configfs: support mass storage gadget

Author: Netdex

app/src/main/assets/scripts/a.lua

@@ -0,0 +1,36 @@
+---
+--- Composite device composed of two keyboards
+---
+---
+usb = luausb.create({ type = "keyboard", id = 0 }, { type = "keyboard", id = 1 })
+kb1 = usb.dev[1]
+kb2 = usb.dev[2]
+
+while true do
+    usb.log("idle")
+
+    -- poll until usb plugged in
+    while usb.state() == "not attached" do
+        usb.delay(1000)
+    end
+
+    usb.log("running")
+    usb.delay(1000)
+
+    -- send a string from keyboard 1
+    kb1.send_string("kb1")
+    usb.delay(1000)
+    -- send a string from keyboard 2
+    kb2.send_string("kb2")
+
+    usb.log("done")
+
+    -- poll until usb unplugged
+    while usb.state() == "configured" do
+        usb.delay(1000)
+    end
+
+    usb.log("disconnected")
+
+    usb.delay(1000)
+end

app/src/main/assets/scripts/composite.lua

@@ -1,7 +1,4 @@
 ---
---- Created by netdex.
---- DateTime: 12/30/17 10:12 PM
----
 --- downloadrun.lua: downloads and executes a file
 --- directly translated from the Java version in previous builds
 ---
@@ -15,8 +12,8 @@ local runAs = usb.should("Task UAC", "Launch exe as admin?");
 while true do
     usb.log("idle")
 
-    -- poll until /dev/hidg0 is writable
-    while not kb.test() do
+    -- poll until usb plugged in
+    while usb.state() == "not attached" do
         usb.delay(1000)
     end
 
@@ -54,7 +51,8 @@ while true do
     )
 
     usb.log("done")
-    while kb.test() do
+    -- poll until usb unplugged
+    while usb.state() == "configured" do
         usb.delay(1000)
     end
     usb.log("disconnected")

app/src/main/assets/scripts/downloadrun.lua

@@ -0,0 +1,11 @@
+---
+--- Generated by EmmyLua(https://github.com/EmmyLua)
+--- Created by netdex.
+--- DateTime: 11/16/2020 10:47 AM
+---
+
+usb = luausb.create({ id = 0, type = "storage" })
+
+while true do
+    usb.delay(1000)
+end

app/src/main/assets/scripts/fuzzer.lua

@@ -1,10 +1,6 @@
 ---
---- Created by netdex.
---- DateTime: 1/6/2018 4:33 PM
----
 --- wallpaper.lua: Changes a Windows 10 desktop wallpaper
 ---
----
 
 usb = luausb.create({ id = 0, type = "keyboard" })
 kb = usb.dev[1]
@@ -14,8 +10,8 @@ local file = usb.ask("Wallpaper to download?", "https://i.redd.it/ur1mqcbpxou51.
 while true do
     usb.log("idle")
 
-    -- poll until /dev/hidg0 is writable
-    while not kb.test() do
+    -- poll until usb plugged in
+    while usb.state() == "not attached" do
         usb.delay(1000)
     end
 
@@ -40,7 +36,8 @@ while true do
             "exit\n")
 
     usb.log("done")
-    while kb.test() do
+    -- poll until usb unplugged
+    while usb.state() == "configured" do
         usb.delay(1000)
     end
 end

app/src/main/assets/scripts/test.lua

@@ -24,7 +24,7 @@
 import org.netdex.hidfuzzer.gui.PromptDialog;
 import org.netdex.hidfuzzer.service.LuaUsbService;
 import org.netdex.hidfuzzer.service.LuaUsbServiceConnection;
-import org.netdex.hidfuzzer.task.AsyncIoBridge;
+import org.netdex.hidfuzzer.task.AsyncIOBridge;
 import org.netdex.hidfuzzer.task.LuaUsbTask;
 import org.netdex.hidfuzzer.task.LuaUsbTaskFactory;
 
@@ -49,7 +49,7 @@ protected void onCreate(Bundle savedInstanceState) {
         TextView logView = findViewById(R.id.text_log);
         ScrollView scrollView = findViewById(R.id.scrollview);
 
-        AsyncIoBridge dialogIO = new AsyncIoBridge() {
+        AsyncIOBridge dialogIO = new AsyncIOBridge() {
             @Override
             public void onLogMessage(String s) {
                 handler_.post(() -> {
@@ -91,7 +91,7 @@ public void createLuaUsbService(LuaUsbTask task) {
     public void terminateLuaUsbService() {
         if (activeServiceConn_ != null) {
             btnCancel_.setEnabled(false);
-            unbindService(activeServiceConn_);
+            unbindService(activeServiceConn_); // TODO this can cause ANR
             activeServiceConn_ = null;
         }
     }

app/src/main/assets/scripts/wallpaper.lua

@@ -18,15 +18,6 @@ public static class Parameters {
 
         public String configName;
 
-        public static final Parameters DEFAULT = new Parameters(
-                null,
-                null,
-                "0x1d6b",
-                "0x104",
-                null,
-                null
-        );
-
         public Parameters(String manufacturer, String serial,
                           String idProduct, String idVendor, String product,
                           String configName) {
@@ -175,6 +166,10 @@ public String getUDC(Shell.Threaded su) {
         return Command.readFile(su, getUDCPath());
     }
 
+    public String getUDCState(Shell.Threaded su, String udc) {
+        return Command.readFile(su, String.format("/sys/class/udc/%s/state", udc));
+    }
+
     public boolean isBound(Shell.Threaded su) {
         return !getUDC(su).isEmpty();
     }

app/src/main/java/org/netdex/hidfuzzer/MainActivity.java

@@ -6,7 +6,10 @@
 
 import eu.chainfire.libsuperuser.Shell;
 
-
+/**
+ * https://www.kernel.org/doc/Documentation/usb/gadget_configfs.txt
+ * https://www.kernel.org/doc/Documentation/ABI/testing/
+ */
 public abstract class UsbGadgetFunction {
     public static class Parameters {
 

app/src/main/java/org/netdex/hidfuzzer/configfs/UsbGadget.java

@@ -4,7 +4,10 @@
 
 import eu.chainfire.libsuperuser.Shell;
 
-
+/**
+ * https://www.kernel.org/doc/Documentation/usb/gadget_hid.txt
+ * https://www.kernel.org/doc/Documentation/ABI/testing/configfs-usb-gadget-hid
+ */
 public class UsbGadgetFunctionHid extends UsbGadgetFunction {
     public static class Parameters extends UsbGadgetFunction.Parameters {
         public int protocol;
@@ -86,19 +89,4 @@ public void create(Shell.Threaded su, String gadgetPath) throws Shell.ShellDiedE
                         String.format("functions/%s/report_desc", functionDir), true, false),
         });
     }
-
-    @Override
-    public void bind(Shell.Threaded su, String gadgetPath, String configDir) throws Shell.ShellDiedException {
-        super.bind(su, gadgetPath, configDir);
-    }
-
-    @Override
-    public void unbind(Shell.Threaded su, String gadgetPath, String configDir) throws Shell.ShellDiedException {
-        super.unbind(su, gadgetPath, configDir);
-    }
-
-    @Override
-    public void remove(Shell.Threaded su, String gadgetPath) throws Shell.ShellDiedException {
-        super.remove(su, gadgetPath);
-    }
 }