Skip to content
This repository has been archived by the owner on Jul 15, 2024. It is now read-only.

new tools + fixes #9

Merged
merged 14 commits into from
Apr 23, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,7 @@
.vscode

# build
/pico-key/build
/pico-key/build

# tests
/tests/basic-keystroke-injection/build/*
4 changes: 2 additions & 2 deletions pico-key/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,10 @@ cmake_minimum_required(VERSION 3.13)

# set path
# this is assuming you pulled this from github
set(PICO_SDK_PATH "pico-sdk")
set(PICO_SDK_FETCH_FROM_GIT ON)

# include the sdk
include(pico_sdk_import.cmake)
include(${CMAKE_CURRENT_LIST_DIR}/pico_sdk_import.cmake)

# project name
project(pico-key)
Expand Down
7 changes: 5 additions & 2 deletions pico-key/boot.c
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,13 @@ int boot(void) {
printf("%s\n", author);

// board info
boardInfo();
boardInfo(void);

// spoof id
spoofID(void);

if (config.run_on_startup) {
read();
read(fullScript); // may need to fix that
return 0;
} else {
// do nothing
Expand Down
2 changes: 2 additions & 0 deletions pico-key/boot.h
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@
#define BOOT_H

#include "config.h"
#include "usb.h"
#include "filesystem.h"
#include "pico/stdio.h"
#include "pico/malloc.h"

Expand Down
4 changes: 4 additions & 0 deletions pico-key/config.c
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,10 @@

#include "config.h"

// define where to write
uint32_t startAddress = 0x10000;
uint32_t sizeBytes = 4096;

void checkConfig(const Configuration& config) {
printf("\nCurrent Config: \n");
printf("LED Pin definition: %d\n", config.led_pin);
Expand Down
3 changes: 2 additions & 1 deletion pico-key/config.h
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@

// default config params
#define LED_PIN PICO_DEFAULT_LED_PIN
#define DEFAULT_PAYLOAD_LOCATION "/payload.dd"
#define DEFAULT_RUN_ON_STARTUP true

// configuration structure
Expand All @@ -22,5 +21,7 @@ struct Configuration {
};

void checkConfig();
uint32_t startAddress;
uint32_t sizeBytes;

#endif // CONFIG_H
83 changes: 35 additions & 48 deletions pico-key/duckyscript.c
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@

#include "duckyscript.h"

// full script
uint8_t fullScript[sizeBytes];

// set size
uint8_t keyboard_report[KEYBOARD_REPORT_SIZE];

Expand All @@ -26,8 +29,6 @@

// run a duckyscript command based on what is in duckyscript.h
int run(const char* command, void* params) {
tusb_init();

// parse command and run
if (strcmp(command, "regular") == 0) {
RegularKey* regKey = (RegularKey*)params;
Expand Down Expand Up @@ -64,11 +65,13 @@
keyboard_report[7] = 0; // reserved
}

printf("\nStarting attack!\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
// run attack
while (1) {
tud_task();
}

printf("\nAttack finished!\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
return 0;
}

Expand Down Expand Up @@ -97,43 +100,32 @@
}

// crap i gotta build a new compiler for this :/
void read(const char* filePath) {
FILE *file = fopen(filePath, "r");

if (file == NULL) {
perror("Can't open '%s' :/", filePath);
return;
}

char line[256];
while (fgets(line, sizeof(line), file)) {
char *command = strtok(line, " \t\n");

char *param = strtok(NULL, "\n");
while (param && strtok(NULL, "\n")) {
strcat(command, " ");
strcat(command, param);
param = strtok(NULL, "\n");
void read(uint8_t array[]) {
char* token;
char* rest = array;
const char commas[] = ",";

// tokenize buffer
while ((token = strtok_r(rest, commas, &rest))) {
char* command = strtok(token, " \t\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
char* param = strtok(NULL, "\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected

if (strcmp(command, "regular") == 0 || strcmp(command, "modifier") == 0 || strcmp(command, "function") == 0) {
run(command);
} else {
printf("Unknown command: %s\n", command);

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
}

run(command);
}

fclose(filePath);
}


void buildScript() {
printf("\nPayloads are built here, but can also be modified using a file manager.\n");
printf("Every time you press enter it will be written to the file.\n");
printf("Type 'exit' to stop.\n");

// assume it's named payload.dd
FILE *file = fopen(config.payload_location, "w");

if (file == NULL) {
printf("Failed to open payload.dd! :(\n");
return;
}
// define script buffer
char scriptBuffer[sizeBytes];

// 25 chars max!! most of the time commands are shorter.
const int MAX_LINE_LENGTH = 25;
Expand All @@ -149,16 +141,21 @@
script[i] = toupper(script[i]);
}

// exit if command is "exit"
if (strcmp(script, "EXIT") == 0) {
// append script line to buffer
if (strlen(script) + strlen(scriptBuffer) + 1 <= sizeBytes) {

Check notice

Code scanning / devskim

If a string is missing a null terminator, strlen will read past the end of the buffer Note

Problematic C function detected (strlen)

Check notice

Code scanning / devskim

If a string is missing a null terminator, strlen will read past the end of the buffer Note

Problematic C function detected (strlen)
strcat(scriptBuffer, script);

Check failure

Code scanning / devskim

If the combination of strings is larger than the destination buffer, strcat will cbuffer overflow the destination buffer Error

Banned C function detected (strcat)
} else {
printf("Script buffer is full. Exiting.\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
break;
}
}

fprintf(file, "%s\n", script);
// format memory and write required info there
format();
seperate(scriptBuffer, sizeof(scriptBuffer), fullScript);
write(fullScript, sizeof(fullScript));

}
fclose(file);
printf("Script saved to payload.dd!\n");
printf("Script saved!\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
}

void testScript() {
Expand Down Expand Up @@ -187,16 +184,6 @@
}
}

char scriptPath[256];
while (1) {
printf("Script to test? > ");
fgets(scriptPath, sizeof(scriptPath), stdin);
scriptPath[strcspn(scriptPath, "\n")] = '\0';

if (strcmp(scriptPath, "EXIT") == 0 || strcmp(scriptPath, "exit") == 0) {
break;
} else {
read(scriptPath);
}
}
// when we pass this we read the script
read(fullScript);
}
4 changes: 3 additions & 1 deletion pico-key/duckyscript.h
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,11 @@
#ifndef DUCKYSCRIPT_H
#define DUCKYSCRIPT_H

#include "config.h"
#include "filesystem.h"
#include "pico/stdio.h"
#include "tinyusb/src/tusb.h"
#include "tinyusb/src/tusb_option.h"
#include "pico/stdio.h"

// define hid report size
#define KEYBOARD_REPORT_SIZE 8
Expand Down
68 changes: 68 additions & 0 deletions pico-key/filesystem.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
/**
* filesystem.c
* handles filesystem related tasks
*/

#include "filesystem.h"

// define where to erase
uint32_t startAddress = 0x10000;
uint32_t sizeBytes = 4096;

// format the specified area
void format(void) {
printf("\nErasing flash...\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected

// erase memory at specified range
flash_range_erase(startAddress, sizeBytes);

printf("Done.\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
}

// seperate the duckyscript buffer
void separate(const char *buffer, size_t buflen, char *array) {
// check if the buffer is empty
if (buflen == 0) {
printf("Buffer is empty.\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
return;
}

// index
size_t index = 0;

// store in array
for (size_t i = 0; i < buflen; i++) {
array[index++] = buffer[i];

// insert a comma
if (i < buflen - 1) {
array[index++] = ',';
}
}

// null-terminate the output
array[index] = '\0';
}

// write the data and keep it constant
void write(const void *data, size_t len) {
// format memory
format(void)

// check if the length exceeds the available space
if (len > sizeBytes) {
printf("Error: Data exceeds available space :/\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
return;
}

printf("\nWriting data to flash...\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected

uint32_t ints = save_and_disable_interrupts();

// write data to flash
flash_range_program(startAddress, data, len);

restore_interrupts(ints);

printf("Data written successfully.\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
}
20 changes: 20 additions & 0 deletions pico-key/filesystem.h
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
/**
* filesystem.h
* headers for filesystem related things
*/

#ifndef FILESYSTEM_H
#define FILESYSTEM_H

#include "config.h"
#include "pico/stdio.h"
#include "pico/stdlib.h"
#include "hardware/flash.h"
#include "hardware/irq.h"
#include "hardware/sync.h"

void format(void);
void seperate(const char *buffer, size_t buflen, char *array);
void write(const void *data, size_t len);

#endif // FILESYSTEM_H
13 changes: 10 additions & 3 deletions pico-key/pico-key.c
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,17 @@
#include "pico-key.h"

int main(void) {
// main initialization
stdio_init_all();
tusb_init();

boot();
while (true) {
printf("\n1. Build Bad USB script\n");
printf("2. Test Bad USB script\n");
printf("3. Fake USB drive\n");
printf("4. Misc\n");
printf("4. STM32F1-Picopwner\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
printf("5. Misc\n");

Check warning

Code scanning / devskim

These functions are historically error-prone and have been associated with a significant number of vulnerabilities. Most of these functions have safer alternatives, such as replacing 'strcpy' with 'strlcpy' or 'strcpy_s'. Warning

Banned C function detected
printf("5. Options\n");
sleep(1);

Expand All @@ -39,11 +42,15 @@
fakeUSB();
break;

case 4:
case 4:
smt(void);
break;

case 5:
misc();
break;

case 5:
case 6:
options();
break;

Expand Down
3 changes: 3 additions & 0 deletions pico-key/pico-key.h
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@
#ifndef PICO_KEY_H
#define PICO_KEY_H

#include "stm.h"
#include "usb.h"
#include "settings.h"
#include "config.h"
#include "boot.h"
#include "duckyscript.h"
Expand Down
Loading
Loading