Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

keyboard-interceptor-micropython (esp32)

Proof-of-concept keyboard keystroke interceptor for PS/2 protocol proposed to be used with USB-to-ps/2 hardware downgrade



USB programming is hard. I'm lazy. PS/2 is simple and practically readable by UART. We want to explore the idea of rapid IOT enabled hardware exploit development. ESP32 with micropython is good for rapid prototyping which makes it extremely suitable for this case.

  • Wifi is a breeze with micropython
  • WebRepl means we already have access to the device console so we don't even need to bother with comms ( )
    • But there is a simple MQTT library for comms, so why not
  • Encryption is possible
  • Code readability is superb
  • They're cheap and accessible
  • We can power an ESP32 from the power line of PS/2 which is actually powered by USB in our case.


  1. Interception
  2. Blocking
  3. Injection

Hardware Preparation Steps

  1. Buy cheap USB->PS/2 and PS/2->USB to downgrade the communication protocol.
  2. Strip out the CLK signal to measure the keyboard's baudrate.
  3. Connect keyboard's data line to UART RX and connect UART TX to PC's data line.
  4. Connect 5V supply to ESP32's 5V input (not tested yet).

Software Preparation Steps

  1. Download and install the latest micropython firmware from
  2. (Preferred) Use VS Code + Pymakr to upload.

What software does

There are two tasks and a periodic timer that run in a round-robin manner (not great, not terrible).

  1. UART task: polls the uart buffer for incoming bytes and "echoes" them (in reality they're forwarded to pc). Received chars are placed in a capture buffer, which is processed (not yet) and then published to an MQTT topic.
  2. MQTT task: listens for MQTT messages and controls the software. Most notably it can inject keystrokes. Timer: Sets the uart baudrate with respect to the recently measured clock frequency

Future Works &| Contribution Requests

Sure, why not. This will need and I will not bother with:

  1. Keystroke processing; captured keystrokes are not really processed and converted to utf8 or similar. Would be better to actually do this processing.
  2. Secure comms; either MQTT over TLS or something better than shared-key-AES. Even an HTTPS based REST API is acceptable.
  3. WiFi AP option; instead of connecting to existing AP. Should be a hidden AP though.
  4. Robustness upgrades; no idea what'll happen if WiFi &| MQTT disconnects.


Proof-of-concept keyboard keystroke interceptor for PS/2 protocol proposed to be used with USB-to-ps/2 downgrade








No releases published


No packages published