4 layers85 × 55 mm
Device
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
29 parts2
4 layers130 × 72 mm
Device
jayis1/hacker-devices2Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
- Size
- 130 × 72 mm
- Copper layers
- 4
- Thickness
- 1.6 mm
- Parts
- 13
- Nets
- 15
- Pads
- 55
- Tracks, vias
- 12, 0
- Routed
- Yes
- KiCad
- KiCad 8 (file 20240108)
- Created
- 12 Jun 2026
- Updated
- 6 Nov 2026
Overview
Device is an open-source printed circuit board by jayis1, from the jayis1/hacker-devices repository on GitHub. It is a 4-layer board of 130 × 72 mm with 13 parts on 15 nets, routed with 12 tracks and 0 vias.
It is built around the STM32H563ZIT6, ICE40UP5K-SG48I and TPS62172DSG, with the SN74AXC4T245PW and TMUX1574PW among its other parts. Its parts include 8 ICs, 3 connectors and 2 switches. It belongs with the STM32 and FPGA and CPLD boards of this library.
Main components
5
STM32H563ZIT6
LQFP-144(20x20)-40℃~+85℃ 1.71V~3.6V 110 250MHz 2MB 32 Bit 640KB ARM Cortex-M33 Built-in+External FLASH LQFP-144(20x20) Microcontrollers (MCU/MPU/SOC) ROHSSTMicroelectronicsMicrocontrollers (MCU/MPU/SOC)
ICE40UP5K-SG48I
QFN-48-EP(7x7)-40℃~+100℃ 1.14V~1.26V 1171456bit 39 5280 660 iCE40 UltraPlus QFN-48-EP(7x7) Programmable Logic Device (CPLDs/FPGAs) ROHSLatticeProgrammable Logic Device (CPLDs/FPGAs)
TPS62172DSG
WSON-8-EP(2x2)-40℃~+85℃@(TA) 1 17uA 2.25MHz 3.3V 3V~17V 500mA Buck Built-in Fixed Overcurrent Protection、Light load efficient mode、Operating status indication Step-down type Yes WSON-8-EP(2x2) DC-DC Converters ROHSTexas InstrumentsDC-DC Converters
SN74AXC4T245PW
TSSOP-16-40℃~+125℃ 2 2 380Mbps 650mV~3.6V 650mV~3.6V Power-Off Protection Tri-State TSSOP-16 Translators, Level Shifters ROHSTexas InstrumentsTranslators, Level ShiftersTMUX1574PW
TSSOP-16-40℃~+125℃ 1.5V~5.5V 2:1 2GHz 2Ω 3.5pC 35ns 4 7.5pF 95ns 95ps Bidirectional analog channel、Fault protection、Power-off isolation、Fail-safe disconnect TSSOP-16 Analog Switches, Multiplexers ROHSTexas InstrumentsAnalog Switches, Multiplexers
README
README.mdHacker Devices — Open Hardware for Security Research
A collection of fully open-source hardware designs for legitimate security research and pentesting. Every device is complete end-to-end: engineering docs, KiCad schematics & PCB layouts, production C/Python firmware, and React Native companion apps. Build it, flash it, run the app, start researching.
What's Inside Every Device
No half-finished reference designs. Each device folder contains the full stack:
| Category | Files | Description |
|---|---|---|
| Engineering Docs | phase1_conceptual_architecture.md → phase4_software_stack.md | 4-phase design process: requirements, BOM & netlists, PCB layout rules, software stack |
| KiCad Schematics | kicad/*.kicad_pro, *.kicad_sch, *.kicad_pcb | Full schematic with real component symbols, net labels, power flags, and board outline with placed footprints |
| C/Python Firmware | firmware/main.c, registers.h, board.h, drivers/, Makefile | Production-quality MCU firmware — init code, drivers with DMA, USB descriptors, wire protocol |
| React Native App | app/App.js, screens/, components/, utils/protocol.js, package.json | Companion mobile app for device control, configuration, real-time status, and data capture |
Design Methodology
Every device follows a rigorous 4-phase process:
| Phase | Document | Contents |
|---|---|---|
| Phase 1 | phase1_conceptual_architecture.md | Purpose, performance targets, constraints, block diagram, bus topology, power domains |
| Phase 2 | phase2_component_selection_schematics.md | BOM with real part numbers, pinouts/MUX tables, decoupling networks, netlists, impedance matching |
| Phase 3 | phase3_pcb_blueprints_layout.md | PCB stackup, routing rules, length matching, via strategy, thermal management, DFM notes |
| Phase 4 | phase4_software_stack.md | MMIO/register defs, clock & GPIO init (production C), critical device driver, device tree, bootloader |
Devices
| # | Device | Status | Description |
|---|---|---|---|
| 1 | wifi-pentest-dongle/ | ✅ Complete | 802.11ax monitor/inject, deauth, PMKID capture |
| 2 | rf-transceiver-tool/ | ✅ Complete | Sub-GHz + 2.4GHz multi-protocol (CC1101 + nRF24) |
| 3 | badusb-injector | ⏳ Queued | HID emulation payload injector, multi-profile |
| 4 | nfc-rfid-cloner | ⏳ Queued | 13.56MHz + 125kHz, Mifare/EM4100 |
| 5 | network-tap-mitm | ⏳ Queued | 2× GbE transparent bridge, packet capture |
| 6 | can-bus-analyzer | ⏳ Queued | OBD-II + CAN-FD, automotive pentest |
| 7 | sdr-keyfob-replay | ⏳ Queued | 433/315MHz keyfob capture & replay |
| 8 | ble-sniffer-spoofer | ⏳ Queued | nRF52, advertisement inject, GATT fuzz |
| 9 | imsi-catcher-detector | ⏳ Queued | LTE/4G SDR analysis |
| 10 | biometric-bypass-toolkit | ⏳ Queued | Fingerprint emulation, RFID clone for access control |
Constraints
- BOM target: Under $100 per device
- Form factor: Portable, USB-powered or battery-operated
- All designs use real, purchasable components with exact part numbers
- KiCad schematics are valid KiCad 7+ format — open them directly
- Firmware is production-quality C — not stubs or pseudocode
- React Native apps have working UI with proper state management and wire protocol matching the firmware
License
| Component | License |
|---|---|
| Hardware design (KiCad) | CERN-OHL-S v2 |
| C firmware & drivers | GPL-2.0 |
| Python tools & scripts | MIT |
| React Native companion apps | MIT |
Parts
13| Qty | Value | Footprint | References |
|---|---|---|---|
| 1 | ADS7042 | Package_DFN_QFN:WSON-8-1EP_2x2mm_P0.5mm_EP0.6x1.2mm | U7 |
| 1 | ATECC608B | Package_SO:SOIC-8_3.9x4.9mm_P1.27mm | U6 |
| 1 | FAIL-SAFE BYPASS | Relay_SMD:Relay_DPDT_Omron_G6K-2F-Y | K1 |
| 1 | HOST PDM | Connector_FFC-FPC:TE_1-1734592-0_1x10-1MP_P0.5mm_Horizontal | J1 |
| 1 | MIC PDM | Connector_FFC-FPC:TE_1-1734592-0_1x10-1MP_P0.5mm_Horizontal | J2 |
| 1 | MX25L12835F | Package_SO:SOIC-8_5.23x5.23mm_P1.27mm | U5 |
| 1 | PHYSICAL ARM | Button_Switch_SMD:SW_SPST_TL3301AN | SW1 |
| 1 | SN74AXC4T245 | Package_DFN_QFN:UQFN-14-1EP_3.5x2.5mm_P0.5mm_EP0.6x2.6mm | U3 |
| 1 | STM32H563ZIT6 | Package_QFP:LQFP-144_20x20mm_P0.5mm | U1 |
| 1 | TMUX1574 | Package_DFN_QFN:WQFN-16-1EP_3x3mm_P0.5mm_EP1.75x1.75mm | U4 |
| 1 | TPS62172 | Package_DFN_QFN:WSON-8-1EP_2x2mm_P0.5mm_EP0.6x1.2mm | U8 |
| 1 | USB-C | Connector_USB:USB_C_Receptacle_GCT_USB4105-xx-A_16P_TopMnt_Horizontal | J3 |
| 1 | iCE40UP5K-SG48 | Package_BGA:ucBGA-48_3.0x3.0mm_Layout6x8_P0.4mm | U2 |
Questions
How big is the Device PCB?
It measures 130 × 72 mm and has 4 copper layers, 1.6 mm thick.
What parts does the Device use?
13 parts, built around the STM32H563ZIT6, ICE40UP5K-SG48I, TPS62172DSG and SN74AXC4T245PW. The full list of its parts is on this page, with links to each part's symbol and footprint where PCBKit's library has them.
Where can I download the Device KiCad files?
From the jayis1/hacker-devices repository on GitHub, at the commit this page was made from: the board is pdm-trust-probe/kicad/device.kicad_pcb. PCBKit opens the board in the browser, with nothing to install.
Can I use the Device design in my own project?
Its repository states no licence, so its author keeps all rights: ask jayis1 before reusing the design.
More from jayis1/hacker-devices
12- 70 × 40 mm
Silent symphony
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
27 parts2 - 4 layers65 × 30 mm
Chronos phantom
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
26 parts2 - 4 layers70 × 45 mm
Device
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
25 parts2 - 4 layers85 × 24 mm
Trace reaper
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
24 parts2 - 4 layers86 × 55 mm
Device
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
22 parts2 - 4 layers120 × 22 mm
Acoustic phantom
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
20 parts2 - 4 layers80 × 40 mm
Device
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
20 parts2 - 4 layers85 × 54 mm
Rf transceiver tool
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
20 parts2 - 2 layers118 × 68 mm
Device
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
19 parts2 - 4 layers50 × 24 mm
Ghostbus
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
18 parts2 - 4 layers22 × 18 mm
Device
jayis1/hacker-devices
Full-cycle hardware designs for security research devices — each device is a subfolder with its own README, schematics, PCB layout, and software stack
18 parts2
Similar boards
- 8 layers125 × 100 mm
- 6 layers138 × 50 mm
- 2 layers65 × 56 mm
Raspberry pi adapter
NightLaneOrg/nr-si468x-dev
Si468x-based DAB/FM receiver module (M.2 E-Key) with open hardware and Linux integration.
17 parts4GPL-3.0 - 4 layers80 × 73.8 mm
ESP32-Bit Pirate Dock
AndreiVladescu/ESP32-Bit-Pirate-Hardware
Carrier breaker-board for the ESP32-S3 Devkit. Works great with the ESP32-Bit-Pirate firmware.
49 parts85CERN-OHL-W-2.0 - 2 layers109.5 × 51 mm
CANBOB (MAGE CANBOB-003)
Mage-Control-Systems-Ltd/CANBOB
A breakout board that enables USB or SPI to CAN communication using the MCP2515.
98 parts8CC-BY-4.0 - 4 layers65 × 56.5 mm
QSPIBuddy
Manawyrm/QSPIBuddy
SPI NOR Flash mux - Raspberry Pi for embedded firmware development - Mux between DUT and Flasher
46 parts4MIT - 4 layers65 × 40 mm
Usb passthrough
fgihl/usb-c-passthrough
A USB 2.0 (480 Mbit/s) passthrough board that can electrically "unplug" a USB connection under software control — used for Hardware-in-the-Loop (HIL) testing.
57 parts2MIT - 6 layers100.1 × 112 mm
Picones
WiiMake/picones
In the last 40 years, technology has advanced to the point were what used to be done in hardware can now be done in software. This project uses an rp2350 to emulate a ROM chip on an NES Cartridge.
59 parts1