# Card-Crack

A manual-trigger hardware/network **recon toolkit** for the
[M5Stack Cardputer](https://docs.m5stack.com/en/core/Cardputer) (ESP32-S3),
built for **home-lab pentesting of devices you own** — your router, a car's
OBD/USB port, a PC, smart appliances.

> ⚠️ **Authorized use only.** Every tool here is scoped for your own bench:
> single targets you enter by hand, curated default-credential lists (not
> brute-force), rate-limited network checks, and read-only descriptor/ID
> reads. Nothing scans, transmits, or replays on its own — you press the
> action key. Don't point it at anything you don't own or run.

## Modules

| Module      | What it does                                                         |
|-------------|---------------------------------------------------------------------|
| **Pin Scan**| JTAGulator-style detection of **UART / JTAG / SWD** pins on the probe header. UART baud estimation; JTAG & SWD IDCODE reads. |
| **V-Sense** | Live target-voltage probe through a divider; guesses the logic family so you know what you're touching before driving a pin. |
| **UART Sniff** | Passive UART capture (hex+ascii, selectable baud); freeze a frame and **replay it on a keypress** (manual TX only). |
| **USB Enum**| ESP32-S3 as USB host — reads **descriptors** (VID/PID, class, strings, config) to fingerprint an unknown device. Read-only. |
| **DefCred** | Checks a single host (default: gateway) against a short list of **factory-default logins** over HTTP Basic Auth. Stops on first hit. |
| **Bus Dump**| Reads **SPI-NOR (25-series)** and **I2C EEPROM (24-series)** chips on your own boards to `/dump/*.bin` on microSD. Read-only. |
| **Crypto Lab** | Offline analysis of a dumped blob: **Shannon entropy**, magic-byte **file-ID**, single-byte **XOR** brute, **AES-128-ECB** known-key decrypt. |
| **Exfil**   | Browse the SD card and **stream a dump to the host** over USB serial as base64 (`base64 -d`); writes a manifest of what you pulled. |
| **Theme**   | Live **UI theme switcher** — 5 palettes, saved to NVS, restyles everything instantly. |
| **CAN Bus** | OBD/automotive **CAN frame sniffer** — listen on MCP2515 over SPI, log frames to SD, cycle bus speeds. |
| **UART+**   | Enhanced UART with **parallel auto-baudrate detection**, session logging to binary, protocol hints. |
| **Protocol**| Unified **UART/SPI/I2C sniffer** — real-time stats (packets/sec, data rate, frame errors). |
| **MemSearch** | Post-dump **binary analysis** — find strings, magic bytes, hardcoded IPs, entropy spikes in captured blobs. |
| **Logger**  | **Persistent session logging** — auto-log to JSON with metadata (voltage, pins, targets, timestamps). Export logs. |
| **Injector**| **Manual credential/command injection** — AT commands, OBD-II queries, Telnet login attempts. Capture responses. |
| **Scope**   | Simple **ASCII oscilloscope** — sample GPIO at ~100kHz, display waveform, spot edges and DC bias. |
| **Wizard**  | **Two-wire protocol auto-detect** — sniff I2C/SWD on pin pairs, register read/write on found slave. |
| **Settings**| Persist configuration (scan delay, voltage thresholds, timeouts, baud list) to NVS. JSON export/import. |

## 18 modules total

**Discover**: Pin Scan, V-Sense, USB Enum, CAN Bus, Wizard  
**Sniff & Replay**: UART Sniff, UART+, Protocol, Scope  
**Dump & Export**: Bus Dump, Logger, Exfil  
**Analyse**: Crypto Lab, MemSearch  
**Inject & Test**: Injector, DefCred  
**System**: Theme, Settings  

## Look & feel

Boot splash with a sweeping-glow logo, CRT scanlines, a breathing menu
cursor, wipe-in transitions, spinners and progress bars. Switch palettes any
time in the **Theme** module.

## Build & flash

Requires [PlatformIO](https://platformio.org/).

```bash
# set your lab Wi-Fi for the DefCred module (or edit defcred.cpp)
pio run -e cardputer \
  -a "--build-property build.flags=-DCC_WIFI_SSID='\"MyAP\"' -DCC_WIFI_PASS='\"secret\"'"
pio run -e cardputer -t upload
pio device monitor
```

## Controls

- Menu: `;` up · `.` down · `Enter` open
- In a module: <code>`</code> (backtick) back · per-module hints on the bottom bar

## Layout

```
src/core/     shell, module interface, UI helpers, pin map
src/modules/  one file per recon tool
docs/         HARDWARE.md wiring + safety
```

See **[docs/HARDWARE.md](docs/HARDWARE.md)** before wiring — the S3 is a 3V3
part and 5V on a bare GPIO will destroy it.