Search This Blog

Sunday, January 5, 2025

Flipper Zero: Ducky scripts

Yesterday I received my Flipper Zero and after a long wait I was ready to tinker away with it.

After capturing some infrared signals and replicating them, it was time to test the legendary Bad USB functionality.

The content of this post is based on the GitHub page.

The BadUsb app on the Flipper Zero uses extended Ducky script syntax which is compatible with the classic USB Rubber Ducky 1.0 language but with extra components such as custom USB ID (how the keyboard is identified), ALT-codes (pressing ALT and numbers on the numpad) and the old SYSRQ command. Both \n and \r\n line endings are supported, empty lines are allowed and you can use spaces or tabs for line indentation.

The script is written in simple .txt files and can be copied over to the Flipper Zero using the Windows app for example, and it must be located in the correct Bad USB folder.

To use the Bad USB function, make sure to have a USB-C to USB-A cable that you connect between the Flipper and the computer that you want to run your script on.

Navigate to "Bad USB" in the main menu, select the script that you want to execute and then press run.
Almost instantly it will execute the keypresses that you preprogrammed.

Here is a simple example that helps you start a PowerShell window with administrative privileges.

GUI r
DELAY 500
STRING powershell
CTRL-SHIFT ENTER
DELAY 500
ALT Y
DELAY 500
STRING write-host "This script is running as admin"
ENTER

Spoof keyboard ID

You can set the custom ID of the Flipper USB HID device. ID command should be in the **first line** of script, it is executed before script run. VID and PID are hex codes and are mandatory. Manufacturer and Product are text strings and are optional.

ID, VID:PID Manufacturer:Product        

Example: "ID 1234:abcd Flipper Devices:Flipper Zero".

Delay, comments, holding down

DELAY, one delay value in ms

DEFAULT_DELAY, delay value in ms before every next command

DEFAULTDELAY, alternative to DEFAULT_DELAY

REM, commenting is done by writing REM followed by a single line of text

HOLD, press and hold key until RELEASE command. Up to 5 keys can be held at the same time.

RELEASE, release key

Arrow keys

DOWNARROW / DOWN

LEFTARROW / LEFT

RIGHTARROW / RIGHT

UPARROW / UP

Various buttons

APP, same as MENU, context menu key (right-clicking)

BACKSPACE

BREAK

CAPSLOCK

DELETE

END

ENTER

ESCAPE / ESC

Fx, F1-F12 keys

HOME

INSERT

MENU, same as APP, context menu key (right-clicking)

NUMLOCK

PAGEDOWN

PAGEUP

PAUSE

PRINTSCREEN

SCROLLLOCK

SPACE

TAB

You can combine the following with a special key command or a single character.

CONTROL / CTRL

SHIFT

ALT

WINDOWS / GUI, the Windows key

CTRL-ALT, ctrl plus alt

CTRL-SHIFT, ctrl plus shift

ALT-SHIFT, alt plus shift

ALT-GUI, alt plus the Windows key

GUI-SHIFT, the Windows key plus shift

GUI-CTRL, the Windows key plus ctrl

Strings and delay between keypresses

STRING, print text string, such as writing something in a terminal

STRINGLN, print text string and press enter after it

STRING_DELAY, delay value in ms which is applied once to next appearing STRING command

STRINGDELAY, an alternative to STRING_DELAY  

DEFAULT_STRING_DELAY, delay value in ms, applied to every appearing STRING command

DEFAULTSTRINGDELAY, alternative to DEFAULT_STRING_DELAY

REPEAT   Number of additional repeats  Repeat previous command

WAIT_FOR_BUTTON_PRESS, will wait for the user to press a button to continue script execution. Will wait indefinitely for a button to be pressed.

On Windows and some Linux systems, you can print characters by holding ALT key and entering its code on Numpad.

ALTCHAR, print single character

ALTSTRING, print text string using ALT+Numpad method

ALTCODE, same as ALTSTRING, presents in some Duckyscript implementations

Send SysRq command, which is a way to interact with the computer even in a frozen state.

SYSRQ, single character

Media keys

Some Media/Consumer Control keys can be pressed with "MEDIA" command

MEDIA, used with commands in the list below:

POWER

REBOOT

SLEEP

LOGOFF

EXIT

BRIGHT_UP, brightness up

BRIGHT_DOWN, brightness down

HOME

BACK

FORWARD

REFRESH

SNAPSHOT, take photo in a camera app

PLAY

PAUSE

PLAY_PAUSE

NEXT_TRACK

PREV_TRACK

STOP

EJECT

MUTE

VOLUME_UP

VOLUME_DOWN

FN, Fn/Globe key on Mac keyboard

GLOBE, special key or single character (Fn/Globe key commands for Mac/iPad)