Get a Pentest and security assessment of your IT network.

Cyber Security

SD Card as HID Device

TL;DR

Yes, an SD card (or microSD card) can emulate a Human Interface Device (HID), like a keyboard or mouse. This is typically achieved using a microcontroller programmed to read data from the SD card and present it as HID reports over USB. It’s not plug-and-play; you need hardware and programming skills.

How it Works

An SD card itself doesn’t have the ability to act as an HID device. It simply stores data. A microcontroller acts as a bridge, reading the data from the SD card and then converting that data into USB HID reports that your computer understands.

Steps to Make an SD Card Emulate an HID Device

  1. Choose a Microcontroller: You’ll need a microcontroller with USB capabilities. Popular choices include:
    • Arduino Leonardo/Micro: Relatively easy to program and widely supported.
    • Teensy: Powerful, but may have a steeper learning curve.
    • ESP32: Offers Wi-Fi and Bluetooth in addition to USB HID support.
  2. Select an SD Card Reader Module: This module connects the SD card to your microcontroller. Make sure it’s compatible with your chosen microcontroller’s voltage levels (typically 3.3V or 5V).
  3. Connect Hardware: Connect the SD card reader module to the microcontroller according to its datasheet. This usually involves SPI pins (MOSI, MISO, SCK, CS) and power/ground.
    // Example Arduino connections (check your specific modules!) 
    const int chipSelect = 10; // SD Card Chip Select pin
    
  4. Install Necessary Libraries: In the Arduino IDE, install libraries for:
    • SD: For reading data from the SD card.
    • Keyboard/Mouse: To emulate HID devices. (Choose one or both depending on your goal).
    • USBHost (if needed): Some microcontrollers require this library for USB communication.
  5. Write the Code: This is the most complex part. The code needs to:
    1. Initialize the SD card reader.
    2. Open and read a file from the SD card (e.g., ‘hid_data.txt’).
    3. Parse the data in the file into HID reports.
    4. Send the HID reports over USB using the Keyboard/Mouse library.
    // Example Arduino code snippet (very basic)
    #include 
    #include 
    
    const int chipSelect = 10;
    
    void setup() {
      Serial.begin(9600);
      if (!SD.begin(chipSelect)) {
        Serial.println("SD card initialization failed!");
        return;
      }
      File file = SD.open("hid_data.txt");
      if (file) {
        while (file.available()) {
          char c = file.read();
          Keyboard.press(c);
          delay(10); // Small delay between key presses
          Keyboard.release(c);
        }
        file.close();
      } else {
        Serial.println("Error opening hid_data.txt");
      }
    }
    
    void loop() {
      // Do nothing in the main loop (data is read once on startup)
    }
    
  6. Create the HID Data File: Create a text file (e.g., ‘hid_data.txt’) on the SD card containing the data that represents your desired HID actions. The format depends on the library and device you’re emulating.
    • For keyboard emulation, this might be a sequence of key presses/releases represented by ASCII codes or specific Keyboard library commands.
    • For mouse emulation, it could be coordinates for movement and button press/release events.
  7. Upload the Code: Upload the code to your microcontroller using the Arduino IDE (or appropriate software for your chosen board).
  8. Test: Connect the microcontroller to your computer via USB. The SD card data should now be interpreted as HID input.

Important Considerations

  • USB Compatibility: Ensure your microcontroller and code are compatible with your operating system’s USB HID standards.
  • Data Format: The format of the ‘hid_data.txt’ file is crucial. Refer to the documentation for your chosen HID library for details.
  • Power Consumption: Microcontrollers can draw significant power, especially during USB communication.
  • Security: Be cautious about running code from untrusted sources on an SD card connected to a computer; malicious data could potentially compromise your system.
Related posts
Cyber Security

Zip Codes & PII: Are They Personal Data?

Cyber Security

Zero-Day Vulnerabilities: User Defence Guide

Cyber Security

Zero Knowledge Voting with Trusted Server

Cyber Security

ZeroNet: 51% Attack Risks & Mitigation