61 Commits

Author SHA1 Message Date
cecio
276edad7e3 bump to release 0.14.3 2024-01-01 16:05:11 +01:00
cecio
751465b3a2 bump to release 0.14.3 2024-01-01 16:03:49 +01:00
cecio
2c493681cc bump to release 0.14.2 2023-12-11 23:23:01 +01:00
cecio
b87b518552 Update README.md 2023-11-20 23:14:04 +01:00
cecio
385a67144a Update README.md 2023-11-20 23:13:29 +01:00
cecio
df739adf29 Update README.md
Typo fixed
2023-11-20 21:47:50 +01:00
cecio
5126ce40d7 new logo and enclosure 2023-11-20 21:44:58 +01:00
cecio
f7a1165cae firmware added 2023-11-15 21:32:04 +01:00
cecio
8b3f6d3223 bump to release 0.14.1 2023-11-15 21:28:13 +01:00
cecio
2d248742e3 Update README.md 2023-10-27 23:28:53 +02:00
cecio
9b92c0b97a bump to release 0.14.0 2023-10-17 23:18:25 +02:00
cecio
d92080cfca bump to release 0.13.1 2023-09-26 21:48:30 +02:00
cecio
4ed324a73b - general clock speed lowered to 120Mhz and managed manually on core1 to achieve max compatibility for HID
- hashing moved to XxHash for performance reason
- bump to release 0.13.0
- upgrade board to `Raspberry Pi RP2040 (3.4.1)`
2023-09-08 23:24:48 +02:00
cecio
39b0a09ff8 bump to release 0.12.3 2023-08-06 12:43:32 +02:00
cecio
adaf489a82 bump to release 0.12.2 2023-08-02 17:20:27 +02:00
cecio
d57360e566 Merge branch 'main' of https://github.com/cecio/USBvalve 2023-07-28 14:48:52 +02:00
cecio
b3e43ff63d Bump to release 0.12.1 2023-07-28 14:47:42 +02:00
WM
999985150f STL files for 1.2 PCB (#6)
STL files for 1.2 PCB and 32 display cover.
2023-07-26 09:37:48 +02:00
cecio
ced8536f8c - HID serial read optimization
- BOOTSLE act now as reset
- bump to releas 0.12.0
2023-07-19 21:48:08 +02:00
cecio
77f995533e - HID serial read optimized
- BOOTSEL now act as reset button
- bump to release 0.12.0
2023-07-19 21:45:42 +02:00
cecio
3b0f285567 logo mods 2023-07-08 15:00:50 +02:00
cecio
52af9dabb7 Update README.md 2023-07-08 00:28:54 +02:00
cecio
94a5d2e8c5 Update README.md 2023-07-07 21:36:57 +02:00
cecio
ef2ddde66f added logo pic 2023-07-07 21:27:57 +02:00
cecio
7953e269af Update README.md 2023-07-05 00:53:07 +02:00
cecio
5aa63c8efe bump to release 0.11.0 2023-07-04 22:01:53 +02:00
cecio
39c3145e71 README mods 2023-07-04 21:38:30 +02:00
cecio
7daafb4d41 README mods 2023-07-04 21:36:54 +02:00
cecio
5a7a485aa4 README mods 2023-07-04 21:35:35 +02:00
cecio
08512d5d87 gitignore updated 2023-07-04 14:55:30 +02:00
cecio
1c351f3a7b Added Dockerfile for build environment 2023-07-04 14:54:42 +02:00
cecio
e1c4fd4816 0.10.0 firmware added 2023-06-12 22:28:19 +02:00
cecio
3de81580bd bump to release 0.10.0 2023-06-11 23:42:09 +02:00
cecio
b6076a6880 Added Anti-Detection comments in README 2023-06-11 22:19:32 +02:00
cecio
d97b34c372 Fixed issue in stopping operations if hash does not match 2023-06-11 22:04:05 +02:00
cecio
c4b914f458 Consistency hashing now skip DISK_LABEL 2023-06-11 21:55:04 +02:00
cecio
a0ad62e20f Fix is needed for changing the DISK_LABEL. 2023-06-10 23:23:25 +02:00
cecio
7bcca191cc Added possibility to customize DISK_LABEL 2023-06-10 23:11:53 +02:00
cecio
386852c994 Added the possibility to override SN (disabled) 2023-06-10 22:35:20 +02:00
cecio
e19cb76910 Added new "Anti-Detection" section for customization 2023-06-10 22:23:41 +02:00
cecio
927dd4d67f grouped variables for USB IDs strings for easy customization 2023-06-10 01:10:40 +02:00
cecio
b8a0baa9f2 added 0.9.1 firmware 2023-05-13 21:51:03 +02:00
cecio
32a4a2d895 New scroll mode and bump to release 0.9.1 2023-05-13 13:19:41 +02:00
cecio
1faf7e440c bump to release 0.9.0 2023-05-10 22:48:14 +02:00
cecio
5bca0f9370 added Mouse report 2023-05-06 23:28:10 +02:00
cecio
f802176d70 beta of version 0.9.0 2023-05-04 22:41:07 +02:00
cecio
61acbde028 minor update to PCB (ground connections) 2023-05-01 11:50:05 +02:00
cecio
881536db0c Update README.md 2023-04-25 22:41:59 +02:00
cecio
bbb9b4e58e Update README.md 2023-04-25 21:52:52 +02:00
cecio
42c4ba357a Update README.md 2023-04-25 21:30:25 +02:00
cecio
e71e9b60a9 update 2023-04-22 22:48:20 +02:00
cecio
41360fc26b Update README.md 2023-04-22 22:38:48 +02:00
cecio
50178b2272 renamed STL files 2023-04-22 22:33:49 +02:00
cecio
41ba557583 Merge branch 'main' of https://github.com/cecio/USBvalve 2023-04-22 22:32:53 +02:00
cecio
b91effbbba new release 0.8.x 2023-04-22 22:32:08 +02:00
WM
ac51d0884a Updated STL files (#3)
* Create .gitkeep

* STL files

STL files for a box and a cover for the 128x32 screen

* Delete .gitkeep

* Updated STL files

Updated STL files for the lid with more grip
2023-04-13 22:35:04 +02:00
cecio
c02516a815 Merge branch 'main' of https://github.com/cecio/USBvalve 2023-04-13 13:17:04 +02:00
WM
181bf1ba0d Add STL files (#2)
* Create .gitkeep

* STL files

STL files for a box and a cover for the 128x32 screen

* Delete .gitkeep
2023-04-13 13:15:05 +02:00
cecio
121742fb6f bump to release 0.8.0 2023-04-04 00:13:04 +02:00
cecio
3d890ff1ac Gerber file renamed 2023-04-03 22:54:24 +02:00
cecio
4318641722 first version with HID detector working 2023-03-30 23:28:12 +02:00
22 changed files with 542 additions and 575 deletions

2
.gitignore vendored
View File

@@ -50,3 +50,5 @@ modules.order
Module.symvers
Mkfile.old
dkms.conf
USBvalve_out

39
Dockerfile Normal file
View File

@@ -0,0 +1,39 @@
#
# To Build:
# docker build -t usbvalve/arduino-cli .
#
# To Run:
# docker run --rm --name usbvalve -v $PWD:/mnt usbvalve/arduino-cli /mnt/USBvalve
#
FROM ubuntu:22.04
WORKDIR /app
# OS setup
RUN apt-get update -y \
&& apt-get install -y git wget python3 \
&& apt-get autoremove -y \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
# arduino-cli setup
RUN cd /app \
&& git clone --recursive https://github.com/arduino/arduino-cli.git \
&& cd arduino-cli \
&& ./install.sh \
&& export PATH=$PATH:/app/arduino-cli/bin \
&& arduino-cli --additional-urls https://github.com/earlephilhower/arduino-pico/releases/download/global/package_rp2040_index.json core search 2040 \
&& arduino-cli --additional-urls https://github.com/earlephilhower/arduino-pico/releases/download/global/package_rp2040_index.json core install rp2040:rp2040 \
&& arduino-cli lib install "Adafruit TinyUSB Library" \
&& arduino-cli lib install "ssd1306" \
&& arduino-cli lib install "Pico PIO USB" \
&& arduino-cli lib install "XxHash_arduino" \
&& arduino-cli lib install "SSD1306Ascii"
# Compilation setup
RUN echo "#!/bin/bash" > /app/entrypoint.sh \
&& echo "export PATH=\$PATH:/app/arduino-cli/bin" >> /app/entrypoint.sh \
&& echo "arduino-cli compile --fqbn rp2040:rp2040:rpipico --board-options \"usbstack=tinyusb\" --board-options \"freq=120\" --output-dir \"/mnt/USBvalve_out\" \"\$1\"" >> /app/entrypoint.sh \
&& chmod +x /app/entrypoint.sh
ENTRYPOINT ["/app/entrypoint.sh"]

Binary file not shown.

Binary file not shown.

View File

@@ -1,5 +1,6 @@
# USBvalve
*Expose USB activity on the fly*
<h1><img width="300" alt="logo, landscape, dark text, transparent background" src="https://github.com/cecio/USBvalve/blob/main/pictures/USBvalve_logo_scaled.png"></a></h1>
### *Expose USB activity on the fly*
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/versions.png" alt="The two models" width="30%" height="30%" />
@@ -14,6 +15,20 @@ With **USBvalve** you can have an immediate feedback about what happen to the dr
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/readme.png" alt="Readme" width="15%" height="15%" />
</p>
and from version `0.8.0` you can also use it as USB Host to detect *BADUSB* devices:
<p float="left">
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/hid.png" alt="HID" width="15%" height="15%" />
</p>
This is an example of the *BADUSB* debugger available on serial port:
<p float="left">
<a href="https://asciinema.org/a/NWfC9Mvzzpj3eZfsC7s5Dz1sJ" target="_blank"><img src="https://asciinema.org/a/NWfC9Mvzzpj3eZfsC7s5Dz1sJ.svg" width="65%" height="65%" /></a>
</p>
If you prefer videos, you can also have a look to my [Insomni'hack Presentation](https://www.youtube.com/watch?v=jy1filtQY4w)
## Repository Structure
`docs`: documentation about the project, with a presentation where you can have a look to all the features
@@ -28,6 +43,8 @@ With **USBvalve** you can have an immediate feedback about what happen to the dr
`pictures`: images and resources used in this doc
`STL`: STL files for enclosure. In `1.1` and `1.2` folders there are full enclosures (thanks to [WhistleMaster](https://github.com/WhistleMaster)). If you want something lighter to protect the LCD you can go with `USBvalve_sliding_cover.stl`.
## Build USBvalve
### Part list
@@ -41,21 +58,27 @@ If you want to build your own, you need:
### Building instructions
Almost all the job is done directly on the board by the software, so you just need to arrange the connection with the OLED for output
Almost all the job is done directly on the board by the software, so you just need to arrange the connection with the OLED for output.
Starting from version 0.8.0 of the firmware, **USBvalve** can detect HID devices (used to detect *BADUSB*). This require an additional USB port behaving as Host. If you are not interested in this, you can use the old instructions [in docs folder](https://github.com/cecio/USBvalve/blob/main/docs/BUILDING-1.1.md) and use PCB version `1.1`. Otherwise go ahead with PCB version `1.2` (we have version for USB-A or USB-B, see folder).
#### With USBvalve PCB
<p float="left">
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/USB_valve_front.png" width="25%" height="25%" />
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/USB_valve_back.png" width="25%" height="25%" />
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/USB_valve_1-2_front.png" width="25%" height="25%" />
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/USB_valve_1-2_back.png" width="24%" height="24%" />
</p>
- solder a USB female port in `USBH` area. This is for version `A`, but there is a version for USB `Micro-B` as well if you prefer
- place the Raspberry Pi Pico on the silk screen on the front
- you don't need to solder all the PINs. Just the following:
- D4 and D5 (left side)
- GND (right side)
- D14 and D15 (left side)
- GND (right side, third pin from the top)
- GND (right side, third pin from the bottom)
- 3v3_OUT (right side)
- VBUS (right side)
- the 3 DEBUG pin on the bottom: SWCLK, GND and SWDIO
- place the 3D printer spacer or a piece of tape on the parts of the OLED that my touch the Raspberry
- solder the OLED (with a header) on the 4 PIN space
@@ -78,14 +101,18 @@ Otherwise you should the opposite and place the solder on the other PADs:
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/pico-pinout.svg" alt="Pico Pi" width="85%" height="85%" />
If you are using a breadboard or just wiring, all you have to do is to ensure to connect the proper PINs at the OLED screen.
If you are using a breadboard or just wiring, all you have to do is to ensure to connect the proper PINs at the OLED screen and to the Host USB port.
The mapping is the following:
- PIN6 of Pi --> OLED SDA
- PIN7 of Pi --> OLED SCL
- PIN19 of Pi --> D+ of USB Host
- PIN20 of Pi --> D- of USB Host
- PIN23 (GND) of Pi --> GND of USB Host
- PIN38 (GND) of Pi --> OLED GND
- PIN36 (3V3OUT) of Pi --> OLED VCC
- PIN40 (VBUS) of Pi --> VCC of USB Host
If you want to use the DEBUG functions, you can also place a header on the 3 SWD PINs at the bottom of the board.
@@ -101,17 +128,57 @@ To flash the firmware, follow these steps:
It's done!
### Anti-Detection
I don't know if it will ever be the case, but you may want to customize the firmware in order to avoid detection done by *USBvalve-aware* malware :-)
I grouped most of the variables you may want to modify in this section ([see Dockerfile below for rebuilding](https://github.com/cecio/USBvalve#dockerfile))
```C
// Anti-Detection settings.
//
// Set USB IDs strings and numbers, to avoid possible detections.
// Remember that you can cusotmize FAKE_DISK_BLOCK_NUM as well
// for the same reason. Also DISK_LABEL in ramdisk.h can be changed.
//
// You can see here for inspiration: https://the-sz.com/products/usbid/
//
// Example:
// 0x0951 0x16D5 VENDORID_STR: Kingston PRODUCTID_STR: DataTraveler
//
#define USB_VENDORID 0x0951 // This override the Pi Pico default 0x2E8A
#define USB_PRODUCTID 0x16D5 // This override the Pi Pico default 0x000A
#define USB_DESCRIPTOR "DataTraveler" // This override the Pi Pico default "Pico"
#define USB_MANUF "Kingston" // This override the Pi Pico default "Raspberry Pi"
#define USB_SERIAL "123456789A" // This override the Pi Pico default. Disabled by default. \
// See "setSerialDescriptor" in setup() if needed
#define USB_VENDORID_STR "Kingston" // Up to 8 chars
#define USB_PRODUCTID_STR "DataTraveler" // Up to 16 chars
#define USB_VERSION_STR "1.0" // Up to 4 chars
```
### Building your firmware
Obviously you can also build your own firmware. To build the *standard* one I used:
- Arduino IDE 2.0.4
- ~~as board I used `Raspberry Pi Pico - Arduino MBED OS RP2040` version `4.0.2`~~
- ~~`Adafruit TinyUSB Library` version `1.14.4`. Newer versions are not working because the RPI SDK of the board is stick to an older version. May be migrate the entire project directly on Raspberry Pi Pico SDK is the solution here.~~
- from version `0.7.0` I used `Adafruit TinyUSB Library` version `2.0.1` and Board `Raspberry Pi RP2040 (2.7.0)`
- Arduino IDE `2.2.1`
- `Adafruit TinyUSB Library` version `2.3.1`, `Pico-PIO-USB` version `0.5.2`, Board `Raspberry Pi RP2040 (3.6.2)` setting Tools=>CPU Speed at `120MHz` and Tools=>USB Stack to `Adafruit TinyUSB`
- `ssd1306` OLED library version `1.8.3`
If you want to re-create a new fake filesystem, you may want to have a look to the `utils` folder, where I placed some utilities to build a new one.
**NOTE**: if you have ideas or improvements in your mind, I encourage you to open an issue so that we can improve the project together! Thanks!
#### Dockerfile
If you want to build your own firmware, after you customized it, I provide a `Dockerfile` which builds a complete **Arduino** environment and compile the firmware. Enter the following commands in the main `USBvalve` folder:
```
docker build -t usbvalve/arduino-cli .
docker run --rm --name usbvalve -v $PWD:/mnt usbvalve/arduino-cli /mnt/USBvalve
```
The firmware will be placed with extension `uf2` in folder `USBvalve_out`.
### Contribute
If you have ideas or improvements in your mind, I encourage you to open an issue so that we can improve the project together! Thanks!

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

Binary file not shown.

View File

@@ -2,7 +2,7 @@
USBvalve
written by Cesare Pizzi
This project extensively reuse code done by Adafruit. Please support them!
This project extensively reuse code done by Adafruit and TinyUSB. Please support them!
*/
/*********************************************************************
@@ -16,8 +16,30 @@
any redistribution
*********************************************************************/
#include <pio_usb.h>
#include "Adafruit_TinyUSB.h"
#include "SSD1306AsciiWire.h"
#include <XxHash_arduino.h>
#include <pico/stdlib.h>
//
// BADUSB detector section
//
/*
* Requirements:
* - [Pico-PIO-USB](https://github.com/sekigon-gonnoc/Pico-PIO-USB) library
* - 2 consecutive GPIOs: D+ is defined by HOST_PIN_DP (gpio2), D- = D+ +1 (gpio3)
* - CPU Speed must be either 120 or 240 Mhz. Selected via "Menu -> CPU Speed"
*/
#define HOST_PIN_DP 14 // Pin used as D+ for host, D- = D+ + 1
#define LANGUAGE_ID 0x0409 // English
// USB Host object
Adafruit_USBH_Host USBHost;
// END of BADUSB detector section
// Define vars for OLED screen
#define I2C_ADDRESS 0x3C // 0X3C+SA0 - 0x3C or 0x3D
@@ -32,7 +54,6 @@ SSD1306AsciiWire oled;
#define FAKE_DISK_BLOCK_NUM 0x800
#define DISK_BLOCK_SIZE 0x200
#include "ramdisk.h"
#include "quark.h"
Adafruit_USBD_MSC usb_msc;
@@ -54,35 +75,54 @@ bool activeState = false;
//
// USBvalve globals
//
#define VERSION "USBvalve - 0.7.0"
#define VERSION "USBvalve - 0.14.3"
boolean readme = false;
boolean autorun = false;
boolean written = false;
boolean deleted = false;
boolean written_reported = false;
int x = 2;
boolean deleted_reported = false;
boolean hid_sent = false;
boolean hid_reported = false;
// Anti-Detection settings.
//
// Set USB IDs strings and numbers, to avoid possible detections.
// Remember that you can cusotmize FAKE_DISK_BLOCK_NUM as well
// for the same reason. Also DISK_LABEL in ramdisk.h can be changed.
//
// You can see here for inspiration: https://the-sz.com/products/usbid/
//
// Example:
// 0x0951 0x16D5 VENDORID_STR: Kingston PRODUCTID_STR: DataTraveler
//
#define USB_VENDORID 0x0951 // This override the Pi Pico default 0x2E8A
#define USB_PRODUCTID 0x16D5 // This override the Pi Pico default 0x000A
#define USB_DESCRIPTOR "DataTraveler" // This override the Pi Pico default "Pico"
#define USB_MANUF "Kingston" // This override the Pi Pico default "Raspberry Pi"
#define USB_SERIAL "123456789A" // This override the Pi Pico default. Disabled by default. \
// See "setSerialDescriptor" in setup() if needed
#define USB_VENDORID_STR "Kingston" // Up to 8 chars
#define USB_PRODUCTID_STR "DataTraveler" // Up to 16 chars
#define USB_VERSION_STR "1.0" // Up to 4 chars
#define BLOCK_AUTORUN 102 // Block where Autorun.inf file is saved
#define BLOCK_README 100 // Block where README.txt file is saved
#define MAX_DUMP_BYTES 16 // Used by the dump of the debug facility: do not increase this too much
#define BYTES_TO_HASH 512 * 2 // Number of bytes of the RAM disk used to check consistency
#define BYTES_TO_HASH_OFFSET 7 // Starting sector to check for consistency (FAT_DIRECTORY is 7)
#define BYTES_TO_HASH_OFFSET 7 // Starting sector to check for consistency (FAT_DIRECTORY is 7)
// Burned hash to check consistency
u8 valid_hash[WIDTH] = {
0x35, 0x98, 0x95, 0x97, 0xC7, 0x70, 0xD3, 0xE4,
0xDD, 0x84, 0x71, 0x1D, 0x55, 0xD2, 0xE5, 0xA4,
0x6C, 0x28, 0x84, 0xF6, 0xE1, 0x02, 0xD1, 0x74,
0x2F, 0xE9, 0x92, 0xAD, 0xAD, 0x74, 0x71, 0xF0,
0x37, 0xFF, 0x79, 0x39, 0xDC, 0x20, 0x56, 0x26,
0xFE, 0xC7, 0x9A, 0x4E, 0x3A, 0x27, 0x65, 0x81
};
uint valid_hash = 2362816530;
u8 computed_hash[WIDTH] = { 0x00 };
// Core 0 Setup
// Core 0 Setup: will be used for the USB mass device functions
void setup() {
// Check consistency of RAM FS
quark(computed_hash, msc_disk[BYTES_TO_HASH_OFFSET], BYTES_TO_HASH);
// Change all the USB Pico settings
TinyUSBDevice.setID(USB_VENDORID, USB_PRODUCTID);
TinyUSBDevice.setProductDescriptor(USB_DESCRIPTOR);
TinyUSBDevice.setManufacturerDescriptor(USB_MANUF);
// This could be used to change the serial number as well
// TinyUSBDevice.setSerialDescriptor(USB_SERIAL);
#if defined(ARDUINO_ARCH_MBED) && defined(ARDUINO_ARCH_RP2040)
// Manual begin() is required on core without built-in support for TinyUSB such as
@@ -91,7 +131,7 @@ void setup() {
#endif
// Set disk vendor id, product id and revision with string up to 8, 16, 4 characters respectively
usb_msc.setID("Watchdog", "USBvalve", "0.1");
usb_msc.setID(USB_VENDORID_STR, USB_PRODUCTID_STR, USB_VERSION_STR);
// Set disk size (using the "fake" size)
usb_msc.setCapacity(FAKE_DISK_BLOCK_NUM, DISK_BLOCK_SIZE);
@@ -107,8 +147,6 @@ void setup() {
usb_msc.setReadyCallback(msc_ready_callback);
#endif
usb_msc.begin();
// Screen Init
Wire.begin();
Wire.setClock(400000L);
@@ -127,44 +165,81 @@ void setup() {
#endif
oled.setFont(Adafruit5x7);
oled.setScrollMode(SCROLL_MODE_AUTO);
cls(); // Clear display
if (memcmp(computed_hash, valid_hash, WIDTH) == 0) {
oled.println("[+] Selftest: OK");
x++;
// Check consistency of RAM FS
// Add 11 bytes to skip the DISK_LABEL from the hashing
uint computed_hash;
computed_hash = XXH32(msc_disk[BYTES_TO_HASH_OFFSET] + 11, BYTES_TO_HASH, 0);
if (computed_hash == valid_hash) {
oled.print("\n[+] Selftest: OK");
} else {
oled.println("[!] Selftest: KO");
oled.println("[!] Stopping...");
oled.print("\n[!] Selftest: KO");
oled.print("\n[!] Stopping...");
while (1) {
delay(1000); // Loop forever
}
}
usb_msc.begin();
}
// Main Core0 loop, managing display
// Core 1 Setup: will be used for the USB host functions for BADUSB detector
void setup1() {
// Set a custom clock (multiple of 12Mhz) to achieve maximum compatibility
set_sys_clock_khz(144000, true);
pio_usb_configuration_t pio_cfg = PIO_USB_DEFAULT_CONFIG;
pio_cfg.pin_dp = HOST_PIN_DP;
USBHost.configure_pio_usb(1, &pio_cfg);
// run host stack on controller (rhport) 1
// Note: For rp2040 pico-pio-usb, calling USBHost.begin() on core1 will have most of the
// host bit-banging processing works done in core1
USBHost.begin(1);
}
// Main Core0 loop: managing display
void loop() {
if (readme == true) {
if (x == OLED_LINES) cls();
oled.println("[!] README (R)");
x++;
oled.print("\n[!] README (R)");
readme = false;
}
if (autorun == true) {
if (x == OLED_LINES) cls();
oled.println("[+] AUTORUN (R)");
x++;
oled.print("\n[+] AUTORUN (R)");
autorun = false;
}
if (deleted == true && deleted_reported == false) {
oled.print("\n[!] DELETING");
deleted = false;
deleted_reported = true;
}
if (written == true && written_reported == false) {
if (x == OLED_LINES) cls();
oled.println("[!] WRITING");
x++;
oled.print("\n[!] WRITING");
written = false;
written_reported = true;
}
if (hid_sent == true && hid_reported == false) {
oled.print("\n[!!] HID Sending data");
hid_sent = false;
hid_reported = true;
}
if (BOOTSEL) {
oled.print("\n[+] RESETTING");
swreset();
}
}
// Main Core1 loop: managing USB Host
void loop1() {
USBHost.task();
}
// Callback invoked when received READ10 command.
@@ -208,14 +283,25 @@ int32_t msc_read_callback(uint32_t lba, void* buffer, uint32_t bufsize) {
// This happens only for the "real" size of disk
int32_t msc_write_callback(uint32_t lba, uint8_t* buffer, uint32_t bufsize) {
// Check for file deletion at Block 7
// The first char of filename is replaced with 0xE5, we are going
// to check for it
if (lba == 7) {
if (buffer[32] == 0xE5 || buffer[64] == 0xE5 || buffer[160] == 0xE5) {
deleted = true;
}
}
// This check for writing of space. The LBA > 10 is set to avoid some
// false positives, in particular on Windows Systems
if (lba > 10) {
written = true;
}
// We are declaring a bigger size than what is actually allocated, so
// this is protecting our memory integrity
if (lba < DISK_BLOCK_NUM - 1) {
// Writing buffer to "disk"
uint8_t* addr = msc_disk[lba];
memcpy(addr, buffer, bufsize);
}
@@ -250,9 +336,8 @@ bool msc_ready_callback(void) {
// Clear display
void cls(void) {
oled.clear();
oled.println(VERSION);
oled.println("----------------");
x = 2;
oled.print(VERSION);
oled.print("\n-----------------");
}
// HexDump
@@ -289,4 +374,200 @@ void hexDump(unsigned char* data, size_t size) {
}
}
SerialTinyUSB.println();
}
}
// Reset the Pico
void swreset() {
watchdog_enable(1500, 1);
while (1)
;
}
//
// BADUSB detector section
//
static uint8_t const keycode2ascii[128][2] = { HID_KEYCODE_TO_ASCII };
// Invoked when device with hid interface is mounted
void tuh_hid_mount_cb(uint8_t dev_addr, uint8_t instance, uint8_t const* desc_report, uint16_t desc_len) {
uint16_t vid, pid;
const char* protocol_str[] = { "None", "Keyboard", "Mouse" };
// Read the HID protocol
uint8_t const itf_protocol = tuh_hid_interface_protocol(dev_addr, instance);
tuh_vid_pid_get(dev_addr, &vid, &pid);
oled.print("\n[!!] HID Device");
SerialTinyUSB.printf("HID device address = %d, instance = %d mounted\r\n", dev_addr, instance);
SerialTinyUSB.printf("VID = %04x, PID = %04x\r\n", vid, pid);
SerialTinyUSB.printf("HID Interface Protocol = %s\r\n", protocol_str[itf_protocol]);
if (!tuh_hid_receive_report(dev_addr, instance)) {
SerialTinyUSB.printf("Error: cannot request to receive report\r\n");
}
}
// Invoked when device with hid interface is un-mounted
void tuh_hid_umount_cb(uint8_t dev_addr, uint8_t instance) {
SerialTinyUSB.printf("HID device address = %d, instance = %d unmounted\r\n", dev_addr, instance);
// Reset HID sent flag
hid_sent = false;
hid_reported = false;
}
// Invoked when received report from device
void tuh_hid_report_received_cb(uint8_t dev_addr, uint8_t instance, uint8_t const* report, uint16_t len) {
static bool kbd_printed = false;
static bool mouse_printed = false;
// Used in main loop to write output to OLED
hid_sent = true;
// Read the HID protocol
uint8_t const itf_protocol = tuh_hid_interface_protocol(dev_addr, instance);
switch (itf_protocol) {
case HID_ITF_PROTOCOL_KEYBOARD:
if (kbd_printed == false) {
SerialTinyUSB.println("HID received keyboard report");
kbd_printed = true;
mouse_printed = false;
}
process_kbd_report((hid_keyboard_report_t const*)report);
break;
case HID_ITF_PROTOCOL_MOUSE:
if (kbd_printed == false) {
SerialTinyUSB.println("HID receive mouse report");
mouse_printed = true;
kbd_printed = false;
}
process_mouse_report((hid_mouse_report_t const*)report);
break;
default:
// Generic report: for the time being we use kbd for this as well
process_kbd_report((hid_keyboard_report_t const*)report);
break;
}
if (!tuh_hid_receive_report(dev_addr, instance)) {
SerialTinyUSB.println("Error: cannot request to receive report");
}
}
static inline bool find_key_in_report(hid_keyboard_report_t const* report, uint8_t keycode) {
for (uint8_t i = 0; i < 6; i++) {
if (report->keycode[i] == keycode) return true;
}
return false;
}
static void process_kbd_report(hid_keyboard_report_t const* report) {
// Previous report to check key released
static hid_keyboard_report_t prev_report = { 0, 0, { 0 } };
for (uint8_t i = 0; i < 6; i++) {
if (report->keycode[i]) {
if (find_key_in_report(&prev_report, report->keycode[i])) {
// Exist in previous report means the current key is holding
} else {
// Not existed in previous report means the current key is pressed
// Check for modifiers. It looks that in specific cases, they are not correctly recognized (probably
// for timing issues in fast input)
bool const is_shift = report->modifier & (KEYBOARD_MODIFIER_LEFTSHIFT | KEYBOARD_MODIFIER_RIGHTSHIFT);
uint8_t ch = keycode2ascii[report->keycode[i]][is_shift ? 1 : 0];
bool const is_gui = report->modifier & (KEYBOARD_MODIFIER_LEFTGUI | KEYBOARD_MODIFIER_RIGHTGUI);
if (is_gui == true) SerialTinyUSB.printf("GUI+");
bool const is_alt = report->modifier & (KEYBOARD_MODIFIER_LEFTALT | KEYBOARD_MODIFIER_RIGHTALT);
if (is_alt == true) SerialTinyUSB.printf("ALT+");
// Check for "special" keys
check_special_key(report->keycode[i]);
// Finally, print out the decoded char
SerialTinyUSB.printf("%c", ch);
if (ch == '\r') SerialTinyUSB.print("\n"); // New line for enter
fflush(stdout); // flush right away, else nanolib will wait for newline
}
}
}
prev_report = *report;
}
static void check_special_key(uint8_t code) {
if (code == HID_KEY_ARROW_RIGHT) SerialTinyUSB.print("<ARROWRIGHT>");
if (code == HID_KEY_ARROW_LEFT) SerialTinyUSB.print("<ARROWLEFT>");
if (code == HID_KEY_ARROW_DOWN) SerialTinyUSB.print("<ARROWDOWN>");
if (code == HID_KEY_ARROW_UP) SerialTinyUSB.print("<ARROWUP>");
if (code == HID_KEY_HOME) SerialTinyUSB.print("<HOME>");
if (code == HID_KEY_KEYPAD_1) SerialTinyUSB.print("<KEYPAD_1>");
if (code == HID_KEY_KEYPAD_2) SerialTinyUSB.print("<KEYPAD_2>");
if (code == HID_KEY_KEYPAD_3) SerialTinyUSB.print("<KEYPAD_3>");
if (code == HID_KEY_KEYPAD_4) SerialTinyUSB.print("<KEYPAD_4>");
if (code == HID_KEY_KEYPAD_5) SerialTinyUSB.print("<KEYPAD_5>");
if (code == HID_KEY_KEYPAD_6) SerialTinyUSB.print("<KEYPAD_6>");
if (code == HID_KEY_KEYPAD_7) SerialTinyUSB.print("<KEYPAD_7>");
if (code == HID_KEY_KEYPAD_8) SerialTinyUSB.print("<KEYPAD_8>");
if (code == HID_KEY_KEYPAD_9) SerialTinyUSB.print("<KEYPAD_9>");
if (code == HID_KEY_KEYPAD_0) SerialTinyUSB.print("<KEYPAD_0>");
if (code == HID_KEY_F1) SerialTinyUSB.print("<F1>");
if (code == HID_KEY_F2) SerialTinyUSB.print("<F2>");
if (code == HID_KEY_F3) SerialTinyUSB.print("<F3>");
if (code == HID_KEY_F4) SerialTinyUSB.print("<F4>");
if (code == HID_KEY_F5) SerialTinyUSB.print("<F5>");
if (code == HID_KEY_F6) SerialTinyUSB.print("<F6>");
if (code == HID_KEY_F7) SerialTinyUSB.print("<F7>");
if (code == HID_KEY_F8) SerialTinyUSB.print("<F8>");
if (code == HID_KEY_F9) SerialTinyUSB.print("<F9>");
if (code == HID_KEY_F10) SerialTinyUSB.print("<F10>");
if (code == HID_KEY_F11) SerialTinyUSB.print("<F11>");
if (code == HID_KEY_F12) SerialTinyUSB.print("<F12>");
if (code == HID_KEY_PRINT_SCREEN) SerialTinyUSB.print("<PRNT>");
if (code == HID_KEY_SCROLL_LOCK) SerialTinyUSB.print("<SCRLL>");
if (code == HID_KEY_PAUSE) SerialTinyUSB.print("<PAUSE>");
if (code == HID_KEY_INSERT) SerialTinyUSB.print("<INSERT>");
if (code == HID_KEY_PAGE_UP) SerialTinyUSB.print("<PAGEUP>");
if (code == HID_KEY_DELETE) SerialTinyUSB.print("<DEL>");
if (code == HID_KEY_END) SerialTinyUSB.print("<END>");
if (code == HID_KEY_PAGE_DOWN) SerialTinyUSB.print("<PAGEDOWN>");
if (code == HID_KEY_NUM_LOCK) SerialTinyUSB.print("<ARROWRIGHT>");
if (code == HID_KEY_KEYPAD_DIVIDE) SerialTinyUSB.print("<KEYPAD_DIV>");
if (code == HID_KEY_KEYPAD_MULTIPLY) SerialTinyUSB.print("<KEYPAD_MUL>");
if (code == HID_KEY_KEYPAD_SUBTRACT) SerialTinyUSB.print("<KEYPAD_SUB>");
if (code == HID_KEY_KEYPAD_ADD) SerialTinyUSB.print("<KEYPAD_ADD>");
if (code == HID_KEY_KEYPAD_DECIMAL) SerialTinyUSB.print("<KEYPAD_DECIMAL>");
}
static void process_mouse_report(hid_mouse_report_t const* report) {
static hid_mouse_report_t prev_report = { 0 };
//------------- button state -------------//
uint8_t button_changed_mask = report->buttons ^ prev_report.buttons;
if (button_changed_mask & report->buttons) {
SerialTinyUSB.printf("MOUSE: %c%c%c ",
report->buttons & MOUSE_BUTTON_LEFT ? 'L' : '-',
report->buttons & MOUSE_BUTTON_MIDDLE ? 'M' : '-',
report->buttons & MOUSE_BUTTON_RIGHT ? 'R' : '-');
}
cursor_movement(report->x, report->y, report->wheel);
}
void cursor_movement(int8_t x, int8_t y, int8_t wheel) {
SerialTinyUSB.printf("(%d %d %d)\r\n", x, y, wheel);
}
// END of BADUSB detector section

View File

@@ -1,484 +0,0 @@
/*
USBvalve
*/
/*
Quark reference C implementation
Copyright (c) 2010-2014 Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
To the extent possible under law, the author(s) have dedicated all copyright
and related and neighboring rights to this software to the public domain
worldwide. This software is distributed without any warranty.
You should have received a copy of the CC0 Public Domain Dedication along with
this software. If not, see <http://creativecommons.org/publicdomain/zero/1.0/>.
*/
#include <stdint.h>
#include <stdlib.h>
#include <stdio.h>
#include "quark.h"
#define DIGEST WIDTH
typedef uint64_t u64;
typedef uint32_t u32;
typedef uint8_t u8;
typedef struct
{
int pos; /* number of bytes read into x from current block */
u32 x[WIDTH * 8]; /* one bit stored in each word */
} hashState;
#if defined(UQUARK)
/* 17 bytes */
u8 iv[] = { 0xd8, 0xda, 0xca, 0x44, 0x41, 0x4a, 0x09, 0x97,
0x19, 0xc8, 0x0a, 0xa3, 0xaf, 0x06, 0x56, 0x44, 0xdb };
#elif defined(DQUARK)
/* 22 bytes */
u8 iv[] = { 0xcc, 0x6c, 0x4a, 0xb7, 0xd1, 0x1f, 0xa9, 0xbd,
0xf6, 0xee, 0xde, 0x03, 0xd8, 0x7b, 0x68, 0xf9,
0x1b, 0xaa, 0x70, 0x6c, 0x20, 0xe9 };
#elif defined(SQUARK)
/* 32 bytes */
u8 iv[] = { 0x39, 0x72, 0x51, 0xce, 0xe1, 0xde, 0x8a, 0xa7,
0x3e, 0xa2, 0x62, 0x50, 0xc6, 0xd7, 0xbe, 0x12,
0x8c, 0xd3, 0xe7, 0x9d, 0xd7, 0x18, 0xc2, 0x4b,
0x8a, 0x19, 0xd0, 0x9c, 0x24, 0x92, 0xda, 0x5d };
#elif defined(CQUARK)
/* 48 bytes */
u8 iv[] = { 0x3b, 0x45, 0x03, 0xec, 0x76, 0x62, 0xc3, 0xcb,
0x30, 0xe0, 0x08, 0x37, 0xec, 0x8d, 0x38, 0xbb,
0xe5, 0xff, 0x5a, 0xcd, 0x69, 0x01, 0xa2, 0x49,
0x57, 0x50, 0xf9, 0x19, 0x8e, 0x2e, 0x3b, 0x58,
0x52, 0xdc, 0xaa, 0x16, 0x62, 0xb7, 0xda, 0xd6,
0x5f, 0xcb, 0x5a, 0x8a, 0x1f, 0x0d, 0x5f, 0xcc };
#endif
void showstate(u32 *x) {
int i;
u8 buf = 0;
for (i = 0; i < 8 * WIDTH; ++i) {
buf ^= (1 & x[i]) << (7 - (i % 8));
if (((i % 8) == 7) && (i)) {
printf("%02x", buf);
buf = 0;
}
}
printf("\n");
}
int permute_u(u32 *x) {
/* state of 136=2x68 bits */
#define ROUNDS_U 4 * 136
#define N_LEN_U 68
#define L_LEN_U 10
u32 *X, *Y, *L;
u32 h;
int i;
X = (u32 *)malloc((N_LEN_U + ROUNDS_U) * sizeof(u32));
Y = (u32 *)malloc((N_LEN_U + ROUNDS_U) * sizeof(u32));
L = (u32 *)malloc((L_LEN_U + ROUNDS_U) * sizeof(u32));
/* local copy of the state in the registers*/
for (i = 0; i < N_LEN_U; ++i) {
X[i] = x[i];
Y[i] = x[i + N_LEN_U];
}
/* initialize the LFSR to 11..11 */
for (i = 0; i < L_LEN_U; ++i)
L[i] = 0xFFFFFFFF;
/* iterate rounds */
for (i = 0; i < ROUNDS_U; ++i) {
/* indices up to i+59, for 8x parallelizibility*/
/* need X[i] as linear term only, for invertibility */
X[N_LEN_U + i] = X[i] ^ Y[i];
X[N_LEN_U + i] ^= X[i + 9] ^ X[i + 14] ^ X[i + 21] ^ X[i + 28] ^ X[i + 33] ^ X[i + 37] ^ X[i + 45] ^ X[i + 52] ^ X[i + 55] ^ X[i + 50] ^ (X[i + 59] & X[i + 55]) ^ (X[i + 37] & X[i + 33]) ^ (X[i + 15] & X[i + 9]) ^ (X[i + 55] & X[i + 52] & X[i + 45]) ^ (X[i + 33] & X[i + 28] & X[i + 21]) ^ (X[i + 59] & X[i + 45] & X[i + 28] & X[i + 9]) ^ (X[i + 55] & X[i + 52] & X[i + 37] & X[i + 33]) ^ (X[i + 59] & X[i + 55] & X[i + 21] & X[i + 15]) ^ (X[i + 59] & X[i + 55] & X[i + 52] & X[i + 45] & X[i + 37]) ^ (X[i + 33] & X[i + 28] & X[i + 21] & X[i + 15] & X[i + 9]) ^ (X[i + 52] & X[i + 45] & X[i + 37] & X[i + 33] & X[i + 28] & X[i + 21]);
/* need Y[i] as linear term only, for invertibility */
Y[N_LEN_U + i] = Y[i];
Y[N_LEN_U + i] ^= Y[i + 7] ^ Y[i + 16] ^ Y[i + 20] ^ Y[i + 30] ^ Y[i + 35] ^ Y[i + 37] ^ Y[i + 42] ^ Y[i + 51] ^ Y[i + 54] ^ Y[i + 49] ^ (Y[i + 58] & Y[i + 54]) ^ (Y[i + 37] & Y[i + 35]) ^ (Y[i + 15] & Y[i + 7]) ^ (Y[i + 54] & Y[i + 51] & Y[i + 42]) ^ (Y[i + 35] & Y[i + 30] & Y[i + 20]) ^ (Y[i + 58] & Y[i + 42] & Y[i + 30] & Y[i + 7]) ^ (Y[i + 54] & Y[i + 51] & Y[i + 37] & Y[i + 35]) ^ (Y[i + 58] & Y[i + 54] & Y[i + 20] & Y[i + 15]) ^ (Y[i + 58] & Y[i + 54] & Y[i + 51] & Y[i + 42] & Y[i + 37]) ^ (Y[i + 35] & Y[i + 30] & Y[i + 20] & Y[i + 15] & Y[i + 7]) ^ (Y[i + 51] & Y[i + 42] & Y[i + 37] & Y[i + 35] & Y[i + 30] & Y[i + 20]);
/* need L[i] as linear term only, for invertibility */
L[L_LEN_U + i] = L[i];
L[L_LEN_U + i] ^= L[i + 3];
/* compute output of the h function */
h = X[i + 25] ^ Y[i + 59] ^ (Y[i + 3] & X[i + 55]) ^ (X[i + 46] & X[i + 55]) ^ (X[i + 55] & Y[i + 59]) ^ (Y[i + 3] & X[i + 25] & X[i + 46]) ^ (Y[i + 3] & X[i + 46] & X[i + 55]) ^ (Y[i + 3] & X[i + 46] & Y[i + 59]) ^ (X[i + 25] & X[i + 46] & Y[i + 59] & L[i]) ^ (X[i + 25] & L[i]);
h ^= X[i + 1] ^ Y[i + 2] ^ X[i + 4] ^ Y[i + 10] ^ X[i + 31] ^ Y[i + 43] ^ X[i + 56] ^ L[i];
/* feedback of h into the registers */
X[N_LEN_U + i] ^= h;
Y[N_LEN_U + i] ^= h;
}
/* copy final state into hashState */
for (i = 0; i < N_LEN_U; ++i) {
x[i] = X[ROUNDS_U + i];
x[i + N_LEN_U] = Y[ROUNDS_U + i];
}
free(X);
free(Y);
free(L);
return 0;
}
int permute_d(u32 *x) {
/* state of 176=2x88 bits */
#define ROUNDS_D 4 * 176
#define N_LEN_D 88
#define L_LEN_D 10
u32 *X, *Y, *L;
u32 h;
int i;
X = (u32 *)malloc((N_LEN_D + ROUNDS_D) * sizeof(u32));
Y = (u32 *)malloc((N_LEN_D + ROUNDS_D) * sizeof(u32));
L = (u32 *)malloc((L_LEN_D + ROUNDS_D) * sizeof(u32));
/* local copy of the state in the registers*/
for (i = 0; i < N_LEN_D; ++i) {
X[i] = x[i];
Y[i] = x[i + N_LEN_D];
}
/* initialize the LFSR to 11..11 */
for (i = 0; i < L_LEN_D; ++i)
L[i] = 0xFFFFFFFF;
/* iterate rounds */
for (i = 0; i < ROUNDS_D; ++i) {
/* need X[i] as linear term only, for invertibility */
X[N_LEN_D + i] = X[i] ^ Y[i];
X[N_LEN_D + i] ^= X[i + 11] ^ X[i + 18] ^ X[i + 27] ^ X[i + 36] ^ X[i + 42] ^ X[i + 47] ^ X[i + 58] ^ X[i + 67] ^ X[i + 71] ^ X[i + 64] ^ (X[i + 79] & X[i + 71]) ^ (X[i + 47] & X[i + 42]) ^ (X[i + 19] & X[i + 11]) ^ (X[i + 71] & X[i + 67] & X[i + 58]) ^ (X[i + 42] & X[i + 36] & X[i + 27]) ^ (X[i + 79] & X[i + 58] & X[i + 36] & X[i + 11]) ^ (X[i + 71] & X[i + 67] & X[i + 47] & X[i + 42]) ^ (X[i + 79] & X[i + 71] & X[i + 27] & X[i + 19]) ^ (X[i + 79] & X[i + 71] & X[i + 67] & X[i + 58] & X[i + 47]) ^ (X[i + 42] & X[i + 36] & X[i + 27] & X[i + 19] & X[i + 11]) ^ (X[i + 67] & X[i + 58] & X[i + 47] & X[i + 42] & X[i + 36] & X[i + 27]);
/* need Y[i] as linear term only, for invertibility */
Y[N_LEN_D + i] = Y[i];
Y[N_LEN_D + i] ^= Y[i + 9] ^ Y[i + 20] ^ Y[i + 25] ^ Y[i + 38] ^ Y[i + 44] ^ Y[i + 47] ^ Y[i + 54] ^ Y[i + 67] ^ Y[i + 69] ^ Y[i + 63] ^ (Y[i + 78] & Y[i + 69]) ^ (Y[i + 47] & Y[i + 44]) ^ (Y[i + 19] & Y[i + 9]) ^ (Y[i + 69] & Y[i + 67] & Y[i + 54]) ^ (Y[i + 44] & Y[i + 38] & Y[i + 25]) ^ (Y[i + 78] & Y[i + 54] & Y[i + 38] & Y[i + 9]) ^ (Y[i + 69] & Y[i + 67] & Y[i + 47] & Y[i + 44]) ^ (Y[i + 78] & Y[i + 69] & Y[i + 25] & Y[i + 19]) ^ (Y[i + 78] & Y[i + 69] & Y[i + 67] & Y[i + 54] & Y[i + 47]) ^ (Y[i + 44] & Y[i + 38] & Y[i + 25] & Y[i + 19] & Y[i + 9]) ^ (Y[i + 67] & Y[i + 54] & Y[i + 47] & Y[i + 44] & Y[i + 38] & Y[i + 25]);
/* need L[i] as linear term only, for invertibility */
L[L_LEN_D + i] = L[i];
L[L_LEN_D + i] ^= L[i + 3]; // linear feedback here
/* compute output of the h function */
h = X[i + 35] ^ Y[i + 79] ^ (Y[i + 4] & X[i + 68]) ^ (X[i + 57] & X[i + 68]) ^ (X[i + 68] & Y[i + 79]) ^ (Y[i + 4] & X[i + 35] & X[i + 57]) ^ (Y[i + 4] & X[i + 57] & X[i + 68]) ^ (Y[i + 4] & X[i + 57] & Y[i + 79]) ^ (X[i + 35] & X[i + 57] & Y[i + 79] & L[i]) ^ (X[i + 35] & L[i]);
h ^= X[i + 1] ^ Y[i + 2] ^ X[i + 5] ^ Y[i + 12] ^ X[i + 40] ^ Y[i + 55] ^ X[i + 72] ^ L[i];
h ^= Y[i + 24] ^ X[i + 48] ^ Y[i + 61];
/* feedback of h into the registers */
X[N_LEN_D + i] ^= h;
Y[N_LEN_D + i] ^= h;
}
/* copy final state into hashState */
for (i = 0; i < N_LEN_D; ++i) {
x[i] = X[ROUNDS_D + i];
x[i + N_LEN_D] = Y[ROUNDS_D + i];
}
free(X);
free(Y);
free(L);
return 0;
}
int permute_s(u32 *x) {
/* state of 256=2x128 bits */
#define ROUNDS_S 4 * 256
#define N_LEN_S 128
#define L_LEN_S 10
u32 *X, *Y, *L;
u32 h;
int i;
X = (u32 *)malloc((N_LEN_S + ROUNDS_S) * sizeof(u32));
Y = (u32 *)malloc((N_LEN_S + ROUNDS_S) * sizeof(u32));
L = (u32 *)malloc((L_LEN_S + ROUNDS_S) * sizeof(u32));
/* local copy of the state in the registers*/
for (i = 0; i < N_LEN_S; ++i) {
X[i] = x[i];
Y[i] = x[i + N_LEN_S];
}
/* initialize the LFSR to 11..11 */
for (i = 0; i < L_LEN_S; ++i)
L[i] = 0xFFFFFFFF;
/* iterate rounds */
for (i = 0; i < ROUNDS_S; ++i) {
/* need X[i] as linear term only, for invertibility */
X[N_LEN_S + i] = X[i] ^ Y[i];
X[N_LEN_S + i] ^= X[i + 16] ^ X[i + 26] ^ X[i + 39] ^ X[i + 52] ^ X[i + 61] ^ X[i + 69] ^ X[i + 84] ^ X[i + 97] ^ X[i + 103] ^ X[i + 94] ^ (X[i + 111] & X[i + 103]) ^ (X[i + 69] & X[i + 61]) ^ (X[i + 28] & X[i + 16]) ^ (X[i + 103] & X[i + 97] & X[i + 84]) ^ (X[i + 61] & X[i + 52] & X[i + 39]) ^ (X[i + 111] & X[i + 84] & X[i + 52] & X[i + 16]) ^ (X[i + 103] & X[i + 97] & X[i + 69] & X[i + 61]) ^ (X[i + 111] & X[i + 103] & X[i + 39] & X[i + 28]) ^ (X[i + 111] & X[i + 103] & X[i + 97] & X[i + 84] & X[i + 69]) ^ (X[i + 61] & X[i + 52] & X[i + 39] & X[i + 28] & X[i + 16]) ^ (X[i + 97] & X[i + 84] & X[i + 69] & X[i + 61] & X[i + 52] & X[i + 39]);
/* need Y[i] as linear term only, for invertibility */
Y[N_LEN_S + i] = Y[i];
Y[N_LEN_S + i] ^= Y[i + 13] ^ Y[i + 30] ^ Y[i + 37] ^ Y[i + 56] ^ Y[i + 65] ^ Y[i + 69] ^ Y[i + 79] ^ Y[i + 96] ^ Y[i + 101] ^ Y[i + 92] ^ (Y[i + 109] & Y[i + 101]) ^ (Y[i + 69] & Y[i + 65]) ^ (Y[i + 28] & Y[i + 13]) ^ (Y[i + 101] & Y[i + 96] & Y[i + 79]) ^ (Y[i + 65] & Y[i + 56] & Y[i + 37]) ^ (Y[i + 109] & Y[i + 79] & Y[i + 56] & Y[i + 13]) ^ (Y[i + 101] & Y[i + 96] & Y[i + 69] & Y[i + 65]) ^ (Y[i + 109] & Y[i + 101] & Y[i + 37] & Y[i + 28]) ^ (Y[i + 109] & Y[i + 101] & Y[i + 96] & Y[i + 79] & Y[i + 69]) ^ (Y[i + 65] & Y[i + 56] & Y[i + 37] & Y[i + 28] & Y[i + 13]) ^ (Y[i + 96] & Y[i + 79] & Y[i + 69] & Y[i + 65] & Y[i + 56] & Y[i + 37]);
/* need L[i] as linear term only, for invertibility */
L[L_LEN_S + i] = L[i];
L[L_LEN_S + i] ^= L[i + 3]; // linear feedback here
/* compute output of the h function */
h = X[i + 47] ^ Y[i + 111] ^ (Y[i + 8] & X[i + 100]) ^ (X[i + 72] & X[i + 100]) ^ (X[i + 100] & Y[i + 111]) ^ (Y[i + 8] & X[i + 47] & X[i + 72]) ^ (Y[i + 8] & X[i + 72] & X[i + 100]) ^ (Y[i + 8] & X[i + 72] & Y[i + 111]) ^ (X[i + 47] & X[i + 72] & Y[i + 111] & L[i]) ^ (X[i + 47] & L[i]);
h ^= X[i + 1] ^ Y[i + 3] ^ X[i + 7] ^ Y[i + 18] ^ X[i + 58] ^ Y[i + 80] ^ X[i + 105] ^ L[i];
h ^= Y[i + 34] ^ Y[i + 71] ^ X[i + 90] ^ Y[i + 91];
/* feedback of h into the registers */
X[N_LEN_S + i] ^= h;
Y[N_LEN_S + i] ^= h;
}
/* copy final state into hashState */
for (i = 0; i < N_LEN_S; ++i) {
x[i] = X[ROUNDS_S + i];
x[i + N_LEN_S] = Y[ROUNDS_S + i];
}
free(X);
free(Y);
free(L);
return 0;
}
int permute_c(u32 *x) {
/* state of 384=2x192 bits */
#define ROUNDS_C 2 * 384
#define N_LEN_C 192
#define L_LEN_C 16
u32 *X, *Y, *L;
u32 h;
int i;
X = (u32 *)malloc((N_LEN_C + ROUNDS_C) * sizeof(u32));
Y = (u32 *)malloc((N_LEN_C + ROUNDS_C) * sizeof(u32));
L = (u32 *)malloc((L_LEN_C + ROUNDS_C) * sizeof(u32));
/* local copy of the state in the registers*/
for (i = 0; i < N_LEN_C; ++i) {
X[i] = x[i];
Y[i] = x[i + N_LEN_C];
}
/* initialize the LFSR to 11..11 */
for (i = 0; i < L_LEN_C; ++i)
L[i] = 0xFFFFFFFF;
/* iterate rounds */
for (i = 0; i < ROUNDS_C; ++i) {
X[N_LEN_C + i] = X[i] ^ Y[i];
X[N_LEN_C + i] ^= X[i + 13] ^ X[i + 34] ^ X[i + 65] ^ X[i + 77] ^ X[i + 94] ^ X[i + 109] ^ X[i + 127] ^ X[i + 145] ^ X[i + 157] ^ X[i + 140] ^ (X[i + 159] & X[i + 157]) ^ (X[i + 109] & X[i + 94]) ^ (X[i + 47] & X[i + 13]) ^ (X[i + 157] & X[i + 145] & X[i + 127]) ^ (X[i + 94] & X[i + 77] & X[i + 65]) ^ (X[i + 159] & X[i + 127] & X[i + 77] & X[i + 13]) ^ (X[i + 157] & X[i + 145] & X[i + 109] & X[i + 94]) ^ (X[i + 159] & X[i + 157] & X[i + 65] & X[i + 47]) ^ (X[i + 159] & X[i + 157] & X[i + 145] & X[i + 127] & X[i + 109]) ^ (X[i + 94] & X[i + 77] & X[i + 65] & X[i + 47] & X[i + 13]) ^ (X[i + 145] & X[i + 127] & X[i + 109] & X[i + 94] & X[i + 77] & X[i + 65]);
Y[N_LEN_C + i] = Y[i];
Y[N_LEN_C + i] ^= Y[i + 21] ^ Y[i + 57] ^ Y[i + 60] ^ Y[i + 94] ^ Y[i + 112] ^ Y[i + 125] ^ Y[i + 133] ^ Y[i + 152] ^ Y[i + 157] ^ Y[i + 146] ^ (Y[i + 159] & Y[i + 157]) ^ (Y[i + 125] & Y[i + 112]) ^ (Y[i + 36] & Y[i + 21]) ^ (Y[i + 157] & Y[i + 152] & Y[i + 133]) ^ (Y[i + 112] & Y[i + 94] & Y[i + 60]) ^ (Y[i + 159] & Y[i + 133] & Y[i + 94] & Y[i + 21]) ^ (Y[i + 157] & Y[i + 152] & Y[i + 125] & Y[i + 112]) ^ (Y[i + 159] & Y[i + 157] & Y[i + 60] & Y[i + 36]) ^ (Y[i + 159] & Y[i + 157] & Y[i + 152] & Y[i + 133] & Y[i + 125]) ^ (Y[i + 112] & Y[i + 94] & Y[i + 60] & Y[i + 36] & Y[i + 21]) ^ (Y[i + 152] & Y[i + 133] & Y[i + 125] & Y[i + 112] & Y[i + 94] & Y[i + 60]);
L[L_LEN_C + i] = L[i] ^ L[i + 2] ^ L[i + 3] ^ L[i + 5];
h = X[i + 25] ^ Y[i + 59] ^ (Y[i + 3] & X[i + 55]) ^ (X[i + 46] & X[i + 55]) ^ (X[i + 55] & Y[i + 59]) ^ (Y[i + 3] & X[i + 25] & X[i + 46]) ^ (Y[i + 3] & X[i + 46] & X[i + 55]) ^ (Y[i + 3] & X[i + 46] & Y[i + 59]) ^ (X[i + 25] & X[i + 46] & Y[i + 59] & L[i]) ^ (X[i + 25] & L[i]);
h ^= L[i];
h ^= X[i + 4] ^ X[i + 28] ^ X[i + 40] ^ X[i + 85] ^ X[i + 112] ^ X[i + 141] ^ X[i + 146] ^ X[i + 152];
h ^= Y[i + 2] ^ Y[i + 33] ^ Y[i + 60] ^ Y[i + 62] ^ Y[i + 87] ^ Y[i + 99] ^ Y[i + 138] ^ Y[i + 148];
X[N_LEN_C + i] ^= h;
Y[N_LEN_C + i] ^= h;
}
/* copy final state into hashState */
for (i = 0; i < N_LEN_C; ++i) {
x[i] = X[ROUNDS_C + i];
x[i + N_LEN_C] = Y[ROUNDS_C + i];
}
free(X);
free(Y);
free(L);
return 0;
}
/* permutation of the state */
static void permute(u32 *x) {
#ifdef DEBUG
printf("enter permute\n");
showstate(x);
#endif
#if defined(UQUARK)
permute_u(x);
#elif defined(DQUARK)
permute_d(x);
#elif defined(SQUARK)
permute_s(x);
#elif defined(CQUARK)
permute_c(x);
#endif
#ifdef DEBUG
printf("permute done\n");
showstate(x);
#endif
}
/* initialization of the IV */
int init_iv(hashState *state) {
int i;
#ifdef DEBUG
printf("enter init\n");
#endif
/* initialize state */
for (i = 0; i < 8 * WIDTH; ++i)
state->x[i] = (iv[i / 8] >> (7 - (i % 8))) & 1;
state->pos = 0;
#ifdef DEBUG
printf("init done\n");
showstate(state->x);
#endif
return 0;
}
int update(hashState *state, const u8 *data, int databytelen) {
/* caller promises us that previous data had integral number of bytes */
/* so state->pos is a multiple of 8 */
int i;
#ifdef DEBUG
printf("enter update\n");
#endif
while (databytelen > 0) {
/* get next byte */
u8 u = *data;
#ifdef DEBUG
printf("get byte %02x at pos %d\n", u, state->pos);
#endif
/* xor state with each bit */
for (i = 8 * state->pos; i < 8 * state->pos + 8; ++i) {
state->x[(8 * (WIDTH - RATE)) + i] ^= (u >> (i % 8)) & 1;
}
data += 1;
databytelen -= 1;
state->pos += 1;
if (state->pos == RATE) {
permute(state->x);
state->pos = 0;
}
}
#ifdef DEBUG
printf("update done\n");
#endif
return 0;
}
/* finalize (padding) and return digest */
int final(hashState *state, u8 *out) {
int i;
int outbytes = 0;
u8 u;
#ifdef DEBUG
printf("enter final\n");
#endif
/* append '1' bit */
state->x[8 * (WIDTH - RATE) + state->pos * 8] ^= 1;
/* permute to obtain first final state*/
permute(state->x);
/* zeroize output buffer */
for (i = 0; i < DIGEST; ++i)
out[i] = 0;
/* while output requested, extract RATE bytes and permute */
while (outbytes < DIGEST) {
/* extract one byte */
for (i = 0; i < 8; ++i) {
u = state->x[8 * (WIDTH - RATE) + i + 8 * (outbytes % RATE)] & 1;
out[outbytes] ^= (u << (7 - i));
}
#ifdef DEBUG
printf("extracted byte %02x (%d)\n", out[outbytes], outbytes);
#endif
outbytes += 1;
if (outbytes == DIGEST)
break;
/* if RATE bytes extracted, permute again */
if (!(outbytes % RATE)) {
permute(state->x);
}
}
#ifdef DEBUG
printf("final done\n");
#endif
return 0;
}
int quark(u8 *out, u8 *in, u64 inlen) {
/* inlen in bytes */
hashState state;
init_iv(&state);
update(&state, in, inlen);
final(&state, out);
return 0;
}

View File

@@ -1,37 +0,0 @@
/*
USBvalve
*/
typedef uint64_t u64;
typedef uint32_t u32;
typedef uint8_t u8;
#define CQUARK
#if defined(UQUARK)
#define CAPACITY 16
#define RATE 1
#define WIDTH 17
#elif defined(DQUARK)
#define CAPACITY 20
#define RATE 2
#define WIDTH 22
#elif defined(SQUARK)
#define CAPACITY 28
#define RATE 4
#define WIDTH 32
#elif defined(CQUARK)
#define CAPACITY 40
#define RATE 8
#define WIDTH 48
#endif
#ifdef __cplusplus
extern "C" {
#endif
int quark(u8 *out, u8 *in, u64 inlen);
#ifdef __cplusplus
}
#endif

View File

@@ -1,5 +1,7 @@
/*
USBvalve
RAMDISK file written by Cesare Pizzi
*/
/*
@@ -35,9 +37,17 @@
// README.TXT
// System Volume Information
//
// Files information are saved at Block 7
//
// Keep 11 chars
#define DISK_LABEL 'M', 'y', 'D', 'r', 'i', 'v', 'e', ' ', ' ', ' ', ' '
// Do not change this here, it is just for reference
#define README_CONTENTS \
"...nuke the entire site from orbit. It's the only way to be sure."
// Do not change this here, it is just for reference
#define AUTORUN_CONTENTS \
"[autorun]\r\nopen=calc.exe\r\nicon=icon.ico\r\n"
@@ -134,7 +144,7 @@ uint8_t msc_disk[DISK_BLOCK_NUM][DISK_BLOCK_SIZE] = {
},
{
//------------- Block 7: -------------//
0x55, 0x53, 0x42, 0x56, 0x41, 0x4c, 0x56, 0x45, 0x20, 0x20, 0x20, 0x08, 0x00, 0x00, 0xaf, 0x60,
DISK_LABEL, 0x08, 0x00, 0x00, 0xaf, 0x60,
0x6d, 0x55, 0x6d, 0x55, 0x00, 0x00, 0xaf, 0x60, 0x6d, 0x55, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x41, 0x55, 0x54, 0x4f, 0x52, 0x55, 0x4e, 0x20, 0x49, 0x4e, 0x46, 0x20, 0x00, 0x9d, 0xef, 0x58,
0x6d, 0x55, 0x6b, 0x55, 0x00, 0x00, 0xef, 0x58, 0x6d, 0x55, 0x60, 0x00, 0x2a, 0x00, 0x00, 0x00,
@@ -601,7 +611,38 @@ uint8_t msc_disk[DISK_BLOCK_NUM][DISK_BLOCK_SIZE] = {
},
{
//------------- Block 85: -------------//
0x00
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x35, 0xc3, 0x28, 0x56, 0xaa, 0x10, 0x9b, 0xd7, 0xd2, 0x75, 0x6e, 0xcf, 0x1e, 0x1e, 0x21, 0xaf,
0xcc, 0x52, 0x04, 0xe4, 0xc3, 0x7d, 0x3e, 0xee, 0xf7, 0xf1, 0x7d, 0xe0, 0x09, 0x95, 0x11, 0x6c,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
},
{
//------------- Block 86: -------------//

58
docs/BUILDING-1.1.md Normal file
View File

@@ -0,0 +1,58 @@
#### With USBvalve PCB
<p float="left">
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/USB_valve_front.png" width="25%" height="25%" />
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/USB_valve_back.png" width="25%" height="25%" />
</p>
- place the Raspberry Pi Pico on the silk screen on the front
- you don't need to solder all the PINs. Just the following:
- D4 and D5 (left side)
- GND (right side)
- 3v3_OUT (right side)
- the 3 DEBUG pin on the bottom: SWCLK, GND and SWDIO
- place the 3D printer spacer or a piece of tape on the parts of the OLED that my touch the Raspberry
- solder the OLED (with a header) on the 4 PIN space
Some of the OLEDs have the GND and VCC PINs swapped, so I built the PCB to be compatible with both versions:
For example if your OLED has GND on PIN1 and VCC on PIN2 like this:
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/usb_valve_oled.png" width="35%" height="35%" />
You have to place a blob of solder on these two pads on the back of the PCB:
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/usb_valve_pads.png" width="15%" height="15%" />
Otherwise you should the opposite and place the solder on the other PADs:
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/usb_valve_pads_2.png" width="15%" height="15%" />
#### Without USBvalve PCB
<img src="https://github.com/cecio/USBvalve/blob/main/pictures/pico-pinout.svg" alt="Pico Pi" width="85%" height="85%" />
If you are using a breadboard or just wiring, all you have to do is to ensure to connect the proper PINs at the OLED screen.
The mapping is the following:
- PIN6 of Pi --> OLED SDA
- PIN7 of Pi --> OLED SCL
- PIN38 (GND) of Pi --> OLED GND
- PIN36 (3V3OUT) of Pi --> OLED VCC
If you want to use the DEBUG functions, you can also place a header on the 3 SWD PINs at the bottom of the board.
### Flash Firmware
To flash the firmware, follow these steps:
- Connect the Raspberry Pi Pico with the USB cable, by keeping the *BOOTSEL* button pressed (the big white button on the board)
- release the button
- you will see a new drive on the system, named `RPI-RP2` (in Linux envs you may have to manually mount it)
- copy the proper firmware file (with extension `uf2`) in the folder, depending on the OLED you used
- wait few seconds until the mounted folder disappear
It's done!

Binary file not shown.

After

Width:  |  Height:  |  Size: 15 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 22 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 170 KiB

BIN
pictures/hid.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 103 KiB