pumpkin

A hardware keylogger/implant based on the RP2350 and the ESP-MINI-1. Designed solely for keyboards.

DISCLAIMER

This device, whether as a prototype or finished device, including also it's firmware is for RESEARCH and EDUCATIONAL PURPOSES ONLY. No colaborator, designer, or manufacturer involved with this project's production, design, or logistics has any intention, whether explicit or implicit, to use this device beyond research and testing. This project is not intended to be used for crime and is to be designed and used in good faith. Any person or entity using this project's code, design, or any physically device to do any level of crime is not affiliated with V.L. Labs, this site or sister sites, or anyone also contributing to this project. The colaborators, designers, and manufacturers of this device DO NOT CONSPIRE OR DESIRE TO COMMIT ANY LEVEL OF CRIME and abide by the Computer Fraud and Abuse Act (Title 18 U.S. Code 1030).

This device, including both hardware designs and code, are not designed with the intent to sell or to be profited off of. Any individual following the license described in LICENSE.md is permitted to use any resources in this repository (pumpkin) on this site (git.vllabs.net).

ANY entity contributing to or using this project must agree to the above disclaimer and the license described in LICENSE.md

Rev 1.0 - 4/29/2026 written by designer & contributor Zane Maples

Media

Compilation

• RP2350 code requires the arm cross compiler (gcc-arm-none-eabi and libnewlib-arm-none-eabi). Package names for this will differ from linux distro to distro (ones provided work on Debian). Also requires CMake. Run the setup.sh script in the RP2350 code directory to setup the build/ directory. From there you can run make in the build directory.
  • In order to flash this code you must put the compiled binary (pumpkin.bin) into the embedded folder in code/esp32-mini-1/main/embedded. The ESP32 will then flash this to the RP2350 at runtime.
• ESP32 code requires the ESP-IDF (v6.0.1) from Espressif. Installing this requires a bit more setup. When building the toolchain make sure you target the ESP32 only.
• For both chips you will need a UART to USB converter in order to read output and for the case of the ESP32 to program the device.

Current Todo

• [1] Create datasheet and full documentation (v0.9.x)
  • [1.1] RP2350 Documentation
  • [1.2] ESP32 Documentation
  • [1.3] Datasheet/Hardware Documentation
• [2] Polish everything for 1.0 release (v0.9.x)

Known Issues

Software Issues

• Composite USB keyboards (ie. ones with a mouse usb slot) have an issue where the mouse or other peripheral does not work. This would require some more TinyUSB setup that to be frank I do not want to setup. Maybe in the future this will be a possiblity (as it should be possible within TinyUSB, or atleast I think it is).
• There is currently no way to get the full proper descriptors from TinyUSB in order to "mimic" the device to the host. I have tried several things, but everytime I try to get the descriptor strings from TinyUSB they come out corrupted/not at all. As well there is no way to dynamically configure high-level parts of TinyUSB as all of it is typically controlled in the predefined configurations or as literal compile-time macros. However, for systems that typically just look at VID/PID for device verification (which is a very a poor idea btw) this will get by just fine. There are one known fix for this:
  • Manually hard coding in values for the specific keyboard/device in question. This mean adjusting endpoint sizes, descriptor strings, etc. manually. This also would require a full recompile of the RP2350 code (and a reflash of the ESP32 with the new binary). This option is not super hard however you will need a pretty decent understanding of how TinyUSB works and how USB descriptors work in general.

Hardware Issues

• The v1.0 version of the board gets pretty hot during operation. I believe this to be from the power diodes & linear regulator, alongside the current draw when transmitting and heavy loads on the SD card. This heat generally congregates to the center of the board and the SD card slot acts as sort of a heatsink. It doesn't get very hot (warm/hot to the touch, but not too incredibly hot) and I haven't noticed any degregation of performance from any subsystem. Just be warned if you ever plan to put this into a case, as without proper heatsinking/thermal management it could overheat.
• The v1.0 version of the board could use with more decoupling capacitors leading into the ESP32. Whenever you plug a USB device into the board it seems to instantly brownout the chip (seemingly caused by the sudden current draw from the board as a whole). It also seems to potentially affect the RP2350 as well. It may be better to solve both problems by putting multiple larger decoupling capacitors to the 5V lines in order to help with the sudden current draw. (Proposed fix in hardware revision 1.1)

Current features

• SD Card Support (SDMMC & SPI)
  • File structure:
  • logs/ holds system logs from both the ESP32 and RP2350
  • keylogs/ holds the keylogger logs (main bulk of the storage)
  • config.json stores the startup configuration for the system
• USB Passthrough via TinyUSB
• USB Keystroke Logging
• RTC clock with coincell battery system to keep the date for an estimated 2-300 days with no power
• ESP32 AP mode with HTTP server
  • Full file downloads and management (at around 300KB/s or ~2.5 megabit/s)
  • Full configuration from the webserver with saving to disk
  • Ability to live control the system