If you're in the penetration testing or hardware hacking space, you already know the value of a good Keystroke Injection tool. The Rubber Ducky changed the game by proving that hardware can bypass software security simply by pretending to be a keyboard. But carrying around a laptop to constantly rewrite and swap out DuckyScript payloads in the field? That gets old fast.

That is why we built RogueDuck.

RogueDuck is a custom, standalone firmware designed for the M5Stack Stick S3. It transforms this pocket-sized ESP32 microcontroller into a covert, field-ready Netrunner terminal that looks as aggressive as it operates.

The Hardware: M5Stack Stick S3

For this build, the M5Stack Stick S3 is the perfect host. It’s tiny, packs an ESP32-S3 chip (which natively supports USB HID emulation), has onboard flash memory, built-in Wi-Fi, and a crisp 160x80 TFT display. It gives us everything we need to build an injector that operates entirely independent of a host laptop.

The Core Features

1. Wireless Payload Management (The Uplink)

Instead of relying on SD cards or serial connections, RogueDuck generates its own secure local Wi-Fi Access Point (RogueDuck_Link). By connecting your smartphone to this network and navigating to the captive web portal at 192.168.4.1, you access a sleek, dark-mode web UI. From here, you can directly upload .txt files, paste raw DuckyScript into a buffer to compile on the fly, or purge old vectors from the device's LittleFS memory.

2. Native DuckyScript 1.0 Execution

Under the hood, the C++ firmware features a custom parsing engine that natively understands classic DuckyScript syntax. It handles string injections, configurable delays, and complex modifier chords (like GUI r or CTRL ALT DEL) without breaking a sweat.

3. The Hardware CRT Terminal UI

Functionality is critical, but aesthetics matter. The physical screen on the Stick S3 has been completely overhauled to mimic an unstable 1990s Netrunner terminal. The firmware draws hardware-level CRT scanlines, utilizes a custom Matrix-green RGB565 color palette, and triggers a randomized, geometric screen-tear effect when a payload is executed. It looks dangerous.

How It Works In The Field

Deployment is designed to be completely frictionless:

1. Load: Power on the device using a battery bank or your phone, connect to the uplink, and drop your payloads into storage.
2. Select: Plug the Stick S3 into the target machine via USB-C. Use the side button (BTN_B) to cycle through your stored vectors on the CRT display.
3. Inject: Hit the main front button (BTN_A). The screen glitches red, the terminal locks, and the ESP32 acts as a standard USB keyboard, firing off your keystrokes at superhuman speed.

Example Payload Syntax

Because it uses standard syntax, writing for RogueDuck is incredibly straightforward. Here is a benign example that simply opens the command prompt:

REM Open CMD and leave a calling card
DEFAULT_DELAY 50
GUI r
DELAY 500
STRING cmd
ENTER
DELAY 500
STRING echo "Uplink Established."
ENTER

Join The Ethical Hackers Den

RogueDuck is an incredible tool for automating repetitive system admin tasks, testing endpoint security response times, and demonstrating physical access vulnerabilities.

Download RogueDuck Today Github

Disclaimer: This tool is strictly for educational purposes and authorized auditing. Never deploy payloads against hardware you do not own or have explicit permission to test.

If you are building your own ESP32 projects, hardware hacking tools, or just love embedded electronics, welcome to the Ethical Hackers Den. Stick around the blog for more source code drops, or join the community as we push the limits of what these pocket-sized microcontrollers can do.

---

Tags: Hardware Hacking, ESP32, M5Stack, DuckyScript, HID Injector, Cybersecurity, Ethical Hacking