18 Commits

Author SHA1 Message Date
cecio
5aa63c8efe bump to release 0.11.0 2023-07-04 22:01:53 +02:00
cecio
39c3145e71 README mods 2023-07-04 21:38:30 +02:00
cecio
7daafb4d41 README mods 2023-07-04 21:36:54 +02:00
cecio
5a7a485aa4 README mods 2023-07-04 21:35:35 +02:00
cecio
08512d5d87 gitignore updated 2023-07-04 14:55:30 +02:00
cecio
1c351f3a7b Added Dockerfile for build environment 2023-07-04 14:54:42 +02:00
cecio
e1c4fd4816 0.10.0 firmware added 2023-06-12 22:28:19 +02:00
cecio
3de81580bd bump to release 0.10.0 2023-06-11 23:42:09 +02:00
cecio
b6076a6880 Added Anti-Detection comments in README 2023-06-11 22:19:32 +02:00
cecio
d97b34c372 Fixed issue in stopping operations if hash does not match 2023-06-11 22:04:05 +02:00
cecio
c4b914f458 Consistency hashing now skip DISK_LABEL 2023-06-11 21:55:04 +02:00
cecio
a0ad62e20f Fix is needed for changing the DISK_LABEL. 2023-06-10 23:23:25 +02:00
cecio
7bcca191cc Added possibility to customize DISK_LABEL 2023-06-10 23:11:53 +02:00
cecio
386852c994 Added the possibility to override SN (disabled) 2023-06-10 22:35:20 +02:00
cecio
e19cb76910 Added new "Anti-Detection" section for customization 2023-06-10 22:23:41 +02:00
cecio
927dd4d67f grouped variables for USB IDs strings for easy customization 2023-06-10 01:10:40 +02:00
cecio
b8a0baa9f2 added 0.9.1 firmware 2023-05-13 21:51:03 +02:00
cecio
32a4a2d895 New scroll mode and bump to release 0.9.1 2023-05-13 13:19:41 +02:00
7 changed files with 148 additions and 42 deletions

2
.gitignore vendored
View File

@@ -50,3 +50,5 @@ modules.order
Module.symvers
Mkfile.old
dkms.conf
USBvalve_out

38
Dockerfile Normal file
View File

@@ -0,0 +1,38 @@
#
# To Build:
# docker build -t usbvalve/arduino-cli .
#
# To Run:
# docker run --rm --name usbvalve -v $PWD:/mnt usbvalve/arduino-cli /mnt/USBvalve
#
FROM ubuntu:22.04
WORKDIR /app
# OS setup
RUN apt-get update -y \
&& apt-get install -y git wget python3 \
&& apt-get autoremove -y \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
# arduino-cli setup
RUN cd /app \
&& git clone --recursive https://github.com/arduino/arduino-cli.git \
&& cd arduino-cli \
&& ./install.sh \
&& export PATH=$PATH:/app/arduino-cli/bin \
&& arduino-cli --additional-urls https://github.com/earlephilhower/arduino-pico/releases/download/global/package_rp2040_index.json core search 2040 \
&& arduino-cli --additional-urls https://github.com/earlephilhower/arduino-pico/releases/download/global/package_rp2040_index.json core install rp2040:rp2040 \
&& arduino-cli lib install "Adafruit TinyUSB Library" \
&& arduino-cli lib install "ssd1306" \
&& arduino-cli lib install "Pico PIO USB" \
&& arduino-cli lib install "SSD1306Ascii"
# Compilation setup
RUN echo "#!/bin/bash" > /app/entrypoint.sh \
&& echo "export PATH=\$PATH:/app/arduino-cli/bin" >> /app/entrypoint.sh \
&& echo "arduino-cli compile --fqbn rp2040:rp2040:rpipico --board-options \"usbstack=tinyusb\" --board-options \"freq=240\" --output-dir \"/mnt/USBvalve_out\" \"\$1\"" >> /app/entrypoint.sh \
&& chmod +x /app/entrypoint.sh
ENTRYPOINT ["/app/entrypoint.sh"]

View File

@@ -127,6 +127,36 @@ To flash the firmware, follow these steps:
It's done!
### Anti-Detection
I don't know if it will ever be the case, but you may want to customize the firmware in order to avoid detection done by *USBvalve-aware* malware :-)
I grouped most of the variables you may want to modify in this section ([see Dockerfile below for rebuilding](https://github.com/cecio/USBvalve#dockerfile))
```C
// Anti-Detection settings.
//
// Set USB IDs strings and numbers, to avoid possible detections.
// Remember that you can cusotmize FAKE_DISK_BLOCK_NUM as well
// for the same reason. Also DISK_LABEL in ramdisk.h can be changed.
//
// You can see here for inspiration: https://the-sz.com/products/usbid/
//
// Example:
// 0x0951 0x16D5 VENDORID_STR: Kingston PRODUCTID_STR: DataTraveler
//
#define USB_VENDORID 0x0951 // This override the Pi Pico default 0x2E8A
#define USB_PRODUCTID 0x16D5 // This override the Pi Pico default 0x000A
#define USB_DESCRIPTOR "DataTraveler" // This override the Pi Pico default "Pico"
#define USB_MANUF "Kingston" // This override the Pi Pico default "Raspberry Pi"
#define USB_SERIAL "123456789A" // This override the Pi Pico default. Disabled by default. \
// See "setSerialDescriptor" in setup() if needed
#define USB_VENDORID_STR "Kingston" // Up to 8 chars
#define USB_PRODUCTID_STR "DataTraveler" // Up to 16 chars
#define USB_VERSION_STR "1.0" // Up to 4 chars
```
### Building your firmware
Obviously you can also build your own firmware. To build the *standard* one I used:
@@ -134,9 +164,22 @@ Obviously you can also build your own firmware. To build the *standard* one I us
- Arduino IDE 2.1.0
- ~~as board I used `Raspberry Pi Pico - Arduino MBED OS RP2040` version `4.0.2`~~
- ~~`Adafruit TinyUSB Library` version `1.14.4`. Newer versions are not working because the RPI SDK of the board is stick to an older version. May be migrate the entire project directly on Raspberry Pi Pico SDK is the solution here.~~
- `Adafruit TinyUSB Library` version `2.2.0` and Board `Raspberry Pi RP2040 (2.7.0)` setting clock at 240MHz (overclock)
- `Adafruit TinyUSB Library` version `2.2.1` and Board `Raspberry Pi RP2040 (3.3.0)` setting clock at 240MHz (overclock)
- `ssd1306` OLED library version `1.8.3`
If you want to re-create a new fake filesystem, you may want to have a look to the `utils` folder, where I placed some utilities to build a new one.
**NOTE**: if you have ideas or improvements in your mind, I encourage you to open an issue so that we can improve the project together! Thanks!
#### Dockerfile
If you want to build your own firmware, after you customized it, I provide a `Dockerfile` which builds a complete **Arduino** environment and compile the firmware, just do this in main `USBvalve` folder:
```
docker build -t usbvalve/arduino-cli .
docker run --rm --name usbvalve -v $PWD:/mnt usbvalve/arduino-cli /mnt/USBvalve
```
The firmware will be placed with extension `uf2` in folder `USBvalve_out`.
### Contribute
If you have ideas or improvements in your mind, I encourage you to open an issue so that we can improve the project together! Thanks!

View File

@@ -42,7 +42,7 @@ Adafruit_USBH_Host USBHost;
// Define vars for OLED screen
#define I2C_ADDRESS 0x3C // 0X3C+SA0 - 0x3C or 0x3D
#define RST_PIN -1 // Define proper RST_PIN if required.
#define OLED_HEIGHT 64 // 64 or 32 depending on the OLED
#define OLED_HEIGHT 32 // 64 or 32 depending on the OLED
#define OLED_LINES (OLED_HEIGHT / 8)
SSD1306AsciiWire oled;
@@ -74,12 +74,32 @@ bool activeState = false;
//
// USBvalve globals
//
#define VERSION "USBvalve - 0.9.0"
#define VERSION "USBvalve - 0.11.0"
boolean readme = false;
boolean autorun = false;
boolean written = false;
boolean written_reported = false;
int x = 2;
// Anti-Detection settings.
//
// Set USB IDs strings and numbers, to avoid possible detections.
// Remember that you can cusotmize FAKE_DISK_BLOCK_NUM as well
// for the same reason. Also DISK_LABEL in ramdisk.h can be changed.
//
// You can see here for inspiration: https://the-sz.com/products/usbid/
//
// Example:
// 0x0951 0x16D5 VENDORID_STR: Kingston PRODUCTID_STR: DataTraveler
//
#define USB_VENDORID 0x0951 // This override the Pi Pico default 0x2E8A
#define USB_PRODUCTID 0x16D5 // This override the Pi Pico default 0x000A
#define USB_DESCRIPTOR "DataTraveler" // This override the Pi Pico default "Pico"
#define USB_MANUF "Kingston" // This override the Pi Pico default "Raspberry Pi"
#define USB_SERIAL "123456789A" // This override the Pi Pico default. Disabled by default. \
// See "setSerialDescriptor" in setup() if needed
#define USB_VENDORID_STR "Kingston" // Up to 8 chars
#define USB_PRODUCTID_STR "DataTraveler" // Up to 16 chars
#define USB_VERSION_STR "1.0" // Up to 4 chars
#define BLOCK_AUTORUN 102 // Block where Autorun.inf file is saved
#define BLOCK_README 100 // Block where README.txt file is saved
@@ -89,20 +109,28 @@ int x = 2;
// Burned hash to check consistency
u8 valid_hash[WIDTH] = {
0x35, 0x98, 0x95, 0x97, 0xC7, 0x70, 0xD3, 0xE4,
0xDD, 0x84, 0x71, 0x1D, 0x55, 0xD2, 0xE5, 0xA4,
0x6C, 0x28, 0x84, 0xF6, 0xE1, 0x02, 0xD1, 0x74,
0x2F, 0xE9, 0x92, 0xAD, 0xAD, 0x74, 0x71, 0xF0,
0x37, 0xFF, 0x79, 0x39, 0xDC, 0x20, 0x56, 0x26,
0xFE, 0xC7, 0x9A, 0x4E, 0x3A, 0x27, 0x65, 0x81
0x60, 0xFB, 0x68, 0xB5, 0xB9, 0xE6, 0xF4, 0xB7,
0x5F, 0xAD, 0x3C, 0x0D, 0xD3, 0x85, 0x01, 0x74,
0xED, 0x70, 0x55, 0x55, 0xE8, 0x1D, 0xE4, 0xBB,
0x4F, 0xC7, 0x2C, 0xA6, 0x7C, 0xC7, 0x79, 0x79,
0xEF, 0x21, 0x81, 0xB0, 0xEB, 0xD1, 0xF1, 0x71,
0x72, 0x37, 0x13, 0x0C, 0x28, 0x39, 0xC0, 0xB0
};
u8 computed_hash[WIDTH] = { 0x00 };
// Core 0 Setup: will be used for the USB mass device functions
void setup() {
// Change all the USB Pico settings
TinyUSBDevice.setID(USB_VENDORID, USB_PRODUCTID);
TinyUSBDevice.setProductDescriptor(USB_DESCRIPTOR);
TinyUSBDevice.setManufacturerDescriptor(USB_MANUF);
// This could be used to change the serial number as well
// TinyUSBDevice.setSerialDescriptor(USB_SERIAL);
// Check consistency of RAM FS
quark(computed_hash, msc_disk[BYTES_TO_HASH_OFFSET], BYTES_TO_HASH);
// Add 11 bytes to skip the DISK_LABEL from the hashing
quark(computed_hash, msc_disk[BYTES_TO_HASH_OFFSET] + 11, BYTES_TO_HASH);
#if defined(ARDUINO_ARCH_MBED) && defined(ARDUINO_ARCH_RP2040)
// Manual begin() is required on core without built-in support for TinyUSB such as
@@ -111,7 +139,7 @@ void setup() {
#endif
// Set disk vendor id, product id and revision with string up to 8, 16, 4 characters respectively
usb_msc.setID("Watchdog", "USBvalve", "0.1");
usb_msc.setID(USB_VENDORID_STR, USB_PRODUCTID_STR, USB_VERSION_STR);
// Set disk size (using the "fake" size)
usb_msc.setCapacity(FAKE_DISK_BLOCK_NUM, DISK_BLOCK_SIZE);
@@ -127,8 +155,6 @@ void setup() {
usb_msc.setReadyCallback(msc_ready_callback);
#endif
usb_msc.begin();
// Screen Init
Wire.begin();
Wire.setClock(400000L);
@@ -147,18 +173,20 @@ void setup() {
#endif
oled.setFont(Adafruit5x7);
oled.setScrollMode(SCROLL_MODE_AUTO);
cls(); // Clear display
if (memcmp(computed_hash, valid_hash, WIDTH) == 0) {
oled.println("[+] Selftest: OK");
x++;
oled.print("\n[+] Selftest: OK");
} else {
oled.println("[!] Selftest: KO");
oled.println("[!] Stopping...");
oled.print("\n[!] Selftest: KO");
oled.print("\n[!] Stopping...");
while (1) {
delay(1000); // Loop forever
}
}
usb_msc.begin();
}
// Core 1 Setup: will be used for the USB host functions for BADUSB detector
@@ -179,23 +207,17 @@ void setup1() {
void loop() {
if (readme == true) {
if (x == OLED_LINES) cls();
oled.println("[!] README (R)");
x++;
oled.print("\n[!] README (R)");
readme = false;
}
if (autorun == true) {
if (x == OLED_LINES) cls();
oled.println("[+] AUTORUN (R)");
x++;
oled.print("\n[+] AUTORUN (R)");
autorun = false;
}
if (written == true && written_reported == false) {
if (x == OLED_LINES) cls();
oled.println("[!] WRITING");
x++;
oled.print("\n[!] WRITING");
written = false;
written_reported = true;
}
@@ -289,9 +311,8 @@ bool msc_ready_callback(void) {
// Clear display
void cls(void) {
oled.clear();
oled.println(VERSION);
oled.println("----------------");
x = 2;
oled.print(VERSION);
oled.print("\n-----------------");
}
// HexDump
@@ -346,9 +367,7 @@ void tuh_hid_mount_cb(uint8_t dev_addr, uint8_t instance, uint8_t const* desc_re
tuh_vid_pid_get(dev_addr, &vid, &pid);
if (x == OLED_LINES) cls();
oled.println("[++] HID Device");
x++;
oled.print("\n[!!] HID Device");
SerialTinyUSB.printf("HID device address = %d, instance = %d mounted\r\n", dev_addr, instance);
SerialTinyUSB.printf("VID = %04x, PID = %04x\r\n", vid, pid);
@@ -370,9 +389,7 @@ void tuh_hid_report_received_cb(uint8_t dev_addr, uint8_t instance, uint8_t cons
static bool kbd_printed = false;
static bool mouse_printed = false;
if (x == OLED_LINES) cls();
oled.println("[!!] HID Sending data");
x++;
oled.print("\n[!!] HID Sending data");
// Read the HID protocol
uint8_t const itf_protocol = tuh_hid_interface_protocol(dev_addr, instance);
@@ -504,9 +521,9 @@ static void process_mouse_report(hid_mouse_report_t const* report) {
uint8_t button_changed_mask = report->buttons ^ prev_report.buttons;
if (button_changed_mask & report->buttons) {
SerialTinyUSB.printf("MOUSE: %c%c%c ",
report->buttons & MOUSE_BUTTON_LEFT ? 'L' : '-',
report->buttons & MOUSE_BUTTON_MIDDLE ? 'M' : '-',
report->buttons & MOUSE_BUTTON_RIGHT ? 'R' : '-');
report->buttons & MOUSE_BUTTON_LEFT ? 'L' : '-',
report->buttons & MOUSE_BUTTON_MIDDLE ? 'M' : '-',
report->buttons & MOUSE_BUTTON_RIGHT ? 'R' : '-');
}
cursor_movement(report->x, report->y, report->wheel);
@@ -516,4 +533,4 @@ void cursor_movement(int8_t x, int8_t y, int8_t wheel) {
SerialTinyUSB.printf("(%d %d %d)\r\n", x, y, wheel);
}
// END of BADUSB detector section
// END of BADUSB detector section

View File

@@ -35,9 +35,15 @@
// README.TXT
// System Volume Information
//
// Keep 11 chars
#define DISK_LABEL 'M', 'y', 'D', 'r', 'i', 'v', 'e', ' ', ' ', ' ', ' '
// Do not change this here, it is just for reference
#define README_CONTENTS \
"...nuke the entire site from orbit. It's the only way to be sure."
// Do not change this here, it is just for reference
#define AUTORUN_CONTENTS \
"[autorun]\r\nopen=calc.exe\r\nicon=icon.ico\r\n"
@@ -134,7 +140,7 @@ uint8_t msc_disk[DISK_BLOCK_NUM][DISK_BLOCK_SIZE] = {
},
{
//------------- Block 7: -------------//
0x55, 0x53, 0x42, 0x56, 0x41, 0x4c, 0x56, 0x45, 0x20, 0x20, 0x20, 0x08, 0x00, 0x00, 0xaf, 0x60,
DISK_LABEL, 0x08, 0x00, 0x00, 0xaf, 0x60,
0x6d, 0x55, 0x6d, 0x55, 0x00, 0x00, 0xaf, 0x60, 0x6d, 0x55, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x41, 0x55, 0x54, 0x4f, 0x52, 0x55, 0x4e, 0x20, 0x49, 0x4e, 0x46, 0x20, 0x00, 0x9d, 0xef, 0x58,
0x6d, 0x55, 0x6b, 0x55, 0x00, 0x00, 0xef, 0x58, 0x6d, 0x55, 0x60, 0x00, 0x2a, 0x00, 0x00, 0x00,