Initial commit

.gitignore

@@ -0,0 +1,9 @@
+*.iml
+.gradle
+/local.properties
+/.idea/workspace.xml
+/.idea/libraries
+.DS_Store
+/build
+/captures
+.externalNativeBuild

app/.gitignore

@@ -0,0 +1 @@
+/build

app/build.gradle

@@ -0,0 +1,30 @@
+apply plugin: 'com.android.application'
+
+android {
+    compileSdkVersion 25
+    buildToolsVersion "25.0.2"
+    defaultConfig {
+        applicationId "cf.netdex.hidfuzzer"
+        minSdkVersion 15
+        targetSdkVersion 25
+        versionCode 1
+        versionName "1.0"
+        testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"
+    }
+    buildTypes {
+        release {
+            minifyEnabled false
+            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+        }
+    }
+}
+
+dependencies {
+    compile fileTree(dir: 'libs', include: ['*.jar'])
+    androidTestCompile('com.android.support.test.espresso:espresso-core:2.2.2', {
+        exclude group: 'com.android.support', module: 'support-annotations'
+    })
+    compile 'com.android.support:appcompat-v7:25.1.0'
+    compile 'eu.chainfire:libsuperuser:1.0.0.+'
+    testCompile 'junit:junit:4.12'
+}

app/proguard-rules.pro

@@ -0,0 +1,17 @@
+# Add project specific ProGuard rules here.
+# By default, the flags in this file are appended to flags specified
+# in D:\Programming\Android\sdk/tools/proguard/proguard-android.txt
+# You can edit the include path and order by changing the proguardFiles
+# directive in build.gradle.
+#
+# For more details, see
+#   http://developer.android.com/guide/developing/tools/proguard.html
+
+# Add any project specific keep options here:
+
+# If your project uses WebView with JS, uncomment the following
+# and specify the fully qualified class name to the JavaScript interface
+# class:
+#-keepclassmembers class fqcn.of.javascript.interface.for.webview {
+#   public *;
+#}

app/src/androidTest/java/cf/netdex/hidfuzzer/ExampleInstrumentedTest.java

@@ -0,0 +1,26 @@
+package cf.netdex.hidfuzzer;
+
+import android.content.Context;
+import android.support.test.InstrumentationRegistry;
+import android.support.test.runner.AndroidJUnit4;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import static org.junit.Assert.*;
+
+/**
+ * Instrumentation test, which will execute on an Android device.
+ *
+ * @see <a href="http://d.android.com/tools/testing">Testing documentation</a>
+ */
+@RunWith(AndroidJUnit4.class)
+public class ExampleInstrumentedTest {
+    @Test
+    public void useAppContext() throws Exception {
+        // Context of the app under test.
+        Context appContext = InstrumentationRegistry.getTargetContext();
+
+        assertEquals("cf.netdex.hidfuzzer", appContext.getPackageName());
+    }
+}

app/src/main/AndroidManifest.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="cf.netdex.hidfuzzer">
+
+    <application
+        android:allowBackup="true"
+        android:icon="@mipmap/ic_launcher"
+        android:label="@string/app_name"
+        android:supportsRtl="true"
+        android:theme="@style/AppTheme">
+        <activity android:name=".MainActivity">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+
+</manifest>

app/src/main/java/cf/netdex/hidfuzzer/FuzzerTask.java

@@ -0,0 +1,83 @@
+package cf.netdex.hidfuzzer;
+
+import android.content.Context;
+import android.os.AsyncTask;
+import android.widget.Toast;
+
+import java.util.List;
+import java.util.Random;
+import java.util.concurrent.CountDownLatch;
+
+import eu.chainfire.libsuperuser.Shell;
+
+/**
+ * Created by netdex on 1/15/2017.
+ */
+
+public class FuzzerTask extends AsyncTask<Void, String, Void> {
+
+    private Context mContext;
+
+    public FuzzerTask(Context context) {
+        mContext = context;
+    }
+
+    @Override
+    protected Void doInBackground(Void... params) {
+        final CountDownLatch latch = new CountDownLatch(1);
+
+        final boolean[] root = new boolean[1];
+        Shell.Interactive sh = new Shell.Builder()
+                .useSU()
+                .setWantSTDERR(true)
+                .setWatchdogTimeout(5)
+                .setMinimalLogging(true)
+                .open(new Shell.OnCommandResultListener() {
+                    @Override
+                    public void onCommandResult(int commandCode, int exitCode, List<String> output) {
+                        if (exitCode != Shell.OnCommandResultListener.SHELL_RUNNING) {
+                            publishProgress("Failed to open SU");
+                            root[0] = false;
+                        } else {
+                            root[0] = true;
+                        }
+                        latch.countDown();
+                    }
+                });
+        Random r = new Random();
+        try {
+            latch.await();
+            if (!root[0]) return null;
+
+            while (!isCancelled()) {
+                while (HID.hid_keyboard(sh, "/dev/hidg0", (byte) 0, Input.Keyboard.Key.VOLUME_UP.code) != 0) {
+                    Thread.sleep(1000);
+                }
+                publishProgress("Connected");
+                byte[] kbuf = new byte[8];
+                byte[] mbuf = new byte[4];
+                int c = 0;
+                while (c == 0) {
+                    r.nextBytes(kbuf);
+                    r.nextBytes(mbuf);
+                    c |= HID.hid_keyboard(sh, "/dev/hidg0", kbuf);
+                    c |= HID.hid_mouse(sh, "/dev/hidg1", mbuf);
+//                    Thread.sleep(1000);
+                }
+                publishProgress("Disconnected");
+            }
+        } catch (InterruptedException ignored) {
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        return null;
+
+    }
+
+    @Override
+    protected void onProgressUpdate(String... s) {
+        Toast.makeText(mContext, s[0], Toast.LENGTH_SHORT).show();
+    }
+
+
+}

app/src/main/java/cf/netdex/hidfuzzer/HID.java

@@ -0,0 +1,64 @@
+package cf.netdex.hidfuzzer;
+
+import java.util.concurrent.CountDownLatch;
+
+import eu.chainfire.libsuperuser.Shell;
+
+/**
+ * Created by netdex on 1/15/2017.
+ */
+
+public class HID {
+    public static int hid_mouse(Shell.Interactive sh, String dev, byte... offset) {
+        if (offset.length > 4)
+            throw new IllegalArgumentException("Your mouse can only move in two dimensions");
+        byte[] buf = new byte[8];
+        System.arraycopy(offset, 0, buf, 0, offset.length);
+        return write_bytes(sh, dev, buf);
+    }
+
+    public static int hid_keyboard(Shell.Interactive sh, String dev, byte... keys) {
+        if (keys.length > 8)
+            throw new IllegalArgumentException("Cannot send more than 7 keys");
+        byte[] buf = new byte[16];
+        for (int i = 0; i < keys.length; i++) {
+            buf[2 * i] = keys[i];
+        }
+        return write_bytes(sh, dev, buf);
+    }
+
+    public static int write_bytes(Shell.Interactive sh, String dev, byte[] arr) {
+        String bt = toShortString(arr);
+        final Integer[] err = {-1};
+        try {
+            final CountDownLatch latch = new CountDownLatch(1);
+            String c = String.format("echo -n -e \"%s\" > %s", bt, dev);
+//            Log.d(MainActivity.TAG, c);
+            sh.addCommand(c, 0, new Shell.OnCommandLineListener() {
+                @Override
+                public void onLine(String line) {
+
+                }
+
+                @Override
+                public void onCommandResult(int commandCode, int exitCode) {
+                    err[0] = exitCode;
+                    latch.countDown();
+                }
+            });
+            latch.await();
+        } catch (InterruptedException ignored) {
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+        return err[0];
+    }
+
+    private static String toShortString(byte[] arr) {
+        StringBuilder sb = new StringBuilder();
+        for (byte b : arr) {
+            sb.append(String.format("\\x%02x", b));
+        }
+        return sb.toString();
+    }
+}