Carputer-cracker/README.md

Card-Crack

A manual-trigger hardware/network recon toolkit for the M5Stack Cardputer (ESP32-S3), built for home-lab pentesting of devices you own — your router, a car's OBD/USB port, a PC, smart appliances.

⚠️ Authorized use only. Every tool here is scoped for your own bench: single targets you enter by hand, curated default-credential lists (not brute-force), rate-limited network checks, and read-only descriptor/ID reads. Nothing scans, transmits, or replays on its own — you press the action key. Don't point it at anything you don't own or run.

Modules

Module	What it does
Pin Scan	JTAGulator-style detection of UART / JTAG / SWD pins on the probe header. UART baud estimation; JTAG & SWD IDCODE reads.
V-Sense	Live target-voltage probe through a divider; guesses the logic family so you know what you're touching before driving a pin.
UART Sniff	Passive UART capture (hex+ascii, selectable baud); freeze a frame and replay it on a keypress (manual TX only).
USB Enum	ESP32-S3 as USB host — reads descriptors (VID/PID, class, strings, config) to fingerprint an unknown device. Read-only.
DefCred	Checks a single host (default: gateway) against a short list of factory-default logins over HTTP Basic Auth. Stops on first hit.
Bus Dump	Reads SPI-NOR (25-series) and I2C EEPROM (24-series) chips on your own boards to /dump/*.bin on microSD. Read-only.
Crypto Lab	Offline analysis of a dumped blob: Shannon entropy, magic-byte file-ID, single-byte XOR brute, AES-128-ECB known-key decrypt.
Exfil	Browse the SD card and stream a dump to the host over USB serial as base64 (base64 -d); writes a manifest of what you pulled.
Theme	Live UI theme switcher — 5 palettes, saved to NVS, restyles everything instantly.
CAN Bus	OBD/automotive CAN frame sniffer — listen on MCP2515 over SPI, log frames to SD, cycle bus speeds.
UART+	Enhanced UART with parallel auto-baudrate detection, session logging to binary, protocol hints.
Protocol	Unified UART/SPI/I2C sniffer — real-time stats (packets/sec, data rate, frame errors).
MemSearch	Post-dump binary analysis — find strings, magic bytes, hardcoded IPs, entropy spikes in captured blobs.
Logger	Persistent session logging — auto-log to JSON with metadata (voltage, pins, targets, timestamps). Export logs.
Injector	Manual credential/command injection — AT commands, OBD-II queries, Telnet login attempts. Capture responses.
Scope	Simple ASCII oscilloscope — sample GPIO at ~100kHz, display waveform, spot edges and DC bias.
Wizard	Two-wire protocol auto-detect — sniff I2C/SWD on pin pairs, register read/write on found slave.
Settings	Persist configuration (scan delay, voltage thresholds, timeouts, baud list) to NVS. JSON export/import.
HID Inject	USB HID keyboard/mouse emulation — inject keystrokes, mouse clicks into any host that plugs in. Configurable payloads with 50ms inter-key delay.
USB Gadget	Emulate different USB device classes (mass storage, CDC/ACM, HID, RNDIS, MTP) to bypass host device filters and detection.
JTAG USB	Tunnel JTAG/SWD debug port to host over USB — expose Cardputer as USB debugger. OpenOCD/GDB-compatible.
RNDIS	Virtual ethernet over USB — assign 192.168.7.1 IP, DHCP server, pivot to host network for scanning/attacks.
USB Sniffer	Monitor and capture USB traffic from connected devices — filter by class, log packets with timestamps and hex payloads to /logs/usb_*.log.
Polyglot	Multi-language code generation — generate reverse shells, creds dumps, memory readers, keyloggers in Python, Bash, PowerShell, C, Go, Rust, Ruby, Perl.
WiFi Dashboard	Start web server on local network — stream all scraped data, logs, payloads to web UI accessible from phone on http://192.168.1.1:8080, download logs as .tar.gz.
BT Dominator	Force Bluetooth connections, spoof devices, create BT serial tunnels, MITM BT traffic, pair without PIN via LMP spoofing.
Ethernet Router	Act as transparent gateway — ARP spoofing, DHCP server, NAT, HTTP/HTTPS interception, DNS poisoning, inject payloads mid-flight.
WiFi Clone	Scan and impersonate legitimate WiFi networks — create open rogue AP, capture credentials, inject payloads into unencrypted traffic.
Exploit Chain	Automated attack workflow — scan → enumerate → exploit → escalate → exfil. Link multiple modules into one-button full compromise.
Honeypot	Create fake services (SSH, HTTP, Telnet, MySQL) to trap and analyze exploits — log attack patterns, credentials, payloads, extract 0-days.
Universal Proto	Speak ANY protocol — HTTP/REST, gRPC, WebSocket, MQTT, CoAP, raw sockets. Auto-detect, parse, generate messages for any service.
IoT Swarm	Control smart home IoT — MQTT, CoAP, Zigbee, Z-Wave, Thread, LoRa. Discover devices, send commands, extract sensor data, control lights/locks/appliances.
Industrial SCADA	Speak industrial protocols — Modbus TCP/RTU, Profibus, OPC-UA, EtherCAT. Read/write PLC registers, control factory automation, HVAC, power systems.
Vehicle Comm	Vehicle diagnostics and control — OBD-II, UDS, KWP2000, CAN-FD. Read fault codes, unlock doors, disable alarms, reprogram ECUs.
Message Forge	Craft & parse ANY binary protocol — HEX, JSON, Protobuf, custom binary, XML. Build valid messages, inject payloads, fuzz protocols.
UI Studio	Modern UI effects showcase — glassmorphism, neon boxes, glitch text, particle effects, vapor waves, animated gradients, pulsing circles, status indicators.
Terminal Emu	Live terminal emulator showing fake "hacking" command execution, payload deployment, privilege escalation, shell access confirmation.
Data Stream	Animated hex dumps and packet captures — scrolling binary data, network traffic visualization, packet dissection in real-time.
System Monitor	Target system dashboard — fake process list, CPU/memory/network load metrics, active connections, resource usage monitoring.
Attack Vis	Active attack visualization — scanning → enumeration → exploitation → privilege escalation → exfiltration stages with intensity feedback.
Log Streamer	Real-time colored log feed with alerts, successes, errors — watch "live" attack logs as they happen, credential captures, exploit confirmations.

48 modules total

Discover: Pin Scan, V-Sense, USB Enum, CAN Bus, Wizard
Sniff & Replay: UART Sniff, UART+, Protocol, Scope
Dump & Export: Bus Dump, Logger, Exfil
Analyse: Crypto Lab, MemSearch
Inject & Test: Injector, DefCred
USB Attacks: HID Inject, USB Gadget, JTAG USB, RNDIS, USB Sniffer
Network Exploitation: Ethernet Router, WiFi Clone, BT Dominator
Automation & Analysis: Polyglot, WiFi Dashboard, Exploit Chain, Honeypot
Universal Communication: Universal Proto, IoT Swarm, Industrial SCADA, Vehicle Comm, Message Forge
Immersive Hacking: Terminal Emu, Data Stream, System Monitor, Attack Vis, Log Streamer
UI & Design: UI Studio, Theme, Settings

Heavy exploitation (authorized use only)

Module	What it does
USB Shell	Interactive CLI over USB serial — read/write memory addresses, GPIO control, direct hardware access.
Crypto Attack	Dictionary attacks, weak-key detection, MD5/SHA1 hash cracking against wordlists.
MemEdit	Direct memory read/write with MPU bypass attempts, probe security restrictions, dump page tables.
Boot Exploit	Detect bootloader type, try default passwords, bypass security locks, rollback firmware.
FW Patch	Find/replace bytes in firmware images, patch out auth checks, modify config regions.
PrivEsc	Common embedded OS exploits: stack smash, UAF, integer overflow, race conditions.
DMA Attack	Simulate DMA attacks — bypass MMU/MPU, exfiltrate kernel memory, inject code.

Look & feel

Modern animated UI with glassmorphism effects, neon glows, glitch text, particle effects, vapor waves, and smooth transitions. Features:

• Glassmorphism cards with semi-transparent blur effects
• Neon glow boxes with pulsing borders
• Glitch/distortion text effects for impact
• Particle explosions on action completion
• Animated gradients for progress indication
• Pulsing circles for activity status
• Vapor wave aesthetic animations
• Status dot indicators with breathing animation
• Smooth slide transitions between views
• Matrix rain falling text effect
• CRT scanlines, breathing menu cursor, wipe-in transitions, spinners, progress bars
• Boot splash with sweeping-glow logo animation
• Switch palettes any time in the Theme module

All effects scale and optimize for the small 240x135 display.

Build & flash

Requires PlatformIO.

# set your lab Wi-Fi for the DefCred module (or edit defcred.cpp)
pio run -e cardputer \
  -a "--build-property build.flags=-DCC_WIFI_SSID='\"MyAP\"' -DCC_WIFI_PASS='\"secret\"'"
pio run -e cardputer -t upload
pio device monitor

Controls

• Menu: ; up · . down · Enter open
• In a module: ` (backtick) back · per-module hints on the bottom bar

Layout

src/core/     shell, module interface, UI helpers, pin map
src/modules/  one file per recon tool
docs/         HARDWARE.md wiring + safety

See docs/HARDWARE.md before wiring — the S3 is a 3V3 part and 5V on a bare GPIO will destroy it.