hak5/usbrubberducky-payloads

Can't get it my rubber ducky to work with a custom layout

blabut opened this issue · 2 comments

I am desperately trying to get my first payloads to work several months after receiving my Rubber Ducky. Unfortunately, it seems like something's not working on my set-up (french keyboard on a MacBook Pro). Here is what I tried to do:

  • Create a fr_mac.json, that I crafted using output from Key Codes tool, as suggested by @dallaswinger on my previous issue regarding file upload on the payload generator. I used us.json file as a template, and tried to narrow the issue by only filling keycodes from uppercase and lowercase letters. For instance, typing "a" on my keyboard gave the following on Key Codes tool:

Screenshot 2023-04-29 at 18 48 33

This led me to add the following entry in my fr_mac.json file:

[...]
"a": "00,00,0c",
[...]

I proceeded the same way for other letters and ended up with the following file content:

{
  "a": "00,00,0c",
  "A": "02,00,0c",
  "b": "00,00,0b",
  "B": "02,00,0b",
  "c": "00,00,08",
  "C": "02,00,08",
  "d": "00,00,02",
  "D": "02,00,02",
  "e": "00,00,0e",
  "E": "02,00,0e",
  "f": "00,00,03",
  "F": "02,00,03",
  "g": "00,00,05",
  "G": "02,00,05",
  "h": "00,00,04",
  "H": "02,00,04",
  "i": "00,00,22",
  "I": "02,00,22",
  "j": "00,00,26",
  "J": "02,00,26",
  "k": "00,00,28",
  "K": "02,00,28",
  "l": "00,00,25",
  "L": "02,00,25",
  "m": "00,00,29",
  "M": "02,00,29",
  "n": "00,00,1f",
  "N": "02,00,1f",
  "o": "00,00,1f",
  "O": "02,00,1f",
  "p": "00,00,23",
  "P": "02,00,23",
  "q": "00,00,00",
  "Q": "02,00,00",
  "r": "00,00,0f",
  "R": "02,00,0f",
  "s": "00,00,01",
  "S": "02,00,01",
  "t": "00,00,11",
  "T": "02,00,11",
  "u": "00,00,20",
  "U": "02,00,20",
  "v": "00,00,09",
  "V": "02,00,09",
  "w": "00,00,06",
  "W": "02,00,06",
  "x": "00,00,07",
  "X": "02,00,07",
  "y": "00,00,10",
  "Y": "02,00,10",
  "z": "00,00,0d",
  "Z": "02,00,0d"
}
  • I then uploaded my file as a keyboard layout on https://payloadstudio.hak5.org/community/, which now effectively changes the keyboard layout on the interface (thanks @dallaswinger since this improved since #202), at least outwardly.
  • I designed the simplest payload, aiming at just typing a few letters without any special chars, just to see if my mapping was correct:
STRING abc
DELAY 500
  • Finally, I compiled, downloaded, and moved the payload at the root of my Rubber Ducky.
  • When executing it by plugin it on my Mac, with my cursor focused on a random text field (Firefox Search bar for instance), all the Rubber Ducky types is an "e" instead of the "abc" I would expect:

Screenshot 2023-04-29 at 19 01 02

Is there something I'm doing wrong ? :(

Any help would be welcomed, would really enjoy starting using my Rubber Ducky for real..

Thanks a lot !

Hi, would anybody have a clue on this please ? :(

try using this updated fr_mac.json file and see if it resolves the issue.
{
"a": "00,00,0c",
"A": "02,00,0c",
"b": "00,00,0b",
"B": "02,00,0b",
"c": "00,00,08",
"C": "02,00,08",
"d": "00,00,02",
"D": "02,00,02",
"e": "00,00,0e",
"E": "02,00,0e",
"f": "00,00,03",
"F": "02,00,03",
"g": "00,00,05",
"G": "02,00,05",
"h": "00,00,04",
"H": "02,00,04",
"i": "00,00,22",
"I": "02,00,22",
"j": "00,00,26",
"J": "02,00,26",
"k": "00,00,28",
"K": "02,00,28",
"l": "00,00,25",
"L": "02,00,25",
"m": "00,00,29",
"M": "02,00,29",
"n": "00,00,1f",
"N": "02,00,1f",
"o": "00,00,23", // Corrected keycode for lowercase "o"
"O": "02,00,23", // Corrected keycode for uppercase "O"
"p": "00,00,23",
"P": "02,00,23",
"q": "00,00,00",
"Q": "02,00,00",
"r": "00,00,0f",
"R": "02,00,0f",
"s": "00,00,01",
"S": "02,00,01",
"t": "00,00,11",
"T": "02,00,11",
"u": "00,00,20",
"U": "02,00,20",
"v": "00,00,09",
"V": "02,00,09",
"w": "00,00,06",
"W": "02,00,06",
"x": "00,00,07",
"X": "02,00,07",
"y": "00,00,10",
"Y": "02,00,10",
"z": "00,00,0d",
"Z": "02,00,0d"
}