Evil Crow Cable Wind - how to program the firmware and not go crazy

Anyone who has ever held a USB cable in their hand and thought, "what if this cable could do more than just charge a phone" - has probably eventually come across the Evil Crow Cable Wind. It's an inconspicuous USB cable that hides an ESP32-S3 microcontroller inside, featuring WiFi, flash memory, and ambitions far exceeding its size.

Today, I will show you how to flash the latest firmware onto it - from scratch, clean, on Windows. And then, how to connect to it and start playing around.

You could, of course, just feed this guide to an AI, and it would hold your hand through the process... :)

What's inside

The Evil Crow Cable Wind is actually a fully-fledged ESP32-S3-PICO-1 microcontroller enclosed in a USB cable housing. Specifically, we have at our disposal:

• 8 MB of Flash memory (built-in, not on an SD card)
• 2 MB PSRAM
• WiFi and Bluetooth LE
• USB HID interface - the cable can emulate a keyboard

The firmware provides a web panel where you can write and run payloads, upload scripts, schedule autoexec - in short, everything you need to work with BadUSB. But for all this to work, you first need to flash the appropriate firmware.

What you will need

Before we move on to the actual fun, we need to prepare our workstation. The shopping list looks like this:

• Arduino CLI - a command-line tool for compiling and uploading firmware. You could use the full Arduino IDE with a graphical interface, but why click around when you can just type one command?
• ESP32 Board Manager v3.2.0 - the Espressif platform for Arduino; it contains the compiler, flashing tools, and board definitions. Version 3.2.0 is strictly required - newer ones may introduce incompatibilities.
• EvilCrowCable-Wind repository - this is where the firmware and modified USB library reside.
• ArduinoJson library - the firmware needs it to handle the configuration.
• A magnet - yes, a physical magnet. Applied to the active end of the cable, it switches it into programming mode. Without it, the cable behaves like an ordinary USB cable and cannot be flashed.

Step-by-step environment setup

We start by creating a working directory and downloading everything we need.

Step 1 - Download arduino-cli

Go to the arduino-cli releases page and download the latest ZIP version for Windows 64-bit. Extract it into our working directory.

mkdir EvilCrowCable-Wind-Setup
cd EvilCrowCable-Wind-Setup
curl -L -o arduino-cli.zip https://github.com/arduino/arduino-cli/releases/download/v1.4.1/arduino-cli_1.4.1_Windows_64bit.zip
unzip arduino-cli.zip -d arduino-cli-bin

Step 2 - Configure the ESP32 board manager

We add the Espressif repository URL and install the ESP32 platform in version 3.2.0:

arduino-cli-bin/arduino-cli.exe config init --overwrite
arduino-cli-bin/arduino-cli.exe config add board_manager.additional_urls https://espressif.github.io/arduino-esp32/package_esp32_index.json
arduino-cli-bin/arduino-cli.exe core update-index
arduino-cli-bin/arduino-cli.exe core install esp32:esp32@3.2.0

This will take a moment - the ESP32 platform weighs over 1 GB. Good time for a coffee.

Step 3 - Clone the repository and libraries

git clone https://github.com/joelsernamoreno/EvilCrowCable-Wind.git
git clone https://github.com/bblanchon/ArduinoJson.git

Now we need to copy the libraries to where Arduino CLI will look for them - to the Documents\Arduino\libraries folder:

mkdir -p ~/Documents/Arduino/libraries
unzip EvilCrowCable-Wind/modified-libraries/USB.zip -d ~/Documents/Arduino/libraries/
cp -r ArduinoJson ~/Documents/Arduino/libraries/ArduinoJson

The USB library in the modified-libraries directory is a modified version of the ESP32 USB library - it's not a standard library from the manager, so it must be installed manually. Without it, the firmware won't compile.

Flashing - a single command

And now for the best part. The entire compilation and firmware upload done with a single terminal command:

arduino-cli-bin/arduino-cli.exe compile --fqbn "esp32:esp32:esp32s3:CDCOnBoot=default,CPUFreq=80,DFUOnBoot=default,FlashMode=qio,FlashSize=8M,PartitionScheme=default_8MB,UploadSpeed=921600,USBMode=hwcdc" --libraries ~/Documents/Arduino/libraries --upload --port COM3 EvilCrowCable-Wind/firmware

Let's break this down because it looks intimidating:

The --upload flag tells arduino-cli to immediately flash the firmware onto the device after compiling. Without it, we would only get a compiled binary file.

How to find the COM port

Before you run the command above, you need to know which port the cable is sitting on. Just type:

arduino-cli-bin/arduino-cli.exe board list

You will see something like this:

Port  Protocol Type              Board Name          FQBN                      Core
COM3  serial   Serial Port (USB) ESP32 Family Device esp32:esp32:esp32_family esp32:esp32

Remember the port number and plug it into the --port parameter.

Programming mode - the magnet

This is the element that distinguishes the Evil Crow Cable Wind from a regular dev board. The cable doesn't have a BOOT button - instead, it has a magnetic sensor. To enter programming mode:

1. Take a magnet (a small neodymium one will do)
2. Apply it to the active end of the cable (the one marked with a sticker)
3. Plug the cable into your computer
4. The cable is now in programming mode and will appear as a COM port

After flashing the firmware, remove the magnet. The cable will reboot and start the new firmware.

Connecting to the cable - the web panel

The firmware is flashed, the cable works. But how do you communicate with it? The Evil Crow Cable Wind connects to a WiFi network as a client (STA mode) - this means it doesn't create its own network, but connects to an existing one.

Default WiFi configuration

The following credentials are set by default in the firmware:

• SSID: Evil Crow Cable Wind
• Password: 123456789

Upon startup, the cable looks for a network with this name and tries to connect. If it doesn't find it, it simply won't establish a connection and the web panel will be inaccessible.

Setting up a hotspot

The easiest way is to set up a hotspot on your laptop or phone with exactly the parameters mentioned above. On Windows, you can do this via Settings > Network > Mobile hotspot, setting:

• Network name: Evil Crow Cable Wind
• Password: 123456789

Once the hotspot is running, plug the cable into a USB port (without the magnet). After a few seconds, the cable should automatically connect to the network.

Finding the IP address

Theoretically, the cable should be accessible at http://cable-wind.local thanks to mDNS. Practically - mDNS can be finicky on Android and temperamental on Windows. That's why checking what IP address the cable received is a better solution.

On a laptop with a hotspot, simply check the list of connected devices, or run in the terminal:

arp -a

Look for an address in the hotspot's subnet - it will usually be something like 192.168.0.x. Enter this address into your browser, and you should see the Evil Crow Cable Wind panel.

The web panel

After navigating to the cable's IP address in your browser, you have a full management panel at your disposal:

• Home - device status, connection information
• Payload Editor - real-time payload editor
• Upload Payload - uploading ready-made scripts
• List Payloads - list of saved payloads
• AutoExec Planning - scheduling scripts to run automatically upon connection
• Config - configuration for WiFi, USB (Vendor ID, Product ID, device name), hostname, and keyboard layout

In the Config section, you can change the SSID and WiFi password to your own - then the cable will connect to your home network, and you won't need to set up a dedicated hotspot every time.

Over-The-Air (OTA) firmware update

If the cable already has firmware flashed and is connected to a WiFi network, subsequent updates can be uploaded wirelessly - without a magnet and without plugging it directly into a computer data port.

In the Arduino CLI, export the compiled binary file:

arduino-cli-bin/arduino-cli.exe compile --fqbn "esp32:esp32:esp32s3:CDCOnBoot=default,CPUFreq=80,DFUOnBoot=default,FlashMode=qio,FlashSize=8M,PartitionScheme=default_8MB,UploadSpeed=921600,USBMode=hwcdc" --libraries ~/Documents/Arduino/libraries --output-dir ./build EvilCrowCable-Wind/firmware

And then send it to the cable with a single curl command:

curl -F "image=@./build/firmware.ino.bin" http://192.168.137.22/update

Of course, you need to replace the IP address with the current address of your cable. After uploading, the cable will automatically restart.

Summary

The whole process from zero to working firmware looks like this:

1. Download arduino-cli, clone the repository and libraries
2. Install ESP32 board manager v3.2.0
3. Apply the magnet, plug in the cable, check the COM port
4. Run a single compile --upload command
5. Set up a hotspot, find the IP, open the panel in a browser

The whole thing - from an empty drive to a working web panel - takes about 15 minutes, most of which is waiting for the ESP32 platform to download. The actual flash takes less than 10 seconds.

The Evil Crow Cable Wind is an interesting tool for security testing and learning about BadUSB attacks. Like any such tool - use it responsibly and only on devices to which you have authorized access. Ethical hacking starts with the owner's consent.