search

RoganDawes / LOGITacker

Enumerate and test Logitech wireless input devices for vulnerabilities with a nRF52840 radio dongle.
GNU General Public License v3.0
635 stars 112 forks source link

Passive-enum mode: raw usb pass-through crash #7

Closed NullByteZero closed 4 years ago

NullByteZero commented 4 years ago

nRF crashes after few seconds of traffic decoding. With raw pass-through enabled. It seems like it can't keep up with the keyboard. But then again it has no problem when pass through is disabled. I've tried halting the logs and closing the terminal. But the result is always the same, it reboots.

Steps leading to the bug:

  1. Start dongle in discover mode. Also open PuTTY.
  2. Wait for dongle to find the keyboard.
  3. Turn on RAW USB pass-through (options passive-enum pass-through-raw on)
  4. Enter passive-enum mode.
  5. Start typing on the wireless keyboard (fast typing, up to 1 min).
  6. Observe logs in the putty terminal. After some time the logs will start lagging and eventually completely stop.
  7. Dongle restarts and the PuTTY terminal closes.

Device: nRF52840-Dongle Firmware: v0.1.2-beta Keyboard: Logitech K350

mame82 commented 4 years ago

Note:

usbd config queue had to be disabled for CLI. Maybe cause of the issue is the native implementation of a queue used by raw HID (to account for fast produced output wvents, like decrypted copy for encrypted reports). Reimplementation of USB message queues has to be tested. Additional debugging has to be applied to find a reproducible root cause