📜 ⬆️ ⬇️

Brutforsim EFI with Arduino

Hail Habravchan!

I think this topic will not surprise many people - it’s enough to type in the search engine the phrase arduino bruteforce and it will immediately become clear how common is the brute force password search using the Arduino platform. I want to talk about how to quickly organize it with the smallest sets of components, without wiring / etching boards and soldering. Immediately make a reservation that the actions I described are of an introductory nature and have not caused anyone any harm, either moral or physical ... except to fraudsters.



Why did i do it

One evening, my iPhone received a password change notification in Apple ID. Suspecting something was wrong, I rushed to check the account Apple ID. As you already guessed, that same unpleasant situation happened to me. Naturally, I couldn’t log in to my account, I also didn’t manage to recover the password - I didn’t receive an email from Apple in the mailbox. Soon I discovered a well-known hacker chip - setting the filtering of incoming mail on the mailbox itself. Actually, the mailbox was initially hacked, then the Apple ID password was changed without any problems. But when it was possible to restore access to the Apple ID, it was already too late. By that time, the iPhone was blocked by attackers through the “Find iPhone” service, the MacBook also required a password, and as it should be, there was a message on the screen:
')


And if resetting the iPhone to factory settings via iCloud did not cause any difficulties, then it is impossible to reset the lock from the Mac using standard tools. The Mac does not set the password for the account, but directly to the EFI firmware. The password is stored on a separate chip in an encrypted form, so the computer becomes locked at the iron level. The support service sent me to an authorized service center, where they offered to reset the password for an N amount and a couple of days. By the way, this amount is almost twice as much as fraudsters ask for a password. But I did not rush to part with the money and began to look on the Internet for ways to do everything myself. Shoveling a lot of forums came to the conclusion that we need a complete brute force of passwords.

Eureka!

It is not royal to sort through 10,000 combinations manually, and there is no place to start the script at all. Fortunately, the keyboard connected to your MacBook via USB, which means it's time to create a “smart USB keyboard”! It was for this occasion that my Arduino Uno was gathering dust, and the whole concert will be with her.

A small digression. Later on the Internet, I found one interesting project of a “hacker” on the Arduino, a rather serious device that reads and analyzes a picture via a VGA connector. But this is for those who have the desire and a lot of time.

For the cause

To begin with, I found a special firmware for the ATMEL MEGA16U2 chip, on the Arduino Uno there is also an ATMEL MEGA8U2. This is an Arduino USB controller. The photo below shows the location of the Arduino Uno R3 revision controller:



Such firmware is necessary so that the computer perceives the board not as a COM-port device, but as a HID keyboard. The firmware code will be later.

Note: Arduino Leonardo and Arduino Micro support USB HID on a regular basis.

So, it remains for the small - to write a program for the controller itself. First, we check our “keyboard” on a deliberately unlocked working computer.

ATTENTION! We first flash the ATMEGA controller, only then the MEGA USB controller! Arduino development environment can not flash the keyboard.

Load the test sketch to the controller:

uint8_t buf[8] = { 0 }; //     «»  void setup() { Serial.begin(9600); //    delay(2000); // ,  «»     } void loop() { int dig1, dig2, dig3, dig4; // ,     int keys[10] = { 39, 30, 31, 32, 33, 34, 35, 36, 37, 38 }; //   ASCII    0  9  //  ,   0000: for(dig1=0; dig1<10; dig1++) { for(dig2=0; dig2<10; dig2++) { for(dig3=0; dig3<10; dig3++) { for(dig4=0; dig4<10; dig4++) { pressKey(keys[dig1]); pressKey(keys[dig2]); pressKey(keys[dig3]); pressKey(keys[dig4]); pressKey(40); //  Enter delay(1000); } } } } } void pressKey(int dig) //   { buf[2] = dig; Serial.write(buf, 8); //   buf[0] = 0; buf[2] = 0; delay(20); Serial.write(buf, 8); //   delay(200); } 


Disconnect the Arduino from the computer.

Now you need to flash the USB controller, to do this, download the FLIP program (Windows) from the ATMEL website and install it.
In the case of MacOS separate instructions . For some versions of the Arduino Uno there are subtleties when flashing a USB controller, details are here .

Create a hex file of the USB controller firmware. The code can be simply copied to a text editor such as Notepad and saved with the extension .hex
"Arduino-Uno-keyboard.hex"
: 100000009AC00000B3C00000B1C00000AFC0000043
: 10001000ADC00000ABC00000A9C00000A7C0000038
: 10002000A5C00000A3C00000A1C00000E3C3000001
: 100030009DC000009BC0000099C0000097C0000058
: 1000400095C0000093C0000091C000008FC0000068
: 100050008DC000008BC0000089C0000052C10000AC
: 1000600085C0000083C0000081C000007FC0000088
: 100070007DC000007BC0000079C0000077C0000098
: 1000800075C0000073C0000071C000006FC00000A8
: 100090006DC000006BC0000005010906A1017501DB
: 1000A0009508050719E029E715002501810295014A
: 1000B0007508810395057501050819012905910247
: 1000C00095017503910395067508150026E700054F
: 1000D00007190029E78100C0120110010000000883
: 1000E000EB0342200000010200010902220001018D
: 1000F00000C03209040000010301010009211101BF
: 1001000000012240000705810308000A04030904D6
: 100110001003410072006400750069006E006F00FA
: 10012000000012034B006500790062006F0061005F
: 1001300072006400000011241FBECFEFD2E0DEBFCA
: 10014000CDBF11E0A0E0B1E0E8EAFFE002C0059019
: 100150000D92AE30B107D9F711E0AEE0B1E001C0C9
: 100160001D92AE3AB107E1F74ED01CC749CFBF92FE
: 10017000CF92DF92EF92FF920F931F93CF93DF9373
: 1001800084B7877F84BF28E10FB6F894209360007E
: 10019000109260000FBE3CECC32ED12C87E690E09D
: 1001A000F601918380839AECE92EF12C86E0B82E3B
: 1001B000F701B08208EC10E0F8011082C9ECD0E041
: 1001C0002883539A5A9A0BD384E085BD5F9A579A35
: 1001D0001882F8011082F70110828FEC90E0F6018E
: 1001E00091838083F701B08282E0F801808388E9FF
: 1001F0008883DF91CF911F910F91FF90EF90DF9057
: 10020000CF90BF900895B3DF2FB7F8948FE191E0BE
: 100210009093A00180939F019093A2018093A101EC
: 100220002FBF789480E091E0E7D584D4FBCF089588
: 10023000089580E091E0B8D5E2EEF0E0808184603E
: 100240008083089580E091E087C480910B019091B4
: 100250000C01009729F0019790930C0180930B01FA
: 1002600008950F931F93CF93DF93E8019FB7F894FE
: 100270008091A3019FBF883050F1AEE0B1E08FE1E3
: 1002800091E0E091A101F091A2015191F093A201BE
: 10029000E093A10141E0EF39F40721F49093A2012A
: 1002A0008093A1016FB7F8944091A301415040930E
: 1002B000A3016FBF5D9341E0A631B40711F78091B0
: 1002C00016019091C80095FFFCCF8093CE00EEE020
: 1002D000F1E0822F932FDC0181918D9381E0E63153
: 1002E000F807D1F788E090E09983888380E0DF9178
: 1002F000CF911F910F910895F9018081809316018C
: 1003000008951F920F920FB60F9211242F938F937F
: 100310009F93EF93FF938091CE009EB39430F9F4B6
: 10032000E0919F01F091A0018083E0919F01F09105
: 10033000A001CF0101969093A00180939F0121E03D
: 100340008F39920721F48FE191E0928381839FB7E7
: 10035000F8948091A3018F5F8093A3019FBFFF91C9
: 10036000EF919F918F912F910F900FBE0F901F9043
: 100370001895933089F0943028F4913059F19230E7
: 1003800071F505C09132E1F0923249F51EC022E2CA
: 1003900030E0EAEEF0E027C0813049F0813018F01B
: 1003A0008230E9F408C0ECE0F1E0249107C0E0E11C
: 1003B000F1E0249103C0E2E2F1E0249130E013C0C7
: 1003C00029E030E0ECEFF0E00EC020E430E0E8E9B6
: 1003D000F0E009C022E130E0E8EDF0E004C020E008
: 1003E00030E0E0E0F0E0DA011196FC93EE93C90111
: 1003F000089528E030E040E003C04F5F220F331F34
: 1004000028173907D0F3842F8295807F0895809331
: 10041000E900EBEEF0E0808181608083EDEEF0E0BA
: 1004200010826093EC0040838091EE00881F882743
: 10043000881F08951092F40080E08093E9001092E4
: 10044000F0001092E8001092ED009091EB009E7F7A
: 100450009093EB008F5F853081F708958091A6011E
: 1004600087FF11C003C08EB38823B1F08091E800EC
: 1004700082FFF9CF8091E8008B778093E8000895A0
: 100480008EB3882349F08091E80080FFF9CF8091F6
: 10049000E8008E778093E800089584E69091EC0060
: 1004A00090FF05C09091E80090FF05C01BC090919F
: 1004B000E80092FD17C09EB39923B1F09EB395302A
: 1004C000A9F09091EB0095FD13C09091E10092FF8F
: 1004D000E5CF9091E1009B7F9093E100882351F05C
: 1004E0008150DCCF80E0089582E0089583E0089594
: 1004F00081E0089584E00895AF92BF92DF92EF9279
: 10050000FF920F931F93DF93CF930F92CDB7DEB778
: 10051000082F5B017A019983C0DFD82E9981882347
: 1005200031F5192F1CC08091E80085FD10C0809125
: 10053000E8008E778093E800E114F10421F0F701E0
: 100540000995813081F0A9DF882349F00FC0F801B7
: 1005500081918F018093F1000894A108B108A11442
: 10056000B10409F704C075E0D72E01C0D82E8D2D37
: 100570000F90CF91DF911F910F91FF90EF90DF903F
: 10058000BF90AF900895282F392FF9018091AC01C9
: 100590009091AD018617970718F4BC0190E032C026
: 1005A00061157105D9F78091E8008E778093E80096
: 1005B000F5CF8091E80083FD37C08091E80082FD8F
: 1005C0002DC08EB38823A1F18EB3853079F180914F
: 1005D000E80080FF17C08091F20006C091919093CF
: 1005E000F100615070408F5F6115710511F0883026
: 1005F000A8F391E0883009F090E08091E8008E77D0
: 100600008093E80061157105A1F6992391F606C063
: 100610008EB3882369F08EB3853061F08091E80055
: 1006200082FFF6CF80E0089581E0089583E0089589
: 1006300082E0089583E00895282F392FC901209181
: 10064000AC013091AD012617370718F4B90130E03D
: 1006500034C061157105D9F72091E8002E772093F9
: 10066000E800F5CF2091E80023FD39C02091E80093
: 1006700022FD2FC02EB32223B1F12EB3253089F1F4
: 100680002091E80020FF19C02091F20008C0FC0171
: 100690000196E491E093F100615070402F5F611585
: 1006A000710511F0283098F331E0283009F030E07E
: 1006B0002091E8002E772093E8006115710591F6EE
: 1006C000332381F606C08EB3882369F08EB385305C
: 1006D00061F08091E80082FFF6CF80E0089581E02C
: 1006E000089583E0089582E0089583E008956115F8
: 1006F000710519F51DC02091E80023FD2EC02EB311
: 10070000222379F12EB3253051F12091E80022FF08
: 10071000F2CFE82FF92F07C08091F1008193CF012C
: 100720006150704029F0CF012091F2002223A1F7FF
: 100730002091E8002B772093E80061157105D9F628
: 1007400006C08EB3882369F08EB3853061F0809146
: 10075000E80080FFF6CF80E0089581E0089583E00F
: 10076000089582E0089583E008953ED040D01EBAF7
: 100770001092A40184E089BD89B5826089BD09B465
: 1007800000FEFDCF8091D800982F9F779093D800DE
: 1007900080688093D800809163008E7F809363008F
: 1007A0008091D8008F7D8093D8008091E0008E7F6B
: 1007B0008093E0008091E1008E7F8093E100809142
: 1007C000E20081608093E2008091E100877F809366
: 1007D000E1008091E20088608093E2000895C5DF27
: 1007E00081E08093A50108951092E200089510928F
: 1007F000E10008951F920F920FB60F9211242F93CC
: 100800003F934F935F936F937F938F939F93AF9398
: 10081000BF93EF93FF938091E10080FF1BC0809115
: 10082000E20080FF17C08091E1008E7F8093E1009D
: 100830008091E2008E7F8093E2008091E2008061EF
: 100840008093E2008091D80080628093D80019BC28
: 100850001EBAEEDC8091E10084FF29C08091E200A5
: 1008600084FF25C084E089BD89B5826089BD09B453
: 1008700000FEFDCF8091D8008F7D8093D8008091BD
: 10088000E1008F7E8093E1008091E2008F7E809373
: 10089000E2008091E20081608093E2008091A401F7
: 1008A000882311F084E001C081E08EBBC0DC809120
: 1008B000E10083FF22C08091E20083FF1EC080918F
: 1008C000E100877F8093E10082E08EBB1092A4015B
: 1008D0008091E1008E7F8093E1008091E2008E7F25
: 1008E0008093E2008091E20080618093E200A2DDCB
: 1008F00080E060E042E08BDD1CD18091E10082FF6E
: 100900000AC08091E20082FF06C08091E1008B7FE7
: 100910008093E1009ADCFF91EF91BF91AF919F919D
: 100920008F917F916F915F914F913F912F910F9098
: 100930000FBE0F901F9018951F93DF93CF9300D099
: 10094000CDB7DEB7E6EAF1E08091F100819381E076
: 10095000EE3AF807C9F78091A6019091A70195306A
: 1009600009F46BC0963040F4913061F1913070F031
: 10097000933009F0C9C026C0983009F49BC0993063
: 1009800009F4AAC0963009F0BFC075C0803809F4D8
: 10099000BCC0823809F0B8C08091AA0187708093EA
: 1009A000E9009091EB001092E9008091E800877FC8
: 1009B0008093E80081E095FF80E08093F100109241
: 1009C000F10083C0882319F0823009F09DC08F7137
: 1009D000823009F09AC08091A801882341F52091C6
: 1009E000AA01277009F491C02093E9008091EB00DF
: 1009F00080FF8BC08091A701833021F48091EB00B0
: 100A0000806213C08091EB0080618093EB0081E0F5
: 100A100090E002C0880F991F2A95E2F78093EA00C0
: 100A20001092EA008091EB0088608093EB001092B6
: 100A3000E9008091E800877F4BC0882309F064C0FB
: 100A40001091A8018091E800877F8093E80006DD7F
: 100A500004C08EB3882309F458C08091E80080FF59
: 100A6000F8CF1F7711F083E001C082E08EBB1068E1
: 100A70001093E3004AC08058823008F045C080914E
: 100A8000A8019091A9016091AA01AE014F5F5F4F4B
: 100A900070DCBC010097C9F18091E800877F8093EA
: 100AA000E80089819A81C8DD8091E8008B77809386
: 100AB000E8002BC0803841F58091E800877F809363
: 100AC000E8008091A4018093F1008091E8008E7786
: 100AD0008093E800C3DC19C08823B1F49091A80189
: 100AE000923098F48091E800877F8093E80090939B
: 100AF000A401B4DC8091A401882311F084E001C03A
: 100B000083E08EBB96DB01C09DDB8091E80083FF14
: 100B10000AC08091EB0080628093EB008091E80036
: 100B2000877F8093E8000F900F90CF91DF911F9106
: 100B3000089508951F938EB3882361F01091E90002
: 100B400017701092E9008091E80083FF01C0F4DE85
: 100B50001093E9001F9108956F927F928F929F9258
: 100B6000AF92BF92CF92DF92EF92FF920F931F93BB
: 100B7000DF93CF9300D00F92CDB7DEB77C016DB677
: 100B80007EB68091E80083FFF8C0F701808190E095
: 100B90002091AA013091AB012817390709F0EDC067
: 100BA0008091A701833009F499C0843030F48130FA
: 100BB00071F0823009F0E1C0C8C08A3009F4AEC0DB
: 100BC0008B3009F498C0893009F0D7C04CC08091AF
: 100BD000A601813A09F0D1C0CDB6DEB69DB68D2C06
: 100BE0008091E800877F8093E8001B821A828091C1
: 100BF000A8010091A9018983F7014781C41AD1088E
: 100C00000FB6F894DEBE0FBECDBE0894C11CD11C39
: 100C1000BC2CAD2CC60160E070E050E0BCD1402F90
: 100C20004150C701BE016F5F7F4F96018E010E5F7D
: 100C30001F4F17DBF701258136812115310529F07A
: 100C40004781C901B60150E09DD11092E9006A8147
: 100C50007B818B2D9A2D97DC8091E8008B77809398
: 100C6000E800940133C08091A601813209F085C06B
: 100C7000CDB6DEB6BDB6AD2C8091E800877F8093FF
: 100C8000E8000091AC011091AD019090A801809016
: 100C9000A9018DB79EB7801B910B0FB6F8949EBF2C
: 100CA0000FBE8DBFCDB6DEB60894C11CD11CC601E7
: 100CB000B8011DDD482D4150C701692D96011CDB8F
: 100CC0008091E8008E778093E8009501832F922F22
: 100CD0000FB6F8949EBF0FBE8DBF4FC08091A60186
: 100CE000813A09F04AC08091E800877F8093E8004C
: 100CF000F70180853AC08091A601813209F03DC09C
: 100D00008091E800877F8093E8009091A80181E0BE
: 100D1000992309F480E0F70180872EC08091A60115
: 100D2000813259F58091E800877F8093E8008091B7
: 100D3000A8019091A901807036E0969587953A9523
: 100D4000E1F7F7019287818717C08091A601813A68
: 100D5000A1F48091E800877F8093E800F701818506
: 100D6000928596958795969587958093F1008091C9
: 100D7000E8008E778093E80071DB0FB6F8947EBEB2
: 100D80000FBE6DBE0F900F900F90CF91DF911F910E
: 100D90000F91FF90EF90DF90CF90BF90AF909F901A
: 100DA0008F907F906F9008950F931F93CF93DF9351
: 100DB000FC010896DC0185E0ED0119928A95E9F7BE
: 100DC00081E0808784EF91E092878187228133815F
: 100DD00001818481882311F014E001C010E0C90171
: 100DE00008DB412F482B4260802F61EC10DBDF9144
: 100DF000CF911F910F9108954F925F926F927F92C2
: 100E00008F929F92AF92BF92CF92DF92EF92FF921A
: 100E10000F931F93DF93CF9300D00F92CDB7DEB720
: 100E20007C016DB67EB68EB3843009F085C0F701C3
: 100E300081818093E9008091E80085FF7DC05DB6E7
: 100E4000472C4781CDB6DEB6C41AD1080FB6F89448
: 100E5000DEBE0FBECDBE0DB71EB70F5F1F4FB02E4B
: 100E6000912E19821B821A82C80160E070E050E066
: 100E700092D0C701BE016F5F7F4F40E098018E01A5
: 100E80000E5F1F4FEED9882EF7018185928500975E
: 100E900059F081E090E0238534852115310511F06A
: 100EA00080E090E06C0102C0CC24DD24F7010581D4
: 100EB00016810115110599F04A815B818B2D992DC1
: 100EC000B80153D0AA24A394009709F4AA24F701E7
: 100ED0004781C8016B2D792D50E054D001C0AA2460
: 100EE0008A819B81009701F1882029F4AA2019F4B6
: 100EF000C114D104C9F0F701818592859487838755
: 100F000081818093E9008981882311F08093F10029
: 100F10006A817B818B2D992D40E050E0EDDA809144
: 100F2000E8008E778093E8009201832F942D0FB60E
: 100F3000F8949EBF0FBE8DBF0FB6F8947EBE0FBE55
: 100F40006DBE0F900F900F90CF91DF911F910F9179
: 100F5000FF90EF90DF90CF90BF90AF909F908F90D9
: 100F60007F906F905F904F900895FB01DC0104C06B
: 100F70008D910190801921F441505040C8F7881B91
: 100F8000990B0895FB01DC0102C001900D924150C4
: 100F90005040D8F70895DC0101C06D934150504096
: 080FA000E0F70895F894FFCF7B
: 0E0FA800000108000017010800000000000012
: 00000001FF

Next you need to transfer the Arduino to DFU mode. To do this, open the "Device Manager" on Windows, connect the board to the computer, make sure that Windows sees it as a COM port device, then we short-circuit Arduino contacts with some piece of hardware as shown in the picture below:



After 5-10 seconds, the contacts open. If a new USB device “ATmega16U2” (or “... 8U2”) appeared in the controller - great!

No - we close the contacts again, you can try to hold it longer. If an “Unknown Device” appears, then you need to install a driver for the Arduino USB controller: right-click on “Unknown Device”> “Update Drivers”> “Search for Drivers on This Computer”> look for the directory with FLIP installed, in which is the folder "Usb"> install the driver.

As a result, we should see the following:



So, Arduino in DFU mode, now it can be turned into a keyboard. Next comes the description of work under Windows.

1. Run FLIP. In the “Device” tab, click “Select” or click on a microcircuit, look for “ATmega16U2” (or “... 8U2”) in the list, click “OK”.



2. Next, the tab "Settings"> "Communication" or click on the USB cord> "USB"> "Open". If no errors have popped up, then for now we are doing everything right. Otherwise, try re-enter the Arduino in DFU mode.





3. Now the tab “File”> “Load HEX File ...” or press the book with the arrow, look for the file “Arduino-Uno-keyboard.hex” created earlier, check the checkboxes and click “Run”.





A couple of moments and Arduino turns ... into an elegant keyboard! Disconnect the board from the computer. On the computer, open any text editor, then connect the Arduino again. After a couple of seconds, someone will start typing:

0000
0001
0002 ...

Our poltergeist password reset is almost ready!

Everything would be fine, but when Arduino enters passwords on a MacBook, we cannot find out which of them turned out to be correct. We will know for sure that some four stars have come up. Therefore, let us make sure that the current password is displayed on a 28-segment indicator. I just had this:



The indicator module is already soldered on the board with keys and resistors, therefore, in my case, the connection scheme is simple: connect the VCC input of the indicator to the 5V output of the Arduino, the rest from D1 to G to the digital outputs of the Arduino from 12 to 2, respectively.

There are many types of segment identifiers: with a common cathode, with a common anode; with built-in controller, without controller, matrix, respectively, and methods of connecting indicators to the controller are different. The easiest way is to work with a modular indicator that has a controller or at least matrix wiring:



I just have to stick the indicator somewhere with tape:



Finish line

We write a sketch with the support of a modular indicator and the necessary input settings. Measurements have shown that the delay time for entering a password on a MacBook before the OS is loaded is 12 seconds after 5 attempts to enter incorrectly. To flash the “keyboard”, you need to return the Arduino USB controller to its original state. To do this, create a hex file of the native USB controller firmware. The code is also simply copied into a text editor such as Notepad and saved with the extension .hex
"Arduino-Uno-R3-usbserial.hex"
: 1000000090C00000A9C00000A7C00000A5C000006B:
: 10001000A3C00000A1C000009FC000009DC0000060
: 100020009BC0000099C0000097C0000048C40000B9
: 100030000CC4000091C000008FC000008DC0000003
: 100040008BC0000089C0000087C0000085C0000090
: 1000500083C0000081C000007FC0000002C100001A
: 100060007BC0000079C0000077C0000075C00000B0
: 1000700073C0000071C000006FC000006DC00000C0
: 100080006BC0000069C0000067C0000065C00000D0
: 1000900063C0000061C000001201100102000008EE
: 1000A0004123430001000102DC0109023E0002017C
: 1000B00000C0320904000001020201000524000111
: 1000C0001004240206052406000107058203080027
: 1000D000FF09040100020A000000070504024000B5
: 1000E00001070583024000010403090432034100B3
: 1000F00072006400750069006E006F002000280027
: 100100007700770077002E006100720064007500B0
: 1001100069006E006F002E0063006300290000007C
: 10012000000011241FBECFEFD2E0DEBFCDBF11E033
: 10013000A0E0B1E0ECEAFFE002C005900D92A6312C
: 10014000B107D9F712E0A6E1B1E001C01D92AF32CC
: 10015000B107E1F7F1D028C753CF9C01DC01AE57BE
: 10016000BF4FED91FC91119741911196FC93EE9345
: 1001700080589F4FE817F90711F42D933C939FB7D0
: 10018000F894F901EC57FF4F8081815080839FBF25
: 10019000842F0895DF92EF92FF920F931F93FC013B
: 1001A0008489813019F0823021F405C040E3D42ED7
: 1001B00004C0DD2402C030E2D32E8389823011F4E2
: 1001C00088E0D82A8589873031F0883031F0863050
: 1001D00031F482E003C084E001C086E0D82A1092A6
: 1001E000C9001092C8001092CA00E784F088018903
: 1001F000128980E0E81681EEF80680E0080780E0CA
: 10020000180719F420E130E00FC0C801B701969536
: 1002100087957795679560587B47814E9F4FA801DA
: 100220009701A0D6215030403093CD002093CC00D0
: 10023000D092CA0080E0E81681EEF80680E0080758
: 1002400080E0180711F082E001C080E08093C800D0
: 1002500088E98093C9001F910F91FF90EF90DF9084
: 1002600008951F920F920FB60F9211242F938F9320
: 100270009F93EF93FF939091CE008EB38430F1F46F
: 10028000E0919901F0919A019083E0919901F091A8
: 100290009A01CF01019690939A018093990189590F
: 1002A000914021F489E191E0928381839FB7F89492
: 1002B00080919D018F5F80939D019FBFFF91EF9182
: 1002C0009F918F912F910F900FBE0F901F901895B7
: 1002D000FC01858580FF02C05F9808955F9A0895AC
: 1002E00080E091E0D5C580E091E088C584B7877F44
: 1002F00084BF28E10FB6F89420936000109260004C
: 100300000FBE87E690E09093CD008093CC0086E00E
: 100310008093CA001092C8002093C900539A5A9A39
: 100320008AB180638AB98BB180638BB983D284E050
: 1003300085BD5F9A579A08950F931F93CF93DF93CC
: 10034000D5DF2FB7F8948EE991E090931F02809348
: 100350001E0290932102809320022FBF2FB7F894A2
: 1003600089E191E090939A018093990190939C0187
: 1003700080939B012FBF7894CEE9D1E003E08FB743
: 10038000F894909122028FBF903809F180E091E0BB
: 10039000ABD497FD1CC0E0911E02F0911F02808338
: 1003A000E0911E02F0911F02CF01019690931F026F
: 1003B00080931E028E51924011F4D283C1839FB765
: 1003C000F894809122028F5F809322029FBF8FB7A3
: 1003D000F89410919D018FBFA89902C0113678F151
: 1003E000A89A80919D01882361F05D980093160181
: 1003F00008C089E191E0B1DE682F80E091E0DAD4B5
: 1004000011501123B1F780911601882351F080918A
: 10041000160181508093160180911601882309F4FA
: 100420005D9A80911701882351F0809117018150C6
: 100430008093170180911701882309F45C9A8FB784
: 10044000F894909122028FBF992369F08EE991E090
: 1004500084DE982F8091C80085FFFCCF9093CE005A
: 100460005C980093170180E091E095D42AD487CF5F
: 10047000DA01923049F0933061F09130F9F4E8E913
: 10048000F0E022E130E01EC0EAEAF0E02EE330E0E6
: 1004900019C0813049F0813018F0823079F408C0F9
: 1004A000E8EEF0E0849107C0ECEEF0E0849103C048
: 1004B000E0E2F1E08491282F30E004C0E0E0F0E0D9
: 1004C00020E030E0ED93FC93C901089528E030E08E
: 1004D00040E003C04F5F220F331F28173907D0F3C6
: 1004E000842F8295807F08958093E9008091EB00AE
: 1004F00081608093EB001092ED006093EC004093DC
: 10050000ED008091EE00881F8827881F08951092C3
: 10051000F40090E09093E9001092F0001092E8004F
: 100520001092ED008091EB008E7F8093EB009F5F37
: 10053000953081F708958091270288238CF403C0B9
: 100540008EB38823B1F08091E80082FFF9CF8091CB
: 10055000E8008B778093E80008958EB3882349F0F4
: 100560008091E80080FFF9CF8091E8008E7780933A
: 10057000E800089594E68091EC0080FF05C080912A
: 10058000E80080FF05C023C08091E80082FD1FC005
: 100590008EB3882311F482E008958EB3853011F470
: 1005A00083E008958091EB0085FF02C081E008950B
: 1005B0008091E10082FFDFCF8091E1008B7F80930B
: 1005C000E100992311F484E008959150D4CF80E0A4
: 1005D00008959C0140912D0250912E024617570715
: 1005E00018F4F90120E038C06115710511F0AB0174
: 1005F000F8CF8091E8008E778093E80040E050E0EB
: 10060000F0CF8091E80083FF02C081E008958091DF
: 10061000E80082FD2DC08EB3882381F18EB3853032
: 1006200079F18091E80080FF17C09091F20006C038
: 1006300081918093F100415050409F5F41155105D9
: 1006400011F09830A8F320E0983009F421E080916F
: 10065000E8008E778093E8004115510591F622233A
: 1006600081F606C08EB3882349F08EB3853041F001
: 100670008091E80082FFF6CF80E0089582E008953F
: 1006800083E008959C0140912D0250912E0246175F
: 10069000570710F490E03BC06115710511F0AB01F4
: 1006A000F9CF8091E8008E778093E80040E050E039
: 1006B000F1CF8091E80083FF02C081E0089580912E
: 1006C000E80082FD30C08EB3882399F18EB3853067
: 1006D00091F18091E80080FF1AC08091F20009C07A
: 1006E000F9012F5F3F4FE491E093F10041505040FA
: 1006F0008F5F4115510511F0883090F390E08830FC
: 1007000009F491E08091E8008E778093E80041152C
: 10071000510579F6992369F606C08EB3882349F00E
: 100720008EB3853041F08091E80082FFF6CF80E003
: 10073000089582E0089583E008959C016115710594
: 1007400029F48091E8008B778093E800F90120C0BC
: 100750008091E80083FF02C081E008958EB3882372
: 1007600039F18EB3853031F18091E80082FFF0CF0E
: 1007700006C08091F10081936150704021F080911A
: 10078000F2008823B1F78091E8008B778093E8002E
: 1007900061157105E9F606C08EB3882349F08EB362
: 1007A000853041F08091E80080FFF6CF80E0089529
: 1007B00082E0089583E0089542D044D01EBA10929A
: 1007C0002502109224021092230284E089BD89B58B
: 1007D000826089BD09B400FEFDCF8091D800982FBA
: 1007E0009F779093D80080688093D80080916300B1
: 1007F0008E7F809363008091D8008F7D8093D80096
: 100800008091E0008E7F8093E0008091E1008E7FF8
: 100810008093E1008091E20081608093E20080910A
: 10082000E100877F8093E1008091E20088608093FF
: 10083000E2000895C1DF81E08093260208951092BE
: 10084000E20008951092E10008951F920F920FB6F2
: 100850000F9211241F932F933F934F935F936F93A6
: 100860007F938F939F93AF93BF93EF93FF93E9EEA3
: 10087000F0E0108117701082E0EFF0E08081877F58
: 1008800080837894C3D0F894A9EEB0E01C92E0EF96
: 10089000F0E08081886080831C93FF91EF91BF918D
: 1008A000AF919F918F917F916F915F914F913F9108
: 1008B0002F911F910F900FBE0F901F9018951F92B0
: 1008C0000F920FB60F9211242F933F934F935F9384
: 1008D0006F937F938F939F93AF93BF93EF93FF9308
: 1008E0008091E10080FF1BC08091E20080FF17C073
: 1008F0008091E1008E7F8093E1008091E2008E7F05
: 100900008093E2008091E20080618093E200809118
: 10091000D80080628093D80019BC1EBAD1D18091D2
: 10092000E10084FF29C08091E20084FF25C084E0BB
: 1009300089BD89B5826089BD09B400FEFDCF809173
: 10094000D8008F7D8093D8008091E1008F7E8093C6
: 10095000E1008091E2008F7E8093E2008091E200CE
: 1009600081608093E20080912502882311F481E068
: 1009700001C084E08EBBA4D18091E10083FF27C039
: 100980008091E20083FF23C08091E100877F809304
: 10099000E10082E08EBB109225028091E1008E7F03
: 1009A0008093E1008091E2008E7F8093E20080914D
: 1009B000E20080618093E200AADD80E060E042E036
: 1009C00093DD8091F00088608093F00079D1809170
: 1009D000E10082FF0AC08091E20082FF06C08091A0
: 1009E000E1008B7F8093E1006BD1FF91EF91BF918C
: 1009F000AF919F918F917F916F915F914F913F91B7
: 100A00002F910F900FBE0F901F9018951F93DF939B
: 100A1000CF93CDB7DEB7AC970FB6F894DEBF0FBE5D
: 100A2000CDBFE7E2F2E08091F100819322E0EF3266
: 100A3000F207C9F78091270230912802353009F476
: 100A400087C0363040F43130C9F1313070F0333086
: 100A500009F01DC133C0383009F4EFC0393009F452
: 100A6000FEC0363009F013C192C0803821F08238C0
: 100A700009F00DC108C090912302809124028823BF
: 100A800099F0926011C080912B0287708093E900E9
: 100A90008091EB0090E025E0969587952A95E1F707
: 100AA000982F91701092E9008091E800877F8093E1
: 100AB000E8009093F1001092F100CAC0882319F069
: 100AC000823009F0E4C090E08F719070009721F0BF
: 100AD000029709F0DDC00CC080912902813009F035
: 100AE000D7C010922402333069F5809324022AC0C3
: 100AF00080912902882331F520912B02277009F477
: 100B0000C7C02093E9008091EB0080FFC1C0333063
: 100B100021F48091EB00806213C08091EB00806132
: 100B20008093EB0081E090E002C0880F991F2A9526
: 100B3000E2F78093EA001092EA008091EB0088606F
: 100B40008093EB001092E9008091E800877F83C0DA
: 100B5000882309F09CC0109129028091E800877FCA
: 100B60008093E800E8DC04C08EB3882309F490C0C9
: 100B70008091E80080FFF8CF812F8F7711F492E009
: 100B800001C093E09EBB80688093E30081C08058E1
: 100B9000823008F07CC08091290290912A0223E0E3
: 100BA0008C3D920799F55FB7F894DE0115964EE0FB
: 100BB00020E030E061E2E42FF0E0609357008491A0
: 100BC00020FF03C082958F704F5F982F9F70892FF1
: 100BD000805D8A3308F0895F8C9311961C9211977F
: 100BE0002F5F3F4F12962431310529F75FBF8AE20C
: 100BF0008B8383E08C838091E800877F8093E8007B
: 100C0000CE0103966AE270E0E4DC11C060912B0231
: 100C1000AE014F5F5F4F2CDCBC010097C9F18091A2
: 100C2000E800877F8093E80089819A812BDD80919D
: 100C3000E8008B778093E8002BC0803841F58091E5
: 100C4000E800877F8093E800809125028093F1007F
: 100C50008091E8008E778093E8006DDC19C08823CE
: 100C6000B1F490912902923098F48091E800877F46
: 100C70008093E800909325025EDC80912502882312
: 100C800011F483E001C084E08EBB2DDB01C028DBC2
: 100C90008091E80083FF0AC08091EB00806280931E
: 100CA000EB008091E800877F8093E800AC960FB658
: 100CB000F894DEBF0FBECDBFCF91DF911F91089595
: 100CC00008951F938EB3882361F01091E90010926C
: 100CD000E9008091E80083FF01C098DE177010934F
: 100CE000E9001F9108950895FC018EB3843021F529
: 100CF00087859089A189B2890097A105B105E1F0A6
: 100D000085818093E9008091E80082FF15C0809181
: 100D1000F200882319F42FEF3FEF04C08091F10017
: 100D2000282F30E08091F200882341F48091E80080
: 100D30008B778093E80002C02FEF3FEFC901089541
: 100D4000FC018EB3843011F587859089A189B28921
: 100D50000097A105B105D1F081818093E9008091D0
: 100D6000F2008823A9F09091E8008091E8008E7746
: 100D70008093E80095FD0CC0FDDB982F882349F493
: 100D80008091E8008E778093E80003C092E001C074
: 100D900090E0892F0895FC018EB3843051F487854B
: 100DA0009089A189B2890097A105B10511F0CF0101
: 100DB000C7CF08951F93FC01162F8EB38430D9F44A
: 100DC00087859089A189B2890097A105B10599F01D
: 100DD00081818093E9008091E80085FD08C08091C1
: 100DE000E8008E778093E800C5DB882329F4109310
: 100DF000F10080E001C082E01F9108950F931F93DE
: 100E0000CF93DF93EC010D96FC0189E0DF011D9289
: 100E10008A95E9F72A813B8109818C81882311F425
: 100E200010E001C014E0C90151DB182B1260802FC3
: 100E300061E8412F59DB882329F12E813F810D8103
: 100E40008885882311F410E001C014E0C9013EDB5D
: 100E5000182B1260802F60E8412F46DB882391F029
: 100E60002A853B8509858C85882311F410E001C013
: 100E700014E0C9012BDB182B1260802F61EC412F8D
: 100E800033DB01C080E0DF91CF911F910F91089576
: 100E9000CF93DF93EC018091E80083FF60C08881ED
: 100EA00090E020912B0230912C022817390709F08D
: 100EB00056C080912802813261F0823220F4803263
: 100EC00009F04DC019C0823269F1833209F047C080
: 100ED00038C080912702813A09F041C08091E80032
: 100EE000877F8093E800CE010F9667E070E071DBAA
: 100EF0008091E8008B7713C080912702813279F5C9
: 100F00008091E800877F8093E800CE010F9667E02C
: 100F100070E013DCCE013ED98091E8008E7780939B
: 100F2000E8001DC0809127028132C9F48091E80059
: 100F3000877F8093E800809129028D87CE01C8D9F0
: 100F40000DC080912702813251F48091E800877FA3
: 100F50008093E800CE0160912902C5DEECDADF91D2
: 100F6000CF910895A1E21A2EAA1BBB1BFD010DC053
: 100F7000AA1FBB1FEE1FFF1FA217B307E407F50749
: 100F800020F0A21BB30BE40BF50B661F771F881F25
: 100F9000991F1A9469F760957095809590959B01BB
: 0C0FA000AC01BD01CF010895F894FFCF13
: 100FAC0000034000000440000002080000000000A4
: 060FBC000000000000002F
: 00000001FF

For all Arduino, the native USB controller firmware is here.

To return to the native USB controller firmware, we do everything using the FLIP program (or according to the instructions for the Mac), as before, at the end we disconnect the board from the computer. Then we re-connect the board to the computer and upload a new, improved sketch with indicator support to the controller.

 uint8_t buf[8] = { 0 }; //     «»  void setup() { Serial.begin(9600); //    pinMode(2, OUTPUT); // G pinMode(3, OUTPUT); // F pinMode(4, OUTPUT); // E pinMode(5, OUTPUT); // D pinMode(6, OUTPUT); // C pinMode(7, OUTPUT); // B pinMode(8, OUTPUT); // A pinMode(9, OUTPUT); // D4 pinMode(10, OUTPUT); // D3 pinMode(11, OUTPUT); // D2 pinMode(12, OUTPUT); // D1 //        ,   ,  //  ,  Arduino      //   //   : digitalWrite(12, HIGH); digitalWrite(11, HIGH); digitalWrite(10, HIGH); digitalWrite(9, HIGH); delay(2000); // ,  «»     } void loop() { int dig1, dig2, dig3, dig4; // ,     int keys[10] = { 39, 30, 31, 32, 33, 34, 35, 36, 37, 38 }; //   ASCII    0  9  //   0000  9999: for(dig1=0; dig1<10; dig1++) { for(dig2=0; dig2<10; dig2++) { for(dig3=0; dig3<10; dig3++) { for(dig4=0; dig4<10; dig4++) { pressKey(keys[dig1]); pressKey(keys[dig2]); pressKey(keys[dig3]); pressKey(keys[dig4]); pressKey(40); //  Enter //        15-  (    ) for(int i=0; i<1200; i++) { digLED(12, dig1); digLED(11, dig2); digLED(10, dig3); digLED(9, dig4); } } } } } } void pressKey(int dig) //   { buf[2] = dig; Serial.write(buf, 8); //   buf[0] = 0; buf[2] = 0; delay(20); Serial.write(buf, 8); //   delay(300); } // ,     ,       , //        void digLED(int pin, int dig) //      { digitalWrite(pin, LOW); switch(dig) { case 0: digitalWrite(8, LOW); digitalWrite(7, LOW); digitalWrite(6, LOW); digitalWrite(5, LOW); digitalWrite(4, LOW); digitalWrite(3, LOW); digitalWrite(2, HIGH); break; case 1: digitalWrite(8, HIGH); digitalWrite(7, LOW); digitalWrite(6, LOW); digitalWrite(5, HIGH); digitalWrite(4, HIGH); digitalWrite(3, HIGH); digitalWrite(2, HIGH); break; case 2: digitalWrite(8, LOW); digitalWrite(7, LOW); digitalWrite(6, HIGH); digitalWrite(5, LOW); digitalWrite(4, LOW); digitalWrite(3, HIGH); digitalWrite(2, LOW); break; case 3: digitalWrite(8, LOW); digitalWrite(7, LOW); digitalWrite(6, LOW); digitalWrite(5, LOW); digitalWrite(4, HIGH); digitalWrite(3, HIGH); digitalWrite(2, LOW); break; case 4: digitalWrite(8, HIGH); digitalWrite(7, LOW); digitalWrite(6, LOW); digitalWrite(5, HIGH); digitalWrite(4, HIGH); digitalWrite(3, LOW); digitalWrite(2, LOW); break; case 5: digitalWrite(8, LOW); digitalWrite(7, HIGH); digitalWrite(6, LOW); digitalWrite(5, LOW); digitalWrite(4, HIGH); digitalWrite(3, LOW); digitalWrite(2, LOW); break; case 6: digitalWrite(8, LOW); digitalWrite(7, HIGH); digitalWrite(6, LOW); digitalWrite(5, LOW); digitalWrite(4, LOW); digitalWrite(3, LOW); digitalWrite(2, LOW); break; case 7: digitalWrite(8, LOW); digitalWrite(7, LOW); digitalWrite(6, LOW); digitalWrite(5, HIGH); digitalWrite(4, HIGH); digitalWrite(3, HIGH); digitalWrite(2, HIGH); break; case 8: digitalWrite(8, LOW); digitalWrite(7, LOW); digitalWrite(6, LOW); digitalWrite(5, LOW); digitalWrite(4, LOW); digitalWrite(3, LOW); digitalWrite(2, LOW); break; case 9: digitalWrite(8, LOW); digitalWrite(7, LOW); digitalWrite(6, LOW); digitalWrite(5, LOW); digitalWrite(4, HIGH); digitalWrite(3, LOW); digitalWrite(2, LOW); break; } delay(3); digitalWrite(pin, HIGH); } 


And again, flashing the USB controller with the Arduino-Uno-keyboard.hex firmware

...

You can run!

Although ... I personally would not be able to look at the indicator and the monitor for 42 hours in a row, waiting for a suitable password. For these purposes, perfect one-eyed witness - a video camera. The recording will be carried out with an old SONY via miniDV (IEEE-1394) using the free SplitCam program on another computer. Alternatively, you can use a webcam or video recorder for the car.

We launch the MacBook with the “alt” key pressed, subtly “keyboard”, turn on the video and go about our business, periodically visually monitoring the process.

System in action:



In my case, the password was found on the second day. This solemn moment on the video:



As it turned out, after the launch of the operating system, the password was again required, but the unsuspecting Arduino continued the search. Later I came up, disconnected the “keyboard”, squandered the video back and entered the correct password.

In turn, I wish everyone to avoid such situations, so more often update passwords on mailboxes and good luck!

Source: https://habr.com/ru/post/240291/


All Articles