Review: HackyPi (SB Components)

The device is advertised as follows: "Whether you're a beginner or an experienced coder, HackyPi from SB Components is a versatile and accessible platform for expanding your knowledge and skills in the exciting world of cybersecurity and coding." I am curious to see if this dream comes true.

I've ordered HackyPi on kickstarter.com and I've received it in May 2023. You can buy HackyPi on sb-components.co.uk.

There is another project called Hacky Pi which is completely different and based on a standard Raspberry Pi.

If you have already used Raspberry Pi Pico (RP2040) and CircuitPython, it's very easy to program. But if it's your first time it's important to get familiar with two different ways to edit your scripts.

If you connect the HackyPi to a USB port then a volume named HACKYPI is mounted by default. And if you use a text editor and save code.py then it will be reloaded immediately. You could change this behavior by setting supervisor.disable_autoreload().

CircuitPython and the computer are accessing the same filesystem simultaneously. Thats why it's best to use either one or the other. I recommend using the latest version of Thonny which is able to manage the files directly in CircuitPython over the USB serial connection. There are instructions available how to setup HackyPi.

You can disable mounting of HACKYPI if you don't need to access it from your computer. First boot.py is executed and then code.py. You only need to enter following to boot.py:

import storage
storage.disable_usb_drive()

Verify code.py that there is no storage.enable_usb_drive() which would mount HACKYPI again.

Normally you can repair filesystem errors without any issues but when it's unsuccessful then you may need to re-flash CircuitPython. Be sure to get the firmware from the CircuitPython Website as the firmware.u2f from github.com/sbcshop is outdated and doesn't work. Warning: This will erase all scripts and other files which were saved on your HackyPi! After flashing do not forget to copy the lib folder (and all subdirs and files) to HACKYPI. Always keep a backup somewhere else.

Pros

• Raspberry Pi Pico RP2040 with a 240x135px TFT display in a nice a 3D printed black enclosure.
• It only costs ~USD 20
• Example payloads for Windows and MacOS are available.
• A display is much better suited to indicate the current program status than an led which lights green or flashes red.

Cons

• I couldn't find any community to share experiences and payloads with other users. You can find answers or ask new questions at issues on github.com (which seems to be unmaintained Update: It seems to be updated very infrequently by the maker) or ask SB Components for help.
• Most of the examples are poorly documented.
• Why there are no examples provided for Linux? For Gnome use Alt-F2 and open gnome-terminal. Use keyboard_layout.write("\n") instead of keyboard.send(Keycode.ENTER), e.g.

  # open gnome-terminal on linux
  keyboard.send(Keycode.ALT, Keycode.F2)
  time.sleep(1)
  keyboard_layout.write("gnome-terminal\n")
  time.sleep(1)
  
  # list ip addresses
  keyboard_layout.write("ip address list\n")
  
  # close terminal after 3 seconds
  time.sleep(3)
  keyboard_layout.write("exit\n")

• The Display_Images_from_SDCard example should be replaced by some other script which makes more sense. It takes almost 3 minutes to load a full screen image. I've tried different SD cards but the speed was equally slow and I just spent unnecessary time debugging. The internal storage is much faster: Display_Images_FromHackyPi requires only ~4 seconds for a full screen image. Update: This issue has been fixed by not rotating the image. But keep in mind that only ~1004kB are allocated for the internal storage. The lib directory is 70kB and each image requires ~100kB so there is not much space left.
• HackyPi is for software hackers only. Unfortunately there is nothing you can really do as a hardware hacker, but to be fair it was never intended for this purpose. On the PCB there are no pads with GPIO pins to solder additional components like switches or sensors.
• The only button which is available is BOOT, and it's reserved for flashing and is normally not accessible from CircuitPython. It would have been nice to select the OS and payload by pressing a button. Following hack might work but I haven't tested it yet: Reading RP2040 BOOTSEL pin from code. With some additional buttons this would be much easier to implement.
• No WiFi connectivity
• No USB-C connector or adapter included

FAQ

• How to prevent autoreload when files are copied to the USB mass storage device?

  supervisor.disable_autoreload()

• How to disable USB mass storage device?

  import storage
  storage.disable_usb_drive()

• How to change the name of the USB mass storage device?
  Try the new example rename_device_script.py with the default label:

  ''' 
  This script rename you device from default circuitpython to your favorite name,
  Just save this script as code.py in HackyPi, then remove and re-insert.
  '''
  import storage
  storage.remount("/", readonly=False)
  m = storage.getmount("/")
  m.label = "HACKYPI"    # replace name which you are interested for your device
  storage.remount("/", readonly=True)
  storage.enable_usb_drive()

• Is keystroke reflection possible like with the USB Rubber Ducky?
  No, probably not yet. It might be possible in future CircuitPython versions.
• Is it possible to display images from the computer on the HackyPi?
  Yes, I think its possible to run some code on the computer and send the scaled bmp images over the USB serial connection but I assume it will be very slow.
• I can see messages that the images are loaded correctly but the display stays black, why?
  Check if the backlight is turned on:

  # turn on backlight
  tft_bl = board.GP13
  led = digitalio.DigitalInOut(tft_bl)
  led.direction = digitalio.Direction.OUTPUT
  led.value=True

Conclusion

The LCD screen is a good replacement for status LEDs and clearly shows the program state but otherwise HackyPi is not very beginner friendly. The examples aren't very useful and often not documented. The hardware has many limitations: No additional buttons and the SD card speed is very slow. Unfortunately, nobody seems to use this device which means you only have a few examples from SB Components to start with. Some examples are broken and do not work. The issues are not getting fixed which makes it even worse. Update: Two days after posting my review some issues have been resolved but I haven't tested them yet. I've still haven't found a community to share experiences and payloads. That's why I can't recommend HackyPi for beginners.

Alternatives

I you're really interested in USB security I would rather buy a USB Rubber Ducky, O.MG Cable or Bash Bunny which is better documented has many more features and lots of examples to explore.

If you want a similar device like the HackyPi with a LCD screen then a LILYGO® T-Display seems to be the better choice. It costs ~USD 18, shipping and case included. There is no SD card slot but it has three additional buttons (one of them is the reset button) and a red LED. It's very similar but in my opinion it's more versatile than the HackyPi and is suitable for both software and hardware hackers. Some GPIOs for the LCD are different but it's easy to run most of the HackyPi examples on a LILYGO® T-Display by modifying only a few lines and adding some code to drive the PWR_EN pin (I assume to conserve power when a LiPo battery is connected for standalone operation which doesn't make sense as a HackyPi replacement). Otherwise the LCD stays dark:

# LILYGO(R) T-Display - same ST7789 1.14" lcd, but on different GPIO
tft_clk = board.GP2 # must be a SPI CLK
tft_mosi= board.GP3 # must be a SPI TX
tft_rst = board.GP0
tft_dc  = board.GP1
tft_cs  = board.GP5
tft_bl  = board.GP4

# PWR_EN to enable 3.3V for the peripherals
pwr_en  = board.GP22 # PWR_EN

#define PWR_EN pin to enable 3.3V
power = digitalio.DigitalInOut(pwr_en)
power.direction = digitalio.Direction.OUTPUT
power.value=True

You need a passive USB-C(m) to USB-A(m) cable to connect the board with the computer which is not included. To connect it to a computer having an USB-C port you need an additional USB-A(f) to USB-C(m) adapter. A standard USB-C(m) to USB-C(m) cable doesn't work as it contains active components for USB PD protocol which is unsupported on the LILYGO® T-Display. But I've found a USB Type C Plug to Plug Adapter which works great to connect the board to a USB-C(f) port. And the USB-A Plug to USB-C Plug Adapter seems to be the ideal adapter for a USB-A(f) port.

Be sure to install CircuitPython for RP2040 and not for the "T-Display RP2040 by LILYGO" which uses a different module to drive the LCD and is incompatible whith the code provided for HackyPi.