Binocular mobile thermal imager v2

AT32 BootLoader.zip

AT32F415KBU7-4_hotcamera.zip

AT32F415KBU7-4_hotcamera.bin

BootLoader.hex

PDF_Binocular Mobile Thermal Imager v2.zip

Altium Binocular Mobile Thermal Imaging Device v2.zip

PADS_Binocular Mobile Thermal Imaging Device v2.zip

BOM_Binocular Mobile Thermal Imaging Camera v2.xlsx

91336

USB Keyboard Prankster

This is a prank device implemented using the CH9329 based on the ESP32 S3 and WCH. The ESP32 S3 is responsible for the USB host to parse the USB keyboard data, and the CH9329 is responsible for reporting the device as a keyboard device to the host computer.

This is a device that allows you to prank others. After connecting it between the other party's USB keyboard and the host computer, you can connect to this device via Bluetooth using Blinker on your phone. The information output in Blinker will then appear on the other party's computer.
The hardware design is as follows:

The upper left corner is a reserved debugging and programming interface, through which you can program the device and send debug information to the PC.
The lower left corner is the core of this design, an ESP32-S3 chip, which enables USB host and Bluetooth communication.
The ESP32-S3 operates at 3.3V, and a TLV1117 is used here. This chip only requires two 1uf capacitors.
The lower right corner is the CH9329 chip, an HID to serial port chip used in this design to implement the USB keyboard function.

The CH9326 is a driverless HID to serial port chip. The CH9326 supports bidirectional data transmission, used to receive serial port data and, according to the HID class device specification, package the data and upload it to the computer via USB, or receive USB data packets compliant with HID class devices from the computer and send them via serial port. The provided host computer software allows users to configure the chip's VID, PID, and various string descriptors. The chip is in an SOP16 package, making it easy to solder.
The basic design idea is that the ESP32-S3 parses USB keyboard data to obtain key information. This information is then sent to the CH9326 via serial port, and the CH9326 simulates key presses on the PC. As you can see, this device is transparent to the PC. Afterwards, the Blinker's Bluetooth function can be used to connect the phone and this device, allowing characters to be sent from the phone to the PC.
The PCB design is as follows:
The finished product is as follows (color silkscreen printing, gold plating process, and a QR code on the back):
The Arduino code is as follows:
#include
#include
#include "show_desc.hpp"
#include "usbhhelp.hpp"
#define BLINKER_PRINT Serial
#define BLINKER_BLE
#include
//Keyboard data
char keypress[] = {0x57, 0xAB, 0x00, 0x02, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10};
bool isKeyboard = false;
bool isKeyboardReady = false;
uint8_t KeyboardInterval;
bool isKeyboardPolling = false;
elapsedMillis KeyboardTimer;
const size_t KEYBOARD_IN_BUFFER_SIZE = 8;
usb_transfer_t *KeyboardIn = NULL;
// Send the content pointed to by Buffer, length of size, and checksum to Serial2
void SendData(byte *Buffer, byte size) {
byte sum = 0;
for (int i = 0; i
Serial2.write(*Buffer);
sum = sum + *Buffer;
Buffer++;
}
*Buffer = sum;
Serial2.write(sum);
}
// Convert ASCII characters to HID Scancode values
​​byte Asc2Scancode(byte Asc, boolean *shift) {
if ((Asc >= 'a') && (Asc *shift = false; return (Asc - 'a' + 0x04); } if ((Asc >= 'A') && (Asc
*shift = true;
return (Asc - 'A' + 0x04);
}
if ((Asc >= '1') && (Asc
*shift = false;
return (Asc - '0' + 0x04);
}
if ((Asc >= '1') && (Asc
*shift = false;
return (Asc - '0' + 0x04); } 0x1E);
}
if (Asc == '>') {
*shift = true;
return (0x37);
}
if (Asc == '.') {
*shift = false;
return (0x37);
}
if (Asc == '_') {
*shift = true;
return (0x2D);
}
if (Asc == '-') {
*shift = false;
return (0x2D);
}
return 0;
}
// If an unbound component is triggered, its contents will be executed
// Input from input boxes will be handled here
void dataRead(const String & data)
{
BLINKER_LOG("Blinker readString: ",data);
boolean shift;
byte scanCode;
for (int i = 0; i
BLINKER_LOG("Key In", data.charAt(1));
// Convert the received ASCII to ScanCode
scanCode = Asc2Scancode(data.charAt(i), &shift);
// Some keys will be escaped when Shift is pressed
if (scanCode != 0) {
if (shift == true) {
keypress[5] = 0x02;
}
BLINKER_LOG("Scancode", scanCode);
// Fill in the ScanCode to be sent
keypress[7] = scanCode;
SendData((byte*)keypress, sizeof(keypress));
delay(10);
keypress[5] = 0x00; keypress[7] = 0;
SendData((byte*)keypress, sizeof(keypress));
delay(10);
}
}
}
void keyboard_transfer_cb(usb_transfer_t *transfer)
{
if (Device_Handle == transfer->device_handle) {
isKeyboardPolling = false;
if (transfer->status == 0) {
if (transfer->actual_num_bytes == 8) {
uint8_t *const p = transfer->data_buffer;
ESP_LOGI("", "HID report: %02x %02x %02x %02x %02x %02x %02x %02x",
p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
// USB Host parses the data and transfers it to PC
//
memcpy(&keypress[5],p,transfer->actual_num_bytes);
SendData((byte*)keypress, sizeof(keypress));
}
else {
ESP_LOGI("", "Keyboard boot hid transfer too short or long");
}
}
else {
ESP_LOGI("", "transfer->status %d", transfer->status);
}
}
}
void check_interface_desc_boot_keyboard(const void *p)
{
const usb_intf_desc_t *intf = (const usb_intf_desc_t *)p;
if ((intf->bInterfaceClass == USB_CLASS_HID) &&
(intf->bInterfaceSubClass == 1) &&
(intf->bInterfaceProtocol == 1)) {
isKeyboard = true;
ESP_LOGI("", "Claiming a boot keyboard!");
esp_err_t err = usb_host_interface_claim(Client_Handle, Device_Handle,
intf->bInterfaceNumber, intf->bAlternateSetting);
if (err != ESP_OK) ESP_LOGI("", "usb_host_interface_claim failed: %x", err);
}
}
void prepare_endpoint(const void *p)
{
const usb_ep_desc_t *endpoint = (const usb_ep_desc_t *)p;
esp_err_t err;
// must be interrupt for HID
if ((endpoint->bmAttributes & USB_BM_ATTRIBUTES_XFERTYPE_MASK) != USB_BM_ATTRIBUTES_XFER_INT) {
ESP_LOGI("", "Not interrupt endpoint: 0x%02x", endpoint->bmAttributes);
return;
}
if (endpoint->bEndpointAddress & USB_B_ENDPOINT_ADDRESS_EP_DIR_MASK) {
err = usb_host_transfer_alloc(KEYBOARD_IN_BUFFER_SIZE, 0, &KeyboardIn);
if (err != ESP_OK) {
KeyboardIn = NULL;
ESP_LOGI("", "usb_host_transfer_alloc In fail: %x", err);
return;
}
KeyboardIn->device_handle = Device_Handle;
KeyboardIn->bEndpointAddress = endpoint->bEndpointAddress;
KeyboardIn->callback = keyboard_transfer_cb;
KeyboardIn->context = NULL;
isKeyboardReady = true;
KeyboardInterval = endpoint->bInterval;
ESP_LOGI("", "USB boot keyboard ready");
}
else {
ESP_LOGI("", "Ignoring interrupt Out endpoint");
}
}
void show_config_desc_full(const usb_config_desc_t *config_desc)
{
// Full decode of config desc.
const uint8_t *p = &config_desc->val[0];
static uint8_t USB_Class = 0;
uint8_t bLength;
for (int i = 0; i wTotalLength; i += bLength, p += bLength) {
bLength = *p;
if ((i + bLength) wTotalLength) {
const uint8_t bDescriptorType = *(p + 1);
switch (bDescriptorType) {
case USB_B_DESCRIPTOR_TYPE_DEVICE:
ESP_LOGI("", "USB Device Descriptor should not appear in config");
break;
case USB_B_DESCRIPTOR_TYPE_CONFIGURATION:
show_config_desc(p);
break;
case If
​
​
​
​
​
​
​
​
​(isKeyboard && KeyboardIn == NULL) prepare_endpoint(p);
break;
case USB_B_DESCRIPTOR_TYPE_DEVICE_QUALIFIER:
// Should not be config config?
ESP_LOGI("", "USB device qual desc TBD");
break;
case USB_B_DESCRIPTOR_TYPE_OTHER_SPEED_CONFIGURATION:
// Should not be config config?
ESP_LOGI("", "USB Other Speed ​​TBD");
break;
case USB_B_DESCRIPTOR_TYPE_INTERFACE_POWER:
// Should not be config config?
ESP_LOGI("", "USB Interface Power TBD");
break;
case 0x21:
if (USB_Class == USB_CLASS_HID) {
show_hid_desc(p);
}
break;
default:
ESP_LOGI("", "Unknown USB Descriptor Type: 0x%x", bDescriptorType);
break;
}
}
else {
ESP_LOGI("", "USB Descriptor invalid");
return;
}
}
}
void setup()
{
// Initialize debug serial port
Serial.begin(115200);
// Initialize CH9329 serial port
Serial2.begin(9600, SERIAL_8N1, 14, 13, false, 1000, 112);
//Serial2.begin(9600);
#if defined(BLINKER_PRINT)
BLINKER_DEBUG.stream(BLINKER_PRINT);
#endif
// Initialize blinker
Blinker.begin();
Blinker.attachData(dataRead);
usbh_setup(show_config_desc_full);
}
void loop()
{
usbh_task();
Blinker.run();
if (isKeyboardReady && !isKeyboardPolling && (KeyboardTimer > KeyboardInterval)) {
KeyboardIn->num_bytes = 8;
esp_err_t err = usb_host_transfer_submit(KeyboardIn);
if (err != ESP_OK) {
ESP_LOGI("", "usb_host_transfer_submit In fail: %x", err);
}
isKeyboardPolling = true;
KeyboardTimer = 0;
}
while (Serial.available()) {
char c = Serial.read();
if (c == 'q') {
boolean shift = false;
// Fill in the ScanCode to be sent
keypress[5] = 0x08;
SendData((byte*)keypress, sizeof(keypress));
delay(20);
keypress[5] = 0;
SendData((byte*)keypress, sizeof(keypress));
}
Serial.print(c);
}
}
Photo of the board after it has been installed in the casing: