Darkwing Ducky

A BadUSB ("Rubber Ducky") firmware for the PicoUSB RP2040-based board.

Built in Zig 0.16 with MicroZig.

Building

zig build

Flashing

Hold the BOOT button while plugging in the PicoUSB board and it will show up as a storage device. Assuming the storage device is /dev/sdc1, run the following as root:

mount /dev/sdc1 /mnt/random/ \
&& cp "$HOME/darkwing/zig-out/firmware/darkwing.uf2" /mnt/random/ \
&& sync \
&& umount /dev/sdc1

Caution: The PicoUSB will reboot and run the payload, so make sure to quickly unplug it after the command executed successfully.

Payload

The payload exists inside the payload.txt and it is embedded into the firmware during the build process. The payload.txt is a plain-text file contains printable ASCII, which is typed literally. \n and \r are ignored, and <...> is a key spec that contains a key name, optionally preceded by modifiers joined with +, and matched without regard to case. If you need to send <, >, or \ you have to escape those using \<, \> and \\.

Inside a key spec, a single character is the unshifted key, so <CTRL+A> is the Control key with a, not A. If you want that instead, you have to use <CTRL+SHIFT+A>.

A modifier on its own, like <SHIFT>, holds that modifier with no key. Since + separates the parts, the plus key is <PLUS>. Supported names are ENTER, ESC, TAB, BACKSPACE (HID 0x2A), DEL (0x4C), arrows, page and home keys, F1 through F24, the keypad, and modifiers CTRL, SHIFT, ALT, and WIN, which has GUI, MOD, SUPER, CMD, META aliases and explicit left and right forms.

One exception is the special <SLEEP> key spec, which allows to pause for a certain amount of time, e.g. <SLEEP+1000> pauses for 1 second.

HID usage codes name physical keys, so the host decides which character each produces based on the layout that is used.

Demo

With the payload.txt in this repository this is what plugging in the PicoUSB does (on a system where Win+Enter is used to launch a new terminal):

License

Copyright © 2026 マリウス

Darkwing Ducky is released under Version 1.1 of the SEGV License, whose full text is included in the LICENSE file. Go read it, there will be a test on it on Monday.