Locked phone: Nexus 5, Nethunter phone: Xiaomi Redmi Note 3 - hid-keyboard works, usb-devices detected, but its not cracking (even when correct pin in the list)

Question

Locked phone: Nexus 5, Nethunter phone: Xiaomi Redmi Note 3 - hid-keyboard works, usb-devices detected, but its not cracking (even when correct pin in the list)

simtcrom opened this issue 3 years ago · comments

To test if its working, I modified optimised-pin-length-4.txt to have only 9 in the list with one of them being my correct pin.
I have a working nethunter phone (redmi note 3) and working locked phone (nexus 5).
Connected otg cable to locked phone and normal micros usb cable to nethunter phone.
ran command bash ./android-pin-bruteforce crack
I can see nethunter phone tried one by one pins in optimised-pin-length-4.txt, it even tried the actual pin and went further. But locked phone did not unlock.

When observed locked phone's PIN screen , I do not see pins being entered there by nethunter phone is that normal behavior?

To test hid-keyboard actually works, I opened a notepad on locked phone and ran the command again on nethunter phone, I could see pins being printed there.

Andrew Horton · Answer 1 · Wed Apr 14 2021 12:24:28 GMT+0800 (China Standard Time)

If you can't see PINs being entered then that is not normal behaviour.

What config are you using, and have you tried the config files I made for the Motorola G4 and G5?

If those config files do not work then you may need to experiment using a keyword to find out what keys must be pressed before entering a PIN, such as ESCAPE, ENTER, SPACE, CTRL-ESCAPE and so on. With that information you could make a new config file.

simtcrom · Answer 2 · Wed Apr 14 2021 12:28:07 GMT+0800 (China Standard Time)

If you can't see PINs being entered then that is not normal behaviour.

attached config and config.default (please note that on phone I kept file names as config and config.default just for uploading here i renamed to .txt

config.default.txt
config.txt

simtcrom · Answer 3 · Wed Apr 14 2021 12:29:16 GMT+0800 (China Standard Time)

If those config files do not work then you may need to experiment using a keyword to find out what keys must be pressed before entering a PIN, such as ESCAPE, ENTER, SPACE, CTRL-ESCAPE and so on. With that information you could make a new config file.

Ah got it. I will give a try.

Andrew Horton · Answer 4 · Wed Apr 14 2021 12:36:56 GMT+0800 (China Standard Time)

This variable might need to change KEYS_BEFORE_EACH_PIN="escape enter"

By the way, you can use it like this.

bash ./android-pin-bruteforce -c ./config.motorola.moto-g4-plus crack

simtcrom · Answer 5 · Wed Apr 14 2021 12:49:11 GMT+0800 (China Standard Time)

This variable might need to change KEYS_BEFORE_EACH_PIN="escape enter"

By the way, you can use it like this.

bash ./android-pin-bruteforce -c ./config.motorola.moto-g4-plus crack

Guess I am making progress now, When I tried config.motorola.moto-g4-plus I can see first PIN in the list being printed on locked phone and saw Wrong PIN .
But then it did not print anything.

Andrew Horton · Answer 6 · Wed Apr 14 2021 12:53:52 GMT+0800 (China Standard Time)

Any tips on how to make the README easier to understand would be helpful. Let me know how your journey goes.

simtcrom · Answer 7 · Wed Apr 14 2021 12:59:19 GMT+0800 (China Standard Time)

Any tips on how to make the README easier to understand would be helpful. Let me know how your journey goes.

Sure. I am trying by connecting an actual keyboard and recording what keystrokes will get to the PIN screen.

space + enter goes to PIN screen
then typing numbers get PIN inputted
enter attempts that PIN.

But after that, if I type another PIN it is not being inputted (even though I am on PIN screen), looks like the cursor went out some where.
I am trying to find the keystroke to get the cursor back.

simtcrom · Answer 8 · Wed Apr 14 2021 22:23:43 GMT+0800 (China Standard Time)

I connected a physical keyboard to my locked phone and ,
Pressed space + enter
Which took me to PIN screen and I could enter PIN there. After entering wrong PIN and hit enter, the cursor goes out from where PIN is entered.
I had to hit tab key 4 times to get cursor back in position.

In short, I have to hit tab key 4 times after every incorrect PIN, how can I put this in to config?

Andrew Horton · Answer 9 · Wed Apr 14 2021 23:17:40 GMT+0800 (China Standard Time)

I have just added the space_enter key combination. You will need to download the latest version of the source code for this feature.

The part of the config to change is this:
KEYS_BEFORE_EACH_PIN="space_enter tab tab tab tab"

Hopefully this works. Let me know how you go. If not, do any other keys other than space + enter work to bring up the PIN screen?

I added this to this part of the script:

function send_keys() {
  prompt="$1"
  delay="$2"

  for key in $prompt; do

    case $key in 
      "ctrl_escape")
        send_key "left-ctrl escape"
        ;;
      "ctrl-escape")
        send_key "left-ctrl escape"
        ;;
      "space_enter")
        send_key "spacebar return"
        ;;
      "space-enter")
        send_key "spacebar return"
        ;;

simtcrom · Answer 10 · Thu Apr 15 2021 13:08:31 GMT+0800 (China Standard Time)

I have just added the space_enter key combination. You will need to download the latest version of the source code for this feature.

The part of the config to change is this:
KEYS_BEFORE_EACH_PIN="space_enter tab tab tab tab"

Hopefully this works. Let me know how you go. If not, do any other keys other than space + enter work to bring up the PIN screen?

I added this to this part of the script:
function send_keys() {
  prompt="$1"
  delay="$2"

  for key in $prompt; do

    case $key in 
      "ctrl_escape")
        send_key "left-ctrl escape"
        ;;
      "ctrl-escape")
        send_key "left-ctrl escape"
        ;;
      "space_enter")
        send_key "spacebar return"
        ;;
      "space-enter")
        send_key "spacebar return"
        ;;

I downloaded latest android-pin-bruteforce and added KEYS_BEFORE_EACH_PIN="space_enter tab tab tab tab" to config.motorola.moto-g4-plus . When I try, its not going to PIN screen any more.

With KEYS_BEFORE_EACH_PIN="ctrl_escape enter" in config.motorola.moto-g4-plus and latest android-pin-bruteforce , at least its going to the PIN screen and input the first PIN in the list and try it. Its the next PIN onwards, its not able to input.

I will find out if any key other than space + enter takes me to PIN screen.

Note: The locked phone I am trying is Nexus 5

simtcrom · Answer 11 · Thu Apr 15 2021 23:24:13 GMT+0800 (China Standard Time)

I set,
KEYS_BEFORE_STARTING="space enter"

And tried setting below to
KEYS_BEFORE_EACH_PIN="tab tab tab tab"

and its going PIN screen, but not selecting PIN field.

And tried setting below to
KEYS_BEFORE_EACH_PIN="ctrl_escape enter"

Now going to PIN screen and get selected and first PIN get inputted correctly. But after 1st PIN inputted, PIN field selection gone. I know that tab tab tab tab (4 times tab keys) will bring back the selection. But some how not able to make the script do that.

Andrew Horton · Answer 12 · Sat Apr 17 2021 10:47:53 GMT+0800 (China Standard Time)

Can you combine those?

KEYS_BEFORE_EACH_PIN="ctrl_escape enter tab tab tab tab"

Above you wrote : KEYS_BEFORE_STARTING="space enter"
This sends space, a short delay, then sends enter.

That is different to: KEYS_BEFORE_EACH_PIN="space_enter
This sends space and enter at the same time.

simtcrom · Answer 13 · Sat Apr 17 2021 15:54:22 GMT+0800 (China Standard Time)

Can you combine those?

KEYS_BEFORE_EACH_PIN="ctrl_escape enter tab tab tab tab"

Above you wrote : KEYS_BEFORE_STARTING="space enter"
This sends space, a short delay, then sends enter.

That is different to: KEYS_BEFORE_EACH_PIN="space_enter
This sends space and enter at the same time.

I tried KEYS_BEFORE_EACH_PIN="ctrl_escape enter tab tab tab tab" and also set KEYS_BEFORE_EACH_PIN="space_enter" still its not doing. Also noticed, during cool off period also its trying PINs on the script.
I made a video of trying different combinations. I am hoping once you see it you will get different behaviors, and you will be able to suggest correct settings to me.

https://youtu.be/tNc6RuflGgs

Andrew Horton · Answer 14 · Sun Apr 18 2021 11:48:35 GMT+0800 (China Standard Time)

I have added KEYS_AFTER_EACH_PIN by default it is "enter" but you could try changing it to "enter tab tab tab tab"

simtcrom · Answer 15 · Sun Apr 18 2021 14:54:30 GMT+0800 (China Standard Time)

I have added KEYS_AFTER_EACH_PIN by default it is "enter" but you could try changing it to "enter tab tab tab tab"

That did not help either.

I was thinking of sending keystrokes using hid-keyboard and get the working pattern.
If I want to write couple of below commands, as part of a shell script, how should I do it?
I tried putting them as is, and get error “/dev/hidg0: No such file or directory”
When I try the command individually on shell it works.

echo left-ctrl escape enter | hid-keyboard /dev/hidg0 keybaord

also spacebar an allowed keystroke or is it space ?

Andrew Horton · Answer 16 · Mon Apr 19 2021 06:58:06 GMT+0800 (China Standard Time)

spacebar should work, but if it isn't working try space.

The following command should work in a shell script:

echo "enter" | /system/xbin/hid-keyboard /dev/hidg0 keyboard

The /system/xbin/hid-keyboard will combine some keys, but combined keys can only be used in this script when an underscore joins them, for example with ctrl_escape.

Andrew Horton · Answer 17 · Fri Apr 30 2021 15:11:50 GMT+0800 (China Standard Time)

@simtcrom were you successful in making a config file for your Nexus 5?

Andrew Horton · Answer 18 · Fri Apr 30 2021 15:18:13 GMT+0800 (China Standard Time)

Try making a script like this for testing:

echo "left-ctrl escape" | /system/xbin/hid-keyboard /dev/hidg0 keyboard
echo "spacebar" | /system/xbin/hid-keyboard /dev/hidg0 keyboard
echo "1 2 3 4" | /system/xbin/hid-keyboard /dev/hidg0 keyboard
echo "enter" | /system/xbin/hid-keyboard /dev/hidg0 keyboard

simtcrom · Answer 19 · Sat May 01 2021 02:26:46 GMT+0800 (China Standard Time)

Try making a script like this for testing:

echo "left-ctrl escape" | /system/xbin/hid-keyboard /dev/hidg0 keyboard
echo "spacebar" | /system/xbin/hid-keyboard /dev/hidg0 keyboard
echo "1 2 3 4" | /system/xbin/hid-keyboard /dev/hidg0 keyboard
echo "enter" | /system/xbin/hid-keyboard /dev/hidg0 keyboard

I got busy with work.
But I definitely plan to come back and try this.
I will sure post my results.

Andrew Horton · Answer 20 · Thu Jul 08 2021 12:29:41 GMT+0800 (China Standard Time)

Have you had a chance to look at this again?

simtcrom · Answer 21 · Thu Jul 08 2021 13:30:30 GMT+0800 (China Standard Time)

Have you had a chance to look at this again?

Sorry I could not. Busy at work place.
Also the touch of nexus stopped working. So will have to spend some considerable amount of time to try this out again.

pathanrajik · Answer 22 · Fri Jul 09 2021 01:32:53 GMT+0800 (China Standard Time)

locked out unlock