# Ph0wn 2018 - LoRa{1,2,3}

LoRa1: Use LoRa dev board to listen to the EU 868.1MHZ and received the flag LoRa2: Scan all the EU frequencies and SpreadFactor to get the flag LoRa3: Find the flag on the LoRa base station

### Details

Points: ?

Category: network

Validations: ?

### Solution

#### LoRa 1

The organizers tell us to use 868.1MHZ with SpreadFactor 10 in order to get the flag. The board is a devkit for LoRaWan based on arduino micro pro.

The organizers gave the name of the LoRa library to use: arduino-LoRa.

Using arduino IDE we wrote a simple program to listen to the given frequency:

#include <SPI.h>
#include <LoRa.h>

void setup() {
Serial.begin(9600);
while (!Serial);

if (!LoRa.begin(868.1E6)) {
Serial.println("Starting LoRa failed!");
while (1);
}
}

Serial.print("packet recv\n");
for (int i = 0; i < packetSize; i++) {
}
}

void loop() {

}


#### LoRa 2

The program has been slightly modified in order to bruteforce all the EU frequencies and the SpreadFactor:

#include <SPI.h>
#include <LoRa.h>

float freq[5] = { 868.3E6, 868.5E6, 867.1E6, 867.5E6, 867.7E6, 867.9E6 };

void setup() {
Serial.begin(9600);
while (!Serial);

if (!LoRa.begin(868.1E6)) {
Serial.println("Starting LoRa failed!");
while (1);
}
}

Serial.print("packet recv\n");
for (int i = 0; i < packetSize; i++) {
}
}

void loop() {

delay(5000);
While(1) {
int i;
for(i=0; i < 5 ; i++)
{

LoRa.setFrequency(freq[i]);
int j;
for(j=7; j <= 12; j++)
{

// loop on spreading factor is finish, set new freq
delay(5000);
}
}
}
}


#### LoRa 3

The program has been adapted in order to print the RSSI of the packet, we need to add a delay of 1s in order to not crash the arduino:

#include <SPI.h>
#include <LoRa.h>

void setup() {
Serial.begin(9600);
while (!Serial);

if (!LoRa.begin(867.1E6)) {
Serial.println("Starting LoRa failed!");
while (1);
}

}

Serial.print("packet recv\n");
}

void loop() {

delay(1000);
}


And we found the flag on the LoRa BTS:

Challenges resources are available in the resources folder

Written on December 14, 2018