detect errors that may occur during the transmission process; Cyclic Redundancy Check (CRC): A commonly used error detection method that calculates the remainder of a polynomial division as a check value and appends it to the data packet; the receiving end recalculates the check value using the same algorithm and compares it with the received check value to check whether the data is complete and correct; Preset standard length: Determine the fixed size of the input data block required to generate the CRC based on the information provided in the RF chip manual; this helps ensure that all tests are performed on a consistent basis, facilitating comparison and analysis of results; Initial value: The starting value used when generating CRC, usually a fixed binary number; different initial values ​​will result in different CRC check bits, so parsing the correct initial value is crucial to accurately understand how the RF chip works; Exhaustive search: When it is not feasible to directly obtain the correct initial value, you can search by trying all possible initial values; although this method has a high computational cost, it is very effective when other methods cannot reach a conclusion.

[0081] In the embodiment of the present application, a reverse engineering method is designed to accurately analyze the physical layer characteristics of the RF chip in the signal shaping and error detection links.

[0082] First, in the signal shaping phase, based on the maximum length determined by the preset RF chip manual, the transmitter sends the maximum length of all-zero data. After whitening, the data is sent to the receiver, and the whitening sequence used by the RF chip is reversely analyzed by comparing the difference between the data received by the receiver and the original all-zero data.

[0083] Next, in the error detection phase, data with a cyclic redundancy check bit (CRC) is generated according to the preset standard length and sent to the receiving end.

[0084] Then, the CRC generated by the transmitter is compared with the CRC decoded by the receiver. If the two are inconsistent, an exhaustive method is used to try multiple initial values ​​until the initial value that makes the CRC match is found. This method not only helps to understand how the RF chip handles error detection, but also reveals the specific CRC parameters used internally, providing a valuable reference for further optimizing the performance of the communication system.

[0085] Here is a specific example: Continuing with the above embodiment, after completing the research on the channel encoding and decoding link, we now turn to the analysis of the signal shaping and error detection links. In order to gain a deeper understanding of the behavioral characteristics of the RF chip in these two key links, we first focus on the signal shaping link. According to the information provided in the RF chip manual, the maximum length is determined to be 128 bytes, and the transmitter is configured to send all-zero data of the maximum length. These data are sent out after being whitened at the transmitter, and the receiving end records the actual data received. By comparing the two sets of data in detail, some regular changes were found, which are the result of the whitening sequence. After further analysis, the whitening sequence used by the RF chip was successfully reverse parsed, which is of great significance for understanding and optimizing the quality of signal transmission.

[0086] Next, we turn to the study of the error detection link. According to the preset standard length provided in the manual, the transmitter is configured to generate data containing cyclic redundancy check bits (CRC) according to this length and send it to the receiver. At the receiving end, the CRC in the received data packet is extracted and recorded. By comparing the CRC generated by the transmitter with the CRC decoded by the receiver, it was found that the two were not completely consistent. In order to find out the reason, an exhaustive method was used to try multiple possible initial values ​​until an initial value that could make the CRC match was found. This process not only helped confirm the CRC generation polynomial used by the RF chip, but also revealed its specific parameters such as the code rate. For example, it was found that using a specific initial value can ensure the accuracy of the CRC check bit, which provides important guidance for the subsequent development of a more reliable data transmission mechanism.

[0087] This method not only deeply analyzes the physical layer characteristics of RF chips in signal shaping and error detection, but also lays a solid foundation for optimizing the performance of wireless communication systems. The entire analysis process shows how to gradually reveal the complex data processing mechanism inside RF chips through systematic experiments and technical means, further promoting the research and development of unknown RF chips.

[0088] Figure 2 A schematic diagram of the structure of a device (or system) for reverse analysis of physical layer characteristics of a radio frequency chip provided in an embodiment of the present application, such as Figure 2 As shown, the device comprises: Configuration burning module 21, used to configure the software environment of the RF chip with unknown physical layer configuration characteristic information. After the software environment configuration is completed, code burning is performed on two development boards carrying the RF chip, and one development board after code burning is used as a transmitter, and the other development board after code burning is used as a receiver; A control module 22, used to control the transmitting end to perform a forward operation in the data processing flow, and to control the receiving end to perform a reverse operation in the data processing flow; The reverse analysis module 23 is used to perform reverse analysis on all data generated by the transmitting end and the receiving end in the data processing flow to obtain the physical layer characteristic information of the radio frequency chip.

[0089] Figure 2 The device for reverse analysis of the physical layer characteristics of a radio frequency chip can perform Figure 1 The implementation principle and technical effect of the method for reverse parsing the physical layer characteristics of a radio frequency chip described in the embodiment shown are not repeated here. The specific way in which each module and unit performs operations in the reverse parsing device for the physical layer characteristics of a radio frequency chip in the above embodiment has been described in detail in the embodiment of the method, and will not be elaborated here.

[0090] In one possible design, Figure 2 The device for reverse analysis of physical layer characteristics of a radio frequency chip in the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32 .

[0091] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0092] The processing component 32 is used to: configure the software environment of the RF chip with unknown physical layer configuration characteristic information, and after the software environment configuration is completed, burn the code to the two development boards carrying the RF chip, and use one development board with the code burned as the transmitter and the other development board with the code burned as the receiver; control the transmitter to perform forward operation in the data processing flow, and control the receiver to perform reverse operation in the data processing flow; perform reverse analysis based on all data generated by the transmitter and the receiver in the data processing flow to obtain the physical layer characteristic information of the RF chip.

[0093] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0094] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as random access memory (RAM), static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0095] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0096] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0097] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0098] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0099] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 A method for reverse analysis of physical layer characteristics of a radio frequency chip according to the embodiment shown.

[0100] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0101] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0102] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0103] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for reverse analysis of physical layer characteristics of a radio frequency chip, characterized in that: Applications in embedded platforms, including: Configure the software environment of the RF chip with unknown physical layer configuration characteristic information. After the software environment configuration is completed, burn the code to the two development boards carrying the RF chip, and use one development board with the code burned as the transmitter and the other development board with the code burned as the receiver; Controlling the transmitting end to perform forward operation in the data processing flow, and controlling the receiving end to perform reverse operation in the data processing flow; Reverse analysis is performed on all data generated by the transmitting end and the receiving end in the data processing flow to obtain physical layer characteristic information of the radio frequency chip.

2. The method according to claim 1, characterized in that The data processing flow includes at least one of the following data processing links: error detection link, channel encoding and decoding link, signal shaping link, time domain dispersion link and carrier modulation link; The controlling the transmitting end to perform a forward operation in the data processing flow and the controlling the receiving end to perform a reverse operation in the data processing flow comprises at least one of the following steps: For the error detection link, enable the cyclic redundancy check bit generation function corresponding to the error detection link of the transmitting end, disable the encoding function, whitening function, interleaving function and modulation function, enable the cyclic redundancy check function corresponding to the error detection link of the receiving end, and disable the decoding function, de-whitening function, de-interleaving function and demodulation function; For the channel coding and decoding link, the encoding function corresponding to the transmitting end and the channel coding and decoding link is enabled, and the cyclic redundancy check bit generation function, whitening function, interleaving function and modulation function are not enabled; the decoding function corresponding to the receiving end and the channel coding and decoding link is enabled, and the cyclic redundancy check function, dewhitening function, deinterleaving function and demodulation function are not enabled; For the signal shaping link, the whitening function corresponding to the transmitting end and the signal shaping link is enabled, and the cyclic redundancy check bit generation function, encoding function, interleaving function and modulation function are not enabled; the de-whitening function corresponding to the receiving end and the signal shaping link is enabled, and the cyclic redundancy check function, decoding function, de-interleaving function and demodulation function are not enabled; For the time domain dispersion link, the interleaving function corresponding to the transmitting end and the time domain dispersion link is enabled, and the cyclic redundancy check bit generation function, encoding function, whitening function and modulation function are not enabled; the deinterleaving function corresponding to the receiving end and the signal shaping link is enabled, and the cyclic redundancy check function, decoding function, dewhitening function and demodulation function are not enabled; For the carrier modulation link, the modulation function corresponding to the transmitting end and the carrier modulation link is enabled, and the cyclic redundancy check bit generation function, encoding function, whitening function and interleaving function are not enabled; the demodulation function corresponding to the receiving end and the signal shaping link is enabled, and the cyclic redundancy check function, decoding function, de-whitening function and de-interleaving function are not enabled.

3. The method according to claim 2, characterized in that The reverse parsing is performed according to all the data generated by the transmitting end and the receiving end in the data processing flow to obtain the physical layer characteristic information of the radio frequency chip, including: In the case where the data processing flow includes a time domain dispersion link, reverse analysis is performed based on the data generated by the transmitting end in the time domain dispersion link and the data generated by the receiving end in the time domain dispersion link to obtain physical layer characteristic information of the RF chip, wherein the physical layer characteristic information includes interleaving block size and interleaving block data position change information.

4. The method according to claim 3, characterized in that The method performs reverse analysis on the data generated by the transmitting end in the time domain dispersion link and the data generated by the receiving end in the time domain dispersion link to obtain the physical layer characteristic information of the radio frequency chip, wherein the physical layer characteristic information includes the interleaving block size and the interleaving block data position change information, including: Step 11, initialize two parameters n and k1, n is the number of bytes, n is an integer greater than or equal to 1, k1 is a coefficient, k1=1; Step 12, generating first repeated data in units of n bytes at the transmitting end as test data, the test data is interleaved when the interleaving function is enabled, and the receiving end obtains the first interleaved data; Step 13, determining whether the first interleaved data is in units of n bytes; if the first interleaved data is not in units of n bytes, executing step 14; or, if the first interleaved data is in units of n bytes, executing step 15; Step 14, update n by accumulation, and repeat steps 12 to 13; Step 15, generating a plurality of groups of second repeated data in units of n bytes at the transmitting end as a plurality of groups of verification data, wherein the plurality of groups of verification data are interleaved when the interleaving function is enabled, and the receiving end obtains a plurality of groups of second interleaved data, and each group of second repeated data is not equal to the first repeated data; Step 16, determining whether the plurality of groups of second interleaved data are all in units of n bytes; if the plurality of groups of second interleaved data are not in units of n bytes, executing step 17; or, if the plurality of groups of second interleaved data are all in units of n bytes, executing step 18; Step 17, update k1 by accumulation, update n by the product of k1 and n, and repeat steps 15 to 16; Step 18: determine that the interleaving block size is n, and trigger the interleaving block data position change process to obtain interleaving block data position change information.

5. The method according to claim 4, characterized in that Triggering the interleaved block data position change process to obtain interleaved block data position change information, including: Step 21, initialize the interleaving block size to n, parameter k2=1, indicating the first byte, a=1, indicating the first bit; Step 22, at the transmitting end, setting the ath bit of the k2th byte to 1 and the remaining bits to 0 to generate non-repetitive data in units of an interleaving block size n, and performing an interleaving process when the interleaving function is enabled; Step 23, determining the position change information of the value 1 according to the third interleaved data received by the receiving end; Step 24, determine whether k2 is equal to n, and whether a is equal to 8; if not, execute step 25; or, if both, execute step 28; Step 25, determine whether a is less than 8, if a is less than 8, execute step 26; if a is equal to 8, execute step 27; Step 26, update a by accumulating, and repeat steps 22 to 24; Step 27, update k2 by accumulation, reset a to 1, and execute steps 22 to 24; Step 28: Generate interleaved block data position change information according to the position change information of all values ​​1.

6. The method according to claim 2, characterized in that The reverse parsing is performed according to all the data generated by the transmitting end and the receiving end in the data processing flow to obtain the physical layer characteristic information of the radio frequency chip, including: In the case where the data processing flow includes a channel coding and decoding link, reverse parsing is performed based on all data generated by the transmitting end and the receiving end in the channel coding and decoding link to obtain physical layer characteristic information of the RF chip, where the physical layer characteristic information includes a coding method adopted by a coding function. When the coding method includes a convolutional code, the convolutional code includes a generating polynomial and a code rate.

7. The method according to claim 2, characterized in that: According to all the data generated by the transmitting end and the receiving end in the data processing flow, reverse parsing is performed to obtain the physical layer characteristic information of the radio frequency chip, including: In the case where the data processing flow includes a signal shaping link, the maximum length is determined according to a preset RF chip manual, all-zero data of the maximum length is sent at the transmitting end, and reverse analysis is performed by comparing the all-zero data with the data received at the receiving end to obtain a whitening sequence of the RF chip; In the case where the data processing flow includes an error detection link, a preset standard length is obtained through a preset RF chip manual, a cyclic redundancy check bit is generated at the transmitting end according to the preset standard length, data with the cyclic redundancy check bit is sent to the receiving end, and the cyclic redundancy check bit of the data sent by the transmitting end is compared with the cyclic redundancy check bit of the data received by the receiving end. If the comparison result is inconsistent, multiple initial values ​​are obtained through an exhaustive method, and the cyclic redundancy check bit generated based on each initial value is compared with the cyclic redundancy check bit of the data sent by the transmitting end to perform reverse analysis to obtain the cyclic redundancy check parameters of the RF chip, and the cyclic redundancy check parameters include: the initial value corresponding to the cyclic redundancy check bit when the comparison is consistent.

8. A reverse analysis system for physical layer characteristics of a radio frequency chip, characterized in that: Applications in embedded platforms, including: The configuration burning module is used to configure the software environment of the RF chip with unknown physical layer configuration characteristic information. After the software environment configuration is completed, the code is burned into the two development boards carrying the RF chip, and one development board after the code is burned is used as the transmitter, and the other development board after the code is burned is used as the receiver; A control module, used to control the transmitting end to perform a forward operation in the data processing flow, and control the receiving end to perform a reverse operation in the data processing flow; The reverse analysis module is used to perform reverse analysis on all data generated by the transmitting end and the receiving end in the data processing flow to obtain the physical layer characteristic information of the radio frequency chip.

9. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a method for reverse parsing physical layer characteristics of a radio frequency chip as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, a method for reverse analysis of physical layer characteristics of a radio frequency chip as described in any one of claims 1 to 7 is implemented.

Images