Will Shackleton

Yeah, I know. Inside it's a debian image which contains squid (a proxy, used to modify data), perl, imagemagick (image processing tools) and all the other debian toolkit. The program then chroots into this image on the SD card.

Hey there, I've recently finished a project called Network Spoofer. It's an application which lets you run arpspoof attacks and other fun hacks from Android, messing with people's internet from your phone. The main feature is that similar to the Upside-down-ternet project: from the phone you can flip pictures on someone's computer upside down. It can do a few more things such as website redirecting and Google search changing, and I hope to add more features soon. If anyone wants to contribute to the code, here are the hosted projects: Launchpad (main project - primarily used) Sourceforge This program works well in combination with Shark for Android - combined they allow you to capture packets when logged onto wifi networks. I hope this works for you - if you have success / no luck / questions, please post in this thread. If you find this doesn't work, please post here / Email / PM me with details and (if you know how) a log output from the application (adb logcat); the tag is 'android-netspoof'. Currently confirmed working devices: Nexus One - thoroughly tested with CM7 - Android 2.3.3 T-Mobile G1 - also tested with CM6 - Android 2.2 Installation: Simply install from the Android Market (on a device running >2.2), and download the setup files from the application. This requires about 600MB free SD card space. The program needs the phone to be rooted, and have busybox (most custom firmwares have this). Once it's done, it takes only a few seconds to get it running. Enjoy! :D Will Shackleton digitalsquid.co.uk

Thanks. In answer to your question, the only way that you could do this would be to open a search, find all *.docx files, select all & copy (tab, ctrl-a ctrl-c) then paste the files into the mail client. The only problem is you can't know when the search has finished... As for coding, I'd advise you to write the code in C, and use the PsyDuck framework for making life easier. http://www.hak5.org/projects/doku.php?id=psyduk

Hi, I've merged the two USB interfaces into one file, so that they can be used in the same program (when programming in C). The two can't be used at the same time, but I've put a DIP-switch on my ducky, and I can change mode from there, without having to download seperate programs. It still works with other libraries, such as PsyDuk, except for a slight change to usb_init(). usb_keyboard.c: /* USB Keyboard Example for Teensy USB Development Board * http://www.pjrc.com/teensy/usb_keyboard.html * Copyright © 2009 PJRC.COM, LLC * * Permission is hereby granted, free of charge, to any person obtaining a copy * of this software and associated documentation files (the "Software"), to deal * in the Software without restriction, including without limitation the rights * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell * copies of the Software, and to permit persons to whom the Software is * furnished to do so, subject to the following conditions: * * The above copyright notice and this permission notice shall be included in * all copies or substantial portions of the Software. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN * THE SOFTWARE. */ // Version 1.0: Initial Release // Version 1.1: Add support for Teensy 2.0 #define USB_SERIAL_PRIVATE_INCLUDE #include "usb_keyboard.h" /************************************************************************** * * Configurable Options * **************************************************************************/ // You can change these to give your code its own name. //#define STR_MANUFACTURER L"Apple Inc." //#define STR_PRODUCT L"Aluminum Keyboard" #define STR_MANUFACTURER L"Generic Keyboard" #define STR_PRODUCT L"Generic Keyboard" #define STR_MANUFACTURER_M L"Microsoft Corp." #define STR_PRODUCT_M L"IntelliMouse" // Mac OS-X and Linux automatically load the correct drivers. On // Windows, even though the driver is supplied by Microsoft, an // INF file is needed to load the driver. These numbers need to // match the INF file. #define VENDOR_ID 0x16C0 #define PRODUCT_ID 0x047C #define VENDOR_ID_M 0x045E #define PRODUCT_ID_M 0x0009 // USB devices are supposed to implment a halt feature, which is // rarely (if ever) used. If you comment this line out, the halt // code will be removed, saving 102 bytes of space (gcc 4.3.0). // This is not strictly USB compliant, but works with all major // operating systems. #define SUPPORT_ENDPOINT_HALT /************************************************************************** * * Endpoint Buffer Configuration * **************************************************************************/ #define ENDPOINT0_SIZE 32 #define KEYBOARD_INTERFACE 0 #define KEYBOARD_ENDPOINT 3 #define KEYBOARD_SIZE 8 #define KEYBOARD_BUFFER EP_DOUBLE_BUFFER #define MOUSE_INTERFACE 0 #define MOUSE_ENDPOINT 3 #define MOUSE_SIZE 8 #define MOUSE_BUFFER EP_DOUBLE_BUFFER static const uint8_t PROGMEM endpoint_config_table[] = { 0, 0, 1, EP_TYPE_INTERRUPT_IN, EP_SIZE(KEYBOARD_SIZE) | KEYBOARD_BUFFER, 0 }; /************************************************************************** * * Descriptor Data * **************************************************************************/ // Descriptors are the data that your computer reads when it auto-detects // this USB device (called "enumeration" in USB lingo). The most commonly // changed items are editable at the top of this file. Changing things // in here should only be done by those who've read chapter 9 of the USB // spec and relevant portions of any USB class specifications! static uint8_t PROGMEM device_descriptor[] = { 18, // bLength 1, // bDescriptorType 0x00, 0x02, // bcdUSB 0, // bDeviceClass 0, // bDeviceSubClass 0, // bDeviceProtocol ENDPOINT0_SIZE, // bMaxPacketSize0 LSB(VENDOR_ID), MSB(VENDOR_ID), // idVendor LSB(PRODUCT_ID), MSB(PRODUCT_ID), // idProduct 0x00, 0x01, // bcdDevice 1, // iManufacturer 2, // iProduct 0, // iSerialNumber 1 // bNumConfigurations }; static uint8_t PROGMEM device_descriptor_m[] = { 18, // bLength 1, // bDescriptorType 0x00, 0x02, // bcdUSB 0, // bDeviceClass 0, // bDeviceSubClass 0, // bDeviceProtocol ENDPOINT0_SIZE, // bMaxPacketSize0 LSB(VENDOR_ID_M), MSB(VENDOR_ID_M), // idVendor LSB(PRODUCT_ID_M), MSB(PRODUCT_ID_M), // idProduct 0x00, 0x01, // bcdDevice 1, // iManufacturer 2, // iProduct 0, // iSerialNumber 1 // bNumConfigurations }; // Keyboard Protocol 1, HID 1.11 spec, Appendix B, page 59-60 static uint8_t PROGMEM keyboard_hid_report_desc[] = { 0x05, 0x01, // Usage Page (Generic Desktop), 0x09, 0x06, // Usage (Keyboard), 0xA1, 0x01, // Collection (Application), 0x75, 0x01, // Report Size (1), 0x95, 0x08, // Report Count (8), 0x05, 0x07, // Usage Page (Key Codes), 0x19, 0xE0, // Usage Minimum (224), 0x29, 0xE7, // Usage Maximum (231), 0x15, 0x00, // Logical Minimum (0), 0x25, 0x01, // Logical Maximum (1), 0x81, 0x02, // Input (Data, Variable, Absolute), ;Modifier byte 0x95, 0x01, // Report Count (1), 0x75, 0x08, // Report Size (8), 0x81, 0x03, // Input (Constant), ;Reserved byte 0x95, 0x05, // Report Count (5), 0x75, 0x01, // Report Size (1), 0x05, 0x08, // Usage Page (LEDs), 0x19, 0x01, // Usage Minimum (1), 0x29, 0x05, // Usage Maximum (5), 0x91, 0x02, // Output (Data, Variable, Absolute), ;LED report 0x95, 0x01, // Report Count (1), 0x75, 0x03, // Report Size (3), 0x91, 0x03, // Output (Constant), ;LED report padding 0x95, 0x06, // Report Count (6), 0x75, 0x08, // Report Size (8), 0x15, 0x00, // Logical Minimum (0), 0x25, 0x68, // Logical Maximum(104), 0x05, 0x07, // Usage Page (Key Codes), 0x19, 0x00, // Usage Minimum (0), 0x29, 0x68, // Usage Maximum (104), 0x81, 0x00, // Input (Data, Array), 0xc0 // End Collection }; // Mouse Protocol 1, HID 1.11 spec, Appendix B, page 59-60, with wheel extension static uint8_t PROGMEM mouse_hid_report_desc[] = { 0x05, 0x01, // Usage Page (Generic Desktop) 0x09, 0x02, // Usage (Mouse) 0xA1, 0x01, // Collection (Application) 0x05, 0x09, // Usage Page (Button) 0x19, 0x01, // Usage Minimum (Button #1) 0x29, 0x03, // Usage Maximum (Button #3) 0x15, 0x00, // Logical Minimum (0) 0x25, 0x01, // Logical Maximum (1) 0x95, 0x03, // Report Count (3) 0x75, 0x01, // Report Size (1) 0x81, 0x02, // Input (Data, Variable, Absolute) 0x95, 0x01, // Report Count (1) 0x75, 0x05, // Report Size (5) 0x81, 0x03, // Input (Constant) 0x05, 0x01, // Usage Page (Generic Desktop) 0x09, 0x30, // Usage (X) 0x09, 0x31, // Usage (Y) 0x15, 0x81, // Logical Minimum (-127) 0x25, 0x7F, // Logical Maximum (127) 0x75, 0x08, // Report Size (8), 0x95, 0x02, // Report Count (2), 0x81, 0x06, // Input (Data, Variable, Relative) 0x09, 0x38, // Usage (Wheel) 0x95, 0x01, // Report Count (1), 0x81, 0x06, // Input (Data, Variable, Relative) 0xC0 // End Collection }; #define CONFIG1_DESC_SIZE (9+9+9+7) #define KEYBOARD_HID_DESC_OFFSET (9+9) static uint8_t PROGMEM config1_descriptor[CONFIG1_DESC_SIZE] = { // configuration descriptor, USB spec 9.6.3, page 264-266, Table 9-10 9, // bLength; 2, // bDescriptorType; LSB(CONFIG1_DESC_SIZE), // wTotalLength MSB(CONFIG1_DESC_SIZE), 1, // bNumInterfaces 1, // bConfigurationValue 0, // iConfiguration 0xC0, // bmAttributes 50, // bMaxPower // interface descriptor, USB spec 9.6.5, page 267-269, Table 9-12 9, // bLength 4, // bDescriptorType KEYBOARD_INTERFACE, // bInterfaceNumber 0, // bAlternateSetting 1, // bNumEndpoints 0x03, // bInterfaceClass (0x03 = HID) 0x01, // bInterfaceSubClass (0x01 = Boot) 0x01, // bInterfaceProtocol (0x01 = Keyboard) 0, // iInterface // HID interface descriptor, HID 1.11 spec, section 6.2.1 9, // bLength 0x21, // bDescriptorType 0x11, 0x01, // bcdHID 0, // bCountryCode 1, // bNumDescriptors 0x22, // bDescriptorType sizeof(keyboard_hid_report_desc), // wDescriptorLength 0, // endpoint descriptor, USB spec 9.6.6, page 269-271, Table 9-13 7, // bLength 5, // bDescriptorType KEYBOARD_ENDPOINT | 0x80, // bEndpointAddress 0x03, // bmAttributes (0x03=intr) KEYBOARD_SIZE, 0, // wMaxPacketSize 1 // bInterval }; #define MOUSE_HID_DESC_OFFSET (9+9) static uint8_t PROGMEM config1_descriptor_m[CONFIG1_DESC_SIZE] = { // configuration descriptor, USB spec 9.6.3, page 264-266, Table 9-10 9, // bLength; 2, // bDescriptorType; LSB(CONFIG1_DESC_SIZE), // wTotalLength MSB(CONFIG1_DESC_SIZE), 1, // bNumInterfaces 1, // bConfigurationValue 0, // iConfiguration 0xC0, // bmAttributes 50, // bMaxPower // interface descriptor, USB spec 9.6.5, page 267-269, Table 9-12 9, // bLength 4, // bDescriptorType MOUSE_INTERFACE, // bInterfaceNumber 0, // bAlternateSetting 1, // bNumEndpoints 0x03, // bInterfaceClass (0x03 = HID) 0x01, // bInterfaceSubClass (0x01 = Boot) 0x01, // bInterfaceProtocol (0x02 = Mouse) 0, // iInterface // HID interface descriptor, HID 1.11 spec, section 6.2.1 9, // bLength 0x21, // bDescriptorType 0x11, 0x01, // bcdHID 0, // bCountryCode 1, // bNumDescriptors 0x22, // bDescriptorType sizeof(mouse_hid_report_desc), // wDescriptorLength 0, // endpoint descriptor, USB spec 9.6.6, page 269-271, Table 9-13 7, // bLength 5, // bDescriptorType MOUSE_ENDPOINT | 0x80, // bEndpointAddress 0x03, // bmAttributes (0x03=intr) 4, 0, // wMaxPacketSize 1 // bInterval }; // If you're desperate for a little extra code memory, these strings // can be completely removed if iManufacturer, iProduct, iSerialNumber // in the device desciptor are changed to zeros. struct usb_string_descriptor_struct { uint8_t bLength; uint8_t bDescriptorType; int16_t wString[]; }; static struct usb_string_descriptor_struct PROGMEM string0 = { 4, 3, {0x0409} }; static struct usb_string_descriptor_struct PROGMEM string1 = { sizeof(STR_MANUFACTURER), 3, STR_MANUFACTURER }; static struct usb_string_descriptor_struct PROGMEM string2 = { sizeof(STR_PRODUCT), 3, STR_PRODUCT }; static struct usb_string_descriptor_struct PROGMEM string1_m = { sizeof(STR_MANUFACTURER_M), 3, STR_MANUFACTURER_M }; static struct usb_string_descriptor_struct PROGMEM string2_m = { sizeof(STR_PRODUCT_M), 3, STR_PRODUCT_M }; // This table defines which descriptor data is sent for each specific // request from the host (in wValue and wIndex). static struct descriptor_list_struct { uint16_t wValue; uint16_t wIndex; const uint8_t *addr; uint8_t length; } PROGMEM descriptor_list[] = { {0x0100, 0x0000, device_descriptor, sizeof(device_descriptor)}, {0x0200, 0x0000, config1_descriptor, sizeof(config1_descriptor)}, {0x2200, KEYBOARD_INTERFACE, keyboard_hid_report_desc, sizeof(keyboard_hid_report_desc)}, {0x2100, KEYBOARD_INTERFACE, config1_descriptor+KEYBOARD_HID_DESC_OFFSET, 9}, {0x0300, 0x0000, (const uint8_t *)&string0, 4}, {0x0301, 0x0409, (const uint8_t *)&string1, sizeof(STR_MANUFACTURER)}, {0x0302, 0x0409, (const uint8_t *)&string2, sizeof(STR_PRODUCT)} }; #define NUM_DESC_LIST (sizeof(descriptor_list)/sizeof(struct descriptor_list_struct)) static struct descriptor_list_struct PROGMEM descriptor_list_m[] = { {0x0100, 0x0000, device_descriptor_m, sizeof(device_descriptor_m)}, {0x0200, 0x0000, config1_descriptor_m, sizeof(config1_descriptor_m)}, {0x2200, MOUSE_INTERFACE, mouse_hid_report_desc, sizeof(mouse_hid_report_desc)}, {0x2100, MOUSE_INTERFACE, config1_descriptor_m+MOUSE_HID_DESC_OFFSET, 9}, {0x0300, 0x0000, (const uint8_t *)&string0, 4}, {0x0301, 0x0409, (const uint8_t *)&string1_m, sizeof(STR_MANUFACTURER_M)}, {0x0302, 0x0409, (const uint8_t *)&string2_m, sizeof(STR_PRODUCT_M)} }; #define NUM_DESC_LIST_M (sizeof(descriptor_list_m)/sizeof(struct descriptor_list_struct)) /************************************************************************** * * Variables - these are the only non-stack RAM usage * **************************************************************************/ // zero when we are not configured, non-zero when enumerated static volatile uint8_t usb_configuration=0; // which modifier keys are currently pressed // 1=left ctrl, 2=left shift, 4=left alt, 8=left gui // 16=right ctrl, 32=right shift, 64=right alt, 128=right gui uint8_t keyboard_modifier_keys=0; // which keys are currently pressed, up to 6 keys may be down at once uint8_t keyboard_keys[6]={0,0,0,0,0,0}; // protocol setting from the host. We use exactly the same report // either way, so this variable only stores the setting since we // are required to be able to report which setting is in use. static uint8_t keyboard_protocol=1; // the idle configuration, how often we send the report to the // host (ms * 4) even when it hasn't changed static uint8_t keyboard_idle_config=125; // count until idle timeout static uint8_t keyboard_idle_count=0; // 1=num lock, 2=caps lock, 4=scroll lock, 8=compose, 16=kana volatile uint8_t keyboard_leds=0; // which buttons are currently pressed static uint8_t mouse_buttons=0; // protocol setting from the host. We use exactly the same report // either way, so this variable only stores the setting since we // are required to be able to report which setting is in use. static uint8_t mouse_protocol=1; /************************************************************************** * * Public Functions - these are the API intended for the user * **************************************************************************/ // initialize USB void usb_init(uint8_t mouse) { mouseMode = mouse; HW_CONFIG(); USB_FREEZE(); // enable USB PLL_CONFIG(); // config PLL while (!(PLLCSR & (1<<PLOCK))) ; // wait for PLL lock USB_CONFIG(); // start USB clock UDCON = 0; // enable attach resistor usb_configuration = 0; if(mouse == 1) UDIEN = (1<<EORSTE); else UDIEN = (1<<EORSTE)|(1<<SOFE); sei(); } // return 0 if the USB is not configured, or the configuration // number selected by the HOST uint8_t usb_configured(void) { return usb_configuration; } // perform a single keystroke int8_t usb_keyboard_press(uint8_t key, uint8_t modifier) { int8_t r; keyboard_modifier_keys = modifier; keyboard_keys[0] = key; r = usb_keyboard_send(); if ® return r; keyboard_modifier_keys = 0; keyboard_keys[0] = 0; return usb_keyboard_send(); } // send the contents of keyboard_keys and keyboard_modifier_keys int8_t usb_keyboard_send(void) { uint8_t i, intr_state, timeout; if (!usb_configuration) return -1; intr_state = SREG; cli(); UENUM = KEYBOARD_ENDPOINT; timeout = UDFNUML + 50; while (1) { // are we ready to transmit? if (UEINTX & (1<<RWAL)) break; SREG = intr_state; // has the USB gone offline? if (!usb_configuration) return -1; // have we waited too long? if (UDFNUML == timeout) return -1; // get ready to try checking again intr_state = SREG; cli(); UENUM = KEYBOARD_ENDPOINT; } UEDATX = keyboard_modifier_keys; UEDATX = 0; for (i=0; i<6; i++) { UEDATX = keyboard_keys[i]; } UEINTX = 0x3A; keyboard_idle_count = 0; SREG = intr_state; return 0; } // Set the mouse buttons. To create a "click", 2 calls are needed, // one to push the button down and the second to release it int8_t usb_mouse_buttons(uint8_t left, uint8_t middle, uint8_t right) { uint8_t mask=0; if (left) mask |= 1; if (middle) mask |= 4; if (right) mask |= 2; mouse_buttons = mask; return usb_mouse_move(0, 0, 0); } // Move the mouse. x, y and wheel are -127 to 127. Use 0 for no movement. int8_t usb_mouse_move(int8_t x, int8_t y, int8_t wheel) { uint8_t intr_state, timeout; if (!usb_configuration) return -1; if (x == -128) x = -127; if (y == -128) y = -127; if (wheel == -128) wheel = -127; intr_state = SREG; cli(); UENUM = MOUSE_ENDPOINT; timeout = UDFNUML + 50; while (1) { // are we ready to transmit? if (UEINTX & (1<<RWAL)) break; SREG = intr_state; // has the USB gone offline? if (!usb_configuration) return -1; // have we waited too long? if (UDFNUML == timeout) return -1; // get ready to try checking again intr_state = SREG; cli(); UENUM = MOUSE_ENDPOINT; } UEDATX = mouse_buttons; UEDATX = x; UEDATX = y; UEDATX = wheel; UEINTX = 0x3A; SREG = intr_state; return 0; } /************************************************************************** * * Private Functions - not intended for general user consumption.... * **************************************************************************/ // USB Device Interrupt - handle all device-level events // the transmit buffer flushing is triggered by the start of frame // ISR(USB_GEN_vect) { if(mouseMode == 1) { uint8_t intbits; intbits = UDINT; UDINT = 0; if (intbits & (1<<EORSTI)) { UENUM = 0; UECONX = 1; UECFG0X = EP_TYPE_CONTROL; UECFG1X = EP_SIZE(ENDPOINT0_SIZE) | EP_SINGLE_BUFFER; UEIENX = (1<<RXSTPE); usb_configuration = 0; } } else { uint8_t intbits, t, i; static uint8_t div4=0; intbits = UDINT; UDINT = 0; if (intbits & (1<<EORSTI)) { UENUM = 0; UECONX = 1; UECFG0X = EP_TYPE_CONTROL; UECFG1X = EP_SIZE(ENDPOINT0_SIZE) | EP_SINGLE_BUFFER; UEIENX = (1<<RXSTPE); usb_configuration = 0; } if ((intbits & (1<<SOFI)) && usb_configuration) { if (keyboard_idle_config && (++div4 & 3) == 0) { UENUM = KEYBOARD_ENDPOINT; if (UEINTX & (1<<RWAL)) { keyboard_idle_count++; if (keyboard_idle_count == keyboard_idle_config) { keyboard_idle_count = 0; UEDATX = keyboard_modifier_keys; UEDATX = 0; for (i=0; i<6; i++) { UEDATX = keyboard_keys[i]; } UEINTX = 0x3A; } } } } } } // Misc functions to wait for ready and send/receive packets static inline void usb_wait_in_ready(void) { while (!(UEINTX & (1<<TXINI))) ; } static inline void usb_send_in(void) { UEINTX = ~(1<<TXINI); } static inline void usb_wait_receive_out(void) { while (!(UEINTX & (1<<RXOUTI))) ; } static inline void usb_ack_out(void) { UEINTX = ~(1<<RXOUTI); } // USB Endpoint Interrupt - endpoint 0 is handled here. The // other endpoints are manipulated by the user-callable // functions, and the start-of-frame interrupt. // ISR(USB_COM_vect) { uint8_t intbits; const uint8_t *list; const uint8_t *cfg; uint8_t i, n, len, en; uint8_t bmRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; uint16_t desc_val; const uint8_t *desc_addr; uint8_t desc_length; UENUM = 0; intbits = UEINTX; if (intbits & (1<<RXSTPI)) { bmRequestType = UEDATX; bRequest = UEDATX; wValue = UEDATX; wValue |= (UEDATX << 8); wIndex = UEDATX; wIndex |= (UEDATX << 8); wLength = UEDATX; wLength |= (UEDATX << 8); UEINTX = ~((1<<RXSTPI) | (1<<RXOUTI) | (1<<TXINI)); if (bRequest == GET_DESCRIPTOR) { list = (mouseMode == 1 ? (const uint8_t *)descriptor_list_m : (const uint8_t *)descriptor_list); for (i=0; ; i++) { if (i >= NUM_DESC_LIST) { UECONX = (1<<STALLRQ)|(1<<EPEN); //stall return; } desc_val = pgm_read_word(list); if (desc_val != wValue) { list += sizeof(struct descriptor_list_struct); continue; } list += 2; desc_val = pgm_read_word(list); if (desc_val != wIndex) { list += sizeof(struct descriptor_list_struct)-2; continue; } list += 2; desc_addr = (const uint8_t *)pgm_read_word(list); list += 2; desc_length = pgm_read_byte(list); break; } len = (wLength < 256) ? wLength : 255; if (len > desc_length) len = desc_length; do { // wait for host ready for IN packet do { i = UEINTX; } while (!(i & ((1<<TXINI)|(1<<RXOUTI)))); if (i & (1<<RXOUTI)) return; // abort // send IN packet n = len < ENDPOINT0_SIZE ? len : ENDPOINT0_SIZE; for (i = n; i; i--) { UEDATX = pgm_read_byte(desc_addr++); } len -= n; usb_send_in(); } while (len || n == ENDPOINT0_SIZE); return; } if (bRequest == SET_ADDRESS) { usb_send_in(); usb_wait_in_ready(); UDADDR = wValue | (1<<ADDEN); return; } if (bRequest == SET_CONFIGURATION && bmRequestType == 0) { usb_configuration = wValue; usb_send_in(); cfg = endpoint_config_table; for (i=1; i<5; i++) { UENUM = i; en = pgm_read_byte(cfg++); UECONX = en; if (en) { UECFG0X = pgm_read_byte(cfg++); UECFG1X = pgm_read_byte(cfg++); } } UERST = 0x1E; UERST = 0; return; } if (bRequest == GET_CONFIGURATION && bmRequestType == 0x80) { usb_wait_in_ready(); UEDATX = usb_configuration; usb_send_in(); return; } if (bRequest == GET_STATUS) { usb_wait_in_ready(); i = 0; #ifdef SUPPORT_ENDPOINT_HALT if (bmRequestType == 0x82) { UENUM = wIndex; if (UECONX & (1<<STALLRQ)) i = 1; UENUM = 0; } #endif UEDATX = i; UEDATX = 0; usb_send_in(); return; } #ifdef SUPPORT_ENDPOINT_HALT if ((bRequest == CLEAR_FEATURE || bRequest == SET_FEATURE) && bmRequestType == 0x02 && wValue == 0) { i = wIndex & 0x7F; if (i >= 1 && i <= MAX_ENDPOINT) { usb_send_in(); UENUM = i; if (bRequest == SET_FEATURE) { UECONX = (1<<STALLRQ)|(1<<EPEN); } else { UECONX = (1<<STALLRQC)|(1<<RSTDT)|(1<<EPEN); UERST = (1 << i); UERST = 0; } return; } } #endif if(mouseMode == 0) { if (wIndex == KEYBOARD_INTERFACE) { if (bmRequestType == 0xA1) { if (bRequest == HID_GET_REPORT) { usb_wait_in_ready(); UEDATX = keyboard_modifier_keys; UEDATX = 0; for (i=0; i<6; i++) { UEDATX = keyboard_keys[i]; } usb_send_in(); return; } if (bRequest == HID_GET_IDLE) { usb_wait_in_ready(); UEDATX = keyboard_idle_config; usb_send_in(); return; } if (bRequest == HID_GET_PROTOCOL) { usb_wait_in_ready(); UEDATX = keyboard_protocol; usb_send_in(); return; } } if (bmRequestType == 0x21) { if (bRequest == HID_SET_REPORT) { usb_wait_receive_out(); keyboard_leds = UEDATX; usb_ack_out(); usb_send_in(); return; } if (bRequest == HID_SET_IDLE) { keyboard_idle_config = (wValue >> 8); keyboard_idle_count = 0; usb_send_in(); return; } if (bRequest == HID_SET_PROTOCOL) { keyboard_protocol = wValue; usb_send_in(); return; } } } } else { if (wIndex == MOUSE_INTERFACE) { if (bmRequestType == 0xA1) { if (bRequest == HID_GET_REPORT) { usb_wait_in_ready(); UEDATX = mouse_buttons; UEDATX = 0; UEDATX = 0; UEDATX = 0; usb_send_in(); return; } if (bRequest == HID_GET_PROTOCOL) { usb_wait_in_ready(); UEDATX = mouse_protocol; usb_send_in(); return; } } if (bmRequestType == 0x21) { if (bRequest == HID_SET_PROTOCOL) { mouse_protocol = wValue; usb_send_in(); return; } } } } } UECONX = (1<<STALLRQ) | (1<<EPEN); // stall } usb_keyboard.h: #ifndef usb_serial_h__ #define usb_serial_h__ #include <stdint.h> void usb_init(uint8_t mouse); // initialize everything uint8_t usb_configured(void); // is the USB port configured volatile uint8_t mouseMode; int8_t usb_keyboard_press(uint8_t key, uint8_t modifier); int8_t usb_keyboard_send(void); extern uint8_t keyboard_modifier_keys; extern uint8_t keyboard_keys[6]; extern volatile uint8_t keyboard_leds; int8_t usb_mouse_buttons(uint8_t left, uint8_t middle, uint8_t right); int8_t usb_mouse_move(int8_t x, int8_t y, int8_t wheel); // This file does not include the HID debug functions, so these empty // macros replace them with nothing, so users can compile code that // has calls to these functions. #define usb_debug_putchar© #define usb_debug_flush_output() #define KEY_CTRL 0x01 #define KEY_SHIFT 0x02 #define KEY_ALT 0x04 #define KEY_GUI 0x08 #define KEY_LEFT_CTRL 0x01 #define KEY_LEFT_SHIFT 0x02 #define KEY_LEFT_ALT 0x04 #define KEY_LEFT_GUI 0x08 #define KEY_RIGHT_CTRL 0x10 #define KEY_RIGHT_SHIFT 0x20 #define KEY_RIGHT_ALT 0x40 #define KEY_RIGHT_GUI 0x80 #define KEY_A 4 #define KEY_B 5 #define KEY_C 6 #define KEY_D 7 #define KEY_E 8 #define KEY_F 9 #define KEY_G 10 #define KEY_H 11 #define KEY_I 12 #define KEY_J 13 #define KEY_K 14 #define KEY_L 15 #define KEY_M 16 #define KEY_N 17 #define KEY_O 18 #define KEY_P 19 #define KEY_Q 20 #define KEY_R 21 #define KEY_S 22 #define KEY_T 23 #define KEY_U 24 #define KEY_V 25 #define KEY_W 26 #define KEY_X 27 #define KEY_Y 28 #define KEY_Z 29 #define KEY_1 30 #define KEY_2 31 #define KEY_3 32 #define KEY_4 33 #define KEY_5 34 #define KEY_6 35 #define KEY_7 36 #define KEY_8 37 #define KEY_9 38 #define KEY_0 39 #define KEY_ENTER 40 #define KEY_ESC 41 #define KEY_BACKSPACE 42 #define KEY_TAB 43 #define KEY_SPACE 44 #define KEY_MINUS 45 #define KEY_EQUAL 46 #define KEY_LEFT_BRACE 47 #define KEY_RIGHT_BRACE 48 #define KEY_BACKSLASH 49 #define KEY_NUMBER 50 #define KEY_SEMICOLON 51 #define KEY_QUOTE 52 #define KEY_TILDE 53 #define KEY_COMMA 54 #define KEY_PERIOD 55 #define KEY_SLASH 56 #define KEY_CAPS_LOCK 57 #define KEY_F1 58 #define KEY_F2 59 #define KEY_F3 60 #define KEY_F4 61 #define KEY_F5 62 #define KEY_F6 63 #define KEY_F7 64 #define KEY_F8 65 #define KEY_F9 66 #define KEY_F10 67 #define KEY_F11 68 #define KEY_F12 69 #define KEY_PRINTSCREEN 70 #define KEY_SCROLL_LOCK 71 #define KEY_PAUSE 72 #define KEY_INSERT 73 #define KEY_HOME 74 #define KEY_PAGE_UP 75 #define KEY_DELETE 76 #define KEY_END 77 #define KEY_PAGE_DOWN 78 #define KEY_RIGHT 79 #define KEY_LEFT 80 #define KEY_DOWN 81 #define KEY_UP 82 #define KEY_NUM_LOCK 83 #define KEYPAD_SLASH 84 #define KEYPAD_ASTERIX 85 #define KEYPAD_MINUS 86 #define KEYPAD_PLUS 87 #define KEYPAD_ENTER 88 #define KEYPAD_1 89 #define KEYPAD_2 90 #define KEYPAD_3 91 #define KEYPAD_4 92 #define KEYPAD_5 93 #define KEYPAD_6 94 #define KEYPAD_7 95 #define KEYPAD_8 96 #define KEYPAD_9 97 #define KEYPAD_0 98 #define KEYPAD_PERIOD 99 // Everything below this point is only intended for usb_serial.c #ifdef USB_SERIAL_PRIVATE_INCLUDE #include <avr/io.h> #include <avr/pgmspace.h> #include <avr/interrupt.h> #define EP_TYPE_CONTROL 0x00 #define EP_TYPE_BULK_IN 0x81 #define EP_TYPE_BULK_OUT 0x80 #define EP_TYPE_INTERRUPT_IN 0xC1 #define EP_TYPE_INTERRUPT_OUT 0xC0 #define EP_TYPE_ISOCHRONOUS_IN 0x41 #define EP_TYPE_ISOCHRONOUS_OUT 0x40 #define EP_SINGLE_BUFFER 0x02 #define EP_DOUBLE_BUFFER 0x06 #define EP_SIZE(s) ((s) == 64 ? 0x30 : \ ((s) == 32 ? 0x20 : \ ((s) == 16 ? 0x10 : \ 0x00))) #define MAX_ENDPOINT 4 #define LSB(n) (n & 255) #define MSB(n) ((n >> 8) & 255) #if defined(__AVR_AT90USB162__) #define HW_CONFIG() #define PLL_CONFIG() (PLLCSR = ((1<<PLLE)|(1<<PLLP0))) #define USB_CONFIG() (USBCON = (1<<USBE)) #define USB_FREEZE() (USBCON = ((1<<USBE)|(1<<FRZCLK))) #elif defined(__AVR_ATmega32U4__) #define HW_CONFIG() (UHWCON = 0x01) #define PLL_CONFIG() (PLLCSR = 0x12) #define USB_CONFIG() (USBCON = ((1<<USBE)|(1<<OTGPADE))) #define USB_FREEZE() (USBCON = ((1<<USBE)|(1<<FRZCLK))) #elif defined(__AVR_AT90USB646__) #define HW_CONFIG() (UHWCON = 0x81) #define PLL_CONFIG() (PLLCSR = 0x1A) #define USB_CONFIG() (USBCON = ((1<<USBE)|(1<<OTGPADE))) #define USB_FREEZE() (USBCON = ((1<<USBE)|(1<<FRZCLK))) #elif defined(__AVR_AT90USB1286__) #define HW_CONFIG() (UHWCON = 0x81) #define PLL_CONFIG() (PLLCSR = 0x16) #define USB_CONFIG() (USBCON = ((1<<USBE)|(1<<OTGPADE))) #define USB_FREEZE() (USBCON = ((1<<USBE)|(1<<FRZCLK))) #endif // standard control endpoint request types #define GET_STATUS 0 #define CLEAR_FEATURE 1 #define SET_FEATURE 3 #define SET_ADDRESS 5 #define GET_DESCRIPTOR 6 #define GET_CONFIGURATION 8 #define SET_CONFIGURATION 9 #define GET_INTERFACE 10 #define SET_INTERFACE 11 // HID (human interface device) #define HID_GET_REPORT 1 #define HID_GET_IDLE 2 #define HID_GET_PROTOCOL 3 #define HID_SET_REPORT 9 #define HID_SET_IDLE 10 #define HID_SET_PROTOCOL 11 // CDC (communication class device) #define CDC_SET_LINE_CODING 0x20 #define CDC_GET_LINE_CODING 0x21 #define CDC_SET_CONTROL_LINE_STATE 0x22 #endif #endif Inside the code, private variables for the mouse have a suffix of "_m". Instead of calling usb_init() at the beginning of your code, call usb_init(0) for keyboard and usb_init(1) for mouse. Only tested on Teensy2.0! So far, I've managed to put the following functions on my ducky, Windows & Linux: Type Text Annoy Steal Cookies Disable Firewall Disable AutoUpdate Do System Update KP: Back (KP=keypress) KP: Enter KP: Alphabet KP: Caps Lock Mouse: Move Mouse: Move (quick)

Another variation of this code would be to just make the program press CTRL+L, and type the address. Then, on the PHP script, redirect back to the original site with: header("Location: " . $_SERVER['HTTP_REFERER']); Use this on an existing webpage, to return back to it afterwards as if nothing had happened. (Only tested with firefox) BTW, awesome piece of code!