Fix BadUSB overflow, Karma OOB, channel compliance, and add Glass2 OLED support - #122
Open
Swissola wants to merge 5 commits into
Open
Fix BadUSB overflow, Karma OOB, channel compliance, and add Glass2 OLED support#122Swissola wants to merge 5 commits into
Swissola wants to merge 5 commits into
Conversation
Two safety fixes in Evil-Cardputer-v1-5-2.ino: 1. BadUSB parser: replace strcpy() with strncpy() + explicit null-terminator for Cmd[15] and OldCmd[15] buffers. strcpy() from user-controlled script content had no length bound, allowing stack corruption on commands longer than 14 characters. 2. packetSnifferKarma(): add sig_len bounds check before accessing frame[25] (SSID IE length byte) and frame[26..] (SSID data). Without this check, a malformed or truncated probe request frame caused an out-of-bounds read. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
UK law (Wireless Telegraphy Act 2006 / Ofcom) permits Wi-Fi channels 1-13. Updated five hardcoded channel arrays across probe sniffing, channel hopper, beacon spam, beacon_task, and PwnGrid spam to include channels 12 and 13. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds glass2.h helper (SSD1309/Adafruit_SSD1306, I2C on Grove GPIO1/2) and wires it into the Cardputer ADV detection block. Glass2 shows active mode on the transparent OLED: KARMA, PORTAL, PROBE, SPAM. Grove port (GPIO1/2) is free on ADV — GPS cap uses EXT header GPIO13/15. No-op if Glass2 not connected (_g2_ready guard). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Swissola
changed the title
M5UnitGLASS2.h ships with M5GFX, which is already a transitive dependency via M5Unified — no extra library required. Gives access to the full M5GFX drawing API vs the basic Adafruit bitmap renderer. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Update Glass2 on every new probe-request SSID captured: shows the latest SSID on line 2 and running count on line 3, giving a glanceable view without looking at the main display. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three fixes and one feature addition for Cardputer ADV.
Fix: BadUSB strcpy overflow
Replace all
strcpy()calls withstrncpy()+ explicit null-terminator forCmd[15]andOldCmd[15]fixed-size buffers.strcpy()from user-controlled Ducky Script content had no length bound — any command token longer than 14 characters overwrites the stack.Fix: Karma sniffer OOB frame access
Add
sig_len < 27guard before accessingframe[25](SSID IE length byte) andframe[26..](SSID data). Also extends the existing SSID length check to verifysig_len >= 26 + ssid_length_Karmabefore thememcpy. A malformed or truncated probe request frame previously caused an out-of-bounds read.Fix: Wi-Fi channel compliance — extend to channels 12–13
Updates all five channel arrays to include channels 12 and 13. Channels 1–13 are legal across ETSI (EU/UK), TELEC (Japan), and most other regulatory domains. The previous 1–11 limit was unnecessarily restrictive outside North America.
Feature: Glass2 secondary OLED display (Cardputer ADV)
Adds support for the M5Stack Glass2 Unit (1.51" transparent OLED, SSD1309 driver, 128×64) as a secondary display on the Grove port.
glass2.husing M5UnitGLASS2 from M5GFX — the official M5Stack driver, already a transitive dependency via M5Unified. No additional library required.board_M5CardputerADVdetection block — no effect on standard Cardputer or any other board_g2_readyflag means calls are safe no-ops if no Glass2 is physically connectedEvil-M5Project / Cardputer ADV / Glass2 readyMODE: KARMA / SSID: -- / CLTS: 0 / CRED: 0MODE: PORTAL / SSID: <name> / CLTS: n / CRED: nMODE: PROBE / Sniffing...MODE: SPAM / Beaconing...Test plan
🤖 Generated with Claude Code