Title: Hacking the STM32 Inside Your USB Charger: A Teardown Tale with SurprisesPosted: May 2025 | By: ChatGPT Contributor
Sometimes the most interesting hardware isn’t in your junk drawer—it’s still plugged into the wall. That’s exactly what [Sam K.] discovered last month when a routine teardown of a generic 65W GaN USB-C charger turned into a full-on reverse engineering rabbit hole. While modern USB-C power delivery bricks often hide sophisticated circuitry, this one had a secret: a full STM32 microcontroller buried under a glob-top of epoxy.We’re used to seeing fixed-function ICs or purpose-built PD controllers in these chargers, but this one was running an STM32F030, a budget ARM Cortex-M0 part more common in hobby projects than power bricks. What was it doing in a consumer-grade power supply? Sam had to find out.
Getting Under the Hood
The teardown started predictably enough—pop open the ultrasonic-welded case, desolder the input board, and inspect the high-voltage side. The charger uses a typical GaN topology with a QR flyback controller, a synchronous rectifier, and a compact transformer. But the secondary side was the real story: a small MCU, a PD controller, and what looked like I2C-accessible current sense ICs.Decapping the epoxy revealed the unmistakable pinout of a 32-pin STM32. Sam probed the UART lines and dumped the firmware using SWD. Surprisingly, the firmware wasn’t locked. A quick disassembly showed that the chip wasn’t just controlling the PD negotiation—it was running a real-time PID loop to dynamically adjust the flyback output based on load transients. That’s rare in low-cost chargers and something we typically see in higher-end modular supplies.
Real-Time Feedback and Telemetry
The STM32 was communicating with both the PD controller and the power stage over I2C and GPIOs. One clever bit: the microcontroller read input voltage, output current, and transformer temperature in real time, adjusting PWM control signals accordingly. It even had routines for adjusting USB PD profiles on the fly, enabling things like Apple Fast Charge and Samsung AFC dynamically based on device identification.Sam also noticed that the firmware included telemetry logging features. These aren’t exposed to the user but seem designed for factory diagnostics or possibly OEM analytics. That’s a little spooky—imagine your charger logging performance data every time you top up your phone.
Hacking Potential
With the firmware in hand and full access to the SWD port, Sam recompiled a modified binary that spoofed PD profiles to force 20V output regardless of the connected load—something that's potentially dangerous but illustrative of the controller’s flexibility. The project is a powerful reminder: what looks like a dumb black box can be a full-featured microcontroller system with real-time controls and updateable firmware.
Lessons Learned
Modern USB-C power supplies are more than just high-efficiency bricks—they’re smart devices with embedded firmware, real-time feedback, and lots of hacking potential. Whether for performance tuning, safety testing, or just curiosity, cracking them open can reveal much more than expected.If you've got a USB-C charger collecting dust—or in your wall—you might be sitting on an STM32-powered goldmine.