Does Rubber Ducky's injected keystroke come from the hardware level or at the OS synthetic input (like AHK)?

[Venzo]

Hello, newbie here. For many of my day to day task, AutoHotKey (AHK) works great for simple scripting events. However, the keystrokes it sends is flagged as synthetic and some games I play block these inputs or the program altogether.

I'm hoping that Rubber Ducky generates keystrokes at the hardware level making it absolutely indistinguishable from a real human input on a keyboard. I have two questions:

1) Does Rubber Ducky generate keystroke at the hardware level just like a real keyboard press or does it use OS synthetic input?

2) Would renaming Rubber Ducky to "Generic Keyboard" be safer or would it not matter?

Thanks.

[Venzo]

Ah, I have been reading the documentation and I know the answer with #2 that it spoofs by taking Vendor/Product ID, etc. with Attack Mode. I'm not quite sure with certainty on #1 however.

[Darren Kitchen]

As you've realized, #2 can be solved by changing the ATTACKMODE parameters.

As for simulating "more human-like input" — the USB Rubber Ducky can do this using the JITTER feature. By enabling this, all keystrokes within a payload will have randomized cadence. See https://docs.hak5.org/hak5-usb-rubber-ducky/advanced-features/jitter

[Venzo]

26 minutes ago, Darren Kitchen said:

As you've realized, #2 can be solved by changing the ATTACKMODE parameters.

As for simulating "more human-like input" — the USB Rubber Ducky can do this using the JITTER feature. By enabling this, all keystrokes within a payload will have randomized cadence. See https://docs.hak5.org/hak5-usb-rubber-ducky/advanced-features/jitter

Heya Darren, thanks for the response! Will be awhile but excited to try it out when it ships.

Generally speaking, does Rubber Ducky work like many other macro softwares where it uses hooks (SetWindowsHookEx, etc. etc.) for keyboard events from the OS or does it generate it at the hardware/driver level? I am hoping it is the second option.

Is it possible to order Rubber Ducky to inject a keystroke via Python if I am more comfortable with it and want to use Python's bigger library options?

[dark_pyrro]

You use DuckyScript (3.0) do create the payloads that are then encoded into something that the Ducky can understand and execute. Python is not an option.

[Korben]

On 12/5/2022 at 9:14 PM, Venzo said:

or does it generate it at the hardware/driver level?

Effectively this.
The host is just receiving keystrokes from a keyboard (in this case the duck) using the generic HID driver as if it was a physical keyboard a user was typing with.