Skip to content

ZeroTrace HID

Features

Full feature catalog for ZeroTrace HID firmware

Core injection

  • Keyboard injection, keystroke payloads at configurable speed, multi-language layouts. Delivered over USB-HID and BLE-HID.
  • Mouse injection, relative movement, click, double-click, scroll, drag-drop, jitter, and draw. USB-HID only.
  • Gamepad emulation, buttons, dual analog sticks, D-Pad, triggers, rapid-fire. USB-HID only.
  • Media & system keys, consumer-control and system-control keys by name or raw usage code. Media keys work over both transports.
  • Live mode, virtual keyboard, mouse, and joystick driven from the mobile app in real time.
  • Repeat & timed execution, repeat / while blocks and the delay primitive for looped or rate-limited runs.

Control

  • Mobile app over Bluetooth, the ZeroTrace app is the only remote control channel: script Executor, live keyboard / mouse / gamepad, file browser, and settings.
  • Trigger from your phone, run payloads on demand over the BLE link, no cable to the controlling device.
  • TraceNetwork fleet, link and drive multiple devices at once (see Coordination below).

USB identity spoofing

  • Custom or randomized USB identity (usb_spoof_mode), custom VID/PID plus manufacturer / product / serial descriptor strings, or a fully randomized identity. Invalid VID/PID values are logged and ignored.
  • The device is always a composite keyboard + mouse + consumer-control endpoint. There is no HID descriptor-class switcher, and no BLE peripheral spoofing. Mass storage is exposed separately via storageMode.

Recon & self-destruct

  • Recon mode (reconMode), suppress all LED activity for a low-visibility run; LED state is restored on exit.
  • Self-destruct (selfDestruct), erase the entire flash chip from the mobile app. Irreversible.
  • Format storage (formatStorage), wipe the user filesystem without touching firmware.

Coordination (TraceNetwork)

  • TraceNetwork, link multiple devices over ESP-NOW, single-hop, channel-pinned, encrypted with AES-128-GCM (HKDF-SHA256 fleet key from a shared passphrase).
  • Synchronized execution, run or stop scripts across the fleet from one app.
  • Fleet WiFi scan, aggregate scan results from all agents (up to 20 APs each; refused while a script is running).
  • Light shows, fleet-wide LED patterns: Off, Solid, Breathe, Blink, Rainbow, Chase, Bounce.
  • Remote admin, list / get / put / delete files and read / write an allow-listed set of config keys on any agent (secrets are forbidden).
  • Identify, blink a chosen device's LED to physically locate it.

Adaptive behavior

  • OS detection (osDetection), auto-detect Windows, macOS, Linux, Android, iOS; expose as _@detectedOS.
  • SilentTrace, auto-switch between USB-HID and BLE-HID transports based on connectivity. USB-only commands are skipped, not downgraded, over BLE.
  • Watchdog geofence (watchdog), scan for a named WiFi SSID and gate execution on its presence. Scan only, the device never associates.
  • Lock & USB status, live Caps / Num / Scroll Lock and USB connection state surfaced in the mobile app.
  • Display support, OLED status (Kit only) for payload progress and alerts.

Storage & power

  • On-device filesystem, multiple persistent payloads, hot-swappable. 10 MB on Kit, 2 MB on Mini and Ghost.
  • Autostart, designate one script (/__autoStart__) to run on boot; requires a mounted USB-HID keyboard.
  • Power modes (powermode), Low (80 MHz / 10 dBm), Normal (160 MHz / 17 dBm), High (240 MHz / 19.5 dBm).

Scripting & control flow

  • Conditionals, IF / ELSE_IF / ELSE with string and numeric comparators; nestable.
  • Loops, repeatStart … repeatEnd (fixed count) and whileStart … whileEnd (condition), with a runaway guard.
  • Functions, define reusable blocks with functionStart / functionEnd, invoke with call (recursion depth-limited).
  • Variables & math, _$VAR declarations plus runtime set / add / sub / mul / mod, and an operator library (_$random, _$concat, _$substring, _$replace, and more).
  • Synchronization, waitFor (host lock-key signal, with timeout), waitForButton, randomDelay, and stop / exit for early bail-out.
  • Disruption & brute force, jamKeys for random-key flooding and the bruteForce primitive for credential brute-forcing with a configurable charset and rate.

Maintenance

  • Web Flasher, browser-based firmware updates via Web Serial.
  • Disable Caps Lock (disable_capslock), auto-clear before script execution.
  • Cross-platform tooling, Windows, macOS, Linux for flashing; firmware payloads are OS-agnostic.

Browse the dedicated pages for each feature in the sidebar.

Command Palette

Search for a command to run...