hardware.nix (2048B)
1 # modules/features/pentest/hardware.nix — the physical layer: flashing chips, 2 # talking to a UART, driving JTAG/SWD, sniffing a logic bus, CAN. 3 # Off by default. `daemon.pentest.hardware.enable = true;` 4 # 5 # This is the "you have the device open on the bench" category. Firmware 6 # extraction (binwalk) lives in dfir.nix and the disassembly of what you pull 7 # off the chip lives in reversing.nix — this is only the part that moves bytes 8 # on and off hardware. 9 { lib, ... }: 10 (import ./_sets.nix { inherit lib; }) { 11 name = "hardware"; 12 description = "firmware flashing, UART/JTAG, logic analysers and CAN"; 13 default = false; 14 15 packages = pkgs: with pkgs; [ 16 # Flashing and dumping 17 flashrom # SPI flash, in-circuit or on a programmer 18 esptool # ESP8266/ESP32: esptool, espefuse, espsecure 19 avrdude 20 dfu-util # anything speaking USB DFU 21 stlink # st-flash, st-info — ST-Link probes 22 23 # Debug ports 24 openocd # JTAG/SWD, the generic answer 25 26 # Serial 27 minicom 28 picocom 29 30 # Logic analysis 31 sigrok-cli 32 pulseview # the GUI for the same capture 33 34 # Vehicle and industrial buses 35 can-utils # candump, cansend, cangen, isotpdump, … 36 ]; 37 38 expectedBins = [ 39 "flashrom" "esptool" "espefuse" "avrdude" "dfu-util" "st-flash" "st-info" 40 "openocd" 41 "minicom" "picocom" 42 "sigrok-cli" "pulseview" 43 "candump" "cansend" "cangen" 44 ]; 45 46 extraConfig = { pkgs, lib, user, ... }: { 47 # Probes and programmers are USB devices; without their rules you are 48 # running every one of the above as root. 49 services.udev.packages = with pkgs; [ 50 openocd 51 stlink 52 sigrok-cli 53 ]; 54 55 # A USB serial adapter appears as /dev/ttyUSB* owned by group `dialout`, 56 # so without this `picocom /dev/ttyUSB0` needs sudo. The host's user is in 57 # networkmanager and wheel only, so the membership is granted HERE and goes 58 # away with the category. `dialout` already exists in NixOS, so only the 59 # membership is added. 60 users.users.${user}.extraGroups = [ "dialout" ]; 61 }; 62 }