We use the Bus Pirate to interface a new chip without writing code or creating a PCB. based on your feedback, and our experience using the original Bus Pirate to demonstrate various parts, we updated the design with new features and more affordable components.

There’s also a firmware update for both Bus Pirate hardware versions, with bug fixes, and a PC AT keyboard decoder. check out the new Hack a Day Bus Pirate page, and browse the Bus Pirate source code in our Google code SVN repository.

We cover the design updates and interface a digital to analog converter below.

Concept overview

The Bus Pirate started as a collection of code fragments we used to test new chips without limitless compile-program-run development cycles. We released it in a how-to and used it to demonstrate a bunch of serial interface ICs in our parts posts. This post introduces an updated design with new features and a bunch of improvements.

Surface mount design

Pull-up resistors on all bus lines with external voltage source

Software resettable 3.3volt and 5volt power supplies

Voltage monitoring of all power supplies

An external voltage measurement probe

Cheaper parts


Click for a full size schematic image (PNG). The circuit and PCB are created using the freeware version of Cadsoft Eagle. All the files for this project are included in the project archive linked at the end of the article.


We used a Microchip PIC24FJ64GA002 28pin SOIC microcontroller (IC1) in this project. The power pins have 0.1uF bypass capacitors to ground (C1,2). The 2.5volt internal regulator requires a 10uF tantalum capacitor (C20). The chip is programmed through a five pin header (ICSP). A 2K pull-up resistor (R1) is required for the MCLR function on pin 1. read a lot more about this chip in our PIC24F introduction.

RS-232 transceiver

An economical MAX3232CSE RS232 transceiver (IC2) interfaces the photo to a PC serial port. This chip replaces the expensive through-hole MAX3223EEPP+ used in the previous version of the Bus Pirate. The serial interface will work with a USB->serial adapter.

Bus pull-up resistors

The original Bus Pirate has 3.3volt pull-up resistors on 2 pins, but a lot of of our tests required additional external resistors. The updated design has pull-up resistors (R20-23) on the three main bus signals (data in, data out, clock) and the chip select (CS) pin.

A row of jumpers (SV5) connects each resistor to an external voltage supplied through the Vext terminal (X4). Through-hole resistors are used like jumper-wires to make the PCB much easier to etch at home.

We couldn’t find an sophisticated way to control an arbitrary voltage pull-up resistor variety from a 3.3volt microcontroller. If you have any ideas, please share them in the comments.

مزود الطاقة

VR1 is a 3.3volt supply for the microcontroller and RS232 transceiver. VR2 is a 5volt supply. Both require two 0.1uF bypass capacitors (C3-C6). J1 is a power supply jack for a common 2.1mm DC barrel plug. 7-10volts DC is probably the optimal power supply range.

The original Bus Pirate had dual power supplies, 3.3volts and 5volts, so a lot of ICs could be interfaced without an additional power supply. A major nuisance was the lack of a power reset for connected chips. If a misconfigured IC needed to be power-cycled, we had to disconnect a wire. We got so worn out of this routine that we added a software controlled reset to the updated design.

VR3 (3.3volts) and VR4 (5volts) are TI TPS796XX voltage regulators with an enable switch. A high level on pin 1 enables the regulator. A pull-down resistor (R13,R12) makes sure that the regulators are off when the photo isn’t actively driving the line, such as during power-up initialization. The datasheet specifies a large capacitor on the input (C23, C21) and output (C24, C22) pins, we used the same 10uF tantalum we use everywhere. An additional, optional, 0.1uF capacitor (C12,C11) can improve regulation.

The switchable regulators are powered by VR2, a 5volt supply.  We did this because the maximum input for VR3 and VR4 is 6volts, leaving the device with a narrow 5.2-6volt power supply range. VR2 will work well above 10volts, and supplies an appropriate supply for the other regulators.

VR3 (3.3volts) has plenty of headroom to operate from a 5volt supply. VR4 (5volts) will lose about 0.2volts, but 4.8volts remains well within the acceptable range for a lot of 5volt chips. In practice, and under light loads, we see less than 0.1volts drop-out from VR4.

Voltage monitoring

Voltage monitoring is a new feature we’re really ecstatic about. has your project ever mysteriously stopped responding because of an accidental short circuit? The Bus Pirate’s power supplies are equipped with voltage monitoring that can discover a change in power levels.

Each monitored signal is connected to an analog to digital converter (ADC) through a resistor voltage divider. two 10K resistors (R10,R11 above) divide the input voltage in half, making it possible to measure up to 6.6volts with the 3.3volt photo microcontroller.

The Bus Pirate has four voltage monitors. The 3.3volt and 5volt power supplies are monitored, as is the external voltage fed to the pull-up resistors. A fourth monitor is connected to pin 9 of the output header to make a voltage probe.


Click for a full size placement diagram (PNG). The board is a supposedly single-sided design, we etched ours in the lab on a single-sided photo-resist PCB. At the top, near C13, two jumper wires meet at a single via; we soldered one jumper wire to the other on the back of the board.

Part list




LD1117S33 3.3volt regulator (SOT223)

LD1117s50 5volt regulator (SOT223)

TPS79633 3.3volt regulator (SOT223-6)

TPS79650 5volt regulator (SOT223-6)

0.1uF capacitor (0805)

10uF tantalum capacitor (SMC A)

2000 ohm resistor (0805)

390 ohm resistor (0805)

10000 ohm resistor (0805)

2.2K–10K ohm resistor (through-hole)

LED (0805)

2.1mm power jack

screw clamp (2 terminals) *untested

db9 female serial port connector *untested

0.1″ pin header, straight

0.1″ pin header or shrouded header

0.1″ pin header, straight

البرامج الثابتة

The firmware is written in C using the complimentary demonstration version of the photo C30 compiler. learn all about working with this photo in our introduction to the photo 24F series.

The most current firmware is posted on the Hack a Day Bus Pirate page. the current source is in our Google Code SVN repository.


The diagram above shows the Bus Pirate pinout.

We made a cord with alligator clips on the end, and added labels to each wire so we don’t have to refer to this table whenever we interface a new chip.

If you know of any amazing connectors or cables, please link to them in the comments.

LTC2640 SPI digital to analog voltage converter

The Linear technology LTC2640-LZ8 is an 8bit digital to analog converter (DAC) programmed over SPI. A DAC is essentially a programmable voltage divider. They’re beneficial for recreating waveforms, such as audio signals. An 8bit DAC has 255 even intervals between 0 and the reference voltage, the L part we used has an internal 2.5volt reference.

The LTC2640 only comes in a small SOT223-8 package, so we made a breadboard adapter in the profile of a DIP-8 chip.  Our LTC2640 footprint is included in the project archive attached at the end of this article.

The schematic above shows our test circuit for the LTC2640. It requires a 2.7-5volt power supply, we used the Bus Pirate’s 3.3volt supply. C1 is a bypass capacitor between the power pin and ground. Pin 8 is an active-low reset pin, tie it high for normal operation. Pin 7 is the DAC output, connect the Bus Pirate voltage measurement probe (ADC) here.

حافلة القراصنة
LTC2640 (pin #)

SDI (3)

ساعة حائط
SCK (2)

CS/LD (1)

Vout (7)

+ 3.3Volts.
CLR (8 )

+ 3.3Volts.
VDD (5)

GND (4)

We connected the Bus Pirate to the LTC2640 as shown in the table. The LTC2640 doesn’t have a data output pin, this SPI connection remains unused.

The Bus Pirate’s hardware SPI library and software RAW3WIRE library are compatible with the LTC2640’s SPI interface. We used the SPI library; if you use the RAW3WIRE library be sure to choose normal pin output.

HIZ> م <-Select وضع 1. حيز 2. 1 سلك 3. UART. 4. I2C. 5. SPI 6. JTAG 7. RAW2WIRE 8. RAW3WIRE 9. الكمبيوتر في لوحة المفاتيح MODE>5<–SPI or RAW3WIRE وضع 900 وضع Set speed: 1. 30KHz 2. 125KHz 3. 250KHz 4. 1MHz SPEED>1 <–test at low speed ... 102 SPI READY spi>

Press M for the Bus Pirate mode menu, choose 5 for SPI mode. There are a bunch of configuration options for the SPI module, use the default options for all of them. After SPI mode is ready we need to configure the power supply.

SPI>p<–power supply setup ث / ث تبديل 3.3 فولت العرض؟ 1. لا 2. نعم MODE>2<–use 3.3volt supply ث / ث تبديل 5 فولت العرض؟ 1. لا 2. نعم MODE>1<–don’t use 5volt supply 9xx توريد تكوينها، واستخدام W / W للتبديل 9XX الجهد مراقب: 5V: 0.0 | 3.3 فولت: 0.0 | VPullup: 0.0 | spi>

p opens the Bus Pirate power supply menu. We use the 3.3volt supply but not the 5volt supply. The voltage monitor verifies that the power supplies are off.

SPI>W<–capital W (silly CSS) enables power supply 9xx 3.3VOLT supply ON SPI>v<–voltage monitor 9XX الجهد مراقب: 5V: 0.0 | 3.3V: 3.3 | VPullup: 0.0 | spi>

Capital ‘W’ enables any power supplies selected in the previous menu, a small ‘w’ disables them. V displays the supply voltage monitor, which now shows 3.3volts output from the 3.3volt supply.

Now that configuration is finished, we can send commands to the LTC2640 over the SPI bus. The LTC2640 has a 24bit (3byte) interface protocol. The first byte is a command, followed by two data bytes. The LTC2640 is available in 8,10, and 12bit versions; the 8bit version uses the first byte to set the DAC valuه، ويتجاهل البايت الثاني.

SPI> [0B00110000 255 0] <- تعيين DAC بالكامل 110 تمكين SPI CS 120 SpI اكتب: 0x30 <-WRITE DAC الأمر 120 SpI اكتب: 0xff <-Dac القيمة 120 SpI اكتب: 0x00 <- لا تهتم 140 درجة مئوية spi>

يبدأ كل أمر SPI عن طريق تمكين PIN SELECT SELECT ([). البايت الأول هو الأمر لتحديث DAC (0B00110000)، متبوعا بقيمة الإخراج (255)، والبايت الثالث الذي يتم تجاهله (0). ينتهي الأمر عن طريق تعطيل رقاقة حدد (]).

استخدمنا 8bit DAC مع 255 خطوة الجهد حتى يتم تعيين الإخراج إلى 255 هو 100٪. يمكننا استخدام مسبار الجهد القراصنة للحافلة لقياس الإخراج.

spi> d <-reasure الجهد 9xx المجاري الجهد: 2.5Volts <-Dac الإخراج spi>

د تؤدي إلى قياس الجهد. الجهد الإخراج DAC هو 100٪ (255/255) من المرجع الداخلي، 2.5Volts.

SPI> [0B00110000 0 0] D
110 تمكين SPI CS
120 SpI اكتب: 0x30 <-WRITE DAC القيادة 120 SpI اكتب: 0x00 <-Dac القيمة 120 SpI اكتب: 0x00 <- لا تهتم 140 درجة مئوية مسبار الجهد 9xx: 0.0Volts <-Dac الإخراج spi>

نفس الأمر مع قيمة DAC من 0 مخرجات 0٪ (0/255) من 2.5Volts؛ 0Volts.

SPI> [0B00110000 128 0] D
110 تمكين SPI CS
120 SpI اكتب: 0x30 <-WRITE DAC الأمر 120 SpI اكتب: 0x80 <-Dac قيمة 120 SpI اكتب: 0x00 <- لا تهتم 140 درجة مئوية مسبار الجهد 9XX: 1.2Volts <-Dac الإخراج spi>

قيمة DAC 128 حوالي 50٪ (128/255) من الجهد المرجعي، 1.2Volts.

SPI> [0b01000000 0 0] د
110 تمكين SPI CS
120 SpI اكتب: 0x40 < 120 SpI اكتب: 0x00 <- لا تهتم 120 SpI اكتب: 0x00 <- لا تهتم 140 درجة مئوية 9xx المجاري الجهد: 0.0Volts <-Dac قبالة spi>

يحتوي LTC2640 على وضع الطاقة المنخفض، حيث يتم تشغيله بواسطة الأمر 0B01000000 واثنين من بايت يتم تجاهله. بعد قيادة السلطة لأسفل يمكننا التحقق من أن هناك إخراج من DAC. اكتب أي قيمة DAC للخروج من وضع الطاقة المنخفض.

أخذها أبعد من ذلك

ما هي الخطوة التالية لقراصنة الحافلة؟ سنقوم في نهاية المطاف بتقديم تحديث نهائي للتصميم الذي يتضمن USB على ثنائي الفينيل متعدد الكلور المصنوع بشكل احترافي. مقررة مؤشر امدادات الطاقة مقررة لهذا الإصدار، ولكن لم يتم تضمينها. سيكون من المفيد أيضا الحصول على موصل لوحة المفاتيح لتصحيح الأخطاء بدون جهاز كمبيوتر. تحقق من خارطة الطريق ويشملها في الاختراق صفحة القراصنة في حافلة اليوم.

تحميل: buspirate.v1a.zip.

Leave a Reply

Your email address will not be published. Required fields are marked *