Didier Stevens

I discovered USB-C rechargeable batteries, and bought a set of AA and AAA batteries.

They have a USB-C connector for recharging, so you don’t need a separate charger like you do for NiMH batteries.

This post is not a full blog post, but more a collection of lab notes.

These USB-C batteries deliver 1,5 Volt (unlike NiMH batteries that deliver 1,3 Volt). And during discharge tests, I noticed that the voltage almost doesn’t change. So not only must they have battery charger electronics inside, but also converter electronics that deliver a constant voltage. Probably something like a switching-mode power supply circuit, because when I look at the ripple of the voltage with an oscilloscope, I see a pattern that makes me think of a switching-mode power supply:

That’s for a AA battery that delivers power to an electronic load that draws 0,100 A current:

The ripple could also come from the electronic load itself, or some electronic noise source in my lab. So to rule that out, I discharged an alkaline battery and got this:

This is a different pattern and it repeats with a different frequency, to the ripple we saw in the first scope picture must come from the battery.

I also did measurements with a spectrum analyzer:

Here you can see a peak (and its harmonics) around 1,20 MHz.

That too comes from the battery, as these peaks do not appear with an alkaline battery:

In the picture of the electronic load screen, one can see 1493 mWh: that’s for the discharge of an AA battery at 0,100 A until the voltage reaches 0,5 V. 1493 is far less than the 3400 mWh printed in a large font on each battery.

I did a series of tests with my AA (0,100 A discharge current) and AAA (0,025 A discharge current) batteries, and on average I get:

Unfortunately, these batteries deliver far less electrical energy than advertized.

For comparison, I also discharged an fresh alkaline AAA battery and got 1380 mWh out of it.

I created a discharge graph for a USB-C rechargeable AA battery:

During more than 9 hours, the voltage stays around 1,45 V (for a 0,100 A discharge current). Then it abruptly drops to 1,05 V, and then 0 V.

Charging the AA batteries requires 2114 mWh on average, the AAA batteries require 754 mWh. This is also far less than the advertized capacity. This allowed me to calculate the Round Trip Efficiency (RTE) in the table above.

Despite the discrepancy in capacity, these batteries have advantages too:

• the nominal voltage is 1,5 Volt
• the voltage curve remains (mostly) flat while discharging
• their chemistry doesn’t result in battery leaks that corrode your electronics
• you don’t need a battery charger

Disadvantages:

• far less capacity than advertized
• very abrupt voltage drop when fully discharged
• they can’t negotiate power with a USB charger (you can’t charge them with a USB-C to USB-C cable, you must use a USB-A to USB-C cable like the one included)
• some electronic noise because of the switching power supply

The USB Power Delivery protocol (USB PD) defines power negotiation.

For example, USB trigger boards negotiate power requirements with a USB power source (like a charger or a powerbank), and can ask for a higher voltage than the standard 5V of a USB source that does not support USB PD.

This also explains why there are (cheap) devices with a USB-C port, that can only be powered with a USB-A to USB-C cable, and not with a USB-C to USB-C cable. These devices are not capable to negotiate their power requirements, they expect 5.0 Volts on the VBUS pins. These devices do not support USB PD.

USB PD made it possible to invent all kinds of gadgets, adapters, …

One adapter I want to talk about in this blog post, allows me to charge my Philips electric razor with a USB-C powerbank.

My Philips electric razor has its own proprietary charger and connector, operating at 15 Volts. When I travel, I need to remember to bring along the charger (it does not fit in the razor’s case).

But now I have this adapter:

On one end, it has a USB-C receptacle:

And on the other end, it has the Philips proprietary razor plug.

The adapter negotiates 15 volts with the USB power source:

I didn’t know such adapters existed, but while experimenting with USB PD, I realized that it makes such adapters possible, and so I started to search and found one on AliExpress.

This allows me to travel without an extra charger, just with a very small adapter (and a USB power source).

I had to replace a button cell, a CR1225, but I only had a CR1220.

So I just used that CR1220 in stead. This works, because a CR1220 and CR1225 differ in mechanical properties (dimension), but not in electrical properties (voltage).

Both cells have a nominal voltage of 3 Volts.

CR1220 means the following:

• C: Lithium battery
• R: Round
• 12: 12mm diameter
• 20: 2,0mm thickness

The difference between a CR1220 and CR1225 is the thickness: a CR1220 is 0,5mm slimmer than a CR1225. So a CR1220 fits in a CR1225 holder without problem.

I did some tests with a Keelog keylogger, the AirDrive Forensic Keylogger: I wanted to find out how much power that keylogger requires.

This is my test setup:

1. This is the USB keyboard
2. The USB cable of the keyboard is plugged into the USB breakout board
3. This is the USB breakout board, allowing me to measure the voltage and current of the USB power lines
4. This is specialized multimeter that can measure power (by measuring voltage and current simultaneously)
5. The USB cable of the USB breakout board is plugged into a USB extension cable that is plugged into a computer

In this standby state, with all its LEDs turned of, the keyboard consumes 11 mW.

That’s not much power. Compare this with the Numlock LED turned on, and we have 4 times as much: 47 mW:

And here I have the keylogger plugged in (between the keyboard and the USB breakout board):

Now the total power measured is 383 mW: that’s for the keyboard (with LEDs turned off) and the keylogger.

That’s a huge difference with 11 mW for a keyboard without keylogger.

If this keylogger would be hidden into the keyboard, it would be easily detected using this measurement method, because this particular keyboard requires 30+ times less power than the keylogger itself.