krakrukra / PocketAdmin

oshw keystroke injection device ( badusb )
MIT License
216 stars 45 forks source link

PocketAdmin v1.3 can't execute payload #6

Closed leomacin closed 4 years ago

leomacin commented 4 years ago

Hai krakrukra, I'm glad to greet you. I built PocketAdmin for a weekend project. I succeeded to flash the device both using ST-link and DFU mode. The device can't be detected by Windows 7-64bit and stated as Unknown Device. In Linux, Android, and Windows 10-64bit, it can be detected both as Keyboard and FlashDrive. I managed to format the drive to FAT and POCKETADMIN as label name. I placed a simple payload payload.txt WAITFOR_INIT DELAY 1000 GUI r

However, PocketAdmin doesn't execute the payload, even though it was detected as USB composite input and flash drive. In addtion, whether I press the switch button or not, PocketAdmin still detected as Keyboard and Flash Drive. do you have any solution?

thank you Regards Leo

krakrukra commented 4 years ago

Regarding payload file not working, it might be because you are formatting the whole drive, while you only need to format the first partition. You can follow the steps in the youtube video here: https://youtu.be/jhsEZJUVx_E , to make an MBR partition table with 1 partition on windows 10 PC. Ignore first 5 seconds of the video, your part starts with right-click on windows start menu. Also, make sure that your filename extentions are shown, so your file is called payload.txt and not payload.txt.txt I turn file extentions on in the video right after I place payload file on the drive.

Regarding switch button, it is in fact intended behaviour. Unless you are using HID_ONLY_MODE it shows up as a composite device, but with MSD-only button held down it will not type anything. Now, if MSD-button is not preventing payload execution, this is 100% a bad solder joint. Probably at pin 12 of MCU, right next to capacitor C8. It sits in a nasty corner, so it is easy to make a bad solder joint there if you are assembling the board for the first time.

As to windows 7, I will have to investigate that further. It is probably some drivers issue that windows 7 has with composite devices. Meanwhile, you could try to use HID_ONLY_MODE and see if it will work on your win7 machine. You could also try to change VID/PID values, or go to device manager (on win7 machine), select this "Unknown device" and choose "delete device" somewhere in the menu. Next time you plug the device in, it might get recognised. I remember from my testing that win7 tends to do things like assigning some driver to a device based on VID/PID, and if it was not a correct driver loaded first time, it will not try to change anything and just give errors. Eg. you had a keyboard with some VID/PID before, now you plug in a composite device with this same VID/PID and that could cause a problem.

leomacin commented 4 years ago

thank you. your first suggestion gives me a priceless clue. "make an MBR partition table with 1 partition" Since my drive have been formated then I can't delete volume from disk management. As we know delete active partition is not supported in disk management. Therefore, It is my trick using diskpart Open diskpart in cmd

`DISKPART> list disk

Disk ### Status Size Free Dyn Gpt


Disk 0 Online 465 GB 1024 KB * Disk 1 Online 96 MB 0 B

DISKPART> select disk 1

Disk 1 is now the selected disk.

DISKPART> clean

DiskPart succeeded in cleaning the disk.

DISKPART> create partition primary

DiskPart succeeded in creating the specified partition.

DISKPART> select partition 1

Partition 1 is now the selected partition.

DISKPART> active

DiskPart marked the current partition as active.

DISKPART> FORMAT FS=FAT QUICK

100 percent completed

DiskPart successfully formatted the volume.

DISKPART>`

leomacin commented 4 years ago

UPDATE

The Windows 7-64bit issue has solved. It was because I messed up with my USB driver and protocol in my PC by using VMware. PocketAdmin works perfectly in the other Windows 7 machine. Even It works in Windows 7 inside VMware(from my messed up USB PC).

So, there is no issue anymore. I will close this github issue. Thank you