Hak5 gear is heavy and obvious. My phone has a full Linux kernel in it, so I made it do the same job — HID emulation, RNDIS, mass storage, the whole thing — straight through ConfigFS. No extra hardware. No cables dangling out of a bag.
Plug into a target, pick a payload, run it. Keystrokes go to /dev/hidg0 directly. Nothing in between.
- Raw HID via ConfigFS — skips Android's USB stack entirely, writes bytes straight to
/dev/hidg0. Fast, and most EDRs see it as a generic keyboard. - DuckyScript on-device — write and run payloads from the built-in editor. No laptop needed, compiler fires interrupts on the spot.
- Payload library — import
.txtfiles from local storage or pull directly from the Hak5 community repo inside the app. - OOB C2 via RNDIS — phone presents itself as a USB Ethernet adapter (
usb0) and runs a tiny web server for swapping payloads or checking status from another machine. Windows picks it up automatically. macOS is annoying about composite USB signatures, fair warning. - BLE HID fallback — USB port blocked? Switch to Bluetooth and push keystrokes over L2CAP instead.
- Mass storage spoof — maps a
.binor.imgtousb_f_mass_storage. Phone shows up as a flash drive on the target.
Kotlin frontend, C++ for anything that touches hardware.
- UI — Jetpack Compose
- Coroutines — keeps char device I/O off the main thread
- JNI — C++ reads
sysfsdirectly to figure out what the kernel actually has compiled in
Needs root. That's the hard requirement.
- Magisk, KernelSU, APatch — doesn't matter which.
- Kernel needs
CONFIG_USB_CONFIGFSandCONFIG_USB_CONFIGFS_F_HID. Stock kernels usually don't have them. Flash NetHunter if yours doesn't. - Android 11+ for BLE HID.
BT HID works reliably across most devices. Wired ConfigFS is a different story — it depends entirely on what your OEM left in the kernel. If you get it working on something unusual (old Pixel, OnePlus, whatever), paste your
dmesgoutput in the Issues tab. Trying to build a compatibility list.
git clone https://github.com/cipher-attack/chimera.git
cd chimera
# Set NDK path in local.properties first or the JNI build will fail immediately
./gradlew assembleDebug- The target needs a second or two to mount the HID driver after you plug in. Start firing keystrokes too early and they disappear. Put
DELAY 1000at the top of every payload. - Doze mode will kill background coroutines when the screen goes off. Go into battery settings and exclude Chimera, otherwise your C2 drops mid-run.
DOCUMENTATION.md covers the JNI bridge and the composite USB setup in detail. Read CONTRIBUTING.md and CODE_OF_CONDUCT.md before opening a PR.
- Release APK — stripped, for actual use
- Debug APK — verbose logs, use when ConfigFS payloads aren't working
Disclaimer: Built for authorized red team and physical security work. Get written permission before you plug into anything.