I wanted 20 volts and I had a drawer full of laptop chargers that could give it to me, if only I knew the password. USB-C Power Delivery is a negotiation, and a plain device that does nothing clever gets the consolation prize: 5V, and not much current. To unlock the higher voltages you have to actually take part in the conversation happening on the CC line, and that conversation is where all the interesting reverse-engineering lives.
The physical layer is the easy bit. There are two CC pins; the cable connects exactly one of them, and that pin is where the chargers does its talking. Hang a logic analyser off CC against ground and you can watch the whole handshake go past. The charger broadcasts a Source Capabilities message listing what it can do, the device replies with a Request for one of those advertised profiles, and the charger says Accept, then PS_RDY, and only then ramps the voltage. Ask for something it never offered and you get a polite Reject and your 5V back.
The signalling itself is BMC encoded, which threw me until I stopped trying to read it as plain UART. It is biphase-mark, transitions carry the bits, and a cheap analyser will happily capture the edges even if it cannot decode the protocol for you. I ended up doing the first few by hand off the timing diagram in the spec, which is tedious but genuinely the fastest way to build intuition for what the bytes mean. Once you have decoded one Source Capabilities PDO by hand, the rest of the protocol stops being magic.
The honest shortcut, and the one I should have reached for first, is a dedicated PD trigger chip. Something like an STUSB4500 will do the whole negotiation for you and let you preset the profile you want over I2C, so the board just comes up at 20V with no microcontroller babysitting the CC line at all. There are little breakout boards built around it for a few quid. I bought one. It worked immediately, which after an evening with a logic analyser felt almost like cheating.
But I do not regret the evening. The trigger chip gives you 20V; the logic analyser gives you the reason. Knowing that the voltage only appears after a four-message handshake explained a dozen things I had previously filed under "USB-C is just flaky," including why a perfectly good charger sometimes sulks at 5V when the cable is the cheap kind that only wires up one CC pin. The protocol was never flaky. I just had not been listening to it.