Skip to content

ZeroTrace HID

Features

Full feature catalog for ZeroTrace HID firmware

Core injection

  • Keyboard injection — keystroke payloads at configurable speed, multi-language layouts.
  • Mouse injection — absolute and relative movement, click, scroll, jitter, draw.
  • Gamepad emulation — buttons, dual analog sticks, D-Pad, rapid-fire.
  • Live mode — virtual keyboard and joystick from the web UI in real time.
  • Repeat mode — loop blocks for persistence or continuous payloads.
  • Timed execution — delay primitive for scheduled or rate-limited runs.

Wireless control

  • WiFi AP mode — WPA2-protected ... ZT network, default password ZeroTrace, web UI at 192.168.4.1.
  • WiFi STA mode — join an existing network and control the device from the same LAN.
  • Wi-Fi-controlled execution — trigger payloads from your phone or laptop.
  • Web UI — script editor, live mode, file manager, settings.

Spoofing & stealth

  • HID descriptor spoofing — keyboard, mouse, gamepad, MSC, printer.
  • BLE peripheral spoofing — AirPods, Fitbit, Car Audio, custom.
  • WiFi SSID spoofing — disguise the AP as common consumer device names.
  • Recon mode — disable all LEDs (state restored on exit).
  • Self-destruct — full flash erase from the UI.

Coordination

  • TraceNetwork — link multiple devices over ESP-NOW (AES-128-GCM, ~200 m line of sight).
  • Synchronized execution — fire HID payloads across the fleet within ~10–20 ms.
  • Fleet WiFi scan — aggregate scan results from all agents for full RF coverage.
  • Light shows — Solid, Pulse, Strobe, Rainbow, Chase, Cylon across the fleet.
  • Remote admin — push/pull/delete files, read/write config, run/stop scripts on any agent from one UI.
  • Identify — blink a chosen device's LED to physically locate it.
  • traceBroadcast — script primitive for fleet-wide event publishing.

Adaptive behavior

  • OS detection — auto-detect Windows, macOS, Linux, Android, iOS; expose as _@detectedOS.
  • SilentTrace — auto-switch between USB-HID and BLE-HID transports based on connectivity.
  • Lock & USB status — live Caps/Num/Scroll Lock and USB connection state in the UI.
  • Display support — OLED status (Kit only) for payload progress and alerts.

Storage & power

  • On-device filesystem — multiple persistent payloads, hot-swappable. 10 MB on Kit, 2 MB on Mini and Ghost.
  • Autostart — designate one script to run on boot.
  • Power modes — Low (80 MHz / 10 dBm), Normal (160 MHz / 17 dBm), High (240 MHz / 20 dBm).

Maintenance

  • Web Flasher — browser-based firmware updates via Web Serial.
  • Disable Caps Lock — auto-clear before script execution.
  • Cross-platform — Windows, macOS, Linux for tooling; firmware payload OS-agnostic.
  • BRUTEFORCE primitive — built-in credential brute-force with configurable charset and rate.

Browse the dedicated pages for each feature in the sidebar.