🦆 OverQuack

Advanced HID automation platform (Rubber Ducky style) with wireless control and Pico support.

🔗 Project URL

https://github.com/VexilonHacker/OverQuack/

Architecture & File Layout

OverQuack runs CircuitPython on Pico devices to execute DuckyScript payloads and handle HID logic.

Runtime

CircuitPython interpreter + HID/gadget logic.

Storage (CIRCUITPY)

  • /OverQuack_src/ – interpreter, runtime, helpers
  • /OverQuack_STORAGE/ – payloads, keyboard layouts, keycodes
  • config.json – central config (payloads, AP, pins, ports)

Client

OverQuack_client.go – manages Pico W remotely via HTTP/API.

Config Highlights

  • DEFAULT_PAYLOAD – auto-executed payload filename
  • BOARD.controll_mode_pin – GPIO for USB role switching
  • AP.ssid/password, ip_address, ports – network config for Pico W
  • enable_auto_reload – auto-reload on file change (dev)

Scripting & Payloads

  • Modular payloads: IMPORT otherstage.oqs
  • Functions, loops, IF/ELSE, arithmetic, variables
  • String blocks: STRINGLN_BLOCK/STRING_BLOCK + DISABLE_STRIP/ENABLE_STRIP
  • Hold/Release keys: HOLD/RELEASE/RELEASE_ALL
  • Mouse API: MOUSE_MOVE/CLICK/SCROLL/BACKGROUND_JIGGLE_MOUSE

Runtime Variables & Generators

  • Network: $_SSID, $_PASSWD, $_BSSID
  • Random generators: $_RANDOM_NUMBER:n, $_RANDOM_CHAR:n, $_RANDOM_INT

Wireless API (Pico W / Pico 2 W)

Endpoints

GET /payloads – list files
POST /payloads – upload
GET /payloads/{name} – download
DELETE /payloads/{name} – remove
POST /run/{name} – execute payload

For lab use only – minimal API, no auth by default.

Developer Workflow

  1. Write .oqs payloads locally
  2. Upload & trigger via OverQuack_client.go
  3. Non-wireless Picos: copy payloads to storage, toggle mode pin
  4. Debug via PRINT messages to serial console

Serial Debugging

picocom -b 9600 /dev/ttyACM0

Windows: PuTTY/Tera Term. PRINT outputs are colorized.

Layouts & Internationalization

  • Add layouts: keyboard_layout_<LANG>.py / keycode_<LANG>.py
  • Register in runtime map, use SELECT_LAYOUT <NAME>

Safety & Ethics

  • Default storage mode prevents accidental HID injection
  • Test only authorized systems
  • Secure API with token/password for wireless use

Contributions & Ideas

  • Authenticated API layer
  • Desktop GUI for payload management
  • Safe payload gallery
  • Unit tests & layout expansion

For more details and better documentation check OverQuack repository