Back to Home

Brutforsim EFI with Arduino

brute force · brute-force · hacking · iCloud · Apple ID · MacBook

Brutforsim EFI with Arduino

Greetings to Khabravchan!

I think that you won’t surprise many with this topic - just type in the search term “arduino bruteforce” and it will immediately become clear how widespread the enumeration of passwords using the Arduino platform is. I want to talk about how to quickly organize this with the smallest sets of components, without wiring / etching the boards and soldering. I’ll make a reservation right away that the actions I have described are for informational purposes only and have not caused harm to anyone, either moral or physical ... unless to scammers.


 
Why did i do that

One evening on my iPhone I received a password change notification in Apple ID. Suspecting something was amiss, I rushed to check my Apple ID account. As you might have guessed, the same unpleasant situation happened to me . Naturally, I couldn’t log into my account, I also couldn’t restore the password - Apple didn’t receive letters in the mailbox. Soon I discovered a well-known hacker chip - filtering incoming mail on the box itself. Actually, they initially hacked the mailbox, then without any problems changed the password to Apple ID. But when it was possible to regain access to the Apple ID, it was too late. By that time, the iPhone was blocked by cybercriminals via the “Find iPhone” service, the MacBook also required a password, and as expected, a message appeared on the screen:



And if resetting the iPhone to factory settings via iCloud did not cause any difficulties, then resetting the lock with Mac with standard tools is impossible . On a Mac, the password is set not to the account, but directly to the EFI firmware. The password is stored on a separate chip in encrypted form, so the computer becomes locked at the iron level. The support service sent me to an authorized service center, where for the N-th amount and a couple of days they suggested resetting the password. By the way, this amount is almost twice as much as fraudsters ask for a password. But I did not rush to part with the money and began to search on the Internet for ways to do everything myself. Having shoveled many forums, I came to the conclusion that we need a complete enumeration of passwords.

Eureka!

Manually sorting 10,000 combinations is not a royal matter, and there is no place to launch a script. Fortunately, the keyboard connected to the MacBook via USB has earned, which means it's time to create a “smart USB keyboard”! It was for this case that my Arduino Uno scarf was gathering dust, and with it the whole concert will be.

A small digression. Later on the Internet I found one interesting “cracker” project on Arduino, a rather serious device that reads and analyzes pictures through a VGA connector. But this is for those who have a desire and a lot of time.

For business

To begin with, I found a special firmware for the ATMEL MEGA16U2 chip, on the Arduino Uno there is also ATMEL MEGA8U2. This is the USB controller of the Arduino board. In the photo below, the location of the Arduino Uno USB controller R3 revision is



needed : Such firmware is needed so that the computer perceives the board not as a COM port device, but as a HID keyboard. The firmware code will be later.

Note: Arduino Leonardo Arduino Micro and support USB HID nominally

So, the case we need to - to write a program for the controller itself. First, check our "keyboard" on a deliberately unbroken work computer.

ATTENTION! We flash the ATMEGA controller first, only then the MEGA USB controller! The Arduino development environment does not know how to flash keyboards.

Download the test sketch to the controller:

uint8_t buf[8] = { 0 }; // байт с информацией о «нажатой» клавише
void setup() 
{
  Serial.begin(9600); // Устанавливаем скорость соединения
  delay(2000); // Пауза, чтобы «клавиатура» успела определиться в системе
}
void loop() 
{
  int dig1, dig2, dig3, dig4; // Цифры, которые будут последовательно вводиться
  int keys[10] = { 39, 30, 31, 32, 33, 
  34, 35, 36, 37, 38  }; // Массив с ASCII кодами цифер от 0 до 9 соответственно
// Перебираем комбинации, начиная  с 0000:
  for(dig1=0; dig1<10; dig1++)
  {
    for(dig2=0; dig2<10; dig2++)
    {
      for(dig3=0; dig3<10; dig3++)
      {
        for(dig4=0; dig4<10; dig4++)
        {
          pressKey(keys[dig1]);
          pressKey(keys[dig2]);
          pressKey(keys[dig3]);
          pressKey(keys[dig4]);
          pressKey(40); // Клавиша Enter
          delay(1000);
        }
      }
    }
  }
}
void pressKey(int dig) // Функция ввода
{
  buf[2] = dig;
  Serial.write(buf, 8); // Нажать клавишу
  buf[0] = 0;
  buf[2] = 0;
  delay(20);
  Serial.write(buf, 8); // Отпустить клавишу
  delay(200);
}


Disconnect the Arduino from the computer.

Now you need to flash the USB controller, for this we download the FLIP (Windows) program from the ATMEL website and install it.
In the case of MacOS, separate instructions . For some versions of Arduino Uno there are subtleties when flashing a USB controller, details here .

Create the hex-file for the firmware of the USB controller. You can simply copy the code into a text editor such as Notepad and save with the extension .hex
"Arduino-Uno-keyboard.hex"
: 100000009AC00000B3C00000B1C00000AFC0000043
: 10001000ADC00000ABC00000A9C00000A7C0000038
: 10002000A5C00000A3C00000A1C00000E3C3000001
: 100030009DC000009BC0000099C0000097C0000058
: 1000400095C0000093C0000091C000008FC0000068
: 100050008DC000008BC0000089C0000052C10000AC
: 1000600085C0000083C0000081C000007FC0000088
: 100070007DC000007BC0000079C0000077C0000098
: 1000800075C0000073C0000071C000006FC00000A8
: 100090006DC000006BC0000005010906A1017501DB
: 1000A0009508050719E029E715002501810295014A
: 1000B0007508810395057501050819012905910247
: 1000C00095017503910395067508150026E700054F
: 1000D00007190029E78100C0120110010000000883
: 1000E000EB0342200000010200010902220001018D
: 1000F00000C03209040000010301010009211101BF
: 1001000000012240000705810308000A04030904D6
: 100110001003410072006400750069006E006F00FA
: 10012000000012034B006500790062006F0061005F
: 1001300072006400000011241FBECFEFD2E0DEBFCA
: 10014000CDBF11E0A0E0B1E0E8EAFFE002C0059019
: 100150000D92AE30B107D9F711E0AEE0B1E001C0C9
: 100160001D92AE3AB107E1F74ED01CC749CFBF92FE
: 10017000CF92DF92EF92FF920F931F93CF93DF9373
: 1001800084B7877F84BF28E10FB6F894209360007E
: 10019000109260000FBE3CECC32ED12C87E690E09D
: 1001A000F601918380839AECE92EF12C86E0B82E3B
: 1001B000F701B08208EC10E0F8011082C9ECD0E041
: 1001C0002883539A5A9A0BD384E085BD5F9A579A35
: 1001D0001882F8011082F70110828FEC90E0F6018E
: 1001E00091838083F701B08282E0F801808388E9FF
: 1001F0008883DF91CF911F910F91FF90EF90DF9057
: 10020000CF90BF900895B3DF2FB7F8948FE191E0BE
: 100210009093A00180939F019093A2018093A101EC
: 100220002FBF789480E091E0E7D584D4FBCF089588
: 10023000089580E091E0B8D5E2EEF0E0808184603E
: 100240008083089580E091E087C480910B019091B4
: 100250000C01009729F0019790930C0180930B01FA
: 1002600008950F931F93CF93DF93E8019FB7F894FE
: 100270008091A3019FBF883050F1AEE0B1E08FE1E3
: 1002800091E0E091A101F091A2015191F093A201BE
: 10029000E093A10141E0EF39F40721F49093A2012A
: 1002A0008093A1016FB7F8944091A301415040930E
: 1002B000A3016FBF5D9341E0A631B40711F78091B0
: 1002C00016019091C80095FFFCCF8093CE00EEE020
: 1002D000F1E0822F932FDC0181918D9381E0E63153
: 1002E000F807D1F788E090E09983888380E0DF9178
: 1002F000CF911F910F910895F9018081809316018C
: 1003000008951F920F920FB60F9211242F938F937F
: 100310009F93EF93FF938091CE009EB39430F9F4B6
: 10032000E0919F01F091A0018083E0919F01F09105
: 10033000A001CF0101969093A00180939F0121E03D
: 100340008F39920721F48FE191E0928381839FB7E7
: 10035000F8948091A3018F5F8093A3019FBFFF91C9
: 10036000EF919F918F912F910F900FBE0F901F9043
: 100370001895933089F0943028F4913059F19230E7
: 1003800071F505C09132E1F0923249F51EC022E2CA
: 1003900030E0EAEEF0E027C0813049F0813018F01B
: 1003A0008230E9F408C0ECE0F1E0249107C0E0E11C
: 1003B000F1E0249103C0E2E2F1E0249130E013C0C7
: 1003C00029E030E0ECEFF0E00EC020E430E0E8E9B6
: 1003D000F0E009C022E130E0E8EDF0E004C020E008
: 1003E00030E0E0E0F0E0DA011196FC93EE93C90111
: 1003F000089528E030E040E003C04F5F220F331F34
: 1004000028173907D0F3842F8295807F0895809331
: 10041000E900EBEEF0E0808181608083EDEEF0E0BA
: 1004200010826093EC0040838091EE00881F882743
: 10043000881F08951092F40080E08093E9001092E4
: 10044000F0001092E8001092ED009091EB009E7F7A
: 100450009093EB008F5F853081F708958091A6011E
: 1004600087FF11C003C08EB38823B1F08091E800EC
: 1004700082FFF9CF8091E8008B778093E8000895A0
: 100480008EB3882349F08091E80080FFF9CF8091F6
: 10049000E8008E778093E800089584E69091EC0060
: 1004A00090FF05C09091E80090FF05C01BC090919F
: 1004B000E80092FD17C09EB39923B1F09EB395302A
: 1004C000A9F09091EB0095FD13C09091E10092FF8F
: 1004D000E5CF9091E1009B7F9093E100882351F05C
: 1004E0008150DCCF80E0089582E0089583E0089594
: 1004F00081E0089584E00895AF92BF92DF92EF9279
: 10050000FF920F931F93DF93CF930F92CDB7DEB778
: 10051000082F5B017A019983C0DFD82E9981882347
: 1005200031F5192F1CC08091E80085FD10C0809125
: 10053000E8008E778093E800E114F10421F0F701E0
: 100540000995813081F0A9DF882349F00FC0F801B7
: 1005500081918F018093F1000894A108B108A11442
: 10056000B10409F704C075E0D72E01C0D82E8D2D37
: 100570000F90CF91DF911F910F91FF90EF90DF903F
: 10058000BF90AF900895282F392FF9018091AC01C9
: 100590009091AD018617970718F4BC0190E032C026
: 1005A00061157105D9F78091E8008E778093E80096
: 1005B000F5CF8091E80083FD37C08091E80082FD8F
: 1005C0002DC08EB38823A1F18EB3853079F180914F
: 1005D000E80080FF17C08091F20006C091919093CF
: 1005E000F100615070408F5F6115710511F0883026
: 1005F000A8F391E0883009F090E08091E8008E77D0
: 100600008093E80061157105A1F6992391F606C063
: 100610008EB3882369F08EB3853061F08091E80055
: 1006200082FFF6CF80E0089581E0089583E0089589
: 1006300082E0089583E00895282F392FC901209181
: 10064000AC013091AD012617370718F4B90130E03D
: 1006500034C061157105D9F72091E8002E772093F9
: 10066000E800F5CF2091E80023FD39C02091E80093
: 1006700022FD2FC02EB32223B1F12EB3253089F1F4
: 100680002091E80020FF19C02091F20008C0FC0171
: 100690000196E491E093F100615070402F5F611585
: 1006A000710511F0283098F331E0283009F030E07E
: 1006B0002091E8002E772093E8006115710591F6EE
: 1006C000332381F606C08EB3882369F08EB385305C
: 1006D00061F08091E80082FFF6CF80E0089581E02C
: 1006E000089583E0089582E0089583E008956115F8
: 1006F000710519F51DC02091E80023FD2EC02EB311
: 10070000222379F12EB3253051F12091E80022FF08
: 10071000F2CFE82FF92F07C08091F1008193CF012C
: 100720006150704029F0CF012091F2002223A1F7FF
: 100730002091E8002B772093E80061157105D9F628
: 1007400006C08EB3882369F08EB3853061F0809146
: 10075000E80080FFF6CF80E0089581E0089583E00F
: 10076000089582E0089583E008953ED040D01EBAF7
: 100770001092A40184E089BD89B5826089BD09B465
: 1007800000FEFDCF8091D800982F9F779093D800DE
: 1007900080688093D800809163008E7F809363008F
: 1007A0008091D8008F7D8093D8008091E0008E7F6B
: 1007B0008093E0008091E1008E7F8093E100809142
: 1007C000E20081608093E2008091E100877F809366
: 1007D000E1008091E20088608093E2000895C5DF27
: 1007E00081E08093A50108951092E200089510928F
: 1007F000E10008951F920F920FB60F9211242F93CC
: 100800003F934F935F936F937F938F939F93AF9398
: 10081000BF93EF93FF938091E10080FF1BC0809115
: 10082000E20080FF17C08091E1008E7F8093E1009D
: 100830008091E2008E7F8093E2008091E2008061EF
: 100840008093E2008091D80080628093D80019BC28
: 100850001EBAEEDC8091E10084FF29C08091E200A5
: 1008600084FF25C084E089BD89B5826089BD09B453
: 1008700000FEFDCF8091D8008F7D8093D8008091BD
: 10088000E1008F7E8093E1008091E2008F7E809373
: 10089000E2008091E20081608093E2008091A401F7
: 1008A000882311F084E001C081E08EBBC0DC809120
: 1008B000E10083FF22C08091E20083FF1EC080918F
: 1008C000E100877F8093E10082E08EBB1092A4015B
: 1008D0008091E1008E7F8093E1008091E2008E7F25
: 1008E0008093E2008091E20080618093E200A2DDCB
: 1008F00080E060E042E08BDD1CD18091E10082FF6E
: 100900000AC08091E20082FF06C08091E1008B7FE7
: 100910008093E1009ADCFF91EF91BF91AF919F919D
: 100920008F917F916F915F914F913F912F910F9098
: 100930000FBE0F901F9018951F93DF93CF9300D099
: 10094000CDB7DEB7E6EAF1E08091F100819381E076
: 10095000EE3AF807C9F78091A6019091A70195306A
: 1009600009F46BC0963040F4913061F1913070F031
: 10097000933009F0C9C026C0983009F49BC0993063
: 1009800009F4AAC0963009F0BFC075C0803809F4D8
: 10099000BCC0823809F0B8C08091AA0187708093EA
: 1009A000E9009091EB001092E9008091E800877FC8
: 1009B0008093E80081E095FF80E08093F100109241
: 1009C000F10083C0882319F0823009F09DC08F7137
: 1009D000823009F09AC08091A801882341F52091C6
: 1009E000AA01277009F491C02093E9008091EB00DF
: 1009F00080FF8BC08091A701833021F48091EB00B0
: 100A0000806213C08091EB0080618093EB0081E0F5
: 100A100090E002C0880F991F2A95E2F78093EA00C0
: 100A20001092EA008091EB0088608093EB001092B6
: 100A3000E9008091E800877F4BC0882309F064C0FB
: 100A40001091A8018091E800877F8093E80006DD7F
: 100A500004C08EB3882309F458C08091E80080FF59
: 100A6000F8CF1F7711F083E001C082E08EBB1068E1
: 100A70001093E3004AC08058823008F045C080914E
: 100A8000A8019091A9016091AA01AE014F5F5F4F4B
: 100A900070DCBC010097C9F18091E800877F8093EA
: 100AA000E80089819A81C8DD8091E8008B77809386
: 100AB000E8002BC0803841F58091E800877F809363
: 100AC000E8008091A4018093F1008091E8008E7786
: 100AD0008093E800C3DC19C08823B1F49091A80189
: 100AE000923098F48091E800877F8093E80090939B
: 100AF000A401B4DC8091A401882311F084E001C03A
: 100B000083E08EBB96DB01C09DDB8091E80083FF14
: 100B10000AC08091EB0080628093EB008091E80036
: 100B2000877F8093E8000F900F90CF91DF911F9106
: 100B3000089508951F938EB3882361F01091E90002
: 100B400017701092E9008091E80083FF01C0F4DE85
: 100B50001093E9001F9108956F927F928F929F9258
: 100B6000AF92BF92CF92DF92EF92FF920F931F93BB
: 100B7000DF93CF9300D00F92CDB7DEB77C016DB677
: 100B80007EB68091E80083FFF8C0F701808190E095
: 100B90002091AA013091AB012817390709F0EDC067
: 100BA0008091A701833009F499C0843030F48130FA
: 100BB00071F0823009F0E1C0C8C08A3009F4AEC0DB
: 100BC0008B3009F498C0893009F0D7C04CC08091AF
: 100BD000A601813A09F0D1C0CDB6DEB69DB68D2C06
: 100BE0008091E800877F8093E8001B821A828091C1
: 100BF000A8010091A9018983F7014781C41AD1088E
: 100C00000FB6F894DEBE0FBECDBE0894C11CD11C39
: 100C1000BC2CAD2CC60160E070E050E0BCD1402F90
: 100C20004150C701BE016F5F7F4F96018E010E5F7D
: 100C30001F4F17DBF701258136812115310529F07A
: 100C40004781C901B60150E09DD11092E9006A8147
: 100C50007B818B2D9A2D97DC8091E8008B77809398
: 100C6000E800940133C08091A601813209F085C06B
: 100C7000CDB6DEB6BDB6AD2C8091E800877F8093FF
: 100C8000E8000091AC011091AD019090A801809016
: 100C9000A9018DB79EB7801B910B0FB6F8949EBF2C
: 100CA0000FBE8DBFCDB6DEB60894C11CD11CC601E7
: 100CB000B8011DDD482D4150C701692D96011CDB8F
: 100CC0008091E8008E778093E8009501832F922F22
: 100CD0000FB6F8949EBF0FBE8DBF4FC08091A60186
: 100CE000813A09F04AC08091E800877F8093E8004C
: 100CF000F70180853AC08091A601813209F03DC09C
: 100D00008091E800877F8093E8009091A80181E0BE
: 100D1000992309F480E0F70180872EC08091A60115
: 100D2000813259F58091E800877F8093E8008091B7
: 100D3000A8019091A901807036E0969587953A9523
: 100D4000E1F7F7019287818717C08091A601813A68
: 100D5000A1F48091E800877F8093E800F701818506
: 100D6000928596958795969587958093F1008091C9
: 100D7000E8008E778093E80071DB0FB6F8947EBEB2
: 100D80000FBE6DBE0F900F900F90CF91DF911F910E
: 100D90000F91FF90EF90DF90CF90BF90AF909F901A
: 100DA0008F907F906F9008950F931F93CF93DF9351
: 100DB000FC010896DC0185E0ED0119928A95E9F7BE
: 100DC00081E0808784EF91E092878187228133815F
: 100DD00001818481882311F014E001C010E0C90171
: 100DE00008DB412F482B4260802F61EC10DBDF9144
: 100DF000CF911F910F9108954F925F926F927F92C2
: 100E00008F929F92AF92BF92CF92DF92EF92FF921A
: 100E10000F931F93DF93CF9300D00F92CDB7DEB720
: 100E20007C016DB67EB68EB3843009F085C0F701C3
: 100E300081818093E9008091E80085FF7DC05DB6E7
: 100E4000472C4781CDB6DEB6C41AD1080FB6F89448
: 100E5000DEBE0FBECDBE0DB71EB70F5F1F4FB02E4B
: 100E6000912E19821B821A82C80160E070E050E066
: 100E700092D0C701BE016F5F7F4F40E098018E01A5
: 100E80000E5F1F4FEED9882EF7018185928500975E
: 100E900059F081E090E0238534852115310511F06A
: 100EA00080E090E06C0102C0CC24DD24F7010581D4
: 100EB00016810115110599F04A815B818B2D992DC1
: 100EC000B80153D0AA24A394009709F4AA24F701E7
: 100ED0004781C8016B2D792D50E054D001C0AA2460
: 100EE0008A819B81009701F1882029F4AA2019F4B6
: 100EF000C114D104C9F0F701818592859487838755
: 100F000081818093E9008981882311F08093F10029
: 100F10006A817B818B2D992D40E050E0EDDA809144
: 100F2000E8008E778093E8009201832F942D0FB60E
: 100F3000F8949EBF0FBE8DBF0FB6F8947EBE0FBE55
: 100F40006DBE0F900F900F90CF91DF911F910F9179
: 100F5000FF90EF90DF90CF90BF90AF909F908F90D9
: 100F60007F906F905F904F900895FB01DC0104C06B
: 100F70008D910190801921F441505040C8F7881B91
: 100F8000990B0895FB01DC0102C001900D924150C4
: 100F90005040D8F70895DC0101C06D934150504096
: 080FA000E0F70895F894FFCF7B
: 0E0FA800000108000017010800000000000012
: 00000001FF

Next, you need to put the Arduino into DFU mode. To do this, open the “Device Manager” on Windows, connect the board to the computer, make sure that Windows sees it as a COM port device, then short-circuit the Arduino contacts with a piece of iron as shown in the picture below:



After 5-10 seconds, open the contacts. If a new USB device “ATmega16U2” (or “... 8U2”) appears in the dispatcher - excellent!

No - close the contacts again, you can try to hold it longer. If “Unknown device” appears, then you need to install the driver for the Arduino USB controller: right-click on “Unknown device”> “Update drivers”> “Search for drivers on this computer”> look for the directory with FLIP installed, in it there is a folder "Usb"> install the driver.

As a result, we should see the following:



So, Arduino in DFU mode, now it can be turned into a keyboard. The following is a description of working under Windows.

1. Launch FLIP. In the “Device” tab, click “Select” or click on the microcircuit, look in the list for “ATmega16U2” (or “... 8U2”), click “OK”.



2. Next, the tab “Settings”> “Communication” or click on the USB lanyard> “USB”> “Open”. If no errors popped up, then so far we are doing everything right. Otherwise, we try to re-enter the Arduino into DFU mode.





3. Now the tab “File”> “Load HEX File ...” or click on the book with the arrow, look for the “Arduino-Uno-keyboard.hex” file created earlier, check the checkboxes and click on “Run”.





A couple of moments and Arduino turns ... into an elegant keyboard! Disconnect the board from the computer. On your computer, open any text editor, then connect the Arduino again. In a couple of seconds, someone will start typing:

0000
0001
0002 ...

Our poltergeist password switcher is almost ready!

Everything would be fine, but when Arduino enters passwords on a MacBook, we won’t be able to find out which one turned out to be correct. We will know for sure that some four stars came up. Therefore, we will make sure that the current password is displayed on a 28-segment indicator. I just had this:



The indicator module is already soldered to the board with the keys and resistors, so, in my case, the connection diagram is simple: we connect the VCC indicator to the 5V Arduino pin, the rest from D1 to G to the Arduino digital pins from 12 to 2, respectively.

There are many types of segment indicators: with a common cathode, with a common anode; with a built-in controller, without a controller, matrix, respectively, and methods for connecting indicators to the controller are different. The easiest way is to work with a modular indicator that has a controller or at least matrix wiring:



I just have to stick the indicator somewhere with electrical tape:



Finish line

We write a sketch with support for a modular indicator and the necessary input settings. The measurements showed that the MacBook password entry delay time before loading the OS is 12 seconds after 5 attempts of incorrect entry. To flash the “keyboard”, you need to return the Arduino USB controller to its original state. To do this, create a hex-file of the native firmware of the USB controller. The code is also just copied to a text editor such as Notepad and saved with the extension .hex
"Arduino-Uno-R3-usbserial.hex"
: 1000000090C00000A9C00000A7C00000A5C000006B
: 10001000A3C00000A1C000009FC000009DC0000060
: 100020009BC0000099C0000097C0000048C40000B9
: 100030000CC4000091C000008FC000008DC0000003
: 100040008BC0000089C0000087C0000085C0000090
: 1000500083C0000081C000007FC0000002C100001A
: 100060007BC0000079C0000077C0000075C00000B0
: 1000700073C0000071C000006FC000006DC00000C0
: 100080006BC0000069C0000067C0000065C00000D0
: 1000900063C0000061C000001201100102000008EE
: 1000A0004123430001000102DC0109023E0002017C
: 1000B00000C0320904000001020201000524000111
: 1000C0001004240206052406000107058203080027
: 1000D000FF09040100020A000000070504024000B5
: 1000E00001070583024000010403090432034100B3
: 1000F00072006400750069006E006F002000280027
: 100100007700770077002E006100720064007500B0
: 1001100069006E006F002E0063006300290000007C
: 10012000000011241FBECFEFD2E0DEBFCDBF11E033
: 10013000A0E0B1E0ECEAFFE002C005900D92A6312C
: 10014000B107D9F712E0A6E1B1E001C01D92AF32CC
: 10015000B107E1F7F1D028C753CF9C01DC01AE57BE
: 10016000BF4FED91FC91119741911196FC93EE9345
: 1001700080589F4FE817F90711F42D933C939FB7D0
: 10018000F894F901EC57FF4F8081815080839FBF25
: 10019000842F0895DF92EF92FF920F931F93FC013B
: 1001A0008489813019F0823021F405C040E3D42ED7
: 1001B00004C0DD2402C030E2D32E8389823011F4E2
: 1001C00088E0D82A8589873031F0883031F0863050
: 1001D00031F482E003C084E001C086E0D82A1092A6
: 1001E000C9001092C8001092CA00E784F088018903
: 1001F000128980E0E81681EEF80680E0080780E0CA
: 10020000180719F420E130E00FC0C801B701969536
: 1002100087957795679560587B47814E9F4FA801DA
: 100220009701A0D6215030403093CD002093CC00D0
: 10023000D092CA0080E0E81681EEF80680E0080758
: 1002400080E0180711F082E001C080E08093C800D0
: 1002500088E98093C9001F910F91FF90EF90DF9084
: 1002600008951F920F920FB60F9211242F938F9320
: 100270009F93EF93FF939091CE008EB38430F1F46F
: 10028000E0919901F0919A019083E0919901F091A8
: 100290009A01CF01019690939A018093990189590F
: 1002A000914021F489E191E0928381839FB7F89492
: 1002B00080919D018F5F80939D019FBFFF91EF9182
: 1002C0009F918F912F910F900FBE0F901F901895B7
: 1002D000FC01858580FF02C05F9808955F9A0895AC
: 1002E00080E091E0D5C580E091E088C584B7877F44
: 1002F00084BF28E10FB6F89420936000109260004C
: 100300000FBE87E690E09093CD008093CC0086E00E
: 100310008093CA001092C8002093C900539A5A9A39
: 100320008AB180638AB98BB180638BB983D284E050
: 1003300085BD5F9A579A08950F931F93CF93DF93CC
: 10034000D5DF2FB7F8948EE991E090931F02809348
: 100350001E0290932102809320022FBF2FB7F894A2
: 1003600089E191E090939A018093990190939C0187
: 1003700080939B012FBF7894CEE9D1E003E08FB743
: 10038000F894909122028FBF903809F180E091E0BB
: 10039000ABD497FD1CC0E0911E02F0911F02808338
: 1003A000E0911E02F0911F02CF01019690931F026F
: 1003B00080931E028E51924011F4D283C1839FB765
: 1003C000F894809122028F5F809322029FBF8FB7A3
: 1003D000F89410919D018FBFA89902C0113678F151
: 1003E000A89A80919D01882361F05D980093160181
: 1003F00008C089E191E0B1DE682F80E091E0DAD4B5
: 1004000011501123B1F780911601882351F080918A
: 10041000160181508093160180911601882309F4FA
: 100420005D9A80911701882351F0809117018150C6
: 100430008093170180911701882309F45C9A8FB784
: 10044000F894909122028FBF992369F08EE991E090
: 1004500084DE982F8091C80085FFFCCF9093CE005A
: 100460005C980093170180E091E095D42AD487CF5F
: 10047000DA01923049F0933061F09130F9F4E8E913
: 10048000F0E022E130E01EC0EAEAF0E02EE330E0E6
: 1004900019C0813049F0813018F0823079F408C0F9
: 1004A000E8EEF0E0849107C0ECEEF0E0849103C048
: 1004B000E0E2F1E08491282F30E004C0E0E0F0E0D9
: 1004C00020E030E0ED93FC93C901089528E030E08E
: 1004D00040E003C04F5F220F331F28173907D0F3C6
: 1004E000842F8295807F08958093E9008091EB00AE
: 1004F00081608093EB001092ED006093EC004093DC
: 10050000ED008091EE00881F8827881F08951092C3
: 10051000F40090E09093E9001092F0001092E8004F
: 100520001092ED008091EB008E7F8093EB009F5F37
: 10053000953081F708958091270288238CF403C0B9
: 100540008EB38823B1F08091E80082FFF9CF8091CB
: 10055000E8008B778093E80008958EB3882349F0F4
: 100560008091E80080FFF9CF8091E8008E7780933A
: 10057000E800089594E68091EC0080FF05C080912A
: 10058000E80080FF05C023C08091E80082FD1FC005
: 100590008EB3882311F482E008958EB3853011F470
: 1005A00083E008958091EB0085FF02C081E008950B
: 1005B0008091E10082FFDFCF8091E1008B7F80930B
: 1005C000E100992311F484E008959150D4CF80E0A4
: 1005D00008959C0140912D0250912E024617570715
: 1005E00018F4F90120E038C06115710511F0AB0174
: 1005F000F8CF8091E8008E778093E80040E050E0EB
: 10060000F0CF8091E80083FF02C081E008958091DF
: 10061000E80082FD2DC08EB3882381F18EB3853032
: 1006200079F18091E80080FF17C09091F20006C038
: 1006300081918093F100415050409F5F41155105D9
: 1006400011F09830A8F320E0983009F421E080916F
: 10065000E8008E778093E8004115510591F622233A
: 1006600081F606C08EB3882349F08EB3853041F001
: 100670008091E80082FFF6CF80E0089582E008953F
: 1006800083E008959C0140912D0250912E0246175F
: 10069000570710F490E03BC06115710511F0AB01F4
: 1006A000F9CF8091E8008E778093E80040E050E039
: 1006B000F1CF8091E80083FF02C081E0089580912E
: 1006C000E80082FD30C08EB3882399F18EB3853067
: 1006D00091F18091E80080FF1AC08091F20009C07A
: 1006E000F9012F5F3F4FE491E093F10041505040FA
: 1006F0008F5F4115510511F0883090F390E08830FC
: 1007000009F491E08091E8008E778093E80041152C
: 10071000510579F6992369F606C08EB3882349F00E
: 100720008EB3853041F08091E80082FFF6CF80E003
: 10073000089582E0089583E008959C016115710594
: 1007400029F48091E8008B778093E800F90120C0BC
: 100750008091E80083FF02C081E008958EB3882372
: 1007600039F18EB3853031F18091E80082FFF0CF0E
: 1007700006C08091F10081936150704021F080911A
: 10078000F2008823B1F78091E8008B778093E8002E
: 1007900061157105E9F606C08EB3882349F08EB362
: 1007A000853041F08091E80080FFF6CF80E0089529
: 1007B00082E0089583E0089542D044D01EBA10929A
: 1007C0002502109224021092230284E089BD89B58B
: 1007D000826089BD09B400FEFDCF8091D800982FBA
: 1007E0009F779093D80080688093D80080916300B1
: 1007F0008E7F809363008091D8008F7D8093D80096
: 100800008091E0008E7F8093E0008091E1008E7FF8
: 100810008093E1008091E20081608093E20080910A
: 10082000E100877F8093E1008091E20088608093FF
: 10083000E2000895C1DF81E08093260208951092BE
: 10084000E20008951092E10008951F920F920FB6F2
: 100850000F9211241F932F933F934F935F936F93A6
: 100860007F938F939F93AF93BF93EF93FF93E9EEA3
: 10087000F0E0108117701082E0EFF0E08081877F58
: 1008800080837894C3D0F894A9EEB0E01C92E0EF96
: 10089000F0E08081886080831C93FF91EF91BF918D
: 1008A000AF919F918F917F916F915F914F913F9108
: 1008B0002F911F910F900FBE0F901F9018951F92B0
: 1008C0000F920FB60F9211242F933F934F935F9384
: 1008D0006F937F938F939F93AF93BF93EF93FF9308
: 1008E0008091E10080FF1BC08091E20080FF17C073
: 1008F0008091E1008E7F8093E1008091E2008E7F05
: 100900008093E2008091E20080618093E200809118
: 10091000D80080628093D80019BC1EBAD1D18091D2
: 10092000E10084FF29C08091E20084FF25C084E0BB
: 1009300089BD89B5826089BD09B400FEFDCF809173
: 10094000D8008F7D8093D8008091E1008F7E8093C6
: 10095000E1008091E2008F7E8093E2008091E200CE
: 1009600081608093E20080912502882311F481E068
: 1009700001C084E08EBBA4D18091E10083FF27C039
: 100980008091E20083FF23C08091E100877F809304
: 10099000E10082E08EBB109225028091E1008E7F03
: 1009A0008093E1008091E2008E7F8093E20080914D
: 1009B000E20080618093E200AADD80E060E042E036
: 1009C00093DD8091F00088608093F00079D1809170
: 1009D000E10082FF0AC08091E20082FF06C08091A0
: 1009E000E1008B7F8093E1006BD1FF91EF91BF918C
: 1009F000AF919F918F917F916F915F914F913F91B7
: 100A00002F910F900FBE0F901F9018951F93DF939B
: 100A1000CF93CDB7DEB7AC970FB6F894DEBF0FBE5D
: 100A2000CDBFE7E2F2E08091F100819322E0EF3266
: 100A3000F207C9F78091270230912802353009F476
: 100A400087C0363040F43130C9F1313070F0333086
: 100A500009F01DC133C0383009F4EFC0393009F452
: 100A6000FEC0363009F013C192C0803821F08238C0
: 100A700009F00DC108C090912302809124028823BF
: 100A800099F0926011C080912B0287708093E900E9
: 100A90008091EB0090E025E0969587952A95E1F707
: 100AA000982F91701092E9008091E800877F8093E1
: 100AB000E8009093F1001092F100CAC0882319F069
: 100AC000823009F0E4C090E08F719070009721F0BF
: 100AD000029709F0DDC00CC080912902813009F035
: 100AE000D7C010922402333069F5809324022AC0C3
: 100AF00080912902882331F520912B02277009F477
: 100B0000C7C02093E9008091EB0080FFC1C0333063
: 100B100021F48091EB00806213C08091EB00806132
: 100B20008093EB0081E090E002C0880F991F2A9526
: 100B3000E2F78093EA001092EA008091EB0088606F
: 100B40008093EB001092E9008091E800877F83C0DA
: 100B5000882309F09CC0109129028091E800877FCA
: 100B60008093E800E8DC04C08EB3882309F490C0C9
: 100B70008091E80080FFF8CF812F8F7711F492E009
: 100B800001C093E09EBB80688093E30081C08058E1
: 100B9000823008F07CC08091290290912A0223E0E3
: 100BA0008C3D920799F55FB7F894DE0115964EE0FB
: 100BB00020E030E061E2E42FF0E0609357008491A0
: 100BC00020FF03C082958F704F5F982F9F70892FF1
: 100BD000805D8A3308F0895F8C9311961C9211977F
: 100BE0002F5F3F4F12962431310529F75FBF8AE20C
: 100BF0008B8383E08C838091E800877F8093E8007B
: 100C0000CE0103966AE270E0E4DC11C060912B0231
: 100C1000AE014F5F5F4F2CDCBC010097C9F18091A2
: 100C2000E800877F8093E80089819A812BDD80919D
: 100C3000E8008B778093E8002BC0803841F58091E5
: 100C4000E800877F8093E800809125028093F1007F
: 100C50008091E8008E778093E8006DDC19C08823CE
: 100C6000B1F490912902923098F48091E800877F46
: 100C70008093E800909325025EDC80912502882312
: 100C800011F483E001C084E08EBB2DDB01C028DBC2
: 100C90008091E80083FF0AC08091EB00806280931E
: 100CA000EB008091E800877F8093E800AC960FB658
: 100CB000F894DEBF0FBECDBFCF91DF911F91089595
: 100CC00008951F938EB3882361F01091E90010926C
: 100CD000E9008091E80083FF01C098DE177010934F
: 100CE000E9001F9108950895FC018EB3843021F529
: 100CF00087859089A189B2890097A105B105E1F0A6
: 100D000085818093E9008091E80082FF15C0809181
: 100D1000F200882319F42FEF3FEF04C08091F10017
: 100D2000282F30E08091F200882341F48091E80080
: 100D30008B778093E80002C02FEF3FEFC901089541
: 100D4000FC018EB3843011F587859089A189B28921
: 100D50000097A105B105D1F081818093E9008091D0
: 100D6000F2008823A9F09091E8008091E8008E7746
: 100D70008093E80095FD0CC0FDDB982F882349F493
: 100D80008091E8008E778093E80003C092E001C074
: 100D900090E0892F0895FC018EB3843051F487854B
: 100DA0009089A189B2890097A105B10511F0CF0101
: 100DB000C7CF08951F93FC01162F8EB38430D9F44A
: 100DC00087859089A189B2890097A105B10599F01D
: 100DD00081818093E9008091E80085FD08C08091C1
: 100DE000E8008E778093E800C5DB882329F4109310
: 100DF000F10080E001C082E01F9108950F931F93DE
: 100E0000CF93DF93EC010D96FC0189E0DF011D9289
: 100E10008A95E9F72A813B8109818C81882311F425
: 100E200010E001C014E0C90151DB182B1260802FC3
: 100E300061E8412F59DB882329F12E813F810D8103
: 100E40008885882311F410E001C014E0C9013EDB5D
: 100E5000182B1260802F60E8412F46DB882391F029
: 100E60002A853B8509858C85882311F410E001C013
: 100E700014E0C9012BDB182B1260802F61EC412F8D
: 100E800033DB01C080E0DF91CF911F910F91089576
: 100E9000CF93DF93EC018091E80083FF60C08881ED
: 100EA00090E020912B0230912C022817390709F08D
: 100EB00056C080912802813261F0823220F4803263
: 100EC00009F04DC019C0823269F1833209F047C080
: 100ED00038C080912702813A09F041C08091E80032
: 100EE000877F8093E800CE010F9667E070E071DBAA
: 100EF0008091E8008B7713C080912702813279F5C9
: 100F00008091E800877F8093E800CE010F9667E02C
: 100F100070E013DCCE013ED98091E8008E7780939B
: 100F2000E8001DC0809127028132C9F48091E80059
: 100F3000877F8093E800809129028D87CE01C8D9F0
: 100F40000DC080912702813251F48091E800877FA3
: 100F50008093E800CE0160912902C5DEECDADF91D2
: 100F6000CF910895A1E21A2EAA1BBB1BFD010DC053
: 100F7000AA1FBB1FEE1FFF1FA217B307E407F50749
: 100F800020F0A21BB30BE40BF50B661F771F881F25
: 100F9000991F1A9469F760957095809590959B01BB
: 0C0FA000AC01BD01CF010895F894FFCF13
: 100FAC0000034000000440000002080000000000A4
: 060FBC000000000000002F
: 00000001FF

For all Arduino, the native firmware of the USB controller is here

To return to the native firmware of the USB controller, we do everything using the FLIP program (or according to the instructions for the Mac), as before, at the end we disconnect the board from the computer. Then we reconnect the board to the computer and load the new, improved sketch with indicator support onto the controller.

uint8_t buf[8] = { 0 }; // байт с информацией о «нажатой» клавише
void setup() 
{
  Serial.begin(9600); // Устанавливаем скорость соединения
  pinMode(2, OUTPUT); // G
  pinMode(3, OUTPUT); // F
  pinMode(4, OUTPUT); // E
  pinMode(5, OUTPUT); // D
  pinMode(6, OUTPUT); // C
  pinMode(7, OUTPUT); // B
  pinMode(8, OUTPUT); // A
  pinMode(9, OUTPUT); // D4
  pinMode(10, OUTPUT); // D3
  pinMode(11, OUTPUT); // D2
  pinMode(12, OUTPUT); // D1
// Так как модуль сегментных индикаторов имеет общий анод, то для того, чтобы 
// светился сегмент, вывод Arduino должно быть в высокоимпедансном состоянии 
// и наоборот
// Выключаем все сегменты:
  digitalWrite(12, HIGH);
  digitalWrite(11, HIGH);
  digitalWrite(10, HIGH);
  digitalWrite(9, HIGH);
  delay(2000); // Пауза, чтобы «клавиатура» успела определиться в системе
}
void loop() 
{
  int dig1, dig2, dig3, dig4; // Цифры, которые будут последовательно вводиться
  int keys[10] = { 39, 30, 31, 32, 33, 
  34, 35, 36, 37, 38 }; // Массив с ASCII кодами цифер от 0 до 9 соответственно
// Перебор с 0000 до 9999:
  for(dig1=0; dig1<10; dig1++)
  {
    for(dig2=0; dig2<10; dig2++)
    {
      for(dig3=0; dig3<10; dig3++)
      {
        for(dig4=0; dig4<10; dig4++)
        {
          pressKey(keys[dig1]);
          pressKey(keys[dig2]);
          pressKey(keys[dig3]);
          pressKey(keys[dig4]);
          pressKey(40); // Клавиша Enter
// Текущий пароль будет отображаться в течение примерно 15-ти секунд (чуть больше времени задержки ввода)
          for(int i=0; i<1200; i++)
          {
            digLED(12, dig1);
            digLED(11, dig2);
            digLED(10, dig3);
            digLED(9, dig4);
          }
        }
      }
    }
  }
}
void pressKey(int dig) // Функция ввода
{
  buf[2] = dig;
  Serial.write(buf, 8); // Нажать клавишу
  buf[0] = 0;
  buf[2] = 0;
  delay(20);
  Serial.write(buf, 8); // Отпустить клавишу
  delay(300);
}
// Возможно, существуют библиотеки для сегментных индикторов, но мне не захотелось с ними разбираться, 
// поэтому набросал свой алгоритм обхода сегментов индикатора
void digLED(int pin, int dig) // Функция отображения цифер на индикаторе
{
  digitalWrite(pin, LOW);
  switch(dig)
  {
  case 0:
    digitalWrite(8, LOW);
    digitalWrite(7, LOW);
    digitalWrite(6, LOW);
    digitalWrite(5, LOW);
    digitalWrite(4, LOW);
    digitalWrite(3, LOW);
    digitalWrite(2, HIGH);
    break;
  case 1:
    digitalWrite(8, HIGH);
    digitalWrite(7, LOW);
    digitalWrite(6, LOW);
    digitalWrite(5, HIGH);
    digitalWrite(4, HIGH);
    digitalWrite(3, HIGH);
    digitalWrite(2, HIGH);
    break;
  case 2:
    digitalWrite(8, LOW);
    digitalWrite(7, LOW);
    digitalWrite(6, HIGH);
    digitalWrite(5, LOW);
    digitalWrite(4, LOW);
    digitalWrite(3, HIGH);
    digitalWrite(2, LOW);
    break;
  case 3:
    digitalWrite(8, LOW);
    digitalWrite(7, LOW);
    digitalWrite(6, LOW);
    digitalWrite(5, LOW);
    digitalWrite(4, HIGH);
    digitalWrite(3, HIGH);
    digitalWrite(2, LOW);
    break;
  case 4:
    digitalWrite(8, HIGH);
    digitalWrite(7, LOW);
    digitalWrite(6, LOW);
    digitalWrite(5, HIGH);
    digitalWrite(4, HIGH);
    digitalWrite(3, LOW);
    digitalWrite(2, LOW);
    break;
  case 5:
    digitalWrite(8, LOW);
    digitalWrite(7, HIGH);
    digitalWrite(6, LOW);
    digitalWrite(5, LOW);
    digitalWrite(4, HIGH);
    digitalWrite(3, LOW);
    digitalWrite(2, LOW);
    break;
  case 6:
    digitalWrite(8, LOW);
    digitalWrite(7, HIGH);
    digitalWrite(6, LOW);
    digitalWrite(5, LOW);
    digitalWrite(4, LOW);
    digitalWrite(3, LOW);
    digitalWrite(2, LOW);
    break;
  case 7:
    digitalWrite(8, LOW);
    digitalWrite(7, LOW);
    digitalWrite(6, LOW);
    digitalWrite(5, HIGH);
    digitalWrite(4, HIGH);
    digitalWrite(3, HIGH);
    digitalWrite(2, HIGH);
    break;
  case 8:
    digitalWrite(8, LOW);
    digitalWrite(7, LOW);
    digitalWrite(6, LOW);
    digitalWrite(5, LOW);
    digitalWrite(4, LOW);
    digitalWrite(3, LOW);
    digitalWrite(2, LOW);
    break;
  case 9:
    digitalWrite(8, LOW);
    digitalWrite(7, LOW);
    digitalWrite(6, LOW);
    digitalWrite(5, LOW);
    digitalWrite(4, HIGH);
    digitalWrite(3, LOW);
    digitalWrite(2, LOW);
    break;
  }
  delay(3);
  digitalWrite(pin, HIGH);
}


And again, we flash the USB controller with the Arduino-Uno-keyboard.hex firmware

...

You can run it!

Although ... I personally would not be able to look at the indicator and monitor for 42 hours in a row, waiting for a suitable password. For these purposes, a one-eyed witness - a video camera, is perfect. Recording will be done with an old SONY via miniDV (IEEE-1394) using the free SplitCam program on another computer. Alternatively, you can use a webcam or a car DVR.

We start the MacBook with the alt key pressed, podsodinat "keyboard", turn on the video and go about our business, periodically visually monitoring the process.

System in action:



In my case, the password was found on the second day. This solemn moment on video:



As it turned out, after starting the operating system, a password was required again, but the unsuspecting Arduino continued to search. Later I came up, disconnected the “keyboard”, scrolled the video back and entered the correct password.

In turn, I wish everyone to avoid such situations, so more often update passwords on mailboxes and good luck!

Read Next