Skip to content

Instantly share code, notes, and snippets.

@bmatusiak
Created July 19, 2020 01:48
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save bmatusiak/ca96afe69cf3e16783d18f1650aafb50 to your computer and use it in GitHub Desktop.
Save bmatusiak/ca96afe69cf3e16783d18f1650aafb50 to your computer and use it in GitHub Desktop.
#!/bin/bash
modprobe libcomposite
command="$1" # "up" or "down"
gadgetDevice="/sys/kernel/config/usb_gadget/my_gadget"
usb_up() {
if [ -d ${gadgetDevice} ]; then
if [ "$(cat ${gadgetDevice}/UDC)" != "" ]; then
echo "Gadget is already up."
exit 1
fi
echo "Cleaning up old directory..."
usb_down
fi
echo "Setting up gadget..."
cd /sys/kernel/config/usb_gadget/
mkdir -p pi_gadget
cd pi_gadget
#idVendor 0x1d50 OpenMoko, Inc.
#idProduct 0x60fc OnlyKey Two-factor Authentication and Password Solution
echo 0x1d6b > idVendor # Linux Foundation
echo 0x0104 > idProduct # Multifunction Composite Gadget
echo 0x0100 > bcdDevice # v1.0.0
echo 0x0200 > bcdUSB # USB2
mkdir -p strings/0x409
echo "6837591367198653" > strings/0x409/serialnumber
echo "bmatusiak" > strings/0x409/manufacturer
echo "pi" > strings/0x409/product
mkdir -p configs/c.1/strings/0x409
echo "badusb cfg1" > configs/c.1/strings/0x409/configuration
echo 250 > configs/c.1/MaxPower
ms_vendor_code="0xcd" # Microsoft
ms_qw_sign="MSFT100" # also Microsoft (if you couldn't tell)
ms_compat_id="RNDIS" # matches Windows RNDIS Drivers
ms_subcompat_id="5162001" # matches Windows RNDIS 6.0 Driver
echo "1" > os_desc/use
echo "${ms_vendor_code}" > os_desc/b_vendor_code
echo "${ms_qw_sign}" > os_desc/qw_sign
#serial ~ serial or ethernet - pick 1
#mkdir -p functions/acm.usb0
#ln -s functions/acm.usb0 configs/c.1/
#ethernet
mkdir -p functions/rndis.usb0
# first byte of address must be even
HOST="46:6f:73:74:50:43" # "HostPC"
SELF="44:61:64:55:53:42" # "BadUSB"
echo $HOST > functions/rndis.usb0/host_addr
echo $SELF > functions/rndis.usb0/dev_addr
echo "${ms_compat_id}" > functions/rndis.usb0/os_desc/interface.rndis/compatible_id
echo "${ms_subcompat_id}" > functions/rndis.usb0/os_desc/interface.rndis/sub_compatible_id
ln -s functions/rndis.usb0 configs/c.1/
#fidou2f
mkdir -p functions/hid.usb0
echo 0 > functions/hid.usb0/protocol
echo 0 > functions/hid.usb0/subclass
echo 64 > functions/hid.usb0/report_length
echo -ne "\x06\xd0\xf1\x09\x01\xa1\x01\x09\x20\x15\x00\x26\xff\x00\x75\x08\x95\x40\x81\x02\x09\x21\x15\x00\x26\xff\x00\x75\x08\x95\x40\x91\x02\xc0" > functions/hid.usb0/report_desc
#Keyboard / Mouse / Joystick (HID)
# mkdir -p functions/hid.usb0
# echo 1 > functions/hid.usb0/protocol
# echo 1 > functions/hid.usb0/subclass
# echo 8 > functions/hid.usb0/report_length
# echo -ne \\x05\\x01\\x09\\x06\\xa1\\x01\\x05\\x07\\x19\\xe0\\x29\\xe7\\x15\\x00\\x25\\x01\\x75\\x01\\x95\\x08\\x81\\x02\\x95\\x01\\x75\\x08\\x81\\x03\\x95\\x05\\x75\\x01\\x05\\x08\\x19\\x01\\x29\\x05\\x91\\x02\\x95\\x01\\x75\\x03\\x91\\x03\\x95\\x06\\x75\\x08\\x15\\x00\\x25\\x65\\x05\\x07\\x19\\x00\\x29\\x65\\x81\\x00\\xc0 > functions/hid.usb0/report_desc
# ln -s functions/hid.usb0 configs/c.1/
#mass storage
FILE=/home/pi/usbdisk.img
if [ ! -f "$FILE" ]; then
echo "creating $FILE"
dd if=/dev/zero of=$FILE bs=1024 count=1024
mkdosfs $FILE
fi
mkdir -p ${FILE/img/d}
mount -o loop,ro, -t vfat $FILE ${FILE/img/d} # FOR IMAGE CREATED WITH DD
mkdir -p functions/mass_storage.usb0
echo 1 > functions/mass_storage.usb0/stall
echo 0 > functions/mass_storage.usb0/lun.0/cdrom
echo 0 > functions/mass_storage.usb0/lun.0/ro
echo 0 > functions/mass_storage.usb0/lun.0/nofua
echo $FILE > functions/mass_storage.usb0/lun.0/file
ln -s functions/mass_storage.usb0 configs/c.1/
# see gadget configurations below
# End functions
ls /sys/class/udc > UDC
#/bin/sleep 1 #wait for load
ifconfig usb0 192.168.8.254 netmask 255.255.255.0 up
#route add -net default gw 10.0.0.2
/usr/sbin/service isc-dhcp-server stop #restart dhcpd server
/usr/sbin/service isc-dhcp-server start #restart dhcpd server
echo "Done."
}
usb_down() {
if [ ! -d ${gadgetDevice} ]; then
echo "Gadget is already down."
exit 1
fi
echo "Taking down gadget..."
# kill the UDC
if [ "$(cat ${gadgetDevice}/UDC)" != "" ]; then
echo "" > ${gadgetDevice}/UDC
fi
#remove configs
#rm -f ${gadgetDevice}/configs/c.1/acm.usb0
rm -f ${gadgetDevice}/configs/c.1/rndis.usb0
rm -f ${gadgetDevice}/configs/c.1/hid.usb0
rm -f ${gadgetDevice}/configs/c.1/mass_storage.usb0
#remove functions
#[ -d ${gadgetDevice}/functions/acm.usb0 ] && rmdir ${gadgetDevice}/functions/acm.usb0
[ -d ${gadgetDevice}/functions/rndis.usb0 ] && rmdir ${gadgetDevice}/functions/rndis.usb0
[ -d ${gadgetDevice}/functions/hid.usb0 ] && rmdir ${gadgetDevice}/functions/hid.usb0
[ -d ${gadgetDevice}/functions/mass_storage.usb0 ] && rmdir ${gadgetDevice}/functions/mass_storage.usb0
#remove strings
[ -d ${gadgetDevice}/configs/c.1/strings/0x409 ] && rmdir ${gadgetDevice}/configs/c.1/strings/0x409
[ -d ${gadgetDevice}/configs/c.1 ] && rmdir ${gadgetDevice}/configs/c.1
[ -d ${gadgetDevice}/strings/0x409 ] && rmdir ${gadgetDevice}/strings/0x409
#remove the gadget
rmdir ${gadgetDevice}
#umount mass_storage
FILE=/home/pi/usbdisk.img
umount ${FILE/img/d};
echo "Done."
}
case ${command} in
up)
usb_up
;;
down)
usb_down
;;
*)
echo "Usage: usb_gadget.sh up|down"
exit 1
;;
esac
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment