Stealth USB CapsLocker

* Source code and Eagle PCB files: CapsLockerPCB&Code.zip *

Just in time for April Fool's Day! I built a device that has the potential to drive a computer user insane.


This device plugs into a USB port and implements a USB HID keyboard. Instead of doing anything useful, it waits between 30 seconds and 8 minutes and sends the scancode for the Caps Lock key. This will toggle the Caps Lock status on or off. Since the operating system controls the LED on the keyboard, the Caps Lock light also toggles. This makes it appear the user has accidentally pressed the Caps Lock key...until it happens 20 or 30 times and they get suspicious. Then they might see the Caps Lock light turn on by itself. Next is a sequence of reboots, bashing the keyboard on the desk, clicking through the Control Panel, possibly even replacing the keyboard. Unless they notice the tiny little device sitting in one of the USB ports on the back of their computer, nothing will help.

Disclaimer: This device provides keyboard input to a computing device outside of user control. It is intended for experimentation and demonstration purposes only. It should never be used in a situation that can result in loss of data, property, or finances. It should never be used in a situation that could cause harm to a person via operation or failure. Usage of this device is beyond my control and I am not responsible for any damages resulting.

 

The CapsLocker was built on an Atmel AVR ATTiny45, and heavily based on the EasyLogger application from ObDev. Very little code modification was necessary to get the random Caps Lock activation working.

This is a single-sided PCB with a couple of jumper wires for simplicity. If I had decided to use the test clips from the beginning, the jumper wires would be unnecessary.


Here are some additional photos showing the installed device and heatshrink over the part that extends from the USB port.



Some have commented on the apparently dirtiness/hairyness of my computer. It really doesn't look that bad until you get up close and use a camera flash. That particular computer has been sitting in the same place on the floor for a year or two, so dust does accumulate. It's probably time to find the vacuum cleaner attachment kit.

Adapter used for programming the device over ISP:


ISP programming adapter

 

Updates:

Since using test clips directly to the ATTiny45 leads was working fine, I modifed the PCB design so that no jumper wires are required. The size remains the same. Here's the new design:


And here's the schematic:


 

The PCB and schematic were created in Cadsoft Eagle. Here is a zip file containing the Eagle project file, schematic, PCB, and a tiled PCB:

CapsLocker.zip

I've created a tiled set of PCBs. This is handy when using the toner transfer method of etching, or when creating more than one device. Here is a PDF of tiled arrangement, already mirrored so that it is ready to print for toner transfer:

capslockerpcb_tiled.pdf

 

Parts List:

 

Construction:

Print the mirrored PCB on glossy photo paper and trim to the size needed. Iron onto freshly-scoured copper clad until firmly attached. Soak at least 30 minutes in water, then carefully peel off the paper. Fibers will still be attached, rub these off with fingers or a soft toothbrush.

Place board in etching solution until all exposed copper is gone. Use solvent such as acetone to scrub off the toner. Use PCB shear or diamond cutoff wheel to cut board to edge of dotted line around PCB.

Solder parts onto PCB. It may also help to tin the USB pads, to prevent connection problems due to oxidation. We're not going to be using gold plate, so solder will have to do.

Commenter "Stev" says:

I just started putting mine together and wanted to add to your section on etching & soldering. If you coat the PCB with a clear Acrylic spray paint after removing the toner it will act as a sealant to protect the copper from oxidation. You'll still need to tin the USB connection pins, but the other traces will be protected. It will also act as a flux to prevent solder crossover to adjacent pins.

Trim piece of plastic to size of PCB and super glue to the bottom side. Important: make sure the plastic shim is wide enough to prevent the PCB from sliding sideways in a USB port...test it. The required thickness of the plastic will also depend on your PCB thickness. The total thickness at the USB connector should be just under 2.0mm or 0.079 inches; trim or sand the plastic to match. Too thick may break the computer's USB connector, too thin may not allow a good connection.

Using reference from AVR ISP connector pinouts and the pin names on the schematic, find a way to connect an ISP header to the PCB temporarily. My solution involved a USB jack and two fine-tipped test clips. Other possible solutions may involve a jig with spring pins, kynar wire temporarily soldered to the right locations, or a clip that fits over the SOIC8 on the PCB. All of the above eventually must connect to an AVR ISP header, and this must be connected to a PC through an AVR ISP adapter. These are inexpensive and available from several sources: USBTinyISP, AVRISP, AVR Dragon, and many more Google can tell you about.

Download capslocker.hex and use AVR Studio or a standalone programming tool to write into the ATTiny45 Flash. Oh, you'll also need to select the fuse for PLL/1k clock source.

If you want to see and/or modify the source code, here it is: CapsLockerPCB&Code.zip

The ZIP file above contains the PCB, schematic, and C source code. It is based on the latest version of the EasyLogger code. I've imported everything into an AVR Studio project, but it can be compiled with standard GCC tools that have ATTiny45 support. I have trimmed out the portions of code that were not necessary in this application, and added the modifications required to press the Caps Lock key at random intervals (psuedorandom, the same pattern will occur on every powerup). As the code will make evident, the Objective Development software USB library makes it extremely simple to create a USB device.

 

Future development:

Develop firmware that allows switching between mouse and keyboard, user selectable pools of keypress options, phrases, timing configuration, etc. All controlled via Control reports from an application on a PC. Device would wait for 15 seconds after being plugged in, and begin normal operation if the configuration application did not contact it during the startup time.

Now that the Stumblepede is mostly over, I'm going to trim out some of the less-relevant comments below. Your humor was appreciated. :)


Submitted by Garrett on Thu, 04/03/2008 - 16:02.

"The policemen pushed him

"The policemen pushed him out of the way and got on with their work. Three men with spraying machines buckled to their shoulders pumped thick clouds of soma vapour into the air."

Aldous Huxley, Brave New World (1932)

http://www.huxley.net/soma/somaquote.html

... Goodness, that's mean!

... Goodness, that's mean!

what i want to know, is this

what i want to know, is this compatible with the attiny13? if so, im going to make one, since i have loads of those lying around :D

In timerPoll(void) where did

In timerPoll(void) where did you get this from

TimerDelay = 2835 + rand(); /* 1/63s * 63 * 30 + 0...32767 */

Where exactly do you get 2835? Your comment and value don't make sense.

I am newby at AVR and

I am newby at AVR and because i couldn't find an ATTINY45 i used an ATMEGA128 to test and practice with the code provided at CAPSLOCK project http://macetech.com/blog/?q=node/46. I used port D 2 for usb D- and port D 0 for usb D+ clocked into usbconfig.h with a 16MHz ceramic resonator the fuses WDTON 1,OCNED 1,JTAGEN 0,CKOPT 0, EESAVE 1, BOOTSZ1-2 0, BOOTRST 1, BODLEVEL 0, BOTEN 0, SUT1 1, SUT0 0, and all CKEL 1, initially the communication was not possible and was getting the message unknown device. after i solder into the interface circuit the 3V6 zeners all gone perfect. one more note for the timer TCCR1 use a 16bit value because for atmega128 this timer is 16bit.

I loved the project and the code :D excellent !!!

Hi, I am trying the same

Hi,
I am trying the same code of CAPSLOCK with ATmega128, where you succesful. please let me know .Thanks in advance,
Regards,
Lucky

I did make 1 PCB as yours ,

I did make 1 PCB as yours , but , It didn't work , my PC (windows) didn't redcognize it , I set fuse to PLL 1k , could you help me ?

hey, i just build one,

hey, i just build one, programmed it, and now it sticks into this laptop im using atm, but i was wondering, how can i check if it works? yeah, when caps lock turns on, but how (+-) will it take till the first one?

and is there any other way?

It's a really great and

It's a really great and useful device :)
I changed the firmware a little bit, so it sends every 5 minutes a 'Left-Shift-Pressed' report to the system. It's enough to fool the screen saver.

I made a useful variation

I made a useful variation that double taps the Scroll Lock every couple of minutes to keep the work PC from logging off. The demand is hard to keep up with.

Thanks so much for sharing...

nice :)

nice :)

I have just rebuilt this

I have just rebuilt this with a PIC10F200... It only sticks out of the USB port by 8mm !!

I have also added a buzzer to the circuit, so i can randomly make it go beep. lol joyturk

Thanks for the idea! ;)

Great article !

Great article !

Better would be to make it

Better would be to make it into an 8 pin usb header plug and stick it in the case

Forget the juvenile

Forget the juvenile practical jokes.

Add a button for activation and program it to send CTRL-ALT-DEL when pressed.

Sell it on ebay.

Would finally resolve the "security issue" where you cannot unlock a Windows 7 touch using the on-screen keyboard. (By Microsoft Design)

When they are available I will buy 6 to start.