kmk_firmware icon indicating copy to clipboard operation
kmk_firmware copied to clipboard

implement arbitrary code execution (ACE) over data serial.

Open xs5871 opened this issue 2 years ago • 1 comments

Every application needs a gaping hole in security, ready to be exploited. I don't even remember how I got the idea, but in the past people were asking questions like "how can I tell my keyboard x from my host OS". Well, here's an API that allows arbitrary code execution over the built-in data serial (which is different from the REPL/console). This is as much a proof-of-concept as it is probably a terrible idea.

How to use:

  1. enable the data serial in boot.py:
import usb_cdc
usb_cdc.enable(data=True)
  1. load module (obvious)
  2. assuming serial on /dev/ttyACM1 and explicitly set to send \n as line break (this is not always the default):
$ echo "keyboard.active_layers" > /dev/ttyACM1
$ cat /dev/ttyACM1
[0]
$ echo "exec('from kmk.keys import KC; keyboard.tap_key(KC.Y)')" > /dev/ttyACM1
$ y

It's in draft because still poc, no docs, not sure if we even want this...

xs5871 avatar Jul 02 '22 15:07 xs5871

I do believe that this has a place, but should have MASSIVE warnings on it. I'm thinking feeding host OS system to the OLED's or something of that sort. I both hate this, but also like what you could do with it.

kdb424 avatar Jul 02 '22 16:07 kdb424