This build targets the Waveshare ESP32-S3 Touch AMOLED 1.64, PCB V1. Check the revision on the physical board before installing firmware. The current EvilKey image and case have not been validated for PCB V2.

Gather one V1 board, a USB-C cable that carries data, the printed V1 enclosure, the short Unitek USB-C loop shown in the prototype, four M2 × 5 mm screws that secure the board from below, and one M5 × 10 mm flat-point grub screw that locks the loop into the case. A microSD card is optional for USB Tool examples. The display, touch panel and IMU are already on the board; this prototype is USB powered and has no battery.

Download the complete source from the public EvilKey firmware repository. Read installation information before changing a board that holds FIDO credentials.

On Windows install Arduino CLI, Python, Git, Arduino-ESP32 3.3.12 and the Waveshare PCB V1 board definition. The project pins its upstream revisions. Its USB stack checker may require the documented local TinyUSB hook in the shared Arduino core; follow the checker output instead of substituting a different board package.

From a terminal opened in the extracted public repository, run these commands in order:

1. cd firmware
2. python prepare_arduino.py
3. python build_arduino.py

The build checks the USB stack and writes the image to firmware/build-arduino/EvilKeyV1.ino.bin. If preparation reports a missing pinned USB hook, resolve it using the repository instructions and rerun the build. Keep the build output and error messages together; do not flash an image from a different board revision.

Connect the V1 board through its native USB connector with a data-capable cable. To enter download mode, hold BOOT, press and release RESET, then release BOOT. From the firmware directory run:

python flash_arduino.py

The script rebuilds and verifies the image, lists serial ports, and requires you to select the correct COM port and confirm with Y. Check the board and port before confirming. The upload uses EraseFlash=none, which preserves NVS but is not a credential backup. After upload, release BOOT and press RESET once.

After RESET, confirm that the screen reaches READY and the touchscreen can navigate to Settings and back in both directions. Open Diagnostics to read the actual RGB565 draw-buffer configuration; 2 × 64 rows was observed on the tested unit, but the firmware can fall back if memory allocation differs.

Try a FIDO2 login using a disposable test account before relying on this build for an important account. A compatible built-in user-verification request may show the on-device PIN keypad; other clients may use standard host-side ClientPIN. Do not present the illustrative PIN image in the project page as a live authentication test.

Disconnect USB power. Slide the Waveshare V1 module through the top opening of the current printed enclosure, with the AMOLED aligned behind the front window. From the underside, fasten the module with four M2 × 5 mm screws.

Seat the short Unitek USB-C keychain loop in the enclosure. After the loop is in place, insert one M5 × 10 mm flat-point grub screw from the left side to lock the loop to the plastic case. Check that the loop is retained, the screen and touch surface are unobstructed, and the USB connector remains accessible. Do not force the module or overtighten the fasteners.

This describes the current home-printed prototype. The planned SLS case and a PCB V2 variant have not been validated by these assembly steps.

From Settings open Air Mouse and select START. The device reconnects as a mouse-only USB role. Hold the central MOVE area and tilt the key: the cursor should travel smoothly horizontally, vertically and diagonally; releasing MOVE should stop it. Use the top LEFT and RIGHT areas and the scroll strip to test clicks and scrolling.

Hold SETTINGS for three seconds to open calibration, sensitivity and vertical inversion. CALIBRATE is also a three-second hold while the key is still. Hold EXIT for three seconds when finished; the device restarts in its normal FIDO role. These modes are selected separately, so the Manager does not connect while the mouse-only role is active.

Only if you fitted a microSD card, copy the original hello_world.duck example into /duckyscripts using Manager Drive, then safely eject the card on the computer. Review the file before running it. Switch the key to USB Tool, focus an empty text editor on a computer you own, select the example on the touchscreen and press RUN.

The example types two lines after a short delay. A script does not launch during boot, USB connection or card mounting; it starts only after local selection and RUN. Read the USB Tool guide and use other scripts only on systems you own or are authorized to test.