Quick Charge, Qualcomm’s power delivery over USB technology, was introduced in 2013 and has evolved over several versions offering increasing levels of power transfer. The current version — QCv3.0 — offers 18 W power at voltage levels between 3.6 V to 20 V. Moreover, connected devices can negotiate and request any voltage between these two limits in 200 mV steps. After some tinkering, [Vincent Deconinck] succeeded in turning a Quick Charge 3.0 charger into a variable voltage power supply.
His blog post is a great introduction and walk through of the Quick Charge ecosystem. [Vincent] was motivated after reading about [Septillion] and [Hugatry]’s work on coaxing a QCv2.0 charger into a variable voltage source which could output either 5 V, 9 V or 12 V. He built upon their work and added QCv3.0 features to create a new QC3Control library.
To come to grips with what happens under the hood, he first obtained several QC2 and QC3 chargers, hooked them up to an Arduino, and ran the QC2Control library to see how they respond. There were some unexpected results; every time a 5 V handshake request was exchanged during QC mode, the chargers reset, their outputs dropped to 0 V and then settled back to a fixed 5 V output. After that, a fresh handshake was needed to revert to QC mode. Digging deeper, he learned that the Quick Charge system relies on specific control voltages being detected on the D+ and D- terminals of the USB port to determine mode and output voltage. These control voltages are generated using resistor networks connected to the microcontroller GPIO pins. After building a fresh resistor network designed to more closely produce the recommended control voltages, and then optimizing it further to use just two micro-controller pins, he was able to get it to work as expected. Armed with all of this information, he then proceeded to design the QC3Control library, available for download on GitHub.
Thanks to his new library and a dual output QC3 charger, he was able to generate the Jolly Wrencher on his Rigol, by getting the Arduino to quickly make voltage change requests.
Nice job :)
No one could possibly ever misuse this feature… am I right?
;)
USB chargers with multiple ports that let devices io talk to each other and some that are so electrically noisy that they effectively transmit everything that appears on the usb tx.
It wouldn’t surprise me if someone wrote an app to set a phone to charge at 20V instead of 5V. Although I suspect that having the charger receive an rf signal that sent data to a phone might be a little too tricky for all but the best nsa hackers.
Smart people uses USB condom. If resistors are needed, put it on the hub side of the plug and leave D+ and D- unconnected. Lastly crowbar circuit on V+ and V- if someone tries to manipulate the hub to pump out too much. Crowbar usually shorts out intentionally and forces fuse on the altered hub to open.
If I remember correctly the original USB specification stated that devices should tolerate out of spec voltages. It went up to 20V I think… The spec did not demand that they actually do anything useful with such voltages, this was not a quick charging scheme. They might just shut themselves down for protection. It only mattered that they not break. Also, anything greater than 5V coming out of the host was out of spec.
The idea I think was that they predicted (correctly) that some not-so ethical people would sell car adapters that were just straight connections from the car’s 12-13.8V power bus to the USB power lines. They wanted devices to protect themselves from that rather than give their new standard a black eye.
So anyway… I would think that devices which are not QC capable would at least still follow that rule and protect themselves from higher voltages. So… hacking a quick charger to try to fry people’s stuff would probably leave the would-be saboteur quite unsatisfied and the magic smoke would remain in the circuitry where it belongs.
Why haven’t anyone commented on the two dinosaurs having sex in the scope picture?