How to deal with strings of symbol and other special characters like unicode?

[andizaa]

When writing payload of strings, it seems it can not read characters like : ; ( ) " '' and $ how to write those strings and how to escape it?

[joelsernamoreno]

Hello

What keyboard layout do you have?

Have you configured this on the device?

[andizaa]

I have configured the cable and it works well for ascii strings and numbers, but it gives wrong typing of symbols like : ; ( ) " '' and $. For example I go to cmd to type: msg Hello then the cable write this: msg } Hello It types * with } It's US Keyboard as in this file: EvilCrowCable-Pro\libraries\USBCrowKeyboard\USBCrowKeyboard\USBCrowKeyboard.cpp

define US_KEYBOARD

[joelsernamoreno]

And your computer is configured with the EN_US layout?

[andizaa]

Yes my computer is EN_US layout. But the weird part is when payload is to open notepad those strings works well : !@#$%^&():<> But only in cmd and powershell, those strings are converted to something else. Please try yourself, open cmd, and type: msg Hello That will be converted to } Even when I modify cmd to: start msg Hello --> it still converted to: start msg } Hello --> which doesnt run the message box But the weird part is I then type in cmd: msg Hello --> it's converted to: msg } Hello --> the shows at the end but not after "msg" and in powershell the $var will be converted to >var

[andizaa]

and also in cmd this prompt: curl https://google.com --> becomes: curl https>&&google.com --> which makes curl not working

[joelsernamoreno]

I have tested your error now, these are my results:

• My payload:

• My layout in the library:

• My layout in Windows 11: English (United States)

• Results in notepad:

• Results in cmd:

• Results in powershell:

It seems that there is no problem here

[andizaa]

as I said, if you open notepad or cmd and directly type !@#$%^&*()_+{}:"<>?[]; That will work just fine. But try put that symbol into arguments, for example in cmd, type: curl https://google.com ----> this will write: curl https>&&google.com (that's weird)

[joelsernamoreno]

Write your payload here and I will test this

[andizaa]

include "exfil.h"

include "phukd.h"

void payload() { delay(2300); Keyboard.press(KEY_LEFT_GUI); Keyboard.press('r'); delay(100); Keyboard.releaseAll(); delay(500); Keyboard.print("cmd"); delay(500); Keyboard.press(KEY_RETURN); delay(100); Keyboard.releaseAll(); delay(1500); Keyboard.print("curl https://google.com"); Keyboard.press(KEY_RETURN); delay(100); Keyboard.releaseAll(); delay(300); Keyboard.print("msg * Hello Friend!"); Keyboard.press(KEY_RETURN); delay(100); Keyboard.releaseAll(); }

Both cmd prompts are not working. The * is replaced with } and the : and // is replaced with > and &&

[andizaa]

This is what shows in my cmd

[joelsernamoreno]

I have copied your code and have no problem with this:

[joelsernamoreno]

Check my video:

https://github.com/user-attachments/assets/490e239e-171e-4a6b-9aca-efe176f49d9d

[andizaa]

ah, so what's the problem then? I use US Keyboard. What keyboard do you use? I already tried ES, US, UK, all the same gives wrong character (in cmd argument). Also in powershell the string $ and : is converted to something else. But when I type in notepad, the symbol works just fine.

[joelsernamoreno]

My Windows 11 is configured with U.S. English layout

Evil Crow Cable Pro is configured with US layout

Can you try this on another computer or increase the delays in the payload?

[andizaa]

https://github.com/user-attachments/assets/fa8a832b-06d5-49f2-ac33-9a0db65c3f6c

I already tried in 3 computers, all the same. As you can see with my payload above this shows different characters in the cmd. Is it the hardware? I bought it from alixpress

[andizaa]

Also tried the US Layout ascii map with this payload: Keyboard.print("msg "); Keyboard.print(0x33); Keyboard.press(KEY_LEFT_SHIFT); Keyboard.press(0x33); Keyboard.write(0x33); delay(200); Keyboard.releaseAll();

But all that doesnt show the symbol * Instead it shows following symbol: