The Fake Badge

SAO v1.69bis USB adapter for DEFCON 2019

Similar projects worth following
Starting from
nsayer has 2321 orders / 163reviews
Ships from United States of America
The Fake Badge is just a USB UART with the pinout for the SAO v1.69bis standard. That said, there is a lanyard hole, so it actually is a badge. But it's useless without a USB connection to a host device of some sort, so it's fake.

The actual circuit is a by-the-book implementation of the Cypress Semi CY7C65213 USB UART chip. This chip was chosen because its USB facade is a standard USB CTC device, which means that no proprietary device drivers are required for it to work (FTDI's continuing weaponization of their device drivers maintains their status as an industry pariah).

The USB specification requires the ground and shield to be connected on the host end of the cable. While completely disconnecting them on the device end is the original recommendation of the spec, it's not a terrible idea to instead add a high impedance and slightly capacitative path between the two. The high impedance gets in the way of ground loops and the capacitative path allows for some amount of EMI shunting.

The USB specification also requires the target (if bus-powered) to not draw excessive current prior to enumeration and during suspend. The CY7C65213 conveniently supplies a !POWER pin to allow gating the supply for target circuitry. We use a P channel MOSFET to turn the SAO power pin on and off. In addition, we can allow hot-swapping of the SAO by adding a hot-swap controller to prevent inrush current on the target from screwing with the badge's power bus. The AP-2331 is my preferred tool for that job, and is immediately after the MOSFET. The 2331 also acts as a current limiter, and will enforce the SAO power limit of 1.1 millihorsepower.

Since both the power and signal levels of the SAO standard are 3.3 volts, we include an LDO to drop the USB 5V supplied to 3.3 volts for the SAO and the VCCIO pin of the UART chip. There are a pair of LEDs for TX and RX, and a pair of resistors in the TXD and RXD lines for a little bit of EMI control and static desensitizing.

And that's about it.

In addition, this project houses an RS-232 converter SAO. That's nothing more than a MAX3232 chip, which is a TTL/LVTTL to RS-232 level converter and charge pump supply capable of running on 3.3 volts. It has an edge-mounted DB-9M for the RS-232 end and should work with any serial-enabled badge.


PDF schematic

Adobe Portable Document Format - 23.78 kB - 04/19/2019 at 19:59



EAGLE schematic

sch - 267.51 kB - 04/19/2019 at 19:56



EAGLE board file

brd - 78.55 kB - 04/19/2019 at 19:56



PDF schematic for the RS-232 SAO

Adobe Portable Document Format - 12.65 kB - 04/19/2019 at 20:03



EAGLE schematic for the RS-232 SAO

sch - 159.92 kB - 04/19/2019 at 20:04


View all 6 files

  • 1 × CY7C65213-32LTXI Microprocessors, Microcontrollers, DSPs / USB Microcontrollers
  • 1 × SMD µUSB jack
  • 1 × 0805 red LED
  • 2 × 0805 68Ω resistor
  • 1 × 0805 150Ω resistor

View all 17 components

  • A useful SAO

    Nick Sayer04/19/2019 at 20:01 0 comments

    One particular SAO that might be useful either for this badge or the Dumb Badge is an RS-232 conversion SAO. Turns out, that's really simple to do - just one chip and a handful of passives.

    I call it SAO 232. It's not really worthy of its own Hackaday project, but I'll throw the board and schematic in the files section here.

  • Why

    Nick Sayer04/19/2019 at 19:46 0 comments

    DRM-114 is going to be an async serial SAO for Defcon 2019. It'll be designed to go with the Dumb Badge, but it's conceivable that not everyone will be able to get ahold of one of those (there are a lot of folks at DEFCON). So plan B is this - it's the Fake Badge and it allows you to bridge the async serial port of an SAO v1.69bis to USB.

View all 2 project logs

Enjoy this project?



Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates