USB KILLER V3 reverse engineering in progress UPDATED - Page 1
Forum section: electronics / projects

author: Parrot974
author_rank: Contributor
timestamp: July 27, 2017, 08:56:47 pm
content: Hello,I decided to reverse engineer a quite interesting thing which is the USB Killer V3. I don't intend to do anything wrong with it, it is just something interesting and easy to reverse engineer since I'm a beginner.After some research, all I found out about this thing is some pictures of the PCB and a partial list of the components so I decided to buy one in order to reverse engineer it.I managed to unsolder all the components properly so I could extract the schematic out of it.Here are the pictures where you can see clearly the PCB and the components:<a target='_blank' href='https://fr.imgbb.com/'>picturehostingHere is also the uncomplete schematic:<a target='_blank' href='https://fr.imgbb.com/'>picturehostingIC3 is an SOT323 Package, sorry about the confusion, Pin 5 is non existingI identified some of the electric components like a Mosfet, what can possibly be a Mosfet driver but not much more. I think the transformer is a flyback transformer so the IC3 is either a flyback boost converter or a dedicated Xenon Flash Capactitor Charger (which is more or less the same I guess)For the Transformer, I measured 5 Ohm at the primary and 40 Ohm at the secondary. For its inductance, I have a LCR meter but without knowing the hysteresis of the core, I’m not sure it is worth measuring it.I understand the flyback converter principle but the thing I don’t understand is how can the capacitors discharge into the data line only once they are fully charged and not before.All the main components have been filed with what appears to be a CNC to prevent anyone to read a reference.The voltage read at the diode D4 pins is 1.1V so I guess it is a Zener Diode.I guess R5 is there to discharge the capacitor when the device is unplugged.Could anyone guess what are the remaining components ?Note The Russian Hacker Dark Purple who first created it was using a Xenon Flash Capacitor Charger in his Version 2: LT3484 from Linear I assume.I attached the Eagle File of the schematic.Kind regards,Parrot

author: daqq
author_rank: Super Contributor
timestamp: July 28, 2017, 07:10:35 am
content: Were I to guess, IC1 is a MOSFET - it has a pretty typical pinout for such devices.Pin 3 of IC3 is a feedback pin, pin2 would be GND, 1 would be SWitch. 4 5 and 6 (there's an error in your schematic, these should all be connected) are connected to a single net, which should be then VCC. Typically, for such controllers there's an inverted SHUTDOWN pin, GND and Softstart of VOUT. This IC (http://cds.linear.com/docs/en/datasheet/3467afe.pdf) could be used, though the SS signal would have to be ignored. Though connecting it to VCC would probably work. It's probably not the specific IC, but very similar to the one you are looking for.QuoteThat would be the job of IC2 - trigger the MOSFET IC1 after some time has passed.

author: daqq
author_rank: Super Contributor
timestamp: July 28, 2017, 07:33:22 am
content: QuoteSure, could be that as well. It should be a simple matter to measure the device and based on the voltage on the transistor when open determine whether it's a MOSFET or an IGBT. An IGBT should have around 2V, a MOSFET should be load dependent.

author: Parrot974
author_rank: Contributor
timestamp: July 28, 2017, 08:09:19 am
content: Thank you very much for your help guys!Daqq, actually on the IC3, the pin 5 is non existing. It is a SOT323 package, it isn't easy to see on the picture and I couldnt fine the right symbol in Eagle. Sorry about that I will edit my post.so it might be this onehttp://www.linear.com/product/LT3468but the "charge" pin would be constantly at VCC so technically it shouldnt work because it need to be toogled to recharge the capacitors:CHARGE (Pin 4): Charge Pin. This pin must be broughthigh (>1V) to enable the part. A low (<0.3V) to high (>1V)transition on this pin puts the part into power deliverymode. Once the target output voltage is reached, the partwill stop charging the output. Toggle this pin to startcharging again. Ground to shut down. You may bring thispin low during a charge cycle to halt charging at any time.About the IC2, how is it triggered ? how can he detect the right time to trigger the Mosfet IC1 ?Im going to look for photoflash IGBT, thanks.

author: daqq
author_rank: Super Contributor
timestamp: July 28, 2017, 08:29:52 am
content: Could be a simple timer with an RC oscillator. You don't need precise timing for this kind of thing. It would probably be OK to assume that it takes X seconds to charge up to 100%, so after any time longer than X it's OK to trigger.edit:QuoteI don't think so... your schematic indicates, that the pin 3 is connected to something that looks very much like a feedback network. The LT3468 has only an inverting DONE on pin 3, which would not do anything useful.

author: Parrot974
author_rank: Contributor
timestamp: July 28, 2017, 10:50:36 am
content: You're right about the LT3484, it wouldn't work. I'll check for another similar device.The RC timer thing totally make sense but I can't really see how it would cycle. Assuming that IC2 is a transistor and that Pin 5 is its Base, it would be constantly triggered.

author: daqq
author_rank: Super Contributor
timestamp: July 28, 2017, 11:15:14 am
content: While searching for a device note that it might not necessarily come from a famous vendor - it might be some obscure chinese company with no english datasheet. Unless you decap the IC you might never be sure.As to the timer, well, for all you know it might be a microcontroller or a specialized IC that just is a self contained long interval RC timer such as this:http://cds.linear.com/docs/en/datasheet/699512fa.pdf

author: Parrot974
author_rank: Contributor
timestamp: July 28, 2017, 11:46:02 am
content: I see yes, it might be easier to use similar components even if it isn't exactly the same. The result will be the same and it will save me some time and effort.I know how it works, that was the goal here. Ill try for some time again and if I can"t find the exact components I'll use some different one.

author: wraper
author_rank: Unknown
timestamp: July 28, 2017, 12:42:03 pm
content: IC1 should be a mosfet. I guess that IC2 could be ATTINY4, pinout matches.

author: Parrot974
author_rank: Contributor
timestamp: July 28, 2017, 01:43:07 pm
content: I think this would be quite an overkill for such a cheap thing. GND and VCC might match but it is quite comon to have VCC and GND here on such small package.I think it is a dedicated timer like dapp mentionned earlier. A bit like this onehttp://cds.linear.com/docs/en/datasheet/699512fa.pdf

author: tablatronix
author_rank: Regular Contributor
timestamp: July 28, 2017, 01:50:54 pm
content: nice, I thought this was open source since I first read about it on hackaday, turns out schematic was never released by deeppurple for previous versions at all.

author: wraper
author_rank: Unknown
timestamp: July 28, 2017, 02:52:18 pm
content: Quote from: Parrot974 on July 28, 2017, 01:43:07 pmWhy overkill? It's extremely simple (512B FLASH 32B SRAM ),cheap, especially in volume and can output pulses exactly as intended without any external parts.http://eu.mouser.com/ProductDetail/Microchip-Technology-Atmel/ATTINY4-TS8R/?qs=sGAEpiMZZMvix4Kz%252byXAvaR0Df3WjnmMAnd it's not cheap at all, costs EUR 50.

author: senso
author_rank: Frequent Contributor
timestamp: July 28, 2017, 04:49:04 pm
content: It shows 0,295€ for me, 30 cents for a programmable micro is pretty cheap, beats a timer with passives all around to set it up.

author: Parrot974
author_rank: Contributor
timestamp: July 28, 2017, 05:02:14 pm
content: well, that make sense after all.

author: drussell
author_rank: Super Contributor
timestamp: July 28, 2017, 09:09:49 pm
content: Why would you want to kill a USB port, anyway?... and if you did, why not just connect up a neon sign transformer or something andreallylet the sparks fly?

author: DBecker
author_rank: Frequent Contributor
timestamp: July 28, 2017, 10:04:44 pm
content: Quote from: drussell on July 28, 2017, 09:09:49 pmThe idea that you drop one in a parking lot to make random people's lives miserable. Or teens use it to destroy school computers.People here presumably have an interest in how the gadget is designed, rather than an interest in destroying things. Pretty much like the curiosity about how a land mine works, even if you don't intend to go out and cripple people.Luckily the typical person understands how much easier it is to destroy than create, and refrains from destruction.

author: wraper
author_rank: Unknown
timestamp: July 29, 2017, 10:24:53 pm
content: Quote from: drussell on July 28, 2017, 09:09:49 pmInvestigate what you need, buy the parts, make circuit, attach USB connector... This is off the shelf solution any person can use to instantly kill computer. Not for sparks and special effects, then you could just use a hammer on your PC as well. More than that, you can quietly kill any computer where you can access USB. Or make a sabotage by placing it in some place so another person plugs it without knowing what it is.

author: amyk
author_rank: Super Contributor
timestamp: July 30, 2017, 02:56:09 pm
content: More interestingly, what would it take to make a USB port survive one?

author: wraper
author_rank: Unknown
timestamp: July 30, 2017, 03:14:19 pm
content: Quote from: amyk on July 30, 2017, 02:56:09 pmNothing reasonable that I could imagine. Protection devices which would give enough protection have too much capacitance to work on USB data lines.

author: NiHaoMike
author_rank: Super Contributor
timestamp: July 30, 2017, 04:08:27 pm
content: I'd imagine a cheap hub (or several) would greatly reduce the effectiveness. Maybe you should have tested that with a few cheap hubs and an old, worthless PC before doing the teardown?

author: drussell
author_rank: Super Contributor
timestamp: July 31, 2017, 04:15:50 am
content: Quote from: DBecker on July 28, 2017, 10:04:44 pmWell, wouldn't it still be more fun then to use a few thousand volts in there instead of a couple hundred?If person X sticks theDESTRUCTION WIZARDthat they found in the parking lot into their computer (instead of just a USB charger or whatnot), then they would at least get a light show for their troubles.As for someone intentionally destroying school property, I hope the bastard is found, expelled, charged criminallyandmade to pay back for all the damage caused!That'sNOTcool...

author: Parrot974
author_rank: Contributor
timestamp: July 31, 2017, 07:11:43 am
content: I will re-solder some of the compoments to mesure some voltages. I'll determine weither IC2 is a ATTINY4 or something else. I may learn more about IC3 too.

author: Parrot974
author_rank: Contributor
timestamp: August 08, 2017, 10:32:18 am
content: Little update,The connection of the capacitors was actually wrong.They are connected according to this schematic.<a target='_blank' href='https://fr.imgbb.com/'>image uploaderThose capacitors being approximately 10µF, connected this way the total capacitance should be 20µFAbout the Voltage, the device is delivering pulses of 200V so there should be 100V per capacitor (2 capacitors in series in each branch but the last one). Therefore, they should be rated for 150V (Given that a capacitor should be used at 80% of his voltage rating which is about 120V)The thing is, capacitors of this capacitance, voltage rating and this size just doesn’t seems to exist.Ceramic capacitors with those specs are a lot bigger, most of the time it is several smaller capacitor packed together. Is it possible that they used a lower voltage rating, not expecting the capacitors to be used for long?How did they managed to make this work?

author: T3sl4co1l
author_rank: Super Contributor
timestamp: August 08, 2017, 12:36:46 pm
content: Thanks, I figured these things were designed as such.It's not a MOSFET, but a photoflash IGBT. Example:http://www.onsemi.com/pub_link/Collateral/TIG058E8-D.PDFNothing else has the ampacity in that size to be useful for switching surges.It could be an SCR, but none are available in such small SMT packages.The capacitors are connected very strangely; did you check continuity of the pads to prove it is correct?They likely are running the capacitors beyond ratings. Ceramic capacitors typically fail (internal breakdown, I think failing shorted) at many times their rating. For example, a 16V part might die at over 100V. The margin may be lower for high voltage parts (i.e., a 100V part dies at 300V, say), but still enough for this.AFAIK, there isn't a wear mechanism at high voltage. The downside is mainly that the capacitance drops like a brick near the rated voltage.Tim

author: wraper
author_rank: Unknown
timestamp: August 08, 2017, 01:37:24 pm
content: Quote from: Parrot974 on August 08, 2017, 10:32:18 amNo, this schematic is completely wrong because:

author: Parrot974
author_rank: Contributor
timestamp: August 08, 2017, 02:30:12 pm
content: Oh! yes my bad. I completely messed up the new schematic. So the initial schematic was right after all. they are all in parrallel.So they should technically withstand 200V. So I guess they are used beyong their voltage rating and the total capacitance is therefore 50µF.

author: free_electron
author_rank: Super Contributor
timestamp: August 08, 2017, 03:57:42 pm
content: Quote from: DBecker on July 28, 2017, 10:04:44 pmThe assholes that find that funny should be removed from the gene pool.As for destroying school computers : really . This is what moderns society is doing ? we have smartphones with more horsepower than the moonrocket and all we do is send tweets to other twits, facepalmbook each other and post funny cat video's ( ok, those i like ) .There is no hope for humanity. I'm going to buy an island in the south pacific and the world can go to hell. I'll have mandatory daily beach bbq's.

author: Parrot974
author_rank: Contributor
timestamp: August 09, 2017, 09:59:39 pm
content: Btw I just found the brand of the transformer. Tokyo Coil.http://www.tokyocoil.com/EN/product2/index.htmlSo it confirms that IC3 is a PhotoFlash Capacitor Charger even if I don't know which one exactly.About the capacitors, according to this linkhttp://www.koaspeer.com/pdfs/MLCC.pdf, the capacitor shouldn't be destroyed by the overvoltage (assuming that they chose a 50V or 100V capacitors) but I'm doubtful about the capacitance during such overvoltages.

author: domeniconixavier
author_rank: Newbie
timestamp: January 04, 2023, 09:32:00 am
content: hello a person shares the gerber file to make the printed circuit

author: free_electron
author_rank: Super Contributor
timestamp: January 07, 2023, 02:52:39 am
content: Quote from: domeniconixavier on January 04, 2023, 09:32:00 amno, we don't need more of this bullshit. This is vandalism, pure and simple

author: niconiconi
author_rank: Frequent Contributor
timestamp: January 12, 2023, 07:32:13 pm
content: Quote from: free_electron on January 07, 2023, 02:52:39 amI have two of them. I ordered them only to give me a technical challenge to design an extreme USB port protection circuit. Unfortunately, I found sabotaging is the only possible use case here. They're useless for actual testing.This is why I went to design an actual, proper IEC 61000-4-5 surge generator for my lab instead.When a 50 Ω load is connected, it keeps pulsing continuously, peak voltage is typically 140 V, but can be as high as 200 V. Pulse width is about 100 μs to 250 μs. Repetition rate is about 27 pulses per second. The pulse characteristics are poorly controlled. If you don't disconnect it quickly enough, after continuously pulsing for a minute or so. It can no longer generate continuous pulses, and the pulses were no longer as powerful anymore. There's permanent circuit damage - Understandable, given the seriously undersized SMD components to fit inside a USB stick enclosure.In other words, the USB Killer eventually kills itself for good.

author: niconiconi
author_rank: Frequent Contributor
timestamp: January 12, 2023, 07:34:14 pm
content: This is the open-circuit voltage.As you can see, it's just a flyback circuit. Nothing terribly interesting.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: January 12, 2023, 10:17:21 pm
content: Quote from: niconiconi on January 12, 2023, 07:32:13 pmBack when this [the device] was a meme, I had the thought to write an article about it, how it couldpossiblybe used, and how it definitely isn't of any real use... but meh. And in time, the meme passed, and nothing of value was lost.Tim