Repository navigation
6. Control CLI Usage
To start using the Control CLI, you can open a new terminal session and use the command:
bombercatYou will see the main view of the CLI:
╭─ Electronic Cats ────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ :=-- --=- | │
│ -====- -===== | │
│ :===================- | │
│ ===================: | │
│ - :==--===========--==- - | bombercat │
│ -===:===- :=====- -==-.-=-- | vX.X.X │
│ -- ====- :===- -==== -- | Whiskers on the wire. │
│ -=: :===================- .=- | │
│ ---=-- -===============- -=--- | │
│ --- --=======-- -- | │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Usage: bombercat [OPTIONS] COMMAND [ARGS]...
BomberCat: All in one bombercat tools environment.
Options:
--version Show the version and exit.
-v, --verbose Trace the wire protocol to stderr (-v, or
-vv for timestamps/bytes).
--auto-flash / --no-auto-flash Allow (or forbid) a command to reflash the
board when it needs a different firmware.
Unset: ask on a TTY, never on a script/pipe
-h, --help Show this message and exit.
Commands:
capture Capture relayed APDUs to pcap (live Wireshark and/or a file).
device Discover and inspect BomberCat devices over USB-serial.
emvy EMVy Controller swiss-army commands (requires the...
flash Download and flash a BomberCat firmware image.
identify Blink a device's LED so you can tell which board an ID refers...
magspoof Magstripe emulation commands (requires the magspoof firmware).
readers NFC reader/terminal detection commands (requires the...
relay NFCGate relay: configure it, run it, and watch the APDU relay.
status Report which firmware is flashed on a BomberCat, and what it...
tags NFC tag detection commands (requires the DetectTags firmware).
The correct usage of bombercat is the following:
bombercat [OPTIONS] COMMAND [ARGS][OPTIONS] |
Description |
|---|---|
--version |
Show the version and exit. |
-v, --verbose |
Trace the wire protocol to stderr (-v, or -vv for timestamps/bytes). |
--auto-flash / --no-auto-flash |
Allow (or forbid) a command to reflash the board when it needs a different firmware. |
--help |
Show this message and exit. |
COMMAND |
Description |
|---|---|
capture |
Capture relayed APDUs to pcap (live Wireshark and/or a file). |
device |
Discover and inspect BomberCat devices over USB-serial. |
emvy |
EMVyBomberCat swiss-army: EMV read, APDU passthrough, tag/magstripe/NDEF/EMV-card emulation (auto-flashable, then gated by firmware identity). |
flash |
Download and flash a BomberCat firmware image. |
identify |
Blink a device's LED so you can tell which board an ID refers to. |
magspoof |
Magstripe emulation: play, show, watch, NFC, and multi-card store. |
readers |
NFC reader/terminal detection over the DetectReaders firmware. |
relay |
NFCGate relay: configure it, run it, and watch the APDU relay. |
status |
Report which firmware is flashed and what it can do. |
tags |
NFC tag detection over the DetectTags firmware's PN7150 reader. |
Before performing any operation, it is recommended to verify that the system correctly detects the BomberCat. To do this, run the command:
bombercat device list[OPTIONS] |
Description |
|---|---|
--help |
Show this message and exit. |
COMMAND |
Description |
|---|---|
info |
Handshake with a BomberCat and show its firmware/config. |
list |
List serial ports, the device ID of each BomberCat and who answers. |
Important
If the Control CLI is not able to see the BomberCat connected, this may indicate there is a problem with the serial port permissions for your user.
Example of expected output when having a BomberCat with the compatible firmware connected:
╭─ Electronic Cats ────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ :=-- --=- | │
│ -====- -===== | │
│ :===================- | │
│ ===================: | │
│ - :==--===========--==- - | bombercat │
│ -===:===- :=====- -==-.-=-- | vX.X.X │
│ -- ====- :===- -==== -- | Nine lives, infinite payloads. │
│ -=: :===================- .=- | │
│ ---=-- -===============- -=--- | │
│ --- --=======-- -- | │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Serial ports
┏━━━━┳━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ ID ┃ Port ┃ BomberCat ┃ Serial# ┃ HWID ┃
┡━━━━╇━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ #1 │ COM89 │ ✓ │ 36A864E62A4019A3 │ USB VID:PID=2341:005E SER=36A864E62A4019A3 LOCATION=1-6:x.0 │
│ │ COM1 │ │ │ ACPI\PNP0501\0 │
└────┴───────┴───────────┴──────────────────┴─────────────────────────────────────────────────────────────┘
ℹ Target one with: bombercat <command> -d <ID> (e.g. bombercat relay config show -d 1)
Note
Ports are automatically assigned by the operating system.
Then run the following command to verify the current firmware flashed on the board.
faultycmd status[OPTIONS] |
Description |
|---|---|
--no-sniff |
Skip boot-banner sniffing (levels 1 & 3 only). |
-p, --port PATH |
Serial port (auto-detected if omitted). |
-d / --device ID |
Device ID from bombercat device list (for multiple BomberCats). |
--help |
Show this message and exit. |
╭─ Electronic Cats ────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ :=-- --=- | │
│ -====- -===== | │
│ :===================- | │
│ ===================: | │
│ - :==--===========--==- - | bombercat status │
│ -===:===- :=====- -==-.-=-- | vX.X.X │
│ -- ====- :===- -==== -- | Sniffing NFC, purring softly. │
│ -=: :===================- .=- | │
│ ---=-- -===============- -=--- | │
│ --- --=======-- -- | │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Firmware @ COM89
┌──────────────┬─────────────────────────┐
│ name │ DetectTags │
│ version │ 1.2.0.0 │
│ detected │ handshake (certain) │
│ capabilities │ identify, monitor, tags │
└──────────────┴─────────────────────────┘
NFC tag reader for the BomberCat's onboard PN7150. It continuously polls the RF field and, whenever a contactless tag
(ISO14443-A/B, ISO15693, Felica, etc.) enters range, it detects the technology, reads the tag's unique identifier (UID)
and prints it over USB serial. It is a lightweight diagnostic/learning firmware to confirm the NFC front-end works and
to capture the UID of physical cards, with no relay or emulation logic.
ℹ Next:
bombercat tags read — detect a single NFC tag
bombercat tags watch — stream tag detections
If more than one BomberCat is plugged into the PC, use this command to blink a LED a couple of seconds, so you can identify the board.
bombercat identify -d <ID>[OPTIONS] |
Description |
|---|---|
-p, --port PATH |
Serial port (auto-detected if omitted). |
-d / --device ID |
Device ID from bombercat device list (for multiple BomberCats). |
--help |
Show this message and exit. |
bombercat identify -d 1
╭─ Electronic Cats ────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ :=-- --=- | │
│ -====- -===== | │
│ :===================- | │
│ ===================: | │
│ - :==--===========--==- - | bombercat identify │
│ -===:===- :=====- -==-.-=-- | vX.X.X │
│ -- ====- :===- -==== -- | Replaying the tag, chasing the laser. │
│ -=: :===================- .=- | │
│ ---=-- -===============- -=--- | │
│ --- --=======-- -- | │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
✓ COM89 is blinking its LED for a couple of seconds
Downloads the .uf2 asset from the latest ElectronicCats/bombercat-firmware GitHub release and flashes it over the RP2040's UF2 bootloader. If the board is not already in boot mode, a remote 1200-baud trigger is tried first (the same "magic baud" convention as picotool reboot -f -u), no button press needed. Only if no BomberCat CDC is detected do you get prompted to put the board in boot mode manually (it enumerates as an RPI-RP2 USB drive).
Since there are different examples created for BomberCat, the latest release contains different .uf2 files. It is mandatory to flash the firmware you need according to your objective.
Usage:
bombercat flash <example>[OPTIONS] |
Description |
|---|---|
-l, --list |
List the available firmwares. |
--refresh |
Re-check GitHub for a newer release now. |
--full |
Show full descriptions (do not truncate). |
-y / --yes |
Do not ask for confirmation. |
-p, --port PATH |
Serial port (auto-detected if omitted). |
-d / --device ID |
Device ID from bombercat device list (for multiple BomberCats). |
--help |
Show this message and exit. |
bombercat flash DetectReaders
╭─ Electronic Cats ────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ :=-- --=- | │
│ -====- -===== | │
│ :===================- | │
│ ===================: | │
│ - :==--===========--==- - | bombercat flash │
│ -===:===- :=====- -==-.-=-- | vX.X.X │
│ -- ====- :===- -==== -- | Herding bits since 2026. │
│ -=: :===================- .=- | │
│ ---=-- -===============- -=--- | │
│ --- --=======-- -- | │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
ℹ About to flash DetectReaders.uf2 (200 KB)
Write it to COM89? [y/N]: y
rebooting COM89 into the UF2 bootloader (1200-bps touch)
waiting for the RPI-RP2 drive
copying DetectReaders.uf2 (205312 bytes) to D:\
waiting for the board to come back
✓ DetectReaders.uf2 written to D:\
ℹ The board came back on COM89
Basic magnetic-stripe emulator. Drives the on-board H-bridge coil to reproduce the electromagnetic field of a real card; a standard magstripe reader picks up the emulated tracks wirelessly. Track data is compiled in; a button press triggers playback. Requires the magspoof firmware.
Usage:
bombercat magspoof <command>[OPTIONS] |
Description |
|---|---|
--help |
Show this message and exit. |
COMMAND |
Description |
|---|---|
card |
Manage the persistent multi-card store (requires flash-storage... |
info |
Report what this magspoof image can do. |
nfc |
NFC (PN7150) commands (requires the magspoof firmware). |
play |
Emulate a swipe of the active card. |
show |
Print the tracks currently loaded on the device. |
watch |
Stream every reproduction — by command or physical button —... |
bombercat magspoof show
╭─ Electronic Cats ────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ :=-- --=- | │
│ -====- -===== | │
│ :===================- | │
│ ===================: | │
│ - :==--===========--==- - | bombercat magspoof │
│ -===:===- :=====- -==-.-=-- | vX.X.X │
│ -- ====- :===- -==== -- | Landed on all four antennas. │
│ -=: :===================- .=- | │
│ ---=-- -===============- -=--- | │
│ --- --=======-- -- | │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
magspoof card @ COM90
track 1 %B123456781234567^LASTNAME/FIRST^YYMMSSSDDDDDDDDDDDDDDDDDDDDDDDDD?
track 2 ;123456781234567=112220100000000000000?
button alternating 1 and 2
── analysis ──────────────────────────────
standard loyalty / transit / generic
The board runs the PN7150 in card-emulation (LISTEN) mode, presenting an emulated contactless card; this way, it can detect NFC reader/terminal. Requires the DetectReaders firmware.
Usage:
bombercat readers <command>[OPTIONS] |
Description |
|---|---|
--help |
Show this message and exit. |
COMMAND |
Description |
|---|---|
info |
Report what this DetectReaders image can do. |
read |
Wait for one reader/terminal to probe the emulated card. |
scan |
Sample reader detections for a while and print an aggregated... |
watch |
Stream reader detections continuously. |
bombercat readers read
╭─ Electronic Cats ────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ :=-- --=- | │
│ -====- -===== | │
│ :===================- | │
│ ===================: | │
│ - :==--===========--==- - | bombercat readers │
│ -===:===- :=====- -==-.-=-- | vX.X.X │
│ -- ====- :===- -==== -- | Cloning cards, breaking hearts. │
│ -=: :===================- .=- | │
│ ---=-- -===============- -=--- | │
│ --- --=======-- -- | │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
ℹ Waiting for a reader on COM90 — Ctrl-C to abort
Reader detected
label unknown
technology NFC-A
protocol ISODEP
interface ISODEP
fingerprint unknown:NFC-A:ISODEP
apdu -
n 0
NFC tag detection over the DetectTags firmware's PN7150 reader. Requires the DetectTags firmware.
Usage:
bombercat tags <command>[OPTIONS] |
Description |
|---|---|
--help |
Show this message and exit. |
COMMAND |
Description |
|---|---|
info |
Report what this DetectTags image can do. |
mifare |
Mifare Classic auth/read/write/sector commands (requires the... |
read |
Wait for one tag and print its UID. |
scan |
Sample tag detections for a while and print an aggregated summary. |
watch |
Stream tag detections continuously. |
bombercat tags watch
╭─ Electronic Cats ────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ :=-- --=- | │
│ -====- -===== | │
│ :===================- | │
│ ===================: | │
│ - :==--===========--==- - | bombercat tags │
│ -===:===- :=====- -==-.-=-- | vX.X.X │
│ -- ====- :===- -==== -- | The cat's out of the sandbox. │
│ -=: :===================- .=- | │
│ ---=-- -===============- -=--- | │
│ --- --=======-- -- | │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
ℹ Watching COM90 — Ctrl-C to stop
[11:58:58] NFC-A MIFARE 93:4D:E1:1C
[11:58:58] NFC-A MIFARE 93:4D:E1:1C (x2)
[11:59:00] NFC-A MIFARE 82:44:0B:AB
[11:59:03] NFC-A MIFARE D8:37:DB:08
[11:59:08] NFC-A MIFARE FF:56:3F:D9
ℹ 5 detections, 4 unique UIDs, 19s
This function works over NFCGate, an application meant to capture, analyze, or modify NFC traffic. Requires the NFCGate firmware.
Usage:
bombercat relay <command>[OPTIONS] |
Description |
|---|---|
--help |
Show this message and exit. |
COMMAND |
Description |
|---|---|
config |
Configure the relay (WiFi + nfcgate parameters), persisted in... |
monitor |
Stream the device's serial output live (relay logs + APDU hex). |
run |
Start the relay (associate WiFi, connect the server, begin the... |
status |
Show live relay status (state, link, peer, relayed count). |
stop |
Stop the relay. |
bombercat relay config show
╭─ Electronic Cats ──────────────────────────────────────────────────────────────────────────────────╮
│ │
│ :=-- --=- | │
│ -====- -===== | │
│ :===================- | │
│ ===================: | │
│ - :==--===========--==- - | bombercat relay │
│ -===:===- :=====- -==-.-=-- | vX.X.X │
│ -- ====- :===- -==== -- | Nine lives, infinite payloads. │
│ -=: :===================- .=- | │
│ ---=-- -===============- -=--- | │
│ --- --=======-- -- | │
│ │
╰────────────────────────────────────────────────────────────────────────────────────────────────────╯
BomberCat @ COM90
┏━━━━━━━━━┳━━━━━━━━━━━━━━━┓
┃ Field ┃ Value ┃
┡━━━━━━━━━╇━━━━━━━━━━━━━━━┩
│ fw │ 1.2.0.0 │
│ role │ reader │
│ ssid │ <SSID> │
│ server │ <server-host> │
│ port │ 5566 │
│ session │ 42 │
│ state │ idle │
└─────────┴───────────────┘
Note
There are two ways to test the relay functions: Path A - Two BomberCats via nfcgate-server. A server must be enabled and the ip address must be the same as the server for both BomberCats. Path B - One BomberCat and Phone running the NFCGate App.
Capture relayed APDUs to pcap (live Wireshark and/or a file). This function works over NFCGate, an application meant to capture, analyze, or modify NFC traffic. Requires the NFCGate firmware and setup the relay functions.
Usage:
bombercat capture <command>[OPTIONS] |
Description |
|---|---|
--help |
Show this message and exit. |
COMMAND |
Description |
|---|---|
start |
Arm the tap and stream APDUs to Wireshark and/or a file until... |
stop |
Disarm the tap on a board (e.g. |
bombercat capture start -ws -d 2
╭─ Electronic Cats ──────────────────────────────────────────────────────────────────────────────────╮
│ │
│ :=-- --=- | │
│ -====- -===== | │
│ :===================- | │
│ ===================: | │
│ - :==--===========--==- - | bombercat capture │
│ -===:===- :=====- -==-.-=-- | vX.X.X │
│ -- ====- :===- -==== -- | Curiosity cloned the card. │
│ -=: :===================- .=- | │
│ ---=-- -===============- -=--- | │
│ --- --=======-- -- | │
│ │
╰────────────────────────────────────────────────────────────────────────────────────────────────────╯
ℹ waiting for Wireshark to attach…
** (wireshark:17972) 12:38:49.681860 [Capture MESSAGE] -- Capture Start ...
✓ Wireshark attached (\\.\pipe\fbombercat) — streaming APDUs
** (wireshark:17972) 12:38:49.724842 [Capture MESSAGE] -- Capture started
** (wireshark:17972) 12:38:49.725374ℹ capturing from COM89 — press Ctrl-C to stop
Note
There are two ways to enable the relay functions: Path A - Two BomberCats via nfcgate-server. A server must be enabled and the ip address must be the same as the server for both BomberCats. Path B - One BomberCat and Phone running the NFCGate App.
The EMVyBomberCat swiss-army knife over its control link — read an EMV card, tunnel raw APDUs to a live card, read a tag's UID, emulate a magstripe swipe, and emulate an NDEF tag or an EMV card while watching every reader/terminal APDU live.
For authorized security testing and research only. These commands read and emulate payment cards; use them only on cards and terminals you own or are explicitly authorized to test.
Usage:
bombercat emvy <command>[OPTIONS] |
Description |
|---|---|
--help |
Show this message and exit. |
COMMAND |
Description |
|---|---|
apdu |
Tunnel one or more APDUs to a live card (WAIT -> APDU: ->... |
cardscan |
Read an EMV card into the device's RAM for reemulation... |
emu |
NDEF tag / EMV-card emulation (EMU/EMUEMV). |
info |
Report the EMVyBomberCat firmware and the operations it exposes. |
mag |
Emulate a magstripe swipe of one or both tracks (MAG). |
nfcinfo |
Diagnose the PN7150 over I2C and re-arm discovery (NFCINFO). |
read |
Read an EMV card via a SCAN (PAN/expiry/AID/track2/...). |
reboot |
Reset the board's MCU (REBOOT). |
tag |
Read any nearby tag's protocol/tech/UID (TAG). |
bombercat emvy tag
╭─ Electronic Cats ────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ :=-- --=- | │
│ -====- -===== | │
│ :===================- | │
│ ===================: | │
│ - :==--===========--==- - | bombercat emvy │
│ -===:===- :=====- -==-.-=-- | vX.X.X │
│ -- ====- :===- -==== -- | Replaying the tag, chasing the laser. │
│ -=: :===================- .=- | │
│ ---=-- -===============- -=--- | │
│ --- --=======-- -- | │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
ℹ Waiting for a tag on COM90 (up to 8s)...
tag @ COM90
protocol 2
tech 0
UID 04E71FE2DB1190
Thank you for reading our Wiki!
