USB Charger Notes

So while I've been working on a project at work, I've been doing some stuff with USB ports and drawing safe amounts of power from them.

There's a lot of information out there on this subject, and the official standard (Battery Charging Specification Revision 1.2, by the USB Implementers Forum, is the latest version I could find, and the one I used for my work project. Get in touch if you can't find a copy of it!) contains a very good runthrough on identifying standards-compliant USB ports.

But there's some very big names that are /not/ standards compliant, and historically have very little chance of becoming standards compliant in the near future(coughcoughApplecough). There's a lot of information about these chargers, as well, but not quite enough, as I've managed to find a seemingly undocumented variant of an official Apple charger. Apple chargers put specific voltages on the data pins that are used for determining the amount of current that the attached device is allowed to draw. I also include Apple model numbers, for easy reference to see if you've found a "new" device that's not on here, though there's actually not room left in this non-standard-standard for new ones...

Description	Apple Model #	Rated Output	D+ Voltage	D- Voltage
2.5W Charger	None	0.5A	2.0V	2.0V
5W Charger	A1102	1.0A@5.0V	2.0V	2.7V
5W Charger	A1205	1.0A@5.0V	2.0V	2.7V
5W Charger	A1265	1.0A@5.0V	2.0V	2.7V
10W Charger	A1357	2.1A@5.1V	2.7V	2.0V
12W Charger	A1401	2.4A@5.2V	2.7V	2.7V

The 2.5W charger values are not actually found in an Apple-sold charger, but was found in third-party Apple-compatible products.  It may or may not work on an Apple device at this point, but there are chargers floating around that use those values to indicate that they are a 2.5W charger.

Building off of that and including the Battery Charging Specification Rev1.2, we can build a table of states that can identify both standard and Apple chargers. For each column in this table, if a given row is not filled, that test does not need to be done to determine whether this port is that type. For each row in this table, all filled columns' tests should be done in a left-to-right manner. The rows should be tested for from top to bottom, and the first match will be the limit used. Terms used here that have not been mentioned previously are most likely referring to the Battery Charging Specification.

Description	Allowed Current	Primary Detection, CHG_DET state	Secondary Detection, DCP_DET state	D+ Voltage	D- Voltage
Standard Downstream Port	0.1A for 45 minutes	False	-	-	Below 2.0V
Apple 12W Charger	2.4A	False	-	2.7V	2.7V
Apple 5W Charger	1A	False	-	2.0V	2.7V
Apple 10W Charger	2A	False	-	2.7V	2.0V
Apple 2.5W Charger	500mA	False	-	2.0V	2.0V
Dedicated Charging Port	At Least 500mA	True	True	-	-
Charging Downstream Port	1.5A	True	False	-	-

Note that this does NOT cover every type of charger covered in the Battery Charging Specification! These are only the states that can be tested for with only the main four USB pins, and without actually enumerating as a device. The fifth pin available on mini/micro USB ports adds a whole lot of configurability to devices that support using it, and enumerating opens up a lot of possibilities(Like the ability to be denied power), but for the purposes of my work project, this is as far as I am able to go with this.

Please be careful, especially with the SDP state! We don't want to burn up people's USB ports! Read the Battery Charging Specification for a lot more details, but this table is one that I ended up building just to double-check my program against, so hopefully someone else finds it useful.

Random Blaster from Amazon

Last week sometime, Jammer found an Amazon listing for a blaster by Simply Addictive Games, that they're calling CALL OF LIFE. It looked suspiciously similar to the Lightstrike gear of days-gone-by, and I bought a pair of them to sate my curiosity.

Advertised setup:

• 4 weapons in each blaster with different sounds/damage amounts
• 4 teams, no friendly fire
• Single sensor, facing forward

They came in today, and it really looks like this is a heavily cost-reduced version of another product, whether it was Lightstrike or something else. There's a transparent piece on the top side of the blaster where they could have put additional sensors, and a floating piece on the back of the top with a fake display that was probably originally supposed to be a real LCD.

They don't exactly promise much, but they do deliver on the features they talk about, and there's also a rumble motor that gets used when firing and I assume when you get hit that they don't mention on the Amazon listing.

Now, onto the juicy protocol details!

Despite looking suspiciously like a Lightstrike recase, it's got an incompatible protocol.

Probably a bit hard to see in there, but it looks like there's five different time increments involved in this protocol. There's a ~1.65ms SYNC pulse, and then different long and short pulses for the active and inactive side of each cycle after that. It looks like both the active and inactive sides are used for data.

SYNC: 1.65ms
Inactive short: 0.33ms
Inactive long: 0.73ms
Active short: 0.45ms
Active long: 0.85ms

I don't actually know what the tolerance of these signals is, so I'm just cutting it off at hundredths of milliseconds after averaging a bunch of the various timings I see in the signals I captured.

I'm going to assume that both of the "shorts" are 0s, and both of the "longs" are 1s.

So decoding the various shots this way, you get...

Blue team, pistol: SYNC/00000000 10101010 00000001 00000001 00000110
Blue team, shotgun: SYNC/00000000 10101010 00000001 00000010 00000111
Blue team, submachine gun: SYNC/00000000 10101010 00000001 00000010 00000111
Blue team, missile launcher: SYNC/00000000 10101010 00000001 00000011 00001000

Green team, pistol: SYNC/00000000 10101010 00000011 00000001 00001000

Red team, pistol: SYNC/00000000 10101010 00000010 00000001 00000111

White team, pistol: SYNC/00000000 10101010 00000100 00000001 00001001

I didn't do an exhaustive capture of every combination, but I think this is enough to pull out the pattern.

The 5th byte looks like a checksum. 3rd and 4th bytes added together plus 0x04 looks to match these examples. The 1st and 2nd bytes are probably just extra syncing stuff, though it's odd that they don't have any examples of the active long pulse in there for clock adjustment. 3rd byte looks to be team, 4th byte looks to be weapon type.

Seems simple enough. The high nibble of the 3rd and 4th bytes could hide more features, but I'm going to guess at the moment that they don't. Maybe at some point I'll poke at it some, and see if I can generate some oddball signatures to throw at it.