Great Scott Gadgets
Test Equipment
KiCad
Cynthion
A multi-tool for building, analyzing, and hacking USB devices
Great Scott Gadgets
Test Equipment
KiCad
Cynthion is an all-in-one tool for building, testing, monitoring, and experimenting with USB devices. Built around a unique FPGA-based architecture, Cynthion’s digital hardware can be fully customized to suit the application at hand. As a result, it can act as a High-Speed USB protocol analyzer, a USB research multi-tool, or a USB development platform.
Out-of-the-box, Cynthion acts as a USB protocol analyzer capable of capturing and analyzing traffic between a host and any Low-, Full-, or High-Speed ("USB 2.0") USB device. It works seamlessly with our open-source analysis software.
Combined with our LUNA gateware and Facedancer libraries, Cynthion becomes a versatile USB research and development tool. Facedancer makes it quick and easy to create or experiment with real USB devices—not just emulations—even if you don’t have experience with digital hardware design, HDL, or FPGA architecture!
Cynthion is a fully reconfigurable test instrument that provides all the hardware, gateware, firmware, and software you need to work with—and, indeed, to master—USB. Below are a few of the challenges to which you can apply your Cynthion:
Protocol analysis for Low-, Full-, and High- speed USB. Cynthion provides everything you need for passive USB monitoring. With our Packetry USB analysis software, Cynthion provides everything you need for passive USB monitoring.
Creating your own Low-, Full-, or High- speed USB device. LUNA provides Amaranth gateware that allows you to create USB devices in gateware, firmware, or a combination of the two. Using the Facedancer library, you can create or emulate real USB devices in high-level Python.
Meddler-in-the-Middle (MitM) attacks on USB communication. Cynthion hardware can function as a "USB proxy" capable of transparently modifying USB data as it flows between a host and a device. Each board’s three USB Type-C connections allow for simultaneous, high-speed proxying while maintaining a high-speed connection to the host. As a result, you can proxy a connection with or without the help of a host PC.
USB reverse engineering and security research. Cynthion hardware and LUNA gateware represent a purpose-built backend for research tools like Facedancer and USB-fuzzing libraries, thereby simplifying the emulation and rapid prototyping of compliant and non-compliant USB devices. Unlike other USB-emulation solutions, Cynthion-based hardware is dynamically reconfigurable, so it gives you the flexibility to create any endpoint configuration and engage in almost any USB (mis)behavior.
Cynthion includes all of the hardware necessary for low-, full-, or high-speed USB protocol analysis – which means it can provide the same core functionality as expensive commercial USB analyzers like the TotalPhase Beagle 480 or the LeCroy Mercury series.
Unlike existing USB solutions, however, Cynthion’s analyzer stack is built entirely upon powerful, open-source tooling. By leveraging the Amaranth gateware-generation library and ultra-fast open FPGA tools, you can customize Cynthion to the task at hand, which gives it access to unique features like user-defined hardware triggering and simultaneous capture of additional external or internal signals.
Cynthion uses the open-source Packetry analyzer frontend, which is a fast cross-platform tool for capturing, viewing and analyzing USB captures. Packetry helps make USB traffic more human-readable, whilst handling large high-speed captures smoothly and efficiently. Since Packetry is completely open source, you can customize it to your needs.
The Cynthion team has a long history of USB education. We’ve developed a number of open-source USB trainings at varying difficulty levels. Cynthion’s customizable architecture allows you to do more than just watch the packets fly by. Using Cynthion, you can reach out and touch USB traffic at every level. It’s a lot easier to learn how something works when you can take it apart, poke around inside it, and manipulate it in clever ways. Cynthion gives you that level of control.
Cynthion was built from the ground-up to facilitate the process of creating new USB devices. Whether you’re a veteran low-level hardware designer or completely new to this, Cynthion will make your life easier in several ways.
First of all, its Facedancer backend allows you to describe entire custom USB devices quickly, using just a few lines of Python, so you can try them out right away on real hardware. And, to help you get started, Facedancer comes with a collection of existing device templates:
# Using a Facedancer pre-made device, you can create a
# "USB rubber ducky" with only a few lines of python!
device = USBKeyboardDevice()
async def type_letters():
await device.type_string('r', modifiers=KeyboardModifiers.MOD_LEFT_META)
await asyncio.sleep(0.5)
await device.type_string('calc\n')
main(device, type_letters())
And, for those with an interest in FPGA design, the Amaranth-based LUNA gateware library makes it almost trivial to implement USB gateware. Have a look at our library of examples and start building your own gateware devices in no time!
Cynthion is as useful when working with existing USB devices as it is when designing new ones. By giving you the ability to inject or modify USB data transparently—on the fly—it allows you to do things that would otherwise be impossible. And its support for Facedancer’s USBProxy means that manipulating USB data on the wire is as easy as writing a few lines of Python:
# USBProxy makes manipulating USB data trivial!
# The following few lines are enough to flip the X-axis
# on a Nintendo-branded USB game controller:
class SwitchControllerInvertXFilter(USBProxyFilter):
def filter_in(self, ep_num, data):
# The fourth byte of our packets contains the
# joystick X position, as a number between 0 and 255.
data[3] = 0xff - data[3]
return ep_num, data
Cynthion’s USB peripherals are customized for each USBProxy application, so you’re not restricted to certain USB device configurations. It is theoretically possible to proxy just about any USB device in existence!
As a Great Scott Gadgets (GSG) product Cynthion has been designed from the beginning to enable new and innovative research, but it also supports a multitude of security and reverse-engineering applications:
yosys+nextpnr open-source FPGA flowTo protect your Cynthion while in use, you can opt for our robust milled-aluminum enclosure that completely surrounds and protects Cynthion’s electronics:
Each case has been precisely CNC-milled from solid aluminum, then anodized for a sleek, matte-black surface finish. The case design features an intricate internal pattern tailored exactly to the Cynthion it contains. This customization maximizes case density for robust protection and an unusually solid feel – without compromising Cynthion’s tiny size or light weight.
| Cynthion | Beagle USB 12 | Beagle USB 480 | USB Explorer 200 | OpenVizsla | PhyWhisperer-USB | GreatFET One | |
|---|---|---|---|---|---|---|---|
| Low-/Full-Speed Support | Y | Y | Y | Y | Y | Y | Y |
| High Speed Support | Y | N | Y | Y | Y | Y | N |
| USB Analysis Supported | Y | Y | Y | Y | Y | limited | N |
| External Buffer DRAM | Y | N | Y | Y | Y | N | N |
| Advanced Analysis Triggering | Y | N | Limited | Limited | N | Y | N |
| Supports User USB Designs | Y | N | N | N | Unofficial ¹ | Unofficial ¹ | Y |
| Facedancer Support | Y | N | N | N | N | N | Full-speed only |
| MITM Support | Y | N | N | N | N | N | Limited |
| USB Device-capable ports ² | 3 | 0 | 0 | 0 | 1 | 1 | 1 |
| USB Host-capable ports ³ | 1 | 0 | 0 | 0 | 0 | 0 | 1 |
| Target Power Control | Y | N | N | N | N | Y | Host mode only |
| Extra/User I/O | 16 (PMOD) | 0 | 4 (mini-DIN connector) | 0 | 22 (0.1" header) | 12 (CW connector) | 100 (0.1" header) |
| LEDS / Unique Colors | 11 / 9 | 1 / 1 | 3 / 2 | 3 / 1 | 3 / 2 | 5 / 3 | 4 / 2 |
| Onboard Debug Hardware ⁴ | Y | N | N | N | UART only | UART only | Y |
| Standalone Operation Capable ⁵ | Y | N | N | N | N | N | Limited |
| User-Customizable FPGA | Y | N | N | N | Y | Y | N/A |
| usbc.tf Training Materials | Y | N | N | N | N | N | Y |
| Open HW/FW/SW | Y | N | N | N | Y | Y | Y |
| Open Toolchain | Y | N | N | N | N (ISE) | N (Vivado) | Y (non-FPGA) |
| Size Equivalent | 7x7 LEGO® tile | Deck of cards | HackRF One | Two bricks | HackRF One | Deck of cards | Deck of cards |
| Cost (USD or USD equivalent) | $149 | $495 | $1,295 | $1,599 | $180 ⁶ | $250 | $89 |
¹ By replacing official gateware with LUNA’s open gateware
² Via LUNA Gateware, TinyUSB SoC, or Facedancer
³ Via FPGA Gateware
⁴ To debug USB/FPGA designs
⁵ For user gateware or firmware designs
⁶ No longer directly available (price from a third-party manufacturing the open design)
The Cynthion project—including its hardware and LUNA gateware, firmware, and software—has been developed and enhanced in the open on GitHub. You can view its annotated hardware designs on GitHub, and its documentation on Read The Docs.
We welcome questions and discussion in the Cynthion Discord Channel.
For support, please open an issue on the Cynthion repository on GitHub.
User documentation https://cynthion.readthedocs.io/en/latest/
Board schematics and design files: https://github.com/greatscottgadgets/cynthion-hardware
LUNA Gateware: https://github.com/greatscottgadgets/luna
Debugger Firmware: https://github.com/greatscottgadgets/apollo
Cynthion: https://github.com/greatscottgadgets/cynthion
LUNA: https://github.com/greatscottgadgets/luna
Facedancer: https://github.com/greatscottgadgets/facedancer
Packetry: https://github.com/greatscottgadgets/packetry
Produced by Great Scott Gadgets in Evergreen, CO.
Sold and shipped by Crowd Supply.
A Cynthion board in a beautiful, robust, CNC-milled, anodized-aluminum enclosure
A Cynthion USB multi-tool without enclosure
Great Scott Gadgets puts open source tools into the hands of innovative people. Our goal is to enable you to do things no one has done before.
