• Out-of-Stock
Screamer M.2 USB-C (R04)
  • Screamer M.2 USB-C (R04)
  • Screamer M.2 USB-C (R04)
  • Screamer M.2 USB-C (R04)
  • Screamer M.2 USB-C (R04)
  • Screamer M.2 USB-C (R04)
  • Screamer M.2 USB-C (R04)
  • Screamer M.2 USB-C (R04)

Screamer M.2 USB-C (R04)


Check out the alternative PCIe version: Screamer PCIe USB-C (R04)

Screamer M.2 USB-C (R04) brings USB-C 3.1 connectivity to our successful Screamer M.2 board while keeping its M.2 form factor and PCIe x4 connectivity.

Existing software and gateware are fully compatible with this new Screamer M.2 USB-C (R04) version.


  • * USB-C (USB 3.1 Gen 1)
  • * PCIe x4
  • * M.2 2280 (22x80 mm)
  • * Key: M

Box content:

  • * Screamer M.2 USB-C (R04)
  • * PCIe x4 to M.2 Adapter card
  • * PCIe x1 to M.2 Adapter card
  • * USB-C to USB-C 3.1 Gen 1 Cable
  • * USB-C to USB 3.1 Type-A Adapter

Screamer M.2 is supported by PCILeech.

PCIe is the main high speed way of communicating between a processor and its peripherals. It is used in PC (also encapsulated in Thunderbolt) and now even in mobile phones. Doing security research on a PCIe system is complex because it requires expensive tools (>$50k) and such tools are not that common when packet generation is needed. Screamer M2 provides a such tool at a more reasonable price.

The board comes pre-flashed with PCILeech gateware. We recommend you to get the JtagSerial pack in order to reprogram it or update it to newer versions.


Documentation and examples





  • XC7A35T Xilinx 7 Series FPGA
  • FT601 FTDI USB 3.0
  • PCIe Gen2 X4


Currently, only few attacks were made on PCIe devices. Most of them were done using a Microblaze inside a Xilinx FPGA to send/receive the TLPs, making it hard to really analyze. (Using embedded C software to generate/analyze traffic) An other way is to use USB3380 chip, but it is also not flexible enough (only supporting 32bits addressing) and does not allow debugging the PCIe state machine.


The PCIe injector is based on a Series 7 Xilinx FPGA connected to a high speed USB 3.0 FT601 chip from FTDI.

It allows:

  1. Having a full control of the PCIe core.
  2. Sending/Receiving TLPs through USB 3.0
  3. Using flexible software/tools on the Host for receiving/generating/analyzing the TLPs. (Wireshark dissectors, scapy, ...)

You might also like