0.10.0 firmware added

README.md

@@ -20,6 +20,13 @@ and from version `0.8.0` you can also use it as USB Host to detect *BADUSB* devi
 <img src="https://github.com/cecio/USBvalve/blob/main/pictures/hid.png" alt="HID" width="15%" height="15%" />
 </p>
 
+This is an example of the *BADUSB* debugger available on serial port:
+
+<p float="left">
+<a href="https://asciinema.org/a/NWfC9Mvzzpj3eZfsC7s5Dz1sJ" target="_blank"><img src="https://asciinema.org/a/NWfC9Mvzzpj3eZfsC7s5Dz1sJ.svg" width="65%" height="65%" /></a>
+</p>
+
+If you prefer videos, you can also have a look to my [Insomni'hack Presentation](https://www.youtube.com/watch?v=jy1filtQY4w)
 
 ## Repository Structure
 
@@ -35,6 +42,8 @@ and from version `0.8.0` you can also use it as USB Host to detect *BADUSB* devi
 
 `pictures`: images and resources used in this doc
 
+`STL`: STL files for enclosure
+
 ## Build USBvalve
 
 ### Part list
@@ -60,7 +69,7 @@ Starting from version 0.8.0 of the firmware, **USBvalve** can detect HID devices
 </p>
 
 
-
+- solder a USB female port in `USBH` area. This is for version `A`, but there is a version for USB `Micro-B` as well if you prefer
 - place the Raspberry Pi Pico on the silk screen on the front 
 - you don't need to solder all the PINs. Just the following:
   - D4 and D5 (left side)
@@ -72,7 +81,6 @@ Starting from version 0.8.0 of the firmware, **USBvalve** can detect HID devices
   - the 3 DEBUG pin on the bottom: SWCLK, GND and SWDIO
 - place the 3D printer spacer or a piece of tape on the parts of the OLED that my touch the Raspberry
 - solder the OLED (with a header) on the 4 PIN space
-- solder a USB female port in `USBH` area. This is for version `A`, but there is a version for USB `Micro-B` as well if you prefer
 
 Some of the OLEDs have the GND and VCC PINs swapped, so I built the PCB to be compatible with both versions: 
 
@@ -119,6 +127,36 @@ To flash the firmware, follow these steps:
 
 It's done!
 
+### Anti-Detection
+
+I don't know if it will ever be the case, but you may want to customize the firmware in order to avoid detection done by *USBvalve-aware* malware :-)
+
+I grouped most of the variables you may want to modify in this section
+
+```C
+// Anti-Detection settings.
+//
+// Set USB IDs strings and numbers, to avoid possible detections.
+// Remember that you can cusotmize FAKE_DISK_BLOCK_NUM as well
+// for the same reason. Also DISK_LABEL in ramdisk.h can be changed.
+//
+// You can see here for inspiration: https://the-sz.com/products/usbid/
+//
+// Example:
+//             0x0951 0x16D5    VENDORID_STR: Kingston   PRODUCTID_STR: DataTraveler
+//
+#define USB_VENDORID 0x0951               // This override the Pi Pico default 0x2E8A
+#define USB_PRODUCTID 0x16D5              // This override the Pi Pico default 0x000A
+#define USB_DESCRIPTOR "DataTraveler"     // This override the Pi Pico default "Pico"
+#define USB_MANUF "Kingston"              // This override the Pi Pico default "Raspberry Pi"
+#define USB_SERIAL "123456789A"           // This override the Pi Pico default. Disabled by default. \
+                                          // See "setSerialDescriptor" in setup() if needed
+#define USB_VENDORID_STR "Kingston"       // Up to 8 chars
+#define USB_PRODUCTID_STR "DataTraveler"  // Up to 16 chars
+#define USB_VERSION_STR "1.0"             // Up to 4 chars
+```
+
+
 ### Building your firmware
 
 Obviously you can also build your own firmware. To build the *standard* one I used:
@@ -126,10 +164,9 @@ Obviously you can also build your own firmware. To build the *standard* one I us
 - Arduino IDE 2.1.0
 - ~~as board I used `Raspberry Pi Pico - Arduino MBED OS RP2040` version `4.0.2`~~
 - ~~`Adafruit TinyUSB Library` version `1.14.4`. Newer versions are not working because the RPI SDK of the board is stick to an older version.  May be migrate the entire project directly on Raspberry Pi Pico SDK is the solution here.~~
-- from version `0.7.0` I used `Adafruit TinyUSB Library` version `2.1.0` and Board `Raspberry Pi RP2040 (2.7.0)`
+- `Adafruit TinyUSB Library` version `2.2.1` and Board `Raspberry Pi RP2040 (2.7.0)` setting clock at 240MHz (overclock)
 - `ssd1306` OLED library version `1.8.3`
 
 If you want to re-create a new fake filesystem, you may want to have a look to the `utils` folder, where I placed some utilities to build a new one.
 
 **NOTE**: if you have ideas or improvements in your mind, I encourage you to open an issue so that we can improve the project together! Thanks!
-

USBvalve/USBvalve.ino

@@ -2,7 +2,7 @@
   USBvalve
   
   written by Cesare Pizzi
-  This project extensively reuse code done by Adafruit. Please support them!
+  This project extensively reuse code done by Adafruit and TinyUSB. Please support them!
 */
 
 /*********************************************************************
@@ -42,7 +42,7 @@ Adafruit_USBH_Host USBHost;
 // Define vars for OLED screen
 #define I2C_ADDRESS 0x3C  // 0X3C+SA0 - 0x3C or 0x3D
 #define RST_PIN -1        // Define proper RST_PIN if required.
-#define OLED_HEIGHT 64    // 64 or 32 depending on the OLED
+#define OLED_HEIGHT 32    // 64 or 32 depending on the OLED
 #define OLED_LINES (OLED_HEIGHT / 8)
 SSD1306AsciiWire oled;
 
@@ -74,12 +74,32 @@ bool activeState = false;
 //
 // USBvalve globals
 //
-#define VERSION "USBvalve - 0.8.1"
+#define VERSION "USBvalve - 0.10.0"
 boolean readme = false;
 boolean autorun = false;
 boolean written = false;
 boolean written_reported = false;
-int x = 2;
+
+// Anti-Detection settings.
+//
+// Set USB IDs strings and numbers, to avoid possible detections.
+// Remember that you can cusotmize FAKE_DISK_BLOCK_NUM as well
+// for the same reason. Also DISK_LABEL in ramdisk.h can be changed.
+//
+// You can see here for inspiration: https://the-sz.com/products/usbid/
+//
+// Example:
+//             0x0951 0x16D5    VENDORID_STR: Kingston   PRODUCTID_STR: DataTraveler
+//
+#define USB_VENDORID 0x0951               // This override the Pi Pico default 0x2E8A
+#define USB_PRODUCTID 0x16D5              // This override the Pi Pico default 0x000A
+#define USB_DESCRIPTOR "DataTraveler"     // This override the Pi Pico default "Pico"
+#define USB_MANUF "Kingston"              // This override the Pi Pico default "Raspberry Pi"
+#define USB_SERIAL "123456789A"           // This override the Pi Pico default. Disabled by default. \
+                                          // See "setSerialDescriptor" in setup() if needed
+#define USB_VENDORID_STR "Kingston"       // Up to 8 chars
+#define USB_PRODUCTID_STR "DataTraveler"  // Up to 16 chars
+#define USB_VERSION_STR "1.0"             // Up to 4 chars
 
 #define BLOCK_AUTORUN 102       // Block where Autorun.inf file is saved
 #define BLOCK_README 100        // Block where README.txt file is saved
@@ -89,20 +109,28 @@ int x = 2;
 
 // Burned hash to check consistency
 u8 valid_hash[WIDTH] = {
-  0x35, 0x98, 0x95, 0x97, 0xC7, 0x70, 0xD3, 0xE4,
-  0xDD, 0x84, 0x71, 0x1D, 0x55, 0xD2, 0xE5, 0xA4,
-  0x6C, 0x28, 0x84, 0xF6, 0xE1, 0x02, 0xD1, 0x74,
-  0x2F, 0xE9, 0x92, 0xAD, 0xAD, 0x74, 0x71, 0xF0,
-  0x37, 0xFF, 0x79, 0x39, 0xDC, 0x20, 0x56, 0x26,
-  0xFE, 0xC7, 0x9A, 0x4E, 0x3A, 0x27, 0x65, 0x81
+  0x60, 0xFB, 0x68, 0xB5, 0xB9, 0xE6, 0xF4, 0xB7,
+  0x5F, 0xAD, 0x3C, 0x0D, 0xD3, 0x85, 0x01, 0x74,
+  0xED, 0x70, 0x55, 0x55, 0xE8, 0x1D, 0xE4, 0xBB,
+  0x4F, 0xC7, 0x2C, 0xA6, 0x7C, 0xC7, 0x79, 0x79,
+  0xEF, 0x21, 0x81, 0xB0, 0xEB, 0xD1, 0xF1, 0x71,
+  0x72, 0x37, 0x13, 0x0C, 0x28, 0x39, 0xC0, 0xB0
 };
 
 u8 computed_hash[WIDTH] = { 0x00 };
 
 // Core 0 Setup: will be used for the USB mass device functions
 void setup() {
+  // Change all the USB Pico settings
+  TinyUSBDevice.setID(USB_VENDORID, USB_PRODUCTID);
+  TinyUSBDevice.setProductDescriptor(USB_DESCRIPTOR);
+  TinyUSBDevice.setManufacturerDescriptor(USB_MANUF);
+  // This could be used to change the serial number as well
+  // TinyUSBDevice.setSerialDescriptor(USB_SERIAL);
+
   // Check consistency of RAM FS
-  quark(computed_hash, msc_disk[BYTES_TO_HASH_OFFSET], BYTES_TO_HASH);
+  // Add 11 bytes to skip the DISK_LABEL from the hashing
+  quark(computed_hash, msc_disk[BYTES_TO_HASH_OFFSET] + 11, BYTES_TO_HASH);
 
 #if defined(ARDUINO_ARCH_MBED) && defined(ARDUINO_ARCH_RP2040)
   // Manual begin() is required on core without built-in support for TinyUSB such as
@@ -111,7 +139,7 @@ void setup() {
 #endif
 
   // Set disk vendor id, product id and revision with string up to 8, 16, 4 characters respectively
-  usb_msc.setID("Watchdog", "USBvalve", "0.1");
+  usb_msc.setID(USB_VENDORID_STR, USB_PRODUCTID_STR, USB_VERSION_STR);
 
   // Set disk size (using the "fake" size)
   usb_msc.setCapacity(FAKE_DISK_BLOCK_NUM, DISK_BLOCK_SIZE);
@@ -127,8 +155,6 @@ void setup() {
   usb_msc.setReadyCallback(msc_ready_callback);
 #endif
 
-  usb_msc.begin();
-
   // Screen Init
   Wire.begin();
   Wire.setClock(400000L);
@@ -147,18 +173,20 @@ void setup() {
 #endif
 
   oled.setFont(Adafruit5x7);
+  oled.setScrollMode(SCROLL_MODE_AUTO);
   cls();  // Clear display
 
   if (memcmp(computed_hash, valid_hash, WIDTH) == 0) {
-    oled.println("[+] Selftest: OK");
-    x++;
+    oled.print("\n[+] Selftest: OK");
   } else {
-    oled.println("[!] Selftest: KO");
-    oled.println("[!] Stopping...");
+    oled.print("\n[!] Selftest: KO");
+    oled.print("\n[!] Stopping...");
     while (1) {
       delay(1000);  // Loop forever
     }
   }
+
+  usb_msc.begin();
 }
 
 // Core 1 Setup: will be used for the USB host functions for BADUSB detector
@@ -179,23 +207,17 @@ void setup1() {
 void loop() {
 
   if (readme == true) {
-    if (x == OLED_LINES) cls();
-    oled.println("[!] README (R)");
-    x++;
+    oled.print("\n[!] README (R)");
     readme = false;
   }
 
   if (autorun == true) {
-    if (x == OLED_LINES) cls();
-    oled.println("[+] AUTORUN (R)");
-    x++;
+    oled.print("\n[+] AUTORUN (R)");
     autorun = false;
   }
 
   if (written == true && written_reported == false) {
-    if (x == OLED_LINES) cls();
-    oled.println("[!] WRITING");
-    x++;
+    oled.print("\n[!] WRITING");
     written = false;
     written_reported = true;
   }
@@ -289,9 +311,8 @@ bool msc_ready_callback(void) {
 // Clear display
 void cls(void) {
   oled.clear();
-  oled.println(VERSION);
-  oled.println("----------------");
-  x = 2;
+  oled.print(VERSION);
+  oled.print("\n-----------------");
 }
 
 // HexDump
@@ -334,23 +355,24 @@ void hexDump(unsigned char* data, size_t size) {
 // BADUSB detector section
 //
 
+static uint8_t const keycode2ascii[128][2] = { HID_KEYCODE_TO_ASCII };
+
 // Invoked when device with hid interface is mounted
-// Report descriptor is also available for use.
-// tuh_hid_parse_report_descriptor() can be used to parse common/simple enough
-// descriptor. Note: if report descriptor length > CFG_TUH_ENUMERATION_BUFSIZE,
-// it will be skipped therefore report_desc = NULL, desc_len = 0
 void tuh_hid_mount_cb(uint8_t dev_addr, uint8_t instance, uint8_t const* desc_report, uint16_t desc_len) {
-  (void)desc_report;
-  (void)desc_len;
   uint16_t vid, pid;
+  const char* protocol_str[] = { "None", "Keyboard", "Mouse" };
+
+  // Read the HID protocol
+  uint8_t const itf_protocol = tuh_hid_interface_protocol(dev_addr, instance);
+
   tuh_vid_pid_get(dev_addr, &vid, &pid);
 
-  if (x == OLED_LINES) cls();
-  oled.println("[++] HID Device");
-  x++;
+  oled.print("\n[!!] HID Device");
 
   SerialTinyUSB.printf("HID device address = %d, instance = %d mounted\r\n", dev_addr, instance);
   SerialTinyUSB.printf("VID = %04x, PID = %04x\r\n", vid, pid);
+  SerialTinyUSB.printf("HID Interface Protocol = %s\r\n", protocol_str[itf_protocol]);
+
   if (!tuh_hid_receive_report(dev_addr, instance)) {
     SerialTinyUSB.printf("Error: cannot request to receive report\r\n");
   }
@@ -361,21 +383,154 @@ void tuh_hid_umount_cb(uint8_t dev_addr, uint8_t instance) {
   SerialTinyUSB.printf("HID device address = %d, instance = %d unmounted\r\n", dev_addr, instance);
 }
 
-// Invoked when received report from device via interrupt endpoint
+// Invoked when received report from device
 void tuh_hid_report_received_cb(uint8_t dev_addr, uint8_t instance, uint8_t const* report, uint16_t len) {
-  if (x == OLED_LINES) cls();
-  oled.println("[!!] HID Sending data");
-  x++;
 
-  SerialTinyUSB.printf("HIDreport : ");
-  for (uint16_t i = 0; i < len; i++) {
-    SerialTinyUSB.printf("0x%02X ", report[i]);
+  static bool kbd_printed = false;
+  static bool mouse_printed = false;
+
+  oled.print("\n[!!] HID Sending data");
+
+  // Read the HID protocol
+  uint8_t const itf_protocol = tuh_hid_interface_protocol(dev_addr, instance);
+
+  switch (itf_protocol) {
+    case HID_ITF_PROTOCOL_KEYBOARD:
+      if (kbd_printed == false) {
+        SerialTinyUSB.println("HID received keyboard report");
+        kbd_printed = true;
+        mouse_printed = false;
+      }
+      process_kbd_report((hid_keyboard_report_t const*)report);
+      break;
+
+    case HID_ITF_PROTOCOL_MOUSE:
+      if (kbd_printed == false) {
+        SerialTinyUSB.println("HID receive mouse report");
+        mouse_printed = true;
+        kbd_printed = false;
+      }
+      process_mouse_report((hid_mouse_report_t const*)report);
+      break;
+
+    default:
+      // Generic report: for the time being we use kbd for this as well
+      process_kbd_report((hid_keyboard_report_t const*)report);
+      break;
   }
-  SerialTinyUSB.println();
-  // continue to request to receive report
+
   if (!tuh_hid_receive_report(dev_addr, instance)) {
-    SerialTinyUSB.printf("Error: cannot request to receive report\r\n");
+    SerialTinyUSB.println("Error: cannot request to receive report");
   }
 }
 
+static inline bool find_key_in_report(hid_keyboard_report_t const* report, uint8_t keycode) {
+  for (uint8_t i = 0; i < 6; i++) {
+    if (report->keycode[i] == keycode) return true;
+  }
+
+  return false;
+}
+
+static void process_kbd_report(hid_keyboard_report_t const* report) {
+  // Previous report to check key released
+  static hid_keyboard_report_t prev_report = { 0, 0, { 0 } };
+
+  for (uint8_t i = 0; i < 6; i++) {
+    if (report->keycode[i]) {
+      if (find_key_in_report(&prev_report, report->keycode[i])) {
+        // Exist in previous report means the current key is holding
+      } else {
+        // Not existed in previous report means the current key is pressed
+
+        // Check for modifiers. It looks that in specific cases, they are not correctly recognized (probably
+        // for timing issues in fast input)
+        bool const is_shift = report->modifier & (KEYBOARD_MODIFIER_LEFTSHIFT | KEYBOARD_MODIFIER_RIGHTSHIFT);
+        uint8_t ch = keycode2ascii[report->keycode[i]][is_shift ? 1 : 0];
+
+        bool const is_gui = report->modifier & (KEYBOARD_MODIFIER_LEFTGUI | KEYBOARD_MODIFIER_RIGHTGUI);
+        if (is_gui == true) SerialTinyUSB.printf("GUI+");
+
+        bool const is_alt = report->modifier & (KEYBOARD_MODIFIER_LEFTALT | KEYBOARD_MODIFIER_RIGHTALT);
+        if (is_alt == true) SerialTinyUSB.printf("ALT+");
+
+        // Check for "special" keys
+        check_special_key(report->keycode[i]);
+
+        // Finally, print out the decoded char
+        SerialTinyUSB.printf("%c", ch);
+        if (ch == '\r') SerialTinyUSB.print("\n");  // New line for enter
+
+        fflush(stdout);  // flush right away, else nanolib will wait for newline
+      }
+    }
+  }
+
+  prev_report = *report;
+}
+
+static void check_special_key(uint8_t code) {
+
+  if (code == HID_KEY_ARROW_RIGHT) SerialTinyUSB.print("<ARROWRIGHT>");
+  if (code == HID_KEY_ARROW_LEFT) SerialTinyUSB.print("<ARROWLEFT>");
+  if (code == HID_KEY_ARROW_DOWN) SerialTinyUSB.print("<ARROWDOWN>");
+  if (code == HID_KEY_ARROW_UP) SerialTinyUSB.print("<ARROWUP>");
+  if (code == HID_KEY_HOME) SerialTinyUSB.print("<HOME>");
+  if (code == HID_KEY_KEYPAD_1) SerialTinyUSB.print("<KEYPAD_1>");
+  if (code == HID_KEY_KEYPAD_2) SerialTinyUSB.print("<KEYPAD_2>");
+  if (code == HID_KEY_KEYPAD_3) SerialTinyUSB.print("<KEYPAD_3>");
+  if (code == HID_KEY_KEYPAD_4) SerialTinyUSB.print("<KEYPAD_4>");
+  if (code == HID_KEY_KEYPAD_5) SerialTinyUSB.print("<KEYPAD_5>");
+  if (code == HID_KEY_KEYPAD_6) SerialTinyUSB.print("<KEYPAD_6>");
+  if (code == HID_KEY_KEYPAD_7) SerialTinyUSB.print("<KEYPAD_7>");
+  if (code == HID_KEY_KEYPAD_8) SerialTinyUSB.print("<KEYPAD_8>");
+  if (code == HID_KEY_KEYPAD_9) SerialTinyUSB.print("<KEYPAD_9>");
+  if (code == HID_KEY_KEYPAD_0) SerialTinyUSB.print("<KEYPAD_0>");
+  if (code == HID_KEY_F1) SerialTinyUSB.print("<F1>");
+  if (code == HID_KEY_F2) SerialTinyUSB.print("<F2>");
+  if (code == HID_KEY_F3) SerialTinyUSB.print("<F3>");
+  if (code == HID_KEY_F4) SerialTinyUSB.print("<F4>");
+  if (code == HID_KEY_F5) SerialTinyUSB.print("<F5>");
+  if (code == HID_KEY_F6) SerialTinyUSB.print("<F6>");
+  if (code == HID_KEY_F7) SerialTinyUSB.print("<F7>");
+  if (code == HID_KEY_F8) SerialTinyUSB.print("<F8>");
+  if (code == HID_KEY_F9) SerialTinyUSB.print("<F9>");
+  if (code == HID_KEY_F10) SerialTinyUSB.print("<F10>");
+  if (code == HID_KEY_F11) SerialTinyUSB.print("<F11>");
+  if (code == HID_KEY_F12) SerialTinyUSB.print("<F12>");
+  if (code == HID_KEY_PRINT_SCREEN) SerialTinyUSB.print("<PRNT>");
+  if (code == HID_KEY_SCROLL_LOCK) SerialTinyUSB.print("<SCRLL>");
+  if (code == HID_KEY_PAUSE) SerialTinyUSB.print("<PAUSE>");
+  if (code == HID_KEY_INSERT) SerialTinyUSB.print("<INSERT>");
+  if (code == HID_KEY_PAGE_UP) SerialTinyUSB.print("<PAGEUP>");
+  if (code == HID_KEY_DELETE) SerialTinyUSB.print("<DEL>");
+  if (code == HID_KEY_END) SerialTinyUSB.print("<END>");
+  if (code == HID_KEY_PAGE_DOWN) SerialTinyUSB.print("<PAGEDOWN>");
+  if (code == HID_KEY_NUM_LOCK) SerialTinyUSB.print("<ARROWRIGHT>");
+  if (code == HID_KEY_KEYPAD_DIVIDE) SerialTinyUSB.print("<KEYPAD_DIV>");
+  if (code == HID_KEY_KEYPAD_MULTIPLY) SerialTinyUSB.print("<KEYPAD_MUL>");
+  if (code == HID_KEY_KEYPAD_SUBTRACT) SerialTinyUSB.print("<KEYPAD_SUB>");
+  if (code == HID_KEY_KEYPAD_ADD) SerialTinyUSB.print("<KEYPAD_ADD>");
+  if (code == HID_KEY_KEYPAD_DECIMAL) SerialTinyUSB.print("<KEYPAD_DECIMAL>");
+}
+
+static void process_mouse_report(hid_mouse_report_t const* report) {
+  static hid_mouse_report_t prev_report = { 0 };
+
+  //------------- button state  -------------//
+  uint8_t button_changed_mask = report->buttons ^ prev_report.buttons;
+  if (button_changed_mask & report->buttons) {
+    SerialTinyUSB.printf("MOUSE: %c%c%c ",
+                         report->buttons & MOUSE_BUTTON_LEFT ? 'L' : '-',
+                         report->buttons & MOUSE_BUTTON_MIDDLE ? 'M' : '-',
+                         report->buttons & MOUSE_BUTTON_RIGHT ? 'R' : '-');
+  }
+
+  cursor_movement(report->x, report->y, report->wheel);
+}
+
+void cursor_movement(int8_t x, int8_t y, int8_t wheel) {
+  SerialTinyUSB.printf("(%d %d %d)\r\n", x, y, wheel);
+}
+
 // END of BADUSB detector section

USBvalve/ramdisk.h

@@ -35,9 +35,15 @@
 //    README.TXT
 //    System Volume Information
 //
+
+// Keep 11 chars
+#define DISK_LABEL 'M', 'y', 'D', 'r', 'i', 'v', 'e', ' ', ' ', ' ', ' '
+
+// Do not change this here, it is just for reference
 #define README_CONTENTS \
   "...nuke the entire site from orbit. It's the only way to be sure."
 
+// Do not change this here, it is just for reference
 #define AUTORUN_CONTENTS \
   "[autorun]\r\nopen=calc.exe\r\nicon=icon.ico\r\n"
 
@@ -134,7 +140,7 @@ uint8_t msc_disk[DISK_BLOCK_NUM][DISK_BLOCK_SIZE] = {
 },
 { 
 //------------- Block 7: -------------//
-0x55, 0x53, 0x42, 0x56, 0x41, 0x4c, 0x56, 0x45, 0x20, 0x20, 0x20, 0x08, 0x00, 0x00, 0xaf, 0x60, 
+DISK_LABEL, 0x08, 0x00, 0x00, 0xaf, 0x60, 
 0x6d, 0x55, 0x6d, 0x55, 0x00, 0x00, 0xaf, 0x60, 0x6d, 0x55, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
 0x41, 0x55, 0x54, 0x4f, 0x52, 0x55, 0x4e, 0x20, 0x49, 0x4e, 0x46, 0x20, 0x00, 0x9d, 0xef, 0x58, 
 0x6d, 0x55, 0x6b, 0x55, 0x00, 0x00, 0xef, 0x58, 0x6d, 0x55, 0x60, 0x00, 0x2a, 0x00, 0x00, 0x00,