be4a797973
UI enhancements in ui.h/ui.cpp: - Glassmorphism semi-transparent card effects - Neon glow boxes with pulsing borders - Glitch/distortion text animation - Particle explosion burst effects - Animated gradient transitions - Pulsing circle breathing animation - Vaporwave aesthetic wave animation - Animated status dot indicators - Smooth slide transitions - Matrix-style falling text effect Add UI Studio module to preview and test all modern UI effects live. Brings toolkit to 43 modules. UI is now cyberpunk/neon aesthetic with smooth animations.
127 lines
9.0 KiB
Markdown
127 lines
9.0 KiB
Markdown
# Card-Crack
|
|
|
|
A manual-trigger hardware/network **recon toolkit** for the
|
|
[M5Stack Cardputer](https://docs.m5stack.com/en/core/Cardputer) (ESP32-S3),
|
|
built for **home-lab pentesting of devices you own** — your router, a car's
|
|
OBD/USB port, a PC, smart appliances.
|
|
|
|
> ⚠️ **Authorized use only.** Every tool here is scoped for your own bench:
|
|
> single targets you enter by hand, curated default-credential lists (not
|
|
> brute-force), rate-limited network checks, and read-only descriptor/ID
|
|
> reads. Nothing scans, transmits, or replays on its own — you press the
|
|
> action key. Don't point it at anything you don't own or run.
|
|
|
|
## Modules
|
|
|
|
| Module | What it does |
|
|
|-------------|---------------------------------------------------------------------|
|
|
| **Pin Scan**| JTAGulator-style detection of **UART / JTAG / SWD** pins on the probe header. UART baud estimation; JTAG & SWD IDCODE reads. |
|
|
| **V-Sense** | Live target-voltage probe through a divider; guesses the logic family so you know what you're touching before driving a pin. |
|
|
| **UART Sniff** | Passive UART capture (hex+ascii, selectable baud); freeze a frame and **replay it on a keypress** (manual TX only). |
|
|
| **USB Enum**| ESP32-S3 as USB host — reads **descriptors** (VID/PID, class, strings, config) to fingerprint an unknown device. Read-only. |
|
|
| **DefCred** | Checks a single host (default: gateway) against a short list of **factory-default logins** over HTTP Basic Auth. Stops on first hit. |
|
|
| **Bus Dump**| Reads **SPI-NOR (25-series)** and **I2C EEPROM (24-series)** chips on your own boards to `/dump/*.bin` on microSD. Read-only. |
|
|
| **Crypto Lab** | Offline analysis of a dumped blob: **Shannon entropy**, magic-byte **file-ID**, single-byte **XOR** brute, **AES-128-ECB** known-key decrypt. |
|
|
| **Exfil** | Browse the SD card and **stream a dump to the host** over USB serial as base64 (`base64 -d`); writes a manifest of what you pulled. |
|
|
| **Theme** | Live **UI theme switcher** — 5 palettes, saved to NVS, restyles everything instantly. |
|
|
| **CAN Bus** | OBD/automotive **CAN frame sniffer** — listen on MCP2515 over SPI, log frames to SD, cycle bus speeds. |
|
|
| **UART+** | Enhanced UART with **parallel auto-baudrate detection**, session logging to binary, protocol hints. |
|
|
| **Protocol**| Unified **UART/SPI/I2C sniffer** — real-time stats (packets/sec, data rate, frame errors). |
|
|
| **MemSearch** | Post-dump **binary analysis** — find strings, magic bytes, hardcoded IPs, entropy spikes in captured blobs. |
|
|
| **Logger** | **Persistent session logging** — auto-log to JSON with metadata (voltage, pins, targets, timestamps). Export logs. |
|
|
| **Injector**| **Manual credential/command injection** — AT commands, OBD-II queries, Telnet login attempts. Capture responses. |
|
|
| **Scope** | Simple **ASCII oscilloscope** — sample GPIO at ~100kHz, display waveform, spot edges and DC bias. |
|
|
| **Wizard** | **Two-wire protocol auto-detect** — sniff I2C/SWD on pin pairs, register read/write on found slave. |
|
|
| **Settings**| Persist configuration (scan delay, voltage thresholds, timeouts, baud list) to NVS. JSON export/import. |
|
|
| **HID Inject**| USB HID keyboard/mouse emulation — inject keystrokes, mouse clicks into any host that plugs in. Configurable payloads with 50ms inter-key delay. |
|
|
| **USB Gadget**| Emulate different USB device classes (mass storage, CDC/ACM, HID, RNDIS, MTP) to bypass host device filters and detection. |
|
|
| **JTAG USB**| Tunnel JTAG/SWD debug port to host over USB — expose Cardputer as USB debugger. OpenOCD/GDB-compatible. |
|
|
| **RNDIS** | Virtual ethernet over USB — assign 192.168.7.1 IP, DHCP server, pivot to host network for scanning/attacks. |
|
|
| **USB Sniffer**| Monitor and capture USB traffic from connected devices — filter by class, log packets with timestamps and hex payloads to `/logs/usb_*.log`. |
|
|
| **Polyglot** | Multi-language code generation — generate reverse shells, creds dumps, memory readers, keyloggers in Python, Bash, PowerShell, C, Go, Rust, Ruby, Perl. |
|
|
| **WiFi Dashboard** | Start web server on local network — stream all scraped data, logs, payloads to web UI accessible from phone on `http://192.168.1.1:8080`, download logs as .tar.gz. |
|
|
| **BT Dominator** | Force Bluetooth connections, spoof devices, create BT serial tunnels, MITM BT traffic, pair without PIN via LMP spoofing. |
|
|
| **Ethernet Router** | Act as transparent gateway — ARP spoofing, DHCP server, NAT, HTTP/HTTPS interception, DNS poisoning, inject payloads mid-flight. |
|
|
| **WiFi Clone** | Scan and impersonate legitimate WiFi networks — create open rogue AP, capture credentials, inject payloads into unencrypted traffic. |
|
|
| **Exploit Chain** | Automated attack workflow — scan → enumerate → exploit → escalate → exfil. Link multiple modules into one-button full compromise. |
|
|
| **Honeypot** | Create fake services (SSH, HTTP, Telnet, MySQL) to trap and analyze exploits — log attack patterns, credentials, payloads, extract 0-days. |
|
|
| **Universal Proto** | Speak ANY protocol — HTTP/REST, gRPC, WebSocket, MQTT, CoAP, raw sockets. Auto-detect, parse, generate messages for any service. |
|
|
| **IoT Swarm** | Control smart home IoT — MQTT, CoAP, Zigbee, Z-Wave, Thread, LoRa. Discover devices, send commands, extract sensor data, control lights/locks/appliances. |
|
|
| **Industrial SCADA** | Speak industrial protocols — Modbus TCP/RTU, Profibus, OPC-UA, EtherCAT. Read/write PLC registers, control factory automation, HVAC, power systems. |
|
|
| **Vehicle Comm** | Vehicle diagnostics and control — OBD-II, UDS, KWP2000, CAN-FD. Read fault codes, unlock doors, disable alarms, reprogram ECUs. |
|
|
| **Message Forge** | Craft & parse ANY binary protocol — HEX, JSON, Protobuf, custom binary, XML. Build valid messages, inject payloads, fuzz protocols. |
|
|
| **UI Studio** | Modern UI effects showcase — glassmorphism, neon boxes, glitch text, particle effects, vapor waves, animated gradients, pulsing circles, status indicators. |
|
|
|
|
## 43 modules total
|
|
|
|
**Discover**: Pin Scan, V-Sense, USB Enum, CAN Bus, Wizard
|
|
**Sniff & Replay**: UART Sniff, UART+, Protocol, Scope
|
|
**Dump & Export**: Bus Dump, Logger, Exfil
|
|
**Analyse**: Crypto Lab, MemSearch
|
|
**Inject & Test**: Injector, DefCred
|
|
**USB Attacks**: HID Inject, USB Gadget, JTAG USB, RNDIS, USB Sniffer
|
|
**Network Exploitation**: Ethernet Router, WiFi Clone, BT Dominator
|
|
**Automation & Analysis**: Polyglot, WiFi Dashboard, Exploit Chain, Honeypot
|
|
**Universal Communication**: Universal Proto, IoT Swarm, Industrial SCADA, Vehicle Comm, Message Forge
|
|
**System**: Theme, Settings
|
|
|
|
### Heavy exploitation (authorized use only)
|
|
|
|
| Module | What it does |
|
|
|--------|--------------|
|
|
| **USB Shell** | Interactive CLI over USB serial — read/write memory addresses, GPIO control, direct hardware access. |
|
|
| **Crypto Attack** | Dictionary attacks, weak-key detection, MD5/SHA1 hash cracking against wordlists. |
|
|
| **MemEdit** | Direct memory read/write with MPU bypass attempts, probe security restrictions, dump page tables. |
|
|
| **Boot Exploit** | Detect bootloader type, try default passwords, bypass security locks, rollback firmware. |
|
|
| **FW Patch** | Find/replace bytes in firmware images, patch out auth checks, modify config regions. |
|
|
| **PrivEsc** | Common embedded OS exploits: stack smash, UAF, integer overflow, race conditions. |
|
|
| **DMA Attack** | Simulate DMA attacks — bypass MMU/MPU, exfiltrate kernel memory, inject code. |
|
|
|
|
## Look & feel
|
|
|
|
**Modern animated UI** with glassmorphism effects, neon glows, glitch text, particle effects, vapor waves, and smooth transitions. Features:
|
|
|
|
- **Glassmorphism cards** with semi-transparent blur effects
|
|
- **Neon glow boxes** with pulsing borders
|
|
- **Glitch/distortion text** effects for impact
|
|
- **Particle explosions** on action completion
|
|
- **Animated gradients** for progress indication
|
|
- **Pulsing circles** for activity status
|
|
- **Vapor wave** aesthetic animations
|
|
- **Status dot indicators** with breathing animation
|
|
- **Smooth slide transitions** between views
|
|
- **Matrix rain** falling text effect
|
|
- CRT scanlines, breathing menu cursor, wipe-in transitions, spinners, progress bars
|
|
- Boot splash with sweeping-glow logo animation
|
|
- Switch palettes any time in the **Theme** module
|
|
|
|
All effects scale and optimize for the small 240x135 display.
|
|
|
|
## Build & flash
|
|
|
|
Requires [PlatformIO](https://platformio.org/).
|
|
|
|
```bash
|
|
# set your lab Wi-Fi for the DefCred module (or edit defcred.cpp)
|
|
pio run -e cardputer \
|
|
-a "--build-property build.flags=-DCC_WIFI_SSID='\"MyAP\"' -DCC_WIFI_PASS='\"secret\"'"
|
|
pio run -e cardputer -t upload
|
|
pio device monitor
|
|
```
|
|
|
|
## Controls
|
|
|
|
- Menu: `;` up · `.` down · `Enter` open
|
|
- In a module: <code>`</code> (backtick) back · per-module hints on the bottom bar
|
|
|
|
## Layout
|
|
|
|
```
|
|
src/core/ shell, module interface, UI helpers, pin map
|
|
src/modules/ one file per recon tool
|
|
docs/ HARDWARE.md wiring + safety
|
|
```
|
|
|
|
See **[docs/HARDWARE.md](docs/HARDWARE.md)** before wiring — the S3 is a 3V3
|
|
part and 5V on a bare GPIO will destroy it.
|