> For the complete documentation index, see [llms.txt](https://documentation.hak5.org/hak5-usb-rubber-ducky/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.hak5.org/hak5-usb-rubber-ducky/advanced-features/payload-hiding.md).

# Payload Hiding

## Overview

In certain circumstances it may be desirable for the mass storage device enumerated by the target when using `ATTACKMODE STORAGE` not to contain an `inject.bin` payload file on its root. To that end, the `HIDE_PAYLOAD` and `RESTORE_PAYLOAD` commands may come in handy.

## HIDE\_PAYLOAD and RESTORE\_PAYLOAD

The `HIDE_PAYLOAD` command will remove the `inject.bin` file (and `seed.bin` file, if it too exists) from the root of the MicroSD card.

{% hint style="info" %}
The `HIDE_PAYLOAD` and `RESTORE_PAYLOAD` commands must be executed before entering an `ATTACKMODE STORAGE` state.
{% endhint %}

### Example

```
REM Example payload hiding and restoring
ATTACKMODE OFF

BUTTON_DEF
    ATTACKMODE OFF
    RESTORE_PAYLOAD
    ATTACKMODE STORAGE
END_BUTTON

HIDE_PAYLOAD
ATTACKMODE HID STORAGE
DELAY 2000
STRING Nothing to see here...
```

#### Result

* Upon first enumeration, the attached computer will not be able to see the i`nject.bin` or `seed.bin` files on the USB Rubber Ducky storage.
* Pressing the button will re-enumerate the USB Rubber Ducky storage with both files visible once more.

{% hint style="warning" %}
The `RESTORE_PAYLOAD` command will write the currently running payload from volatile memory, including the values for all stored variables, to the disk as `inject.bin`.
{% endhint %}

{% hint style="danger" %}
Executing the `HIDE_PAYLOAD` command will erase the running payload from the disk. If no subsequent `RESTORE_PAYLOAD` command is executed before detaching the USB Rubber Ducky, the payload will not appear on the disk.
{% endhint %}