Rickroll with ESP32. Simulate a Bluetooth Keyboard

One day I learned about the existence of ESP32 microcontrollers, which have built-in Bluetooth and Wi-Fi modules. Then I started telling everyone what a cool piece of hardware it was, until someone finally gave me one.

At the time of writing, such a microcontroller can be purchased in the Russian Federation with delivery for less than 1000 rubles. Isn't it a miracle?

Having received the piece of iron in my hands, I began to think about why I needed it. The first thought that came to mind was to implement Bluetooth speaker jammerbut more about that later.

Here I remembered the times of my studies at the institute, where we simulated a HID device using microcontrollers. Therefore, I wondered if the same could be done for a Bluetooth keyboard. It turns out that there are quite a few such projects, and I decided to repeat one of them.

There is a great one on GitHub libraryallowing me to realize my idea.

So, let's begin.

Setting up the environment

You can use literally anything to write code, but a fairly canonical and convenient development environment is the Arduino IDE.

Download the IDE and run it.

Here we need to download the package to support ESP32 boards:

Go to the board manager – press Ctrl+Shift+B

In the window that opens, enter ESP32

Here we need to download esp32 from Espressif. Note that the latest version is not suitable for the library we are using, and we need version 2.0.1 – it does not compile on later versions.

Then, create a new sketch by pressing Ctrl+N

Download the library and connect it via the context menu Sketch->Connect library->add .ZIP library

The IDE kindly tells you that the library is installed:

Then, connect the microcontroller to the PC and go to the device manager – press WIN+R and call devmgmt.msc

Go to Ports (COM and LPT), where we see our device

If your device is not detected, you need to install the driver (google it by searching for “{Chip model} driver”)

Then, we return to the IDE and configure the board settings:

At the top of the workspace, open the drop-down list and select “Select another board and port”

And we set up the correspondence between the board name and the COM port

This completes the environment setup.

Let's move on to programming

As a payload we will open RickRoll on Youtube.

Let's take an example from the library and implement the following functions:

void setup() {
  Serial.begin(115200);
  Serial.println("Starting BLE work!");
  bleKeyboard.begin();

}
void loop() {
  if(bleKeyboard.isConnected()) {
  delay(1000);
  }

  Serial.println("Waiting 5 seconds...");
  delay(5000);
}

Next we implement the opening of a web page.

For example, this can be done by calling powershell with the parameters “-c Start-Process http://example.com“

Let's write a simple script that opens a page with a video.

To do this, we will call WIN+R and enter the command for execution.

The library implements the following functions for text input:

press, release, write, releaseAll, print, so our loop function will look like this:

void loop() {
  if(bleKeyboard.isConnected()) {
  bleKeyboard.press(KEY_LEFT_GUI);
  bleKeyboard.print("r");
  delay(100);
  bleKeyboard.releaseAll();
  delay(100);
  bleKeyboard.print("powershell.exe -с \"Start-Process https://www. youtube.com/watc h?v=dQw4w9WgXcQ\"");
  delay(100);
  bleKeyboard.write(KEY_RETURN);
  }

  Serial.println("Waiting 5 seconds...");
  delay(5000);
}

However, for reasons unknown to me, entering long strings would occasionally cause the key to stick, and the string being entered would turn into something like “powershellllllllllllll”

Therefore, by manually selecting the command length, the optimal length was developed, and the final script looks like this:

#include <BleKeyboard.h>

BleKeyboard bleKeyboard;
void setup() {
  Serial.begin(115200);
  Serial.println("Starting BLE work!");
  bleKeyboard.begin();

}

void loop() {
  if(bleKeyboard.isConnected()) {
  bleKeyboard.press(KEY_LEFT_GUI);
  bleKeyboard.print("r");
  delay(100);
  bleKeyboard.releaseAll();
  delay(100);
  bleKeyboard.print("powershell.exe");
  delay(100);
  bleKeyboard.print(" -c  ");
  delay(100);
  bleKeyboard.print("\"Start-Process");
  delay(100);
  bleKeyboard.print(" https://www.");
  delay(100);
  bleKeyboard.print("youtube.com/watc");
  delay(100);
  bleKeyboard.print("h?v=dQw4w9WgXcQ\"");
  delay(100);
  bleKeyboard.write(KEY_RETURN);
  delay(1000);
  }

  Serial.println("Waiting 5 seconds...");
  delay(5000);
}