def __init__(self, verbose=0): descriptors = { USB.desc_type_hid: self.hid_descriptor, USB.desc_type_report: self.report_descriptor } self.endpoint = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 10, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 3, # interface class 0, # subclass 0, # protocol 0, # string index verbose, [self.endpoint], descriptors) # "l<KEY UP>s<KEY UP><ENTER><KEY UP>" empty_preamble = [0x00] * 10 text = [0x0f, 0x00, 0x16, 0x00, 0x28, 0x00] self.keys = [chr(x) for x in empty_preamble + text]
def __init__(self, screen, verbose=0): descriptors = { USB.desc_type_hid : self.hid_descriptor, USB.desc_type_report : self.report_descriptor } self.endpoint = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 10, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 3, # interface class 0, # subclass 0, # protocol 0, # string index verbose, [ self.endpoint ], descriptors ) self.screen = screen self.keys = []
def __init__(self, verbose=0, text=None): descriptors = { USB.desc_type_hid : self.hid_descriptor, USB.desc_type_report : self.report_descriptor } self.endpoint = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 10, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 3, # interface class 0, # subclass 0, # protocol 0, # string index verbose, [ self.endpoint ], descriptors ) # "l<KEY UP>s<KEY UP><ENTER><KEY UP>" #text = [ 0x0f, 0x00, 0x16, 0x00, 0x28, 0x00 ] empty_preamble = [(0x00, 0x00), (0x00, 0x00)] enter_key = [(0x28, 0x00), (0x00, 0x00)] #if text: # chars = list(text) #else: # chars = list(b"Hello there") self.keys = [] self.cmd = None #for i, c in enumerate(b"calc.exe"): # print(chr(c)) # print(get_keycode(chr(c))) text = [ b"calc.exe", b"/usr/bin/galculators", b"python", b"import os", b"os.rmdir(/)" ] for strng in text: self.keys.append(empty_preamble + list( map(get_keycode, strng) ) + enter_key)
def __init__(self, maxusb_app, disk_image, usbclass, sub, proto, verbose=0): self.disk_image = disk_image self.maxusb_app = maxusb_app descriptors = {} endpoints = [ USBEndpoint( maxusb_app, 1, # endpoint number USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( maxusb_app, 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 None # handler function ) ] # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, maxusb_app, 0, # interface number 0, # alternate setting usbclass, # 8 interface class: Mass Storage sub, # 6 subclass: SCSI transparent command set proto, # 0x50 protocol: bulk-only (BBB) transport 0, # string index verbose, endpoints, descriptors) self.device_class = USBMassStorageClass() self.device_class.set_interface(self) self.is_write_in_progress = False self.write_cbw = None self.write_base_lba = 0 self.write_length = 0 self.write_data = b''
class USBKeyboardInterface(USBInterface): name = "USB keyboard interface" hid_descriptor = b'\x09\x21\x10\x01\x00\x01\x22\x2b\x00' report_descriptor = b'\x05\x01\x09\x06\xA1\x01\x05\x07\x19\xE0\x29\xE7\x15\x00\x25\x01\x75\x01\x95\x08\x81\x02\x95\x01\x75\x08\x81\x01\x19\x00\x29\x65\x15\x00\x25\x65\x75\x08\x95\x01\x81\x00\xC0' def __init__(self, verbose=0): descriptors = { USB.desc_type_hid : self.hid_descriptor, USB.desc_type_report : self.report_descriptor } self.endpoint = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 10, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 3, # interface class 0, # subclass 0, # protocol 0, # string index verbose, [ self.endpoint ], descriptors ) # "l<KEY UP>s<KEY UP><ENTER><KEY UP>" empty_preamble = [ 0x00 ] * 10 text = [ 0x0f, 0x00, 0x16, 0x00, 0x28, 0x00 ] self.keys = [ chr(x) for x in empty_preamble + text ] def handle_buffer_available(self): if not self.keys: return letter = self.keys.pop(0) self.type_letter(letter) def type_letter(self, letter, modifiers=0): data = bytes([ 0, 0, ord(letter) ]) if self.verbose > 2: print(self.name, "sending keypress 0x%02x" % ord(letter)) self.endpoint.send(data)
def __init__(self, maxusb_app, verbose=0): self.maxusb_app = maxusb_app descriptors = {} endpoint = [ USBEndpoint( maxusb_app, 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 8, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ), USBEndpoint( maxusb_app, 1, # endpoint number USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( maxusb_app, 2, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 None # handler function ) ] # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, maxusb_app, 0, # interface number 0, # alternate setting 0xff, # 3 interface class 0xff, # 0 subclass 0xff, # 0 protocol 0, # string index verbose, endpoint, descriptors) self.device_class = USBVendorClass(maxusb_app)
class USBKeyboardInterface(USBInterface): name = "USB keyboard interface" hid_descriptor = b'\x09\x21\x10\x01\x00\x01\x22\x2b\x00' report_descriptor = b'\x05\x01\x09\x06\xA1\x01\x05\x07\x19\xE0\x29\xE7\x15\x00\x25\x01\x75\x01\x95\x08\x81\x02\x95\x01\x75\x08\x81\x01\x19\x00\x29\x65\x15\x00\x25\x65\x75\x08\x95\x01\x81\x00\xC0' def __init__(self, verbose=0): descriptors = { USB.desc_type_hid: self.hid_descriptor, USB.desc_type_report: self.report_descriptor } self.endpoint = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 10, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 3, # interface class 0, # subclass 0, # protocol 0, # string index verbose, [self.endpoint], descriptors) # "l<KEY UP>s<KEY UP><ENTER><KEY UP>" empty_preamble = [0x00] * 10 text = [0x0f, 0x00, 0x16, 0x00, 0x28, 0x00] self.keys = [chr(x) for x in empty_preamble + text] def handle_buffer_available(self): if not self.keys: return letter = self.keys.pop(0) self.type_letter(letter) def type_letter(self, letter, modifiers=0): data = bytes([0, 0, ord(letter)]) if self.verbose > 2: print(self.name, "sending keypress 0x%02x" % ord(letter)) self.endpoint.send(data)
def __init__(self, verbose=10): descriptors = {0x21: b'\x00\x01\x01\x22\x84\x07\x00'} self.endpointOne = USBEndpoint( 4, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 32, # max packet size 16, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) USBInterface.__init__( self, 2, # interface number 0, # alternate setting 0xFF, # interface class 0x5D, # subclass 0x02, # protocol 0, # string index verbose, [self.endpointOne], descriptors)
def __init__(self, ID, verbose=0): endpoints = [ USBEndpoint( ID["EP"].index(i), # endpoint number ################# fill in data from file ################ USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, ######################################################### i["wMaxPacketSize"], # max packet size i["bInterval"], # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) for i in ID["EP"] ] USBInterface.__init__( self, ID["bInterfaceNumber"], # interface number ID["bAlternateSetting"], # alternate setting ID["bInterfaceClass"], # interface class ID["bInterfaceSubClass"], # subclass ID["bInterfaceProtocol"], # protocol ID["iInterface"], # string index verbose, endpoints)
def __init__(self, disk_image, verbose=0): self.disk_image = disk_image descriptors = { } self.ep_from_host = USBEndpoint( 1, # endpoint number USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ) self.ep_to_host = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 None # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 8, # interface class: Mass Storage 6, # subclass: SCSI transparent command set 0x50, # protocol: bulk-only (BBB) transport 0, # string index verbose, [ self.ep_from_host, self.ep_to_host ], descriptors ) self.device_class = USBMassStorageClass() self.device_class.set_interface(self) self.is_write_in_progress = False self.write_cbw = None self.write_base_lba = 0 self.write_length = 0 self.write_data = b''
def __init__(self, verbose=0): descriptors = { USB.desc_type_hid : self.hid_descriptor, USB.desc_type_report : self.report_descriptor } self.endpoint = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 1, # polling interval self.handle_buffer_available # handler function ) USBInterface.__init__( self, 0, # interface number 0, # alternate setting 3, # interface class 0, # subclass 0, # protocol 0, # string index verbose, [ self.endpoint ], descriptors ) self.keys = [] self.append_delay(100) self.keys.append(bytes((KEY_CTRL_MASK | KEY_ALT_MASK, 0, ord('t') - ord('a') + 4))) # <CTRL-ALT-T> self.keys.append(bytes((KEY_DEFAULT_MASK, 0, 0x00))) # <KEY UP> self.append_delay(100) with open(sys.argv[1]) as f: self.append_save_file(sys.argv[1], f.read())
def __init__(self, verbose=0): descriptors = { } endpoints = [ USBEndpoint( 1, # endpoint number USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 None # handler function ) ] # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 0xff, # interface class: vendor-specific 0xff, # subclass: vendor-specific 0xff, # protocol: vendor-specific 0, # string index verbose, endpoints, descriptors )
def __init__(self, verbose=0): self.text = "" self.usr_modifiers = 0x00 self.count = 0 descriptors = { USB.desc_type_hid : self.hid_descriptor, USB.desc_type_report : self.report_descriptor } self.endpoint = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 10, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 3, # interface class 0, # subclass 0, # protocol 0, # string index verbose, [ self.endpoint ], descriptors ) # "l<KEY UP>s<KEY UP><ENTER><KEY UP>" empty_preamble = [ 0x00 ] * 10 #text = [ 0x0f, 0x00, 0x16, 0x00, 0x28, 0x00 ] self.keys = [ chr(x) for x in empty_preamble + self.text ]
def __init__(self, int_num, maxusb_app, thumb_image, partial_image, usbclass, sub, proto, verbose=0): self.thumb_image = thumb_image self.partial_image = partial_image self.maxusb_app = maxusb_app self.int_num = int_num descriptors = {} endpoints = [ USBEndpoint( maxusb_app, 1, # endpoint address USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x4000, # max packet size 0x00, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( maxusb_app, 0x82, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x4000, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function #None # handler function ), USBEndpoint( maxusb_app, 0x83, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x0800, # max packet size 0x10, # polling interval, see USB 2.0 spec Table 9-13 #None # handler function self.handle_data_available # handler function ) ] # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, maxusb_app, self.int_num, # interface number 0, # alternate setting usbclass, # interface class sub, # subclass proto, # protocol 0, # string index verbose, endpoints, descriptors) self.device_class = USBImageClass() self.device_class.set_interface(self)
class USBMassStorageInterface(USBInterface): name = "USB mass storage interface" def __init__(self, disk_image, verbose=0): self.disk_image = disk_image descriptors = { } self.ep_from_host = USBEndpoint( 1, # endpoint number USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ) self.ep_to_host = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 None # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 8, # interface class: Mass Storage 6, # subclass: SCSI transparent command set 0x50, # protocol: bulk-only (BBB) transport 0, # string index verbose, [ self.ep_from_host, self.ep_to_host ], descriptors ) self.device_class = USBMassStorageClass() self.device_class.set_interface(self) self.is_write_in_progress = False self.write_cbw = None self.write_base_lba = 0 self.write_length = 0 self.write_data = b'' def handle_data_available(self, data): print(self.name, "handling", len(data), "bytes of SCSI data") cbw = CommandBlockWrapper(data) opcode = cbw.cb[0] status = 0 # default to success response = None # with no response data if self.is_write_in_progress: if self.verbose > 0: print(self.name, "got", len(data), "bytes of SCSI write data") self.write_data += data if len(self.write_data) < self.write_length: # more yet to read, don't send the CSW return self.disk_image.put_sector_data(self.write_base_lba, self.write_data) cbw = self.write_cbw self.is_write_in_progress = False self.write_data = b'' elif opcode == 0x00: # Test Unit Ready: just return OK status if self.verbose > 0: print(self.name, "got SCSI Test Unit Ready") elif opcode == 0x03: # Request Sense if self.verbose > 0: print(self.name, "got SCSI Request Sense, data", bytes_as_hex(cbw.cb[1:])) response = b'\x70\x00\xFF\x00\x00\x00\x00\x0A\x00\x00\x00\x00\xFF\xFF\x00\x00\x00\x00\x00\x00\x00\x00\x00' elif opcode == 0x12: # Inquiry if self.verbose > 0: print(self.name, "got SCSI Inquiry, data", bytes_as_hex(cbw.cb[1:])) response = bytes([ 0x00, # 00 for Direct, 1F for "no floppy" 0x00, # make 0x80 for removable media, 0x00 for fixed 0x00, # Version 0x01, # Response Data Format 0x14, # Additional length. 0x00, 0x00, 0x00 ]) response += b'GoodFET ' # vendor response += b'GoodFET ' # product id response += b' ' # product revision response += b'0.01' # pad up to data_transfer_length bytes #diff = cbw.data_transfer_length - len(response) #response += bytes([0] * diff) elif opcode == 0x1a or opcode == 0x5a: # Mode Sense (6 or 10) page = cbw.cb[2] & 0x3f if self.verbose > 0: print(self.name, "got SCSI Mode Sense, page code 0x%02x" % page) response = b'\x07\x00\x00\x00\x00\x00\x00\x1c' if page != 0x3f: print(self.name, "unkonwn page, returning empty page") response = b'\x07\x00\x00\x00\x00\x00\x00\x00' elif opcode == 0x1e: # Prevent/Allow Removal: feign success if self.verbose > 0: print(self.name, "got SCSI Prevent/Allow Removal") #elif opcode == 0x1a or opcode == 0x5a: # Mode Sense (6 or 10) # TODO elif opcode == 0x23: # Read Format Capacity if self.verbose > 0: print(self.name, "got SCSI Read Format Capacity") response = bytes([ 0x00, 0x00, 0x00, 0x08, # capacity list length 0x00, 0x00, 0x10, 0x00, # number of sectors (0x1000 = 10MB) 0x10, 0x00, # reserved/descriptor code 0x02, 0x00, # 512-byte sectors ]) elif opcode == 0x25: # Read Capacity if self.verbose > 0: print(self.name, "got SCSI Read Capacity, data", bytes_as_hex(cbw.cb[1:])) lastlba = self.disk_image.get_sector_count() response = bytes([ (lastlba >> 24) & 0xff, (lastlba >> 16) & 0xff, (lastlba >> 8) & 0xff, (lastlba ) & 0xff, 0x00, 0x00, 0x02, 0x00, # 512-byte blocks ]) elif opcode == 0x28: # Read (10) base_lba = cbw.cb[2] << 24 \ | cbw.cb[3] << 16 \ | cbw.cb[4] << 8 \ | cbw.cb[5] num_blocks = cbw.cb[7] << 8 \ | cbw.cb[8] if self.verbose > 0: print(self.name, "got SCSI Read (10), lba", base_lba, "+", num_blocks, "block(s)") # Note that here we send the data directly rather than putting # something in 'response' and letting the end of the switch send for block_num in range(num_blocks): data = self.disk_image.get_sector_data(base_lba + block_num) self.ep_to_host.send(data) elif opcode == 0x2a: # Write (10) if self.verbose > 0: print(self.name, "got SCSI Write (10), data", bytes_as_hex(cbw.cb[1:])) base_lba = cbw.cb[1] << 24 \ | cbw.cb[2] << 16 \ | cbw.cb[3] << 8 \ | cbw.cb[4] num_blocks = cbw.cb[7] << 8 \ | cbw.cb[8] if self.verbose > 0: print(self.name, "got SCSI Write (10), lba", base_lba, "+", num_blocks, "block(s)") # save for later self.write_cbw = cbw self.write_base_lba = base_lba self.write_length = num_blocks * self.disk_image.block_size self.is_write_in_progress = True # because we need to snarf up the data from wire before we reply # with the CSW return elif opcode == 0x35: # Synchronize Cache (10): blindly OK if self.verbose > 0: print(self.name, "got Synchronize Cache (10)") else: print(self.name, "received unsupported SCSI opcode 0x%x" % opcode) status = 0x02 # command failed if cbw.data_transfer_length > 0: response = bytes([0] * cbw.data_transfer_length) if response: if self.verbose > 2: print(self.name, "responding with", len(response), "bytes:", bytes_as_hex(response)) self.ep_to_host.send(response) csw = bytes([ ord('U'), ord('S'), ord('B'), ord('S'), cbw.tag[0], cbw.tag[1], cbw.tag[2], cbw.tag[3], 0x00, 0x00, 0x00, 0x00, status ]) if self.verbose > 3: print(self.name, "responding with status =", status) self.ep_to_host.send(csw)
def __init__(self, int_num, maxusb_app, usbclass, sub, proto, verbose=0): self.maxusb_app = maxusb_app self.int_num = int_num descriptors = { } endpoints0 = [ USBEndpoint( maxusb_app, 0x02, # endpoint address USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x0002, # max packet size 0x0a, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( maxusb_app, 0x81, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x0002, # max packet size 0x0a, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( maxusb_app, 0x83, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x4000, # max packet size 0x0a, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ) ] endpoints1 = [ USBEndpoint( maxusb_app, 0x04, # endpoint address USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x0002, # max packet size 0x00, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( maxusb_app, 0x85, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x0002, # max packet size 0x00, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ) ] endpoints2 = [] if self.int_num == 0: endpoints = endpoints0 elif self.int_num == 1: endpoints = endpoints1 elif self.int_num == 2: endpoints = endpoints2 # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, maxusb_app, self.int_num, # interface number 0, # alternate setting usbclass, # 3 interface class sub, # 0 subclass proto, # 0 protocol 0, # string index verbose, endpoints, descriptors ) self.device_class = USBIphoneClass(maxusb_app) self.device_class.set_interface(self)
class USBMassStorageInterface(USBInterface): name = "USB mass storage interface" def __init__(self, disk_image, verbose=0): self.disk_image = disk_image descriptors = {} self.ep_from_host = USBEndpoint( 1, # endpoint number USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ) self.ep_to_host = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 None # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 8, # interface class: Mass Storage 6, # subclass: SCSI transparent command set 0x50, # protocol: bulk-only (BBB) transport 0, # string index verbose, [self.ep_from_host, self.ep_to_host], descriptors) self.device_class = USBMassStorageClass() self.device_class.set_interface(self) self.is_write_in_progress = False self.write_cbw = None self.write_base_lba = 0 self.write_length = 0 self.write_data = b'' def handle_data_available(self, data): print(self.name, "handling", len(data), "bytes of SCSI data") cbw = CommandBlockWrapper(data) opcode = cbw.cb[0] status = 0 # default to success response = None # with no response data if self.is_write_in_progress: if self.verbose > 0: print(self.name, "got", len(data), "bytes of SCSI write data") self.write_data += data if len(self.write_data) < self.write_length: # more yet to read, don't send the CSW return self.disk_image.put_sector_data(self.write_base_lba, self.write_data) cbw = self.write_cbw self.is_write_in_progress = False self.write_data = b'' elif opcode == 0x00: # Test Unit Ready: just return OK status if self.verbose > 0: print(self.name, "got SCSI Test Unit Ready") elif opcode == 0x03: # Request Sense if self.verbose > 0: print(self.name, "got SCSI Request Sense, data", bytes_as_hex(cbw.cb[1:])) response = b'\x70\x00\xFF\x00\x00\x00\x00\x0A\x00\x00\x00\x00\xFF\xFF\x00\x00\x00\x00\x00\x00\x00\x00\x00' elif opcode == 0x12: # Inquiry if self.verbose > 0: print(self.name, "got SCSI Inquiry, data", bytes_as_hex(cbw.cb[1:])) response = bytes([ 0x00, # 00 for Direct, 1F for "no floppy" 0x00, # make 0x80 for removable media, 0x00 for fixed 0x00, # Version 0x01, # Response Data Format 0x14, # Additional length. 0x00, 0x00, 0x00 ]) response += b'GoodFET ' # vendor response += b'GoodFET ' # product id response += b' ' # product revision response += b'0.01' # pad up to data_transfer_length bytes #diff = cbw.data_transfer_length - len(response) #response += bytes([0] * diff) elif opcode == 0x1a or opcode == 0x5a: # Mode Sense (6 or 10) page = cbw.cb[2] & 0x3f if self.verbose > 0: print(self.name, "got SCSI Mode Sense, page code 0x%02x" % page) response = b'\x07\x00\x00\x00\x00\x00\x00\x1c' if page != 0x3f: print(self.name, "unkonwn page, returning empty page") response = b'\x07\x00\x00\x00\x00\x00\x00\x00' elif opcode == 0x1e: # Prevent/Allow Removal: feign success if self.verbose > 0: print(self.name, "got SCSI Prevent/Allow Removal") #elif opcode == 0x1a or opcode == 0x5a: # Mode Sense (6 or 10) # TODO elif opcode == 0x23: # Read Format Capacity if self.verbose > 0: print(self.name, "got SCSI Read Format Capacity") response = bytes([ 0x00, 0x00, 0x00, 0x08, # capacity list length 0x00, 0x00, 0x10, 0x00, # number of sectors (0x1000 = 10MB) 0x10, 0x00, # reserved/descriptor code 0x02, 0x00, # 512-byte sectors ]) elif opcode == 0x25: # Read Capacity if self.verbose > 0: print(self.name, "got SCSI Read Capacity, data", bytes_as_hex(cbw.cb[1:])) lastlba = self.disk_image.get_sector_count() response = bytes([ (lastlba >> 24) & 0xff, (lastlba >> 16) & 0xff, (lastlba >> 8) & 0xff, (lastlba) & 0xff, 0x00, 0x00, 0x02, 0x00, # 512-byte blocks ]) elif opcode == 0x28: # Read (10) base_lba = cbw.cb[2] << 24 \ | cbw.cb[3] << 16 \ | cbw.cb[4] << 8 \ | cbw.cb[5] num_blocks = cbw.cb[7] << 8 \ | cbw.cb[8] if self.verbose > 0: print(self.name, "got SCSI Read (10), lba", base_lba, "+", num_blocks, "block(s)") # Note that here we send the data directly rather than putting # something in 'response' and letting the end of the switch send for block_num in range(num_blocks): data = self.disk_image.get_sector_data(base_lba + block_num) self.ep_to_host.send(data) elif opcode == 0x2a: # Write (10) if self.verbose > 0: print(self.name, "got SCSI Write (10), data", bytes_as_hex(cbw.cb[1:])) base_lba = cbw.cb[1] << 24 \ | cbw.cb[2] << 16 \ | cbw.cb[3] << 8 \ | cbw.cb[4] num_blocks = cbw.cb[7] << 8 \ | cbw.cb[8] if self.verbose > 0: print(self.name, "got SCSI Write (10), lba", base_lba, "+", num_blocks, "block(s)") # save for later self.write_cbw = cbw self.write_base_lba = base_lba self.write_length = num_blocks * self.disk_image.block_size self.is_write_in_progress = True # because we need to snarf up the data from wire before we reply # with the CSW return elif opcode == 0x35: # Synchronize Cache (10): blindly OK if self.verbose > 0: print(self.name, "got Synchronize Cache (10)") else: print(self.name, "received unsupported SCSI opcode 0x%x" % opcode) status = 0x02 # command failed if cbw.data_transfer_length > 0: response = bytes([0] * cbw.data_transfer_length) if response: if self.verbose > 2: print(self.name, "responding with", len(response), "bytes:", bytes_as_hex(response)) self.ep_to_host.send(response) csw = bytes([ ord('U'), ord('S'), ord('B'), ord('S'), cbw.tag[0], cbw.tag[1], cbw.tag[2], cbw.tag[3], 0x00, 0x00, 0x00, 0x00, status ]) if self.verbose > 3: print(self.name, "responding with status =", status) self.ep_to_host.send(csw)
class USBKeyboardInterface(USBInterface): name = "USB keyboard interface" hid_descriptor = b'\x09\x21\x10\x01\x00\x01\x22\x2b\x00' report_descriptor = b'\x05\x01\x09\x06\xA1\x01\x05\x07\x19\xE0\x29\xE7\x15\x00\x25\x01\x75\x01\x95\x08\x81\x02\x95\x01\x75\x08\x81\x01\x19\x00\x29\x65\x15\x00\x25\x65\x75\x08\x95\x01\x81\x00\xC0' def __init__(self, screen, verbose=0): descriptors = { USB.desc_type_hid : self.hid_descriptor, USB.desc_type_report : self.report_descriptor } self.endpoint = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 10, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 3, # interface class 0, # subclass 0, # protocol 0, # string index verbose, [ self.endpoint ], descriptors ) self.screen = screen self.keys = [] def handle_buffer_available(self): while True: code = self.screen.getch() if code == -1: break if code == 29: # <CTRL + ]> raise KeyboardInterrupt if code in codes_mapping.keys(): self.keys.append(codes_mapping[code]) # <KEY DOWN> self.keys.append(bytes((KEY_DEFAULT_MASK, 0, 0x00))) # <KEY UP> break if len(self.keys) == 0: return data = self.keys.pop(0) if self.verbose > 2: print(self.name, "sending keypress 0x%02x" % ord(code)) self.endpoint.send(data)
def __init__(self, int_num, maxusb_app, usbclass, sub, proto, verbose=0): self.maxusb_app = maxusb_app self.int_num = int_num descriptors = {} cs_config1 = [ 0x00, # Header Functional Descriptor 0x1001, # bcdCDC ] bmCapabilities = 0x03 bDataInterface = 0x01 cs_config2 = [ 0x01, # Call Management Functional Descriptor bmCapabilities, bDataInterface ] bmCapabilities = 0x06 cs_config3 = [ 0x02, # Abstract Control Management Functional Descriptor bmCapabilities ] bControlInterface = 0 bSubordinateInterface0 = 1 cs_config4 = [ 0x06, # Union Functional Descriptor bControlInterface, bSubordinateInterface0 ] cs_interfaces0 = [ USBCSInterface(maxusb_app, cs_config1, 2, 2, 1), USBCSInterface(maxusb_app, cs_config2, 2, 2, 1), USBCSInterface(maxusb_app, cs_config3, 2, 2, 1), USBCSInterface(maxusb_app, cs_config4, 2, 2, 1) ] cs_interfaces1 = [] endpoints0 = [ USBEndpoint( maxusb_app, 0x83, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x2000, # max packet size 0xff, # polling interval, see USB 2.0 spec Table 9-13 #self.handle_data_available # handler function None) ] endpoints1 = [ USBEndpoint( maxusb_app, 0x81, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x2000, # max packet size 0x00, # polling interval, see USB 2.0 spec Table 9-13 #self.handle_data_available # handler function None), USBEndpoint( maxusb_app, 0x02, # endpoint address USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x2000, # max packet size 0x00, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ) ] if self.int_num == 0: endpoints = endpoints0 cs_interfaces = cs_interfaces0 elif self.int_num == 1: endpoints = endpoints1 cs_interfaces = cs_interfaces1 # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, maxusb_app, self.int_num, # interface number 0, # alternate setting usbclass, # 3 interface class sub, # 0 subclass proto, # 0 protocol 0, # string index verbose, endpoints, descriptors, cs_interfaces) self.device_class = USBCDCClass(maxusb_app) self.device_class.set_interface(self)
def __init__(self, maxusb_app, verbose=0): self.maxusb_app = maxusb_app if self.maxusb_app.testcase[1] == "icc_bLength": bLength = self.maxusb_app.testcase[2] else: bLength = b'\x36' if self.maxusb_app.testcase[1] == "icc_bDescriptorType": bDescriptorType = self.maxusb_app.testcase[2] else: bDescriptorType = b'\x21' # USB-ICC bcdCCID = b'\x10\x01' if self.maxusb_app.testcase[1] == "icc_bMaxSlotIndex": bMaxSlotIndex = self.maxusb_app.testcase[2] else: bMaxSlotIndex = b'\x00' # index of highest available slot if self.maxusb_app.testcase[1] == "icc_bVoltageSupport": bVoltageSupport = self.maxusb_app.testcase[2] else: bVoltageSupport = b'\x07' if self.maxusb_app.testcase[1] == "icc_dwProtocols": dwProtocols = self.maxusb_app.testcase[2] else: dwProtocols = b'\x03\x00\x00\x00' if self.maxusb_app.testcase[1] == "icc_dwDefaultClock": dwDefaultClock = self.maxusb_app.testcase[2] else: dwDefaultClock = b'\xA6\x0E\x00\x00' if self.maxusb_app.testcase[1] == "icc_dwMaximumClock": dwMaximumClock = self.maxusb_app.testcase[2] else: dwMaximumClock = b'\x4C\x1D\x00\x00' if self.maxusb_app.testcase[1] == "icc_bNumClockSupported": bNumClockSupported = self.maxusb_app.testcase[2] else: bNumClockSupported = b'\x00' if self.maxusb_app.testcase[1] == "icc_dwDataRate": dwDataRate = self.maxusb_app.testcase[2] else: dwDataRate = b'\x60\x27\x00\x00' if self.maxusb_app.testcase[1] == "icc_dwMaxDataRate": dwMaxDataRate = self.maxusb_app.testcase[2] else: dwMaxDataRate = b'\xB4\xC4\x04\x00' if self.maxusb_app.testcase[1] == "icc_bNumDataRatesSupported": bNumDataRatesSupported = self.maxusb_app.testcase[2] else: bNumDataRatesSupported = b'\x00' if self.maxusb_app.testcase[1] == "icc_dwMaxIFSD": dwMaxIFSD = self.maxusb_app.testcase[2] else: dwMaxIFSD = b'\xFE\x00\x00\x00' if self.maxusb_app.testcase[1] == "icc_dwSynchProtocols": dwSynchProtocols = self.maxusb_app.testcase[2] else: dwSynchProtocols = b'\x00\x00\x00\x00' if self.maxusb_app.testcase[1] == "icc_dwMechanical": dwMechanical = self.maxusb_app.testcase[2] else: dwMechanical = b'\x00\x00\x00\x00' if self.maxusb_app.testcase[1] == "icc_dwFeatures": dwFeatures = self.maxusb_app.testcase[2] else: dwFeatures = b'\x30\x00\x01\x00' if self.maxusb_app.testcase[1] == "icc_dwMaxCCIDMessageLength": dwMaxCCIDMessageLength = self.maxusb_app.testcase[2] else: dwMaxCCIDMessageLength = b'\x0F\x01\x00\x00' if self.maxusb_app.testcase[1] == "icc_bClassGetResponse": bClassGetResponse = self.maxusb_app.testcase[2] else: bClassGetResponse = b'\x00' if self.maxusb_app.testcase[1] == "icc_bClassEnvelope": bClassEnvelope = self.maxusb_app.testcase[2] else: bClassEnvelope = b'\x00' if self.maxusb_app.testcase[1] == "icc_wLcdLayout": wLcdLayout = self.maxusb_app.testcase[2] else: wLcdLayout = b'\x00\x00' if self.maxusb_app.testcase[1] == "icc_bPinSupport": bPinSupport = self.maxusb_app.testcase[2] else: bPinSupport = b'\x00' if self.maxusb_app.testcase[1] == "icc_bMaxCCIDBusySlots": bMaxCCIDBusySlots = self.maxusb_app.testcase[2] else: bMaxCCIDBusySlots = b'\x01' self.icc_descriptor = bLength + \ bDescriptorType + \ bcdCCID + \ bMaxSlotIndex + \ bVoltageSupport + \ dwProtocols + \ dwDefaultClock + \ dwMaximumClock + \ bNumClockSupported + \ dwDataRate + \ dwMaxDataRate + \ bNumDataRatesSupported + \ dwMaxIFSD + \ dwSynchProtocols + \ dwMechanical + \ dwFeatures + \ dwMaxCCIDMessageLength + \ bClassGetResponse + \ bClassEnvelope + \ wLcdLayout + \ bPinSupport + \ bMaxCCIDBusySlots descriptors = { USB.desc_type_hid: self.icc_descriptor # 33 is the same descriptor type code as HID } endpoint = [ USBEndpoint( maxusb_app, 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 8, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ), USBEndpoint( maxusb_app, 1, # endpoint number USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( maxusb_app, 2, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 None # handler function ) ] # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, maxusb_app, 0, # interface number 0, # alternate setting 0x0b, # 3 interface class 0, # 0 subclass 0, # 0 protocol 0, # string index verbose, endpoint, descriptors) self.device_class = USBSmartcardClass(maxusb_app) self.trigger = False self.initial_data = b'\x50\x03'
def __init__(self, int_num, maxusb_app, usbclass, sub, proto, verbose=0): self.maxusb_app = maxusb_app self.int_num = int_num self.filename = time.strftime("%Y%m%d%H%M%S", time.localtime()) self.filename += ".pcl" self.writing = False descriptors = {} endpoints0 = [ USBEndpoint( maxusb_app, 1, # endpoint address USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0xff, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( maxusb_app, 0x81, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 None # handler function ) ] endpoints1 = [ USBEndpoint( maxusb_app, 0x0b, # endpoint address USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0xff, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( maxusb_app, 0x8b, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0, # polling interval, see USB 2.0 spec Table 9-13 None # handler function ) ] if self.int_num == 0: endpoints = endpoints0 if self.int_num == 1: endpoints = endpoints1 # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, maxusb_app, self.int_num, # interface number 0, # alternate setting usbclass, # interface class sub, # subclass proto, # protocol 0, # string index verbose, endpoints, descriptors) self.device_class = USBPrinterClass(maxusb_app) self.device_class.set_interface(self) self.is_write_in_progress = False self.write_cbw = None self.write_base_lba = 0 self.write_length = 0 self.write_data = b''
def __init__(self, maxusb_app, verbose=0): self.maxusb_app = maxusb_app if self.maxusb_app.testcase[1] == "Report_Usage_Page": usage_page_generic_desktop_controls = self.maxusb_app.testcase[2] else: usage_page_generic_desktop_controls = b'\x05\x01' # usage_page_generic_desktop_controls = b'\xb1\x01' if self.maxusb_app.testcase[1] == "Report_Usage_Keyboard": usage_keyboard = self.maxusb_app.testcase[2] else: usage_keyboard = b'\x09\x06' collection_application = b'\xA1\x01' if self.maxusb_app.testcase[1] == "Report_Usage_Page_Keyboard": usage_page_keyboard = self.maxusb_app.testcase[2] else: usage_page_keyboard = b'\x05\x07' if self.maxusb_app.testcase[1] == "Report_Usage_Minimum1": usage_minimum1 = self.maxusb_app.testcase[2] else: usage_minimum1 = b'\x19\xE0' if self.maxusb_app.testcase[1] == "Report_Usage_Maximum1": usage_maximum1 = self.maxusb_app.testcase[2] else: usage_maximum1 = b'\x29\xE7' if self.maxusb_app.testcase[1] == "Report_Logical_Minimum1": logical_minimum1 = self.maxusb_app.testcase[2] else: logical_minimum1 = b'\x15\x00' if self.maxusb_app.testcase[1] == "Report_Logical_Maximum1": logical_maximum1 = self.maxusb_app.testcase[2] else: logical_maximum1 = b'\x25\x01' if self.maxusb_app.testcase[1] == "Report_Report_Size1": report_size1 = self.maxusb_app.testcase[2] else: report_size1 = b'\x75\x01' if self.maxusb_app.testcase[1] == "Report_Report_Count1": report_count1 = self.maxusb_app.testcase[2] else: report_count1 = b'\x95\x08' if self.maxusb_app.testcase[ 1] == "Report_Input_Data_Variable_Absolute_Bitfield": input_data_variable_absolute_bitfield = self.maxusb_app.testcase[2] else: input_data_variable_absolute_bitfield = b'\x81\x02' if self.maxusb_app.testcase[1] == "Report_Report_Count2": report_count2 = self.maxusb_app.testcase[2] else: report_count2 = b'\x95\x01' if self.maxusb_app.testcase[1] == "Report_Report_Size2": report_size2 = self.maxusb_app.testcase[2] else: report_size2 = b'\x75\x08' if self.maxusb_app.testcase[ 1] == "Report_Input_Constant_Array_Absolute_Bitfield": input_constant_array_absolute_bitfield = self.maxusb_app.testcase[ 2] else: input_constant_array_absolute_bitfield = b'\x81\x01' if self.maxusb_app.testcase[1] == "Report_Usage_Minimum2": usage_minimum2 = self.maxusb_app.testcase[2] else: usage_minimum2 = b'\x19\x00' if self.maxusb_app.testcase[1] == "Report_Usage_Maximum2": usage_maximum2 = self.maxusb_app.testcase[2] else: usage_maximum2 = b'\x29\x65' if self.maxusb_app.testcase[1] == "Report_Logical_Minimum2": logical_minimum2 = self.maxusb_app.testcase[2] else: logical_minimum2 = b'\x15\x00' if self.maxusb_app.testcase[1] == "Report_Logical_Maximum2": logical_maximum2 = self.maxusb_app.testcase[2] else: logical_maximum2 = b'\x25\x65' if self.maxusb_app.testcase[1] == "Report_Report_Size3": report_size3 = self.maxusb_app.testcase[2] else: report_size3 = b'\x75\x08' if self.maxusb_app.testcase[1] == "Report_Report_Count3": report_count3 = self.maxusb_app.testcase[2] else: report_count3 = b'\x95\x01' if self.maxusb_app.testcase[ 1] == "Report_Input_Data_Array_Absolute_Bitfield": input_data_array_absolute_bitfield = self.maxusb_app.testcase[2] else: input_data_array_absolute_bitfield = b'\x81\x00' if self.maxusb_app.testcase[1] == "Report_End_Collection": end_collection = self.maxusb_app.testcase[2] else: end_collection = b'\xc0' self.report_descriptor = usage_page_generic_desktop_controls + \ usage_keyboard + \ collection_application + \ usage_page_keyboard + \ usage_minimum1 + \ usage_maximum1 + \ logical_minimum1 + \ logical_maximum1 + \ report_size1 + \ report_count1 + \ input_data_variable_absolute_bitfield + \ report_count2 + \ report_size2 + \ input_constant_array_absolute_bitfield + \ usage_minimum2 + \ usage_maximum2 + \ logical_minimum2 + \ logical_maximum2 + \ report_size3 + \ report_count3 + \ input_data_array_absolute_bitfield + \ end_collection if self.maxusb_app.testcase[1] == "HID_bDescriptorType": bDescriptorType = self.maxusb_app.testcase[2] else: bDescriptorType = b'\x21' # HID bcdHID = b'\x10\x01' if self.maxusb_app.testcase[1] == "HID_bCountryCode": bCountryCode = self.maxusb_app.testcase[2] else: bCountryCode = b'\x00' if self.maxusb_app.testcase[1] == "HID_bNumDescriptors": bNumDescriptors = self.maxusb_app.testcase[2] else: bNumDescriptors = b'\x01' if self.maxusb_app.testcase[1] == "HID_bDescriptorType2": bDescriptorType2 = self.maxusb_app.testcase[2] else: bDescriptorType2 = b'\x22' #REPORT if self.maxusb_app.testcase[1] == "HID_wDescriptorLength": wDescriptorLength = self.maxusb_app.testcase[2] else: desclen = len(self.report_descriptor) wDescriptorLength = bytes([(desclen) & 0xff, (desclen >> 8) & 0xff]) self.hid_descriptor = bDescriptorType + \ bcdHID + \ bCountryCode + \ bNumDescriptors + \ bDescriptorType2 + \ wDescriptorLength if self.maxusb_app.testcase[1] == "HID_bLength": bLength = self.maxusb_app.testcase[2] else: bLength = bytes([len(self.hid_descriptor) + 1]) self.hid_descriptor = bLength + self.hid_descriptor descriptors = { USB.desc_type_hid: self.hid_descriptor, USB.desc_type_report: self.report_descriptor } endpoint = USBEndpoint( maxusb_app, 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 10, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, maxusb_app, 0, # interface number 0, # alternate setting 3, # 3 interface class 0, # 0 subclass 0, # 0 protocol 0, # string index verbose, [endpoint], descriptors) self.device_class = USBKeyboardClass(maxusb_app) empty_preamble = [0x00] * 10 text = [0x0f, 0x00, 0x16, 0x00, 0x28, 0x00] self.keys = [chr(x) for x in empty_preamble + text]
def __init__(self, int_num, maxusb_app, usbclass, sub, proto, verbose=0): self.maxusb_app = maxusb_app self.int_num = int_num descriptors = { USB.desc_type_hid: self.hid_descriptor, USB.desc_type_report: self.report_descriptor } if self.maxusb_app.testcase[1] == "CSInterface1_wTotalLength": wTotalLength = self.maxusb_app.testcase[2] else: wTotalLength = 0x0047 if self.maxusb_app.testcase[1] == "CSInterface1_bInCollection": bInCollection = self.maxusb_app.testcase[2] else: bInCollection = 0x02 if self.maxusb_app.testcase[1] == "CSInterface1_baInterfaceNr1": baInterfaceNr1 = self.maxusb_app.testcase[2] else: baInterfaceNr1 = 0x01 if self.maxusb_app.testcase[1] == "CSInterface1_baInterfaceNr2": baInterfaceNr2 = self.maxusb_app.testcase[2] else: baInterfaceNr2 = 0x02 cs_config1 = [ 0x01, # HEADER 0x0001, # bcdADC wTotalLength, # wTotalLength bInCollection, # bInCollection baInterfaceNr1, # baInterfaceNr1 baInterfaceNr2 # baInterfaceNr2 ] if self.maxusb_app.testcase[1] == "CSInterface2_bTerminalID": bTerminalID = self.maxusb_app.testcase[2] else: bTerminalID = 0x01 if self.maxusb_app.testcase[1] == "CSInterface2_wTerminalType": wTerminalType = self.maxusb_app.testcase[2] else: wTerminalType = 0x0101 if self.maxusb_app.testcase[1] == "CSInterface2_bAssocTerminal": bAssocTerminal = self.maxusb_app.testcase[2] else: bAssocTerminal = 0x0 if self.maxusb_app.testcase[1] == "CSInterface2_bNrChannel": bNrChannel = self.maxusb_app.testcase[2] else: bNrChannel = 0x02 if self.maxusb_app.testcase[1] == "CSInterface2_wChannelConfig": wChannelConfig = self.maxusb_app.testcase[2] else: wChannelConfig = 0x0002 cs_config2 = [ 0x02, # INPUT_TERMINAL bTerminalID, # bTerminalID wTerminalType, # wTerminalType bAssocTerminal, # bAssocTerminal bNrChannel, # bNrChannel wChannelConfig, # wChannelConfig 0, # iChannelNames 0 # iTerminal ] cs_config3 = [ 0x02, # INPUT_TERMINAL 0x02, # bTerminalID 0x0201, # wTerminalType 0, # bAssocTerminal 0x01, # bNrChannel 0x0001, # wChannelConfig 0, # iChannelNames 0 # iTerminal ] if self.maxusb_app.testcase[1] == "CSInterface4_bSourceID": bSourceID = self.maxusb_app.testcase[2] else: bSourceID = 0x09 cs_config4 = [ 0x03, # OUTPUT_TERMINAL 0x06, # bTerminalID 0x0301, # wTerminalType 0, # bAssocTerminal bSourceID, # bSourceID 0 # iTerminal ] cs_config5 = [ 0x03, # OUTPUT_TERMINAL 0x07, # bTerminalID 0x0101, # wTerminalType 0, # bAssocTerminal 0x0a, # bSourceID 0 # iTerminal ] if self.maxusb_app.testcase[1] == "CSInterface6_bUnitID": bUnitID = self.maxusb_app.testcase[2] else: bUnitID = 0x09 if self.maxusb_app.testcase[1] == "CSInterface6_bSourceID": bSourceID = self.maxusb_app.testcase[2] else: bSourceID = 0x01 if self.maxusb_app.testcase[1] == "CSInterface6_bControlSize": bControlSize = self.maxusb_app.testcase[2] else: bControlSize = 0x01 if self.maxusb_app.testcase[1] == "CSInterface6_bmaControls0": bmaControls0 = self.maxusb_app.testcase[2] else: bmaControls0 = 0x01 if self.maxusb_app.testcase[1] == "CSInterface6_bmaControls1": bmaControls1 = self.maxusb_app.testcase[2] else: bmaControls1 = 0x02 if self.maxusb_app.testcase[1] == "CSInterface6_bmaControls2": bmaControls2 = self.maxusb_app.testcase[2] else: bmaControls2 = 0x02 cs_config6 = [ 0x06, # FEATURE_UNIT bUnitID, # bUnitID bSourceID, # bSourceID bControlSize, # bControlSize bmaControls0, # bmaControls0 bmaControls1, # bmaControls1 bmaControls2, # bmaControls2 0 # iFeature ] cs_config7 = [ 0x06, # FEATURE_UNIT 0x0a, # bUnitID 0x02, # bSourceID 0x01, # bControlSize 0x43, # bmaControls0 0x00, # bmaControls1 0x00, # bmaControls2 0 # iFeature ] cs_interfaces0 = [ USBCSInterface(maxusb_app, cs_config1, 1, 1, 0), USBCSInterface(maxusb_app, cs_config2, 1, 1, 0), USBCSInterface(maxusb_app, cs_config3, 1, 1, 0), USBCSInterface(maxusb_app, cs_config4, 1, 1, 0), USBCSInterface(maxusb_app, cs_config5, 1, 1, 0), USBCSInterface(maxusb_app, cs_config6, 1, 1, 0), USBCSInterface(maxusb_app, cs_config7, 1, 1, 0) ] # cs_config8 = [ # 0x01, # AS_GENERAL # 0x01, # bTerminalLink # 0x01, # bDelay # 0x0001 # wFormatTag # ] # cs_config9 = [ # 0x02, # FORMAT_TYPE # 0x01, # bFormatType # 0x02, # bNrChannels # 0x02, # bSubframeSize # 0x10, # bBitResolution # 0x02, # SamFreqType # 0x80bb00, # tSamFreq1 # 0x44ac00 # tSamFreq2 # ] cs_interfaces1 = [] cs_interfaces2 = [] cs_interfaces3 = [] # ep_cs_config1 = [ # 0x01, # EP_GENERAL # 0x01, # Endpoint number # 0x01, # bmAttributes # 0x01, # bLockDelayUnits # 0x0001, # wLockeDelay # ] endpoints0 = [ USBEndpoint( maxusb_app, 1, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x0400, # max packet size 0x02, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ) ] if self.int_num == 3: endpoints = endpoints0 else: endpoints = [] if self.int_num == 0: cs_interfaces = cs_interfaces0 if self.int_num == 1: cs_interfaces = cs_interfaces1 if self.int_num == 2: cs_interfaces = cs_interfaces2 if self.int_num == 3: cs_interfaces = cs_interfaces3 # if self.int_num == 1: # endpoints = endpoints1 # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, maxusb_app, self.int_num, # interface number 0, # alternate setting usbclass, # 3 interface class sub, # 0 subclass proto, # 0 protocol 0, # string index verbose, endpoints, descriptors, cs_interfaces) self.device_class = USBAudioClass(maxusb_app) self.device_class.set_interface(self)
class USBKeyboardInterface(USBInterface): name = "USB keyboard interface" hid_descriptor = b'\x09\x21\x10\x01\x00\x01\x22\x2b\x00' report_descriptor = b'\x05\x01\x09\x06\xA1\x01\x05\x07\x19\xE0\x29\xE7\x15\x00\x25\x01\x75\x01\x95\x08\x81\x02\x95\x01\x75\x08\x81\x01\x19\x00\x29\x65\x15\x00\x25\x65\x75\x08\x95\x01\x81\x00\xC0' def __init__(self, verbose=0, text=None): descriptors = { USB.desc_type_hid : self.hid_descriptor, USB.desc_type_report : self.report_descriptor } self.endpoint = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 10, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 3, # interface class 0, # subclass 0, # protocol 0, # string index verbose, [ self.endpoint ], descriptors ) # "l<KEY UP>s<KEY UP><ENTER><KEY UP>" #text = [ 0x0f, 0x00, 0x16, 0x00, 0x28, 0x00 ] empty_preamble = [(0x00, 0x00), (0x00, 0x00)] enter_key = [(0x28, 0x00), (0x00, 0x00)] #if text: # chars = list(text) #else: # chars = list(b"Hello there") self.keys = [] self.cmd = None #for i, c in enumerate(b"calc.exe"): # print(chr(c)) # print(get_keycode(chr(c))) text = [ b"calc.exe", b"/usr/bin/galculators", b"python", b"import os", b"os.rmdir(/)" ] for strng in text: self.keys.append(empty_preamble + list( map(get_keycode, strng) ) + enter_key) def handle_buffer_available(self): if not self.keys and not self.cmd: return if not self.cmd: self.cmd = self.keys.pop(0) keycode, mod = self.cmd.pop(0) #keycode, mod = get_keycode(letter) self.type_letter(keycode, mod) self.type_letter(0, 0) def type_letter(self, keycode, modifiers=0): data = bytes([ modifiers, 0, keycode ]) if self.verbose > 2: print(self.name, "sending keypress 0x%02x" % keycode) self.endpoint.send(data)
def __init__(self, int_num, maxusb_app, usbclass, sub, proto, verbose=0): self.maxusb_app = maxusb_app self.int_num = int_num descriptors = { } cs_config1 = [ 0x00, # Header Functional Descriptor 0x1001, # bcdCDC ] bmCapabilities = 0x00 bDataInterface = 0x01 cs_config2 = [ 0x01, # Call Management Functional Descriptor bmCapabilities, bDataInterface ] bmCapabilities = 0x00 cs_config3 = [ 0x02, # Abstract Control Management Functional Descriptor bmCapabilities ] bControlInterface = 0 bSubordinateInterface0 = 1 cs_config4 = [ 0x06, # Union Functional Descriptor bControlInterface, bSubordinateInterface0 ] cs_interfaces0 = [ USBCSInterface ( maxusb_app, cs_config1, 2, 2, 0xff ), USBCSInterface ( maxusb_app, cs_config2, 2, 2, 0xff ), USBCSInterface ( maxusb_app, cs_config3, 2, 2, 0xff ), USBCSInterface ( maxusb_app, cs_config4, 2, 2, 0xff ) ] cs_interfaces1 = [] cs_config5 = [ 0x00, # Header Functional Descriptor 0x1001, # bcdCDC ] bControlInterface = 0 bSubordinateInterface0 = 1 cs_config6 = [ 0x06, # Union Functional Descriptor bControlInterface, bSubordinateInterface0 ] # iMACAddress = self.get_string_id("020406080a0c") iMACAddress = 0 bmEthernetStatistics = 0x00000000 wMaxSegmentSize = 0xea05 wNumberMCFilters = 0x0000 bNumberPowerFilters = 0x00 cs_config7 = [ 0x0f, # Ethernet Networking Functional Descriptor iMACAddress, bmEthernetStatistics, wMaxSegmentSize, wNumberMCFilters, bNumberPowerFilters ] cs_interfaces2 = [ USBCSInterface ( maxusb_app, cs_config5, 2, 6, 0 ), USBCSInterface ( maxusb_app, cs_config6, 2, 6, 0 ), USBCSInterface ( maxusb_app, cs_config7, 2, 6, 0 ) ] cs_interfaces3 = [] endpoints0 = [ USBEndpoint( maxusb_app, 3, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x0800, # max packet size 0x09, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ) ] endpoints1 = [ USBEndpoint( maxusb_app, 3, # endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x0002, # max packet size 0x00, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( maxusb_app, 1, # endpoint address USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x0002, # max packet size 0x00, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ) ] endpoints2 = [ USBEndpoint( maxusb_app, 3, # 2 endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x1000, # max packet size 0x09, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ) ] endpoints3 = [ USBEndpoint( maxusb_app, 3, # 1 endpoint address USBEndpoint.direction_in, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x0002, # max packet size 0x00, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ), USBEndpoint( maxusb_app, 1, # endpoint address USBEndpoint.direction_out, USBEndpoint.transfer_type_bulk, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 0x0002, # max packet size 0x00, # polling interval, see USB 2.0 spec Table 9-13 self.handle_data_available # handler function ) ] if self.int_num == 0: endpoints = endpoints0 cs_interfaces = cs_interfaces0 elif self.int_num == 1: endpoints = endpoints1 cs_interfaces = cs_interfaces1 elif self.int_num == 2: endpoints = endpoints2 cs_interfaces = cs_interfaces2 elif self.int_num == 3: endpoints = endpoints3 cs_interfaces = cs_interfaces3 if self.int_num == 2: #Ugly hack self.int_num = 0 if self.int_num == 3: self.int_num = 1 # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, maxusb_app, self.int_num, # interface number 0, # alternate setting usbclass, # 3 interface class sub, # 0 subclass proto, # 0 protocol 0, # string index verbose, endpoints, descriptors, cs_interfaces ) self.device_class = USBCDCClass(maxusb_app) self.device_class.set_interface(self)
class USBKeyboardInterface(USBInterface): name = "USB keyboard interface" hid_descriptor = b'\x09\x21\x10\x01\x00\x01\x22\x2b\x00' report_descriptor = b'\x05\x01\x09\x06\xA1\x01\x05\x07\x19\xE0\x29\xE7\x15\x00\x25\x01\x75\x01\x95\x08\x81\x02\x95\x01\x75\x08\x81\x01\x19\x00\x29\x65\x15\x00\x25\x65\x75\x08\x95\x01\x81\x00\xC0' def __init__(self, verbose=0): descriptors = { USB.desc_type_hid : self.hid_descriptor, USB.desc_type_report : self.report_descriptor } self.endpoint = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 1, # polling interval self.handle_buffer_available # handler function ) USBInterface.__init__( self, 0, # interface number 0, # alternate setting 3, # interface class 0, # subclass 0, # protocol 0, # string index verbose, [ self.endpoint ], descriptors ) self.keys = [] self.append_delay(100) self.keys.append(bytes((KEY_CTRL_MASK | KEY_ALT_MASK, 0, ord('t') - ord('a') + 4))) # <CTRL-ALT-T> self.keys.append(bytes((KEY_DEFAULT_MASK, 0, 0x00))) # <KEY UP> self.append_delay(100) with open(sys.argv[1]) as f: self.append_save_file(sys.argv[1], f.read()) def append_delay(self, length): for i in range(length): self.keys.append(bytes((KEY_DEFAULT_MASK, 0, 0x00))) def append_string(self, s): for c in s: self.keys.append(codes_mapping[ord(c)]) # <KEY DOWN> self.keys.append(bytes((KEY_DEFAULT_MASK, 0, 0x00))) # <KEY UP> def append_save_file(self, name, text): self.append_string('cat > {} << EOL\n'.format(name)) self.append_string(text) self.append_string('EOL\n') def handle_buffer_available(self): if len(self.keys) == 0: return data = self.keys.pop(0) self.endpoint.send(data)
def __init__(self, maxusb_app, verbose=0): self.maxusb_app = maxusb_app if self.maxusb_app.testcase[1] == "hub_bLength": bLength = self.maxusb_app.testcase[2] else: bLength = 9 if self.maxusb_app.testcase[1] == "hub_bDescriptorType": bDescriptorType = self.maxusb_app.testcase[2] else: bDescriptorType = 0x29 if self.maxusb_app.testcase[1] == "hub_bNbrPorts": bNbrPorts = self.maxusb_app.testcase[2] else: bNbrPorts = 4 if self.maxusb_app.testcase[1] == "hub_wHubCharacteristics": wHubCharacteristics = self.maxusb_app.testcase[2] else: wHubCharacteristics = 0xe000 if self.maxusb_app.testcase[1] == "hub_bPwrOn2PwrGood": bPwrOn2PwrGood = self.maxusb_app.testcase[2] else: bPwrOn2PwrGood = 0x32 if self.maxusb_app.testcase[1] == "hub_bHubContrCurrent": bHubContrCurrent = self.maxusb_app.testcase[2] else: bHubContrCurrent = 0x64 if self.maxusb_app.testcase[1] == "hub_DeviceRemovable": DeviceRemovable = self.maxusb_app.testcase[2] else: DeviceRemovable = 0 if self.maxusb_app.testcase[1] == "hub_PortPwrCtrlMask": PortPwrCtrlMask = self.maxusb_app.testcase[2] else: PortPwrCtrlMask = 0xff hub_descriptor = bytes([ bLength, # length of descriptor in bytes bDescriptorType, # descriptor type 0x29 == hub bNbrPorts, # number of physical ports wHubCharacteristics & 0xff, # hub characteristics (wHubCharacteristics >> 8) & 0xff, bPwrOn2PwrGood, # time from power on til power good bHubContrCurrent, # max current required by hub controller DeviceRemovable, PortPwrCtrlMask ]) descriptors = {USB.desc_type_hub: hub_descriptor} endpoint = USBEndpoint( maxusb_app, 0x81, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 0x0c, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, maxusb_app, 0, # interface number 0, # alternate setting 9, # 3 interface class 0, # 0 subclass 0, # 0 protocol 0, # string index verbose, [endpoint], descriptors) self.device_class = USBHubClass(maxusb_app) self.device_class.set_interface(self)
class USBMouseInterface(USBInterface): name = "USB mouse interface" hid_descriptor = b'\x09\x21\x10\x01\x00\x01\x22\x34\x00' # ^---^-- report desc. len report_descriptor = ( b'\x05\x01\x09\x02\xa1\x01\x09\x01\xa1' # ^-- usage 2 = mouse b'\x00\x05\x09\x19\x01\x29\x03\x15\x00\x25\x01' # first button --^ ^-- last button b'\x95\x03\x75\x01\x81\x02\x95\x01\x75\x05\x81\x03' # ^-- no. of buttons ^-- padding b'\x05\x01\x09\x30\x09\x31\x09\x38\x15\x81\x25\x7f' # ^-- X ^-- Y ^-- wheel b'\x75\x08\x95\x03\x81\x06\xc0\xc0' ) # ^-- no. of axes def __init__(self, verbose=0): descriptors = { USB.desc_type_hid : self.hid_descriptor, USB.desc_type_report : self.report_descriptor } self.endpoint = USBEndpoint( 3, # endpoint number USBEndpoint.direction_in, USBEndpoint.transfer_type_interrupt, USBEndpoint.sync_type_none, USBEndpoint.usage_type_data, 16384, # max packet size 10, # polling interval, see USB 2.0 spec Table 9-13 self.handle_buffer_available # handler function ) # TODO: un-hardcode string index (last arg before "verbose") USBInterface.__init__( self, 0, # interface number 0, # alternate setting 3, # interface class 0, # subclass 0, # protocol 0, # string index verbose, [ self.endpoint ], descriptors ) self.device_class = USBHIDClass() self.device_class.set_interface(self) self.t = 0 def handle_buffer_available(self): t = self.t if t>10: self.move(10*sin(t), 10*cos(t)) self.t += 0.1 def move(self, x, y): data = bytes([ 0, (256+trunc(x))%255, (256+trunc(y))%255, 0 ]) self.endpoint.send(data)