ALL SYSTEMS CAVE |
zero trackers · zero cookies open source · agplv3 + mit three devs · one cave hosted in the eu zero trackers · zero cookies open source · agplv3 + mit three devs · one cave hosted in the eu
zéro traceurs · zéro cookies open source · agplv3 + mit trois devs · une cave hébergé en europe zéro traceurs · zéro cookies open source · agplv3 + mit trois devs · une cave hébergé en europe
| PARIS · --:--
corploc CorpLoc
ship it
corploc / tools / pillar
// tool · beta ·

rubber ducky scripts,
readable.
scripts rubber ducky,
lisibles.

A programming language that compiles to DuckyScript. Write structured code with functions, loops, imports, and type checking — compile it down to USB Rubber Ducky / Flipper Zero payloads. Un langage de programmation qui compile en DuckyScript. Écris du code structuré avec fonctions, boucles, imports et vérification de types — compile-le en payloads USB Rubber Ducky / Flipper Zero.

~/cave · pillar
$ cat payload.pill
import Keyboard
import Process
import Windows

Windows.open("notepad.exe")
Process.wait(500)
Keyboard.type("Hello from Pillar!")
Keyboard.press(Keys.Enter)

$ pillar compile -i payload.pill -o payload
→ parsing payload.pill... ok
→ type checking... ok (0 warnings)
→ output: out/payload (6 lines)

$ cat out/payload
GUI R
DELAY 500
STRING notepad.exe
ENTER
DELAY 500
STRING Hello from Pillar!
ENTER
$
stars
language
latest version
<1s
compile time
// 01

how it works

3 steps · no surprises
// 01

install.

Grab a pre-built binary from GitHub releases, or clone the repo and make build (requires Deno). Produces a standalone native binary for Linux/macOS/Windows.

// 02

write.

Write payloads in .pill files. Real language features — fn, let/const, if/else, while, for, import. Built-in modules: Keyboard, Process, Windows.

// 03

compile.

pillar compile -i script.pill -o output — type checks your code and emits valid DuckyScript. Flash the output to your Rubber Ducky or Flipper Zero.

// 02

use cases

2 scenarios

pentesters

Write complex HID payloads with real language features — variables, functions, loops, imports. Stop copy-pasting DuckyScript snippets and stitching them together by hand.

CTF players

Build and iterate on BadUSB payloads fast. The REPL lets you test snippets interactively. The compiler catches typos before you flash.

// 03

origin story

Zyksa had the idea, Hoka built it. DuckyScript is painful to write at scale — no variables, no functions, no way to reuse code. Pillar started as "what if DuckyScript had a real compiler?" and became a full language with a lexer, parser, evaluator, and emitter. The Windows module alone — written in Pillar itself — shows what's possible when you have real abstractions over raw keystrokes.

L'idée est de Zyksa, Hoka l'a construit. Le DuckyScript c'est pénible à écrire à grande échelle — pas de variables, pas de fonctions, aucun moyen de réutiliser du code. Pillar a commencé comme "et si DuckyScript avait un vrai compilateur ?" et c'est devenu un langage complet avec lexer, parser, évaluateur et émetteur. Le module Windows à lui seul — écrit en Pillar — montre ce qui est possible quand on a de vraies abstractions au-dessus des keystrokes brutes.

// 04

comparisons

honest positioning

raw DuckyScript

DuckyScript is flat and repetitive. Pillar gives you functions, variables, imports, and a type checker — then compiles it all back to valid DuckyScript.

// 05

faq

5 questions
why not just write DuckyScript directly?
DuckyScript is flat — no variables, no functions, no imports. Pillar gives you a real language with a compiler pipeline (lexer, parser, evaluator, emitter) that outputs valid DuckyScript.
what devices are supported?
USB Rubber Ducky (Hak5), Flipper Zero BadUSB, and any HID device that accepts DuckyScript payloads.
what built-in modules exist?
Process (write text, delays), Keyboard (key presses, modifiers), Keys (full key constants), and Windows (higher-level: open apps, powershell, shutdown, lock, volume control).
vscode extension?
Yes — pillar-lang.pillar-ext on the VS Code marketplace. Syntax highlighting, error squiggles, and compile-on-save.
is this for pentesting only?
Primarily yes — authorized security testing and CTF challenges. Pillar is a tool. Use it responsibly.
> ESC
↑↓ navigate select esc close