[GH-ISSUE #3726] [Feature] Matter & Thread reverse engineering: commissioning captures, TLV, clusters, endpoints, fabrics and mesh topology reconstruction #1436

New issue

Open

opened 2026-10-16 21:05:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:25 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3726

Problem Statement & Context

The modern smart home and IoT ecosystem is rapidly consolidating around Matter (application protocol standard governed by the Connectivity Standards Alliance / CSA) and Thread (low-power, IPv6-based wireless mesh network protocol governed by the Thread Group).

Investigating Matter/Thread devices and captures presents unique challenges:

Thread Mesh Networking (6LoWPAN / IEEE 802.15.4): IPv6 mesh topology consisting of Thread Leaders, Routers, End Devices (SEDs), and Border Routers, routing encrypted mesh packets via CoAP.
Matter Session & Secure Channel Protocol: Secure session establishment using Password-Authenticated Session Establishment (PASE) for onboarding/commissioning and Certificate-Authenticated Session Establishment (CASE) for operational device-to-device communication.
Matter TLV (Tag-Length-Value) Serialization: Highly compact binary encoding format supporting anonymous tags, context-specific tags, profile-specific tags, and nested structures.
Data Model (Clusters & Endpoints): Standardized hierarchical application data model: Nodes -> Endpoints (0 to N) -> Clusters (e.g. On/Off, Level Control, Color Control, Door Lock, Thermostat) -> Attributes, Commands, and Events.
Multi-Fabric Coordination: Devices joined concurrently to multiple administrative fabrics (e.g. Apple Home, Google Home, Amazon Alexa) using distinct fabric credentials.

REA currently lacks a dedicated Matter/Thread inspector to decode commissioning captures, unpack Matter TLV streams, and reconstruct multi-fabric device topologies.

Proposed Architecture

flowchart TD
    A["Network Capture (PCAP Thread / UDP Matter) / Device Artifacts"] --> B["Matter & Thread Semantic Engine"]
    B --> C["Thread Mesh Topology Slicer"]
    B --> D["Matter Protocol & Session Analyzer"]
    B --> E["TLV Deserializer & Cluster Data Model Parser"]
    
    C --> C1["6LoWPAN / MLE (Mesh Link Establishment)"]
    C --> C2["Router & End Device Roles (RLOC, EID Addresses)"]
    
    D --> D1["Commissioning Flow Tracking (PASE -> CASE Handshakes)"]
    D --> D2["Operational Message Framing (Counter, Node ID, Fabric ID)"]
    
    E --> E1["Matter TLV Decoding (Anonymous, Context, Profile Tags)"]
    E --> E2["Cluster Model (Endpoints, Attributes, Commands, Events)"]
    E --> E3["Multi-Fabric Binding Map"]
    
    C & D & E --> F["Synthesized Smart-Home Device Graph & Cluster Specification"]

Technical Capabilities & Modules

Thread Mesh Capture Slicing:
- Ingest IEEE 802.15.4 / 6LoWPAN network captures (from hardware sniffers or Thread Border Router diagnostic logs).
- Parse Mesh Link Establishment (MLE) packets and neighbor tables.
- Reconstruct mesh network topology (Leader, Active Routers, Sleepy End Devices).
Matter Secure Channel & Session Tracking:
- Parse Matter message framing over UDP (port 5540): Session ID, Security Flags, Message Counter, Source/Destination Node IDs.
- Track session handshakes: PASE (commissioning) and CASE (operational communication).
- Audit credentials and device attestation certificates (DAC).
Matter TLV Parser:
- Implement universal, zero-copy Matter TLV stream deserializer.
- Support all standard control tags: Anonymous, Context-Specific (1-byte), Common Profile (2/4-byte), and Fully-Qualified Profile tags.
- Export decoded TLV structures to clean, formatted JSON.
Cluster & Endpoint Data Model Reconstruction:
- Map messages to specific Endpoints and Cluster IDs (e.g., 0x0006 On/Off, 0x0008 LevelControl, 0x0038 Basic Information).
- Dissect Interaction Model action frames: ReadRequest, ReportData, WriteRequest, InvokeRequest, InvokeResponse.
- Correlate attribute subscriptions and asynchronous event reports.
Multi-Fabric Topology Mapping:
- Detect fabric assignments (Fabric Index, Fabric ID, Root CA public keys).
- Build a visual topology showing how devices are shared across multiple ecosystems.

Acceptance Criteria

Complete parsing and decoding of Matter binary TLV payloads into JSON structures.
Tracking and decoding of Matter Interaction Model operations (Read, Write, Invoke).
Mapping of device endpoints, clusters, attributes, and command handlers.
Extraction of Thread mesh topology and device routing relationships from captures.
Multi-fabric device mapping showing fabric IDs and operational node IDs.

Complements #3641 (USB protocol reverse engineering)
Complements #3644 (Bluetooth/BLE reverse engineering)
Complements #3615 (Hardware and Embedded Reverse Engineering)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3726 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context The modern smart home and IoT ecosystem is rapidly consolidating around **Matter** (application protocol standard governed by the Connectivity Standards Alliance / CSA) and **Thread** (low-power, IPv6-based wireless mesh network protocol governed by the Thread Group). Investigating Matter/Thread devices and captures presents unique challenges: 1. **Thread Mesh Networking (6LoWPAN / IEEE 802.15.4)**: IPv6 mesh topology consisting of Thread Leaders, Routers, End Devices (SEDs), and Border Routers, routing encrypted mesh packets via CoAP. 2. **Matter Session & Secure Channel Protocol**: Secure session establishment using Password-Authenticated Session Establishment (PASE) for onboarding/commissioning and Certificate-Authenticated Session Establishment (CASE) for operational device-to-device communication. 3. **Matter TLV (Tag-Length-Value) Serialization**: Highly compact binary encoding format supporting anonymous tags, context-specific tags, profile-specific tags, and nested structures. 4. **Data Model (Clusters & Endpoints)**: Standardized hierarchical application data model: Nodes -> Endpoints (0 to N) -> Clusters (e.g. On/Off, Level Control, Color Control, Door Lock, Thermostat) -> Attributes, Commands, and Events. 5. **Multi-Fabric Coordination**: Devices joined concurrently to multiple administrative fabrics (e.g. Apple Home, Google Home, Amazon Alexa) using distinct fabric credentials. REA currently lacks a dedicated Matter/Thread inspector to decode commissioning captures, unpack Matter TLV streams, and reconstruct multi-fabric device topologies. ### Proposed Architecture ```mermaid flowchart TD A["Network Capture (PCAP Thread / UDP Matter) / Device Artifacts"] --> B["Matter & Thread Semantic Engine"] B --> C["Thread Mesh Topology Slicer"] B --> D["Matter Protocol & Session Analyzer"] B --> E["TLV Deserializer & Cluster Data Model Parser"] C --> C1["6LoWPAN / MLE (Mesh Link Establishment)"] C --> C2["Router & End Device Roles (RLOC, EID Addresses)"] D --> D1["Commissioning Flow Tracking (PASE -> CASE Handshakes)"] D --> D2["Operational Message Framing (Counter, Node ID, Fabric ID)"] E --> E1["Matter TLV Decoding (Anonymous, Context, Profile Tags)"] E --> E2["Cluster Model (Endpoints, Attributes, Commands, Events)"] E --> E3["Multi-Fabric Binding Map"] C & D & E --> F["Synthesized Smart-Home Device Graph & Cluster Specification"] ``` ### Technical Capabilities & Modules 1. **Thread Mesh Capture Slicing:** - Ingest IEEE 802.15.4 / 6LoWPAN network captures (from hardware sniffers or Thread Border Router diagnostic logs). - Parse Mesh Link Establishment (MLE) packets and neighbor tables. - Reconstruct mesh network topology (Leader, Active Routers, Sleepy End Devices). 2. **Matter Secure Channel & Session Tracking:** - Parse Matter message framing over UDP (port 5540): Session ID, Security Flags, Message Counter, Source/Destination Node IDs. - Track session handshakes: PASE (commissioning) and CASE (operational communication). - Audit credentials and device attestation certificates (DAC). 3. **Matter TLV Parser:** - Implement universal, zero-copy Matter TLV stream deserializer. - Support all standard control tags: Anonymous, Context-Specific (1-byte), Common Profile (2/4-byte), and Fully-Qualified Profile tags. - Export decoded TLV structures to clean, formatted JSON. 4. **Cluster & Endpoint Data Model Reconstruction:** - Map messages to specific Endpoints and Cluster IDs (e.g., `0x0006` On/Off, `0x0008` LevelControl, `0x0038` Basic Information). - Dissect Interaction Model action frames: `ReadRequest`, `ReportData`, `WriteRequest`, `InvokeRequest`, `InvokeResponse`. - Correlate attribute subscriptions and asynchronous event reports. 5. **Multi-Fabric Topology Mapping:** - Detect fabric assignments (Fabric Index, Fabric ID, Root CA public keys). - Build a visual topology showing how devices are shared across multiple ecosystems. ### Acceptance Criteria - [ ] Complete parsing and decoding of Matter binary TLV payloads into JSON structures. - [ ] Tracking and decoding of Matter Interaction Model operations (Read, Write, Invoke). - [ ] Mapping of device endpoints, clusters, attributes, and command handlers. - [ ] Extraction of Thread mesh topology and device routing relationships from captures. - [ ] Multi-fabric device mapping showing fabric IDs and operational node IDs. ### Related Issues & Dependencies - Complements #3641 (USB protocol reverse engineering) - Complements #3644 (Bluetooth/BLE reverse engineering) - Complements #3615 (Hardware and Embedded Reverse Engineering)

bsakaguchi referenced this issue

2026-10-17 21:11:25 +00:00

[PR #1436] [MERGED] test(native): verify macOS provenance through real CLI and MCP #2885

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1436

No description provided.

Rows
Columns