unleashed-firmware/applications/mousejacker/mousejacker_ducky.c

#include "mousejacker_ducky.h"

static const char ducky_cmd_comment[] = {"REM"};
static const char ducky_cmd_delay[] = {"DELAY "};
static const char ducky_cmd_string[] = {"STRING "};
static const char ducky_cmd_repeat[] = {"REPEAT "};

static uint8_t LOGITECH_HID_TEMPLATE[] =
    {0x00, 0xC1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
static uint8_t LOGITECH_HELLO[] = {0x00, 0x4F, 0x00, 0x04, 0xB0, 0x10, 0x00, 0x00, 0x00, 0xED};
static uint8_t LOGITECH_KEEPALIVE[] = {0x00, 0x40, 0x00, 0x55, 0x6B};

uint8_t prev_hid = 0;

#define RT_THRESHOLD 50
#define LOGITECH_MIN_CHANNEL 2
#define LOGITECH_MAX_CHANNEL 83
#define LOGITECH_KEEPALIVE_SIZE 5
#define LOGITECH_HID_TEMPLATE_SIZE 10
#define LOGITECH_HELLO_SIZE 10
#define TAG "mousejacker_ducky"

MJDuckyKey mj_ducky_keys[] = {{" ", 44, 0},         {"!", 30, 2},          {"\"", 52, 2},
                              {"#", 32, 2},         {"$", 33, 2},          {"%", 34, 2},
                              {"&", 36, 2},         {"'", 52, 0},          {"(", 38, 2},
                              {")", 39, 2},         {"*", 37, 2},          {"+", 46, 2},
                              {",", 54, 0},         {"-", 45, 0},          {".", 55, 0},
                              {"/", 56, 0},         {"0", 39, 0},          {"1", 30, 0},
                              {"2", 31, 0},         {"3", 32, 0},          {"4", 33, 0},
                              {"5", 34, 0},         {"6", 35, 0},          {"7", 36, 0},
                              {"8", 37, 0},         {"9", 38, 0},          {":", 51, 2},
                              {";", 51, 0},         {"<", 54, 2},          {"=", 46, 0},
                              {">", 55, 2},         {"?", 56, 2},          {"@", 31, 2},
                              {"A", 4, 2},          {"B", 5, 2},           {"C", 6, 2},
                              {"D", 7, 2},          {"E", 8, 2},           {"F", 9, 2},
                              {"G", 10, 2},         {"H", 11, 2},          {"I", 12, 2},
                              {"J", 13, 2},         {"K", 14, 2},          {"L", 15, 2},
                              {"M", 16, 2},         {"N", 17, 2},          {"O", 18, 2},
                              {"P", 19, 2},         {"Q", 20, 2},          {"R", 21, 2},
                              {"S", 22, 2},         {"T", 23, 2},          {"U", 24, 2},
                              {"V", 25, 2},         {"W", 26, 2},          {"X", 27, 2},
                              {"Y", 28, 2},         {"Z", 29, 2},          {"[", 47, 0},
                              {"\\", 49, 0},        {"]", 48, 0},          {"^", 35, 2},
                              {"_", 45, 2},         {"`", 53, 0},          {"a", 4, 0},
                              {"b", 5, 0},          {"c", 6, 0},           {"d", 7, 0},
                              {"e", 8, 0},          {"f", 9, 0},           {"g", 10, 0},
                              {"h", 11, 0},         {"i", 12, 0},          {"j", 13, 0},
                              {"k", 14, 0},         {"l", 15, 0},          {"m", 16, 0},
                              {"n", 17, 0},         {"o", 18, 0},          {"p", 19, 0},
                              {"q", 20, 0},         {"r", 21, 0},          {"s", 22, 0},
                              {"t", 23, 0},         {"u", 24, 0},          {"v", 25, 0},
                              {"w", 26, 0},         {"x", 27, 0},          {"y", 28, 0},
                              {"z", 29, 0},         {"{", 47, 2},          {"|", 49, 2},
                              {"}", 48, 2},         {"~", 53, 2},          {"BACKSPACE", 42, 0},
                              {"", 0, 0},           {"ALT", 0, 4},         {"SHIFT", 0, 2},
                              {"CTRL", 0, 1},       {"GUI", 0, 8},         {"SCROLLLOCK", 71, 0},
                              {"ENTER", 40, 0},     {"F12", 69, 0},        {"HOME", 74, 0},
                              {"F10", 67, 0},       {"F9", 66, 0},         {"ESCAPE", 41, 0},
                              {"PAGEUP", 75, 0},    {"TAB", 43, 0},        {"PRINTSCREEN", 70, 0},
                              {"F2", 59, 0},        {"CAPSLOCK", 57, 0},   {"F1", 58, 0},
                              {"F4", 61, 0},        {"F6", 63, 0},         {"F8", 65, 0},
                              {"DOWNARROW", 81, 0}, {"DELETE", 42, 0},     {"RIGHT", 79, 0},
                              {"F3", 60, 0},        {"DOWN", 81, 0},       {"DEL", 76, 0},
                              {"END", 77, 0},       {"INSERT", 73, 0},     {"F5", 62, 0},
                              {"LEFTARROW", 80, 0}, {"RIGHTARROW", 79, 0}, {"PAGEDOWN", 78, 0},
                              {"PAUSE", 72, 0},     {"SPACE", 44, 0},      {"UPARROW", 82, 0},
                              {"F11", 68, 0},       {"F7", 64, 0},         {"UP", 82, 0},
                              {"LEFT", 80, 0}};

/*
static bool mj_ducky_get_number(const char* param, uint32_t* val) {
    uint32_t value = 0;
    if(sscanf(param, "%lu", &value) == 1) {
        *val = value;
        return true;
    }
    return false;
}
*/

static uint32_t mj_ducky_get_command_len(const char* line) {
    uint32_t len = strlen(line);
    for(uint32_t i = 0; i < len; i++) {
        if(line[i] == ' ') return i;
    }
    return 0;
}

static bool mj_get_ducky_key(char* key, size_t keylen, MJDuckyKey* dk) {
    //FURI_LOG_I(TAG, "looking up key %s with length %d", key, keylen);
    for(uint i = 0; i < sizeof(mj_ducky_keys) / sizeof(MJDuckyKey); i++) {
        if(!strncmp(mj_ducky_keys[i].name, key, keylen)) {
            memcpy(dk, &mj_ducky_keys[i], sizeof(MJDuckyKey));
            return true;
        }
    }

    return false;
}

static void checksum(uint8_t* payload, uint len) {
    // This is also from the KeyKeriki paper
    // Thanks Thorsten and Max!
    uint8_t cksum = 0xff;
    for(uint n = 0; n < len - 2; n++) cksum = (cksum - payload[n]) & 0xff;
    cksum = (cksum + 1) & 0xff;
    payload[len - 1] = cksum;
}

static void inject_packet(
    FuriHalSpiBusHandle* handle,
    uint8_t* addr,
    uint8_t addr_size,
    uint8_t rate,
    uint8_t* payload,
    size_t payload_size) {
    uint8_t rt_count = 0;
    while(1) {
        if(nrf24_txpacket(handle, payload, payload_size, true)) break;

        rt_count++;
        // retransmit threshold exceeded, scan for new channel
        if(rt_count > RT_THRESHOLD) {
            if(nrf24_find_channel(
                   handle,
                   addr,
                   addr,
                   addr_size,
                   rate,
                   LOGITECH_MIN_CHANNEL,
                   LOGITECH_MAX_CHANNEL,
                   true) > LOGITECH_MAX_CHANNEL)
                return; // fail

            rt_count = 0;
        }
    }
}

static void build_hid_packet(uint8_t mod, uint8_t hid, uint8_t* payload) {
    memcpy(payload, LOGITECH_HID_TEMPLATE, LOGITECH_HID_TEMPLATE_SIZE);
    payload[2] = mod;
    payload[3] = hid;
    checksum(payload, LOGITECH_HID_TEMPLATE_SIZE);
}

static void send_hid_packet(
    FuriHalSpiBusHandle* handle,
    uint8_t* addr,
    uint8_t addr_size,
    uint8_t rate,
    uint8_t mod,
    uint8_t hid) {
    uint8_t hid_payload[LOGITECH_HID_TEMPLATE_SIZE] = {0};
    build_hid_packet(0, 0, hid_payload);
    if(hid == prev_hid)
        inject_packet(
            handle,
            addr,
            addr_size,
            rate,
            hid_payload,
            LOGITECH_HID_TEMPLATE_SIZE); // empty hid packet

    prev_hid = hid;
    build_hid_packet(mod, hid, hid_payload);
    inject_packet(handle, addr, addr_size, rate, hid_payload, LOGITECH_HID_TEMPLATE_SIZE);
    furi_delay_ms(12);
}

// returns false if there was an error processing script line
static bool mj_process_ducky_line(
    FuriHalSpiBusHandle* handle,
    uint8_t* addr,
    uint8_t addr_size,
    uint8_t rate,
    char* line,
    char* prev_line) {
    MJDuckyKey dk;
    uint8_t hid_payload[LOGITECH_HID_TEMPLATE_SIZE] = {0};
    char* line_tmp = line;
    uint32_t line_len = strlen(line);
    for(uint32_t i = 0; i < line_len; i++) {
        if((line_tmp[i] != ' ') && (line_tmp[i] != '\t') && (line_tmp[i] != '\n')) {
            line_tmp = &line_tmp[i];
            break; // Skip spaces and tabs
        }
        if(i == line_len - 1) return true; // Skip empty lines
    }

    FURI_LOG_I(TAG, "line: %s", line_tmp);

    // General commands
    if(strncmp(line_tmp, ducky_cmd_comment, strlen(ducky_cmd_comment)) == 0) {
        // REM - comment line
        return true;
    } else if(strncmp(line_tmp, ducky_cmd_delay, strlen(ducky_cmd_delay)) == 0) {
        // DELAY
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        uint32_t delay_val = 0;
        delay_val = atoi(line_tmp);
        if(delay_val > 0) {
            uint32_t delay_count = delay_val / 10;
            build_hid_packet(0, 0, hid_payload);
            inject_packet(
                handle,
                addr,
                addr_size,
                rate,
                hid_payload,
                LOGITECH_HID_TEMPLATE_SIZE); // empty hid packet
            for(uint32_t i = 0; i < delay_count; i++) {
                inject_packet(
                    handle, addr, addr_size, rate, LOGITECH_KEEPALIVE, LOGITECH_KEEPALIVE_SIZE);
                furi_delay_ms(10);
            }
            return true;
        }
        return false;
    } else if(strncmp(line_tmp, ducky_cmd_string, strlen(ducky_cmd_string)) == 0) {
        // STRING
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        for(size_t i = 0; i < strlen(line_tmp); i++) {
            if(!mj_get_ducky_key(&line_tmp[i], 1, &dk)) return false;

            send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid);
        }

        return true;
    } else if(strncmp(line_tmp, ducky_cmd_repeat, strlen(ducky_cmd_repeat)) == 0) {
        // REPEAT
        uint32_t repeat_cnt = 0;
        if(prev_line == NULL) return false;

        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        repeat_cnt = atoi(line_tmp);
        if(repeat_cnt < 2) return false;

        FURI_LOG_I(TAG, "repeating %s %d times", prev_line, repeat_cnt);
        for(uint32_t i = 0; i < repeat_cnt; i++)
            mj_process_ducky_line(handle, addr, addr_size, rate, prev_line, NULL);

        return true;
    } else if(strncmp(line_tmp, "ALT", strlen("ALT")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 4, dk.hid);
        return true;
    } else if(
        strncmp(line_tmp, "GUI", strlen("GUI")) == 0 ||
        strncmp(line_tmp, "WINDOWS", strlen("WINDOWS")) == 0 ||
        strncmp(line_tmp, "COMMAND", strlen("COMMAND")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 8, dk.hid);
        return true;
    } else if(
        strncmp(line_tmp, "CTRL-ALT", strlen("CTRL-ALT")) == 0 ||
        strncmp(line_tmp, "CONTROL-ALT", strlen("CONTROL-ALT")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 4 | 1, dk.hid);
        return true;
    } else if(
        strncmp(line_tmp, "CTRL-SHIFT", strlen("CTRL-SHIFT")) == 0 ||
        strncmp(line_tmp, "CONTROL-SHIFT", strlen("CONTROL-SHIFT")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 4 | 2, dk.hid);
        return true;
    } else if(
        strncmp(line_tmp, "CTRL", strlen("CTRL")) == 0 ||
        strncmp(line_tmp, "CONTROL", strlen("CONTROL")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 1, dk.hid);
        return true;
    } else if(strncmp(line_tmp, "SHIFT", strlen("SHIFT")) == 0) {
        line_tmp = &line_tmp[mj_ducky_get_command_len(line_tmp) + 1];
        if(!mj_get_ducky_key(line_tmp, strlen(line_tmp), &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod | 2, dk.hid);
        return true;
    } else if(
        strncmp(line_tmp, "ESC", strlen("ESC")) == 0 ||
        strncmp(line_tmp, "APP", strlen("APP")) == 0 ||
        strncmp(line_tmp, "ESCAPE", strlen("ESCAPE")) == 0) {
        if(!mj_get_ducky_key("ESCAPE", 6, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid);
        return true;
    } else if(strncmp(line_tmp, "ENTER", strlen("ENTER")) == 0) {
        if(!mj_get_ducky_key("ENTER", 5, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid);
        return true;
    } else if(
        strncmp(line_tmp, "UP", strlen("UP")) == 0 ||
        strncmp(line_tmp, "UPARROW", strlen("UPARROW")) == 0) {
        if(!mj_get_ducky_key("UP", 2, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid);
        return true;
    } else if(
        strncmp(line_tmp, "DOWN", strlen("DOWN")) == 0 ||
        strncmp(line_tmp, "DOWNARROW", strlen("DOWNARROW")) == 0) {
        if(!mj_get_ducky_key("DOWN", 4, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid);
        return true;
    } else if(
        strncmp(line_tmp, "LEFT", strlen("LEFT")) == 0 ||
        strncmp(line_tmp, "LEFTARROW", strlen("LEFTARROW")) == 0) {
        if(!mj_get_ducky_key("LEFT", 4, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid);
        return true;
    } else if(
        strncmp(line_tmp, "RIGHT", strlen("RIGHT")) == 0 ||
        strncmp(line_tmp, "RIGHTARROW", strlen("RIGHTARROW")) == 0) {
        if(!mj_get_ducky_key("RIGHT", 5, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid);
        return true;
    } else if(strncmp(line_tmp, "SPACE", strlen("SPACE")) == 0) {
        if(!mj_get_ducky_key("SPACE", 5, &dk)) return false;
        send_hid_packet(handle, addr, addr_size, rate, dk.mod, dk.hid);
        return true;
    }

    return false;
}

void mj_process_ducky_script(
    FuriHalSpiBusHandle* handle,
    uint8_t* addr,
    uint8_t addr_size,
    uint8_t rate,
    char* script) {
    uint8_t hid_payload[LOGITECH_HID_TEMPLATE_SIZE] = {0};
    char* prev_line = NULL;

    inject_packet(handle, addr, addr_size, rate, LOGITECH_HELLO, LOGITECH_HELLO_SIZE);
    char* line = strtok(script, "\n");
    while(line != NULL) {
        if(strcmp(&line[strlen(line) - 1], "\r") == 0) line[strlen(line) - 1] = (char)0;

        if(!mj_process_ducky_line(handle, addr, addr_size, rate, line, prev_line))
            FURI_LOG_I(TAG, "unable to process ducky script line: %s", line);

        prev_line = line;
        line = strtok(NULL, "\n");
    }
    build_hid_packet(0, 0, hid_payload);
    inject_packet(
        handle,
        addr,
        addr_size,
        rate,
        hid_payload,
        LOGITECH_HID_TEMPLATE_SIZE); // empty hid packet at end
}