Attack of the Clones: Reverse Engineering and Fixing Knockoff FPGA USB Programmers
Doug Brown teaches us all how reverse engineering and a bit of patience can really save your wallet.
I always love a good tool hack in engineering to fix something that's broken or to repurpose something to solve a problem in a pinch. And I really love it when engineers/makers document their hacks and what they learned because it's a great way for me to learn by osmosis. The most recent example of this I have stumbled upon is Doug Brown's documentation of his journey fixing two different Altera USB Blaster devices that weren't working correctly due to being knockoff clones.
For those that are unfamiliar, the Altera USB Blaster is the USB to JTAG adapter used to program an Intel (formerly Altera) FPGA from a host PC.
So if you use an Intel/Altera FPGA in your project, you'll need a USB Blaster to program the bitstream onto it you built from your PC. Unfortunately, these USB JTAG adapters to program FPGAs can be a bit on the pricey side, especially if you only need it for a one-off project like Brown did for his HDMI lag tester project.
Looking for a cheaper alternative to the $300 OG USB Blaster, Brown found a few clone alternatives with more wallet-friendly price tags. The first of which being the Waveshare USB Blaster V2 for $34.
TL;DR, after finding that the Waveshare USB Blaster was completely incompatible with a Linux host and switching to his Windows VM, Brown found it worked perfectly only on Windows.
By looking at the USB traffic with both a USB sniffer and the JTAG clock TCK on an oscilloscope, he narrowed down the issue to the JTAG data being slightly overclocked coming out of the Waveshare USB Blaster at 6.25MHz instead of the standard 6MHz.
To prove his suspicion that this was the issue, he popped off the oscillator chip on the Waveshare USB Blaster PCB and provided a clock frequency to it manually using a Raspberry Pi Pico. Once he slowed the clock frequency of the Waveshare USB Blaster down enough, he found it worked perfectly on a Linux host OS (read his own blog posts here for the full technical details).
However, while Brown was troubleshooting the Waveshare USB Blaster, he had also ordered another clone USB Blaster to try out. This second clone came with a $9 price tag and basically said "Hold my beer" in terms of issues compared to the Waveshare USB Blaster.
While this clone simply didn't work on a Linux host OS, it blue-screened Brown's Windows host before he even had the chance to open Quartus Programmer. Other unfortunate souls in the Amazon reviews of this clone reported experiencing the same fate.
Upon cracking open this second clone device, he found it was comprised of little more than a WCH CH552G microcontroller with an extremely simplistic circuit design of a 3.3V regulator it was bootstrapped to and lazy level translation series resistors on each of the GPIO used for the JTAG interface.
Given that this clone device contained the entirety of its functionality within the firmware on the CH552G, taking data from the USB packets and converting them to the JTAG standard required by the FPGA, Brown decided to see if he could "fix" this clone with his own firmware.
By shorting the 3V3 and D+ pins on the PCB, he was able to get the CH552G into the bootloader mode and upload a customized version of the open-source CH55x-USB-Blaster firmware previously put out on Github several years ago by VladimirDuan.
Brown then decided to experiment with coding his own CPLD design for a USB Blaster from another open source deign for the FT245+CPLD Blaster that's a common setup for many clone devices. There is amazing detail and technical info about his process in his follow up blog post here.
Taking what he learned for experimenting with the CPLDs, Brown was then able to build his own version of a USB Blaster using spare parts and dev boards he had on hand using the firmware design from the open source FT245+CPLD design (see the comment in his second blog post).
What started off as a troubleshooting task, lead down a road that ultimately equipped Brown and his readers with the knowledge to build a custom USB Blaster with parts on hand if need be. Which like I mentioned in the beginning is my favorite kind of hack and Brown is a great soul for documenting this journey for the rest of us.