In the process of expanding the family of supported displays for the WiFiChron clock, I found this amazing VFD module on aliexpress:

It has an SPI interface, it is powered by 5V, character set is defined and stored internally.

A quick search produced a sketch and documentation for the driver, PT6302.

According to the PCB silkscreen, the VFD module is powered by 5V, but the signals are 3V3. (The 30V required by the VFD glass itself is made by the on-board switching mode power supply, so no need to worry about generating high voltage externally.) An ESP32 board would be the perfect candidate to control this display. Luckily, the found sketch was also written for ESP32, so all I had to do was compile and upload using Arduino IDE 1.8.13. The only problem was that my IDE installation did not show ESP32 boards anymore, even though I used it once previously. Therefore, I had to re-visit the whole setup process once again. This time I am documenting it, to save on any future effort. So here are the steps:

• install Arduino IDE (1.8.13, in my case) from Windows store, placed here:

#include <WiFi.h>
#include <WiFiUdp.h>
#include <NTPClient.h>
#include <TimeLib.h>

WiFiUDP ntpUDP;
NTPClient timeClient(ntpUDP, "cn.ntp.org.cn", 8*3600, 60000);
const char *ssid     = "<wifinet>";
const char *password = "<password>";

uint8_t din   = 33; // DA
uint8_t clk   = 12; //23; // CK
uint8_t cs    = 13; //19; // CS
uint8_t Reset = 27; //22; // RS

char *str_time = "00:00:00";
String format_time = "00:00:00";

void write_6302(unsigned char w_data)
{
  unsigned char i;
  for (i = 0; i < 8; i++)
  {
    digitalWrite(clk, LOW);
    if ( (w_data & 0x01) == 0x01)
    {
      digitalWrite(din, HIGH);
    }
    else
    {
      digitalWrite(din, LOW);
    }
    w_data >>= 1;
    digitalWrite(clk, HIGH);
  }
}

void VFD_cmd(unsigned char command)
{
  digitalWrite(cs, LOW);
  write_6302(command);
  digitalWrite(cs, HIGH);
  delayMicroseconds(5);
}

void S1201_show(void)
{
  digitalWrite(cs, LOW);
  write_6302(0xe8);
  digitalWrite(cs, HIGH);
}

void VFD_init()
{
  // set number of characters for display;
  digitalWrite(cs, LOW);
  write_6302(0xe0);
  delayMicroseconds(5);
  write_6302(0x07);  // 8 chars;
  digitalWrite(cs, HIGH);
  delayMicroseconds(5);

  // set brightness;
  digitalWrite(cs, LOW);
  write_6302(0xe4);
  delayMicroseconds(5);
  write_6302(0x33); // level 255 (max);
  digitalWrite(cs, HIGH);
  delayMicroseconds(5);
}

void S1201_WriteOneChar(unsigned char x, unsigned char chr)
{
  digitalWrite(cs, LOW);
  write_6302(0x20 + x);
  write_6302(chr + 0x30);
  digitalWrite(cs, HIGH);
  S1201_show();
}

void S1201_WriteStr(unsigned char x, char *str)
{
  digitalWrite(cs, LOW);
  write_6302(0x20 + x);
  while (*str)
  {
    write_6302(*str); // ascii
    str++;
  }
  digitalWrite(cs, HIGH);
  S1201_show();
}

void setup()
{
  WiFi.begin(ssid, password);
  Serial.begin(115200);
  Serial.print("Connecting.");
  while ( WiFi.status() != WL_CONNECTED ) {
    delay(500);
    Serial.print(".");
  }
  Serial.println("connected");
 
  timeClient.begin();

  pinMode(clk, OUTPUT);
  pinMode(din, OUTPUT);
  pinMode(cs, OUTPUT);
  pinMode(Reset, OUTPUT);
  digitalWrite(Reset, LOW);
  delayMicroseconds(5);
  digitalWrite(Reset, HIGH);
  VFD_init();
}

void loop()
{
  timeClient.update();
  format_time = timeClient.getFormattedTime();
  char *str_time = &format_time[0]; 
  S1201_WriteStr(0, str_time);
  Serial.println(timeClient.getFormattedTime());
  delay(1000);
}

• easy through-hole soldering
• includes a variety of components
• reasonably priced (this is relative; what may be expensive for me may be cheap for you)
• standalone and all-inclusive: does not require extra parts/components/modules sourced from third parties and does not require loading software;
• interesting (as opposed to boring) functionality: flashes LEDs, displays something on a screen, makes some sounds etc.
• relative simplicity of the circuit, so it can be easy to understand and debug if necessary
• aesthetics of the board (shape, colour, component placement etc.)
• preferably open source
• powered by low voltage (battery, USB, power adapter)
• digital electronics rather than analog (easier to debug, if necessary)
• practical utility: use it for a utilitarian purpose rather than forget about it once built
• expandability: can be either integrated as part of a bigger project, or its capabilities and functionality can be extended by adding modules or parts
• provides extra learning (besides soldering) by displaying information: wave forms, frequencies, binary/hex number representation, musical notes, proverbs etc.
• satisfaction guaranteed once assembled and working  :)

• easy through-hole soldering
• includes a variety of components
• reasonably priced (this is relative; what may be expensive for me may be cheap for you)
• standalone and all-inclusive: does not require extra parts/components/modules sourced from third parties and does not require loading software;
• interesting (as opposed to boring) functionality: flashes LEDs, displays something on a screen, makes some sounds etc.
• relative simplicity of the circuit, so it can be easy to understand and debug if necessary
• aesthetics of the board (shape, colour, component placement etc.)
• preferably open source
• powered by low voltage (battery, USB, power adapter)
• digital electronics rather than analog (easier to debug, if necessary)
• practical utility: use it for a utilitarian purpose rather than forget about it once built
• expandability: can be either integrated as part of a bigger project, or its capabilities and functionality can be extended by adding modules or parts
• provides extra learning (besides soldering) by displaying information: wave forms, frequencies, binary/hex number representation, musical notes, proverbs etc.
• satisfaction guaranteed once assembled and working  :)

• Each class had 6 groups of 3 students sharing a soldering station. This (not my decision) was probably based of space constraints (6 desks in a normal-sized classroom) and safety/supervision considerations. It worked pretty well: the 2 students (in each group) not soldering had time to observe, analyze, think and to ask lots of questions. Two professional teachers assisted, with supervision, helping the students and keeping discipline.

• Each student had their own "HDSP clock" kit to assemble. It took 6 one-hour sessions to complete, with a success rate of about 95% (2 failures out of 38 assembled, because of solder bridges).

• The intended "50% theory and 50% practice" ratio had quickly become 10/90. Still managed to introduce components (resistor, capacitor, crystal), electrical concepts (AC vs DC, voltage, resistance, current, frequency) and units of measures (Volts, Farads, Ohms, Hertz). We even talked about Tesla batteries :)

• Some parts were lost (e.g. crystal) or damaged (dropped, then stepped on by accident) between or during the classes. The lesson learned is to have extras available.

• Each student received individual instructions, guidance, assistance and supervision on soldering. We came up with the "3-second rule" to make a good soldering joint: hold the tip of the soldering iron in contact with the pad and the terminal for 3 seconds while touching and melting the solder wire on the tip.

• Having students pay attention to the instructions was very important. It saves energy to talk once to the whole class, rather than answering the same question to each individual. (I also learned from professional teachers  the "1-2-3 eyes on me" attention-getter.)

• Sockets for integrated circuits are a must in a beginner kit. Imagine fixing an IC soldered in the wrong orientation! (The "worst" that happened was that all 3 ICs in the kit were soldered directly onto the board, luckily in the correct orientation.) Also, silkscreen should be as detailed as possible, indicating the component's place. In case of the "HDSP clock" kit, the students were able to easily identify the placeholders for each component, just by using logic (except for the resistors; they learned quickly to bend the resistors' terminals).

• Some of the most frequent mistakes were soldering bridges and filling empty holes with solder. Bridges were easily fixed (initially by me, then the students learned to do it themselves) using the copper wick/braid, and flux. To fix the solder-filled holes, I had to use a tailor pin (part of my EDC Swiss card).

• Surprisingly, every student showed interest in working on, and completing, the kit. I think it was a successful experiment even for the school, in making "practical electronics" as part of their curriculum. Like in the old days of practical skills teaching (wood working for boys, sewing or cooking for girls), this course demonstrated that Grade 6 students are very capable and eager to acquire skills that may stay with them for life.

• resistors (current reduction), variable resistor/potentiometer, trimmer
• capacitors (energy accumulator), variable capacitor
• transistors (amplification)
• coils (inductors)
• diodes, LEDs
• speakers. microphones
• buttons, switches
• integrated circuits, processors
• displays
• sensors (light, magnetic, proximity/infrared/ultrasound)
• servo motors
• relays

• voltage, current, resistance;
• AC vs DC
• digital vs analog
• oscillation
• rectification
• amplification
• series, parallel
• voltage transformation (AC)
• voltage regulation (AC, DC)

• soldering station + solder wire (preferable 0.6 mm) + desoldering wick/braid + flux pen;
• one kit (per student), with through-hole components to assemble and solder;
• prototyping boards for soldering practice + LEDs + resistors + wires + batteries;
• tools: wire cutter, pliers, screwdriver, tweezers, magnifier, multi-meter;
• optional: panavise/third hand, power supplies, wires, connectors;

A while back, I wrote an article about Malduino, an Arduino-based, open-source BadUSB device. I found the project interesting so I signed up for an Elite version and sure enough, the friendly postman dropped it off in my mail box last Friday, which means I got to play around with it over the weekend. For those who missed the article, Malduino is USB device which is able to emulate a keyboard and inject keystrokes, among other things. When in a proper casing, it will just look like a USB flash drive. It’s like those things you see in the movies where a guy plugs in a device and it auto hacks the computer. It ships in two versions, Lite and Elite, both based on the ATmega32U4.

The Lite version is really small, besides the USB connector it only contains a switch, which allows the user to choose between running and programming mode, and a LED, which indicates when the script has finished running.

The Elite version is bigger, comes with a Micro-SD card reader and four DIP switches, which allow the user to choose which script to run from the card. It also has the LED, which indicates when a script has finished to run. This allows the user to burn the firmware only once and then program the keystroke injection scripts that stored in the Micro-SD card, in contrast to the Lite version which needs to be flashed each time a user wants to run a different script.

These are the two Malduinos and because they are programmed straight from the Arduino IDE, every feature I just mentioned can be re-programmed, re-purposed or dropped all together. You can buy one and just choose to use it like a ‘normal’ Arduino, although there are not a lot of pins to play around with. This freedom was one the first things I liked about it and actually drove me to participate in the crowd-funding campaign. Read on for the full review.

The Hardware

So the Elite board arrived as schedule and I found myself some time to look an it. Despite being longer than the Lite version, it’s still quite small, measuring roughly 4.6 cm x 1.1 cm (around 1.8 in x 0.43 in), which you can easily adapt to an old USB case, although you’ll have to cut some holes for the DIP switches and the Micro-SD card. In the crowd-funding campaign, the original sketch was for a 3 DIP switch version but the final Elite has four, which I found nice. I plugged it in to an old computer, after some consideration about which firmware it could ship with and what it could do to my laptop, and sure enough a red LED appeared. And that was it. Nothing else.

After playing around with the switches and exercising some RTFM, I realised that the firmware it ships with is probably some sort of Q.C. test for the dips, which makes the Malduino output the numbers 1 to 4 (actually simulating a keypress 1 to 4), depending on which switches are ON. So far so good, it works and I’ve seen worse PCB boards than this one. The board has holes for six pins, which I did not trace to the micro-controller and I don’t know what they are for.

The Setup

Setting up the Malduino requires that you have the Arduino IDE installed and up to date. You’ll need to open up the board manager and install the Sparkfun boards since the Elite is programmed as a ‘Sparkfun Pro Micro’ running at 3.3 V and 8 MHz. Then you need to go the Malduino Script Converter website which serves several purposes:

• It allows to convert scripts between the Lite and Elite versions
• It allows you to choose your keyboard layout language
• It auto generates the Arduino project for you to import to the IDE

For the Elite version, just create a simple or even empty script to download the project, since when in ‘normal’ operation you will just flash the Malduino once and then use the Micro-SD card to store new scripts.

A note on flashing, if you are using a Debian-based distribution you might come across some problems like I did and not be able to flash the device. Like the user on this most useful post, my modem-manager was trying to talk with the Malduino after every reset and confused AVRDUDE to death. The solution is to add udev rules to “/etc/udev/rules.d/77-mm-usb-device-blacklist-local.rules”, kudos to [socrim]:

ACTION!="add|change", GOTO="mm_usb_device_blacklist_local_end"
SUBSYSTEM!="usb", GOTO="mm_usb_device_blacklist_local_end"
ENV{DEVTYPE}!="usb_device", GOTO="mm_usb_device_blacklist_local_end"

ATTRS{idVendor}=="1b4f" ATTRS{idProduct}=="9204", ENV{ID_MM_DEVICE_IGNORE}="1"
ATTRS{idVendor}=="1b4f" ATTRS{idProduct}=="9203", ENV{ID_MM_DEVICE_IGNORE}="1"

LABEL="mm_usb_device_blacklist_local_end"

The Software

Since I’m running Linux, a quick shortcut to run a command is the ALT-F2 combination. So I script that into a file and save it to 1111.txt. The Elite searches the Micro-SD card for a file corresponding to the current dip switch state. Lets say the dip switch 2 and 4 are ON. In this case, the software tries to find the file named 0101.txt and parse its contents (as in dip switch order 1,2,3,4 and not the binary representation of the number 2 and 4) . When it finishes, the red LED starts flashing quickly. My simple script was:

DELAY 2000
ALT F2
DELAY 1000
STRING xterm
DELAY 1000
ENTER
DELAY 1000
STRING id
DELAY 1000
ENTER

But it was not working. Almost all commands worked but the ALT-F2 combo was not functioning properly. Close, but no cigar. No ALT-F2, no run command window. I’ve already lazy-browsed the source code a bit because I really didn’t have a lot of time on my hands but I needed to figure this out. The offending code was this:

else if(equals(s,e,"F1",<strong>3</strong>)) Keyboard.press(KEY_F1);</pre>

else if(equals(s,e,"F2",<strong>3</strong>)) Keyboard.press(KEY_F2);
...
else if(equals(s,e,"F10",3)) Keyboard.press(KEY_F10);
else if(equals(s,e,"F11",3)) Keyboard.press(KEY_F11);

A custom equals function was receiving size 3 for the strings of the Function keys, like “F2”. It was ok for “F10”, “F11” and “F12”, but failed for the rest of the keys. Changing 3 to 2 did the trick, but my Portuguese keyboard layout started to interfere with other test scripts. So I changed the code to include PT and UK layouts, changing them in a #define at compile time.

It would be cool if it was possible to access the SD card from the computer as a regular USB volume. I don’t know exactly how feasible that is, but it does not come with the current firmware. I still wanted to be able to output the content of an arbitrary file on the SD card to the screen, so I added another script function called ECHOFILEHEX that outputs the content of a file in the SD card as escape characters. For example, if the file a.txt contains “AAA”, the script command ECHOFILEHEX a.txt would output “\x41\x41\x41”. This can be useful to echo binary files into printf or echo -e, in Linux hosts at least.

Meanwhile, I had some trouble reading the original code. You know, we all have different programming styles. Don’t get me wrong, I’ve been known to write some messed-up spaghetti code. I sometimes browse old projects looking for some libs or classes I coded and wonder ‘who the heck wrote this steaming pile of code?’ Me, it was me. Anyway, I started to change a bit here and there and ended up changing pretty much the entire code. That’s the beauty and the curse of open-source. If you’re curious you can check it out here.

Conclusion

All in all, and despite some bumps, I’m quite pleased with Malduino. It is what I expected: an open platform for BadUSB attacks that’s in its infancy. It’s awesome that we can all tinker with it, modify it, make it better or just make it suit our needs. I hope a real community can start so we can see its full potential emerge. My short list includes simulating other USB devices, better SD card management, and expanding the device via the unused pins. What would you add?

It’s a long way to go and a lot can go wrong, so good luck with the project [Seytonic]!