Jump to content

[Question] Ducky as a plain old USB drive

Go to solution Solved by no42,

Recommended Posts

When no payload is loaded how well does the Ducky work as a USB drive when paired with a good MicroSD card? I like to carry as little crap as I have to and was wondering what the read/write speeds were for the Ducky and a good card? Is the microcontroller involved at all when doing simple transfers?

Link to comment
Share on other sites

I understand how to test the read/write speeds but I do not yet own a Ducky making it very difficult for me to do these tests myself.

Hopefully you have one on the way. Although I'm not sure of your concern for transfer speeds when you don't currently have a ducky and it's the same size as a typical flash drive that you can put on a keychain. Maybe someone with a ducky can shed some light on their experiences.

Link to comment
Share on other sites

Tricky, I dont have the facilities to practically test the speed today. But in theory:

The SPI uses a 12 MHz clock (from conf_sd_mmc.conf) <- this is the limiting factor (as USB should support a maximum of 12Mbps)

People from AVRfreaks claim 340 KBytes/sec for writing a 100 MB file.

Hope this helps.


Link to comment
Share on other sites

  • Solution

OK, Initial speed test using HS2testW (http://www.heise.de/download/h2testw.html) using the default sdcard that came with the Ducky.

Has put the Ducky's write/read speed at an average of 88KB/s (surprisingly slow)

After liaising with Atmel Tech Support, today I have almost doubled this speed to 155KB/s, and this is as far as I have got.

It means playing around with all the clocks - its quite tricky (doesn't help that all their examples are tied down to 12MHz), its a bit of trial and error to raise the Ducky's speed.

Turns out everything they publish is using 12MHz even though the chip supports a maximum of 60MHz.


Cant get it any faster at the moment.

Version 2.1 of Twin_Duck & USB_Duck have been uploaded to Ducky Decode, so you can test the latest version improvements.


Wont reach SD speeds (2MB+) as its proprietary (ie licensing and membership - $2000+ per year, correct me if I'm wrong?)

either way to keep costs low :) this is all open source/freeware

Edited by midnitesnake
Link to comment
Share on other sites

  • 3 weeks later...

This is what Atmel gave me:

You can increase the CPU frequency. UC3B supports maximum of 60MHz. Please refer section “28.6 System Clock Characteristics” in the device datasheet for more details.

With PLL we can generate higher frequencies. Please refer section “9.5.4 PLL operation” for details on its functionality.

You can also refer to the example projects “PM-Example2 – EVK1101” in ASF for configuration details.


1)Using common clock service from ASF

If you are using common clock services from ASF, the clock should be configured in “conf_clock.h” file in src/config. In main function, calling “sysclk_init()” will do the initialization based on the configuration in conf_clock.h.

The following are the excerpt from conf_clock.h that are responsible for main clock confuiguration ,for your convenience

//configure the source clock as PLL0


// ===== PLL Options

//set OSC0 as source for PLL0


//set MUL = 11 and DIV =2 so the freq= (OSC0_freq * MUL)/DIV

#define CONFIG_PLL0_MUL 11 /* Fpll = (Fclk * PLL_mul) / PLL_div */

#define CONFIG_PLL0_DIV 2 /* Fpll = (Fclk * PLL_mul) / PLL_div */

//the fowlloing are to configure different bus clock frequencies

// ===== System Clock Bus Division Options

#define CONFIG_SYSCLK_CPU_DIV 0 /* Fcpu = Fsys/(2 ^ CPU_div) */

#define CONFIG_SYSCLK_PBA_DIV 0 /* Fpba = Fsys/(2 ^ PBA_div) */

#define CONFIG_SYSCLK_PBB_DIV 0 /* Fpbb = Fsys/(2 ^ PBB_div) */

Calling sysclk_init() in main will initialize the clock accordingly. Please refer “Common API for Clocks Control Example 1, 2 and 3 for EVK1101” from ASF.

2)Using PM driver APIs

You can also directly call functions from PM driver. Please refer PM Example for the same.

The following are the excerpt from the same which corresponds to clock configuration part alone.

volatile avr32_pm_t* pm = &AVR32_PM;

/* \note All calculations here suppose that the Osc0 frequency is 12MHz. */

pm_switch_to_osc0(pm, FOSC0, OSC0_STARTUP); // Switch main clock to Osc0.

/* Setup PLL0 on Osc0, mul=7 ,no divisor, lockcount=16, ie. 12Mhzx8 = 96MHz output */

/*void pm_pll_setup(volatile avr32_pm_t* pm,

unsigned int pll,

unsigned int mul,

unsigned int div,

unsigned int osc,

unsigned int lockcount) {



0, // use PLL0

7, // MUL=7 in the formula

1, // DIV=1 in the formula

0, // Sel Osc0/PLL0 or Osc1/PLL1

16); // lockcount in main clock for the PLL wait lock


This function will set a PLL option.

*pm Base address of the Power Manager (i.e. &AVR32_PM)

pll PLL number 0

pll_freq Set to 1 for VCO frequency range 80-180MHz, set to 0 for VCO frequency range 160-240Mhz.

pll_div2 Divide the PLL output frequency by 2 (this settings does not change the FVCO value)

pll_wbwdisable 1 Disable the Wide-Bandith Mode (Wide-Bandwith mode allow a faster startup time and out-of-lock time). 0 to enable the Wide-Bandith Mode.


/* PLL output VCO frequency is 96MHz. We divide it by 2 with the pll_div2=1. This enable to get later main clock to 48MHz */

pm_pll_set_option(pm, 0, 1, 1, 0);

/* Enable PLL0 */


void pm_pll_enable(volatile avr32_pm_t* pm,

unsigned int pll) {



/* Wait for PLL0 locked */

pm_wait_for_pll0_locked(pm) ;

/* Divide PBA clock by 2 from main clock (PBA clock = 48MHz/2 = 24MHz).

Peripheral Bus A clock divisor enable = 1

Peripheral Bus A select = 0

Peripheral Bus B clock divisor enable = 0

Peripheral Bus B select = 0

High Speed Bus clock divisor enable = 0

High Speed Bus select = 0


pm_cksel(pm, 1, 0, 0, 0, 0, 0);

// Set one wait-state (WS) for flash controller. 0 WS access is up to 30MHz for HSB/CPU clock.

// As we want to have 48MHz on HSB/CPU clock, we need to set 1 WS on flash controller.


pm_switch_to_clock(pm, AVR32_PM_MCSEL_PLL0); /* Switch main clock to 48MHz */

I know your proficient at reading and modifying the code, and you appear to have more development time than me at the moment.

I challenge you to do better than my improvements!

You can either give a man a fish for a day, or give him a rod and teach him to fish for life...

Edited by midnitesnake
Link to comment
Share on other sites

OK, so 407 (on that test, which was chosen to test something else, so was in my .bash_history, the read speed is better if you are doing longer reads) is where the clocks seem to make no difference (running the processor at 60 vs 48 MHz made no difference) when using the stock USB MSC example from ASF 3.5.0 for EVK1101 (the closest example board they have to the ducky). Also, the USBCLK must be set to exactly 48MHz, which wasnt in datasheet, but in source comments...

Now the real work of porting over my anti-forensics stuff to the 3.5.0 codebase begins (and it should be able to do better since the CPU speed isnt the limiting factor anymore)

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...