USB Hacking – Reverse Engineering the Aaronia BPSG 6 Signal Generator

Introduction

This project aims to reverse engineer the USB communication protocol of the Aaronia BPSG 6 RF signal generator, a professional device covering the 23.5 MHz - 6 GHz range. The manufacturer provides no API documentation, and its proprietary software is limited to graphical platforms, making it unusable on embedded systems like the Raspberry Pi.

The generator is composed of:

• A MAX2870 Phase-Locked Loop (PLL): generates the desired RF frequency via configurable registers.
• A gain control module: adjusts the RF output power (encoding not documented yet).
• A USB HID communication interface: allows device control from a computer without proprietary drivers.

Our open-source solution enables (partial) control via USB in Python, including:

• Precise frequency tuning (Integer-N and Fractional-N modes)
• Headless operation (SSH, automated scripts)

Warning: Gain control is not functional at this stage. The exact relationship between the gain command and the end of the USB frame remains to be determined. The project is ongoing and not finalized.

Reverse Engineering Methodology

1. Device Identification

• Tools: lsusb, dmesg, usbmon
• Identifiers:
  • Vendor ID: 0x04d8
  • Product ID: 0xf3b5
• Type: HID (Human Interface Device), allowing native compatibility without specific drivers.

2. USB Frame Capture and Analysis

• Tools: Wireshark with targeted filters (e.g., usb.bus_id == 1 && usb.device.address == 10)
• Frame Structure:

  [12-byte header] | [SPI registers (24 bytes)] | [Gain command (approx. 5 bytes?)] | [Padding]
  

  • Header: Constant for a given model (e.g., 19 03 04 05 06 07 08 ff 00 00 00 00)
  • SPI Registers: Configuration of the MAX2870 PLL (6 registers of 4 bytes in little-endian)
  • Gain Command: Bytes modified when adjusting output power (relationship not understood yet)

3. Decoding the MAX2870 PLL

The frequency is generated by a MAX2870 PLL, configured via 6 registers:

• Register 0: Mode (Integer/Fractional-N), N and F values
• Register 1: Charge Pump parameters and modulus (M)
• Register 4: Output divider (DIVA) and RF power

Example calculation for 2 GHz:

f_out = 2000e6  # 2 GHz
registers = generate_spi_registers(f_out, int_n=False)
# Output: ['80003200', '42E80019', 'C0400C93', '00000013', '630000E4', '00040000']

Implemented Features

Frequency Control

• Supports Integer-N (stability) and Fractional-N (precision) modes
• Automatic calculation of PLL parameters (N, F, DIVA) via generate_spi_registers()
• Coverage: 23.5 MHz - 6 GHz with <1 Hz resolution

Current Limitations

• Gain control is not operational: the USB frame section corresponding to gain is not understood, and no reliable relationship has been found so far.
• The project is ongoing: any contribution or further analysis is welcome to help progress on frame understanding.

Usage Example

# Generate a 1.5 GHz signal (gain parameter is ignored)
python send_trame_usb.py 1500

Project Structure

The repository is organized as follows:

.
├── generate_spi.py            # SPI register generation for the MAX2870 PLL
├── send_trame_usb.py          # USB frame construction and display (frequency/gain)
├── usb.py                     # Actually sends a USB frame to the device via HID
├── little_endian_convert.py   # Tool to convert registers between little/big endian formats
├── trame.txt                  # Example captured frames (Wireshark, reverse engineering)
├── TRAMES.md                  # Detailed documentation of MAX2870 registers
├── docs/                      # Screenshots, diagrams, additional resources
└── README.md                  # This document

• generate_spi.py: Computes the register values needed to obtain the desired frequency.
• send_trame_usb.py: Assembles the complete frame to send (frequency, gain, padding) and displays it in hexadecimal.
• usb.py: Sends a raw frame to the device via the HID protocol.
• little_endian_convert.py: Utility for manipulating register byte formats.
• trame.txt: Lists real frames for comparative analysis.
• TRAMES.md: Complete reference for MAX2870 registers and their meaning.
• docs/: Folder for any visual or technical supplementary resources.

Results and Perspectives

Achievements

• Full frequency control via USB
• Compatible with Linux/ARM (Raspberry Pi)
• Lightweight solution (<100 lines of Python code)

Limitations

• Gain control not functional (relationship to be determined in the frame)
• Lack of precise calibration for output power

Next Steps

• Determine the exact relationship between the gain command and the end of the USB frame
• Complete decoding of gain control through statistical analysis
• Web interface for remote control
• Integration with GNU Radio for SDR applications

---

Project by Bosco de Rauglaudre & Yanis Bouzidi - BUT GEII 2024/2025