v1.2.2.0

BomberCat Firmware v1.2.2.0

Executive Summary

This release is a major step forward for the BomberCat's contactless payment card (EMV) analysis capabilities. The headline feature is EMVyBomberCat, a unified "Swiss army knife" firmware that combines — in a single image controlled over the serial port — EMV contactless reading, EMV card and NDEF tag emulation, magnetic-stripe emulation (magspoof), and NFC tag reading.

Under the hood, the project was reorganized around a reusable core library (MagStripe, TagReader, HexUtils, EmvKernel, and a shared NFC controller), so every sketch now builds on the same tested foundation. On top of this comes a heavy round of robustness work on EMV reading — now with real support for Mastercard PayPass and other brands — plus several fixes that prevent the device from becoming unresponsive after a transaction.

New Features

• Unified EMVyBomberCat firmware (EMVy Controller). A single image with multiple modes, all accessible via serial commands at 115200 baud:
  • SCAN — full EMV contactless flow with JSON output.
  • CARDSCAN / EMUEMV — read an EMV card and re-emulate it (from RAM or from a host capture), useful for extracting the payment terminal profile (which data it requests and with what parameters).
  • EMU:<hex> — observable emulation of NFC Type 4 (NDEF) tags, reporting every reader APDU over serial.
  • TAG / TAGS — NFC tag reading with protocol, technology, and UID.
  • MAG:<track1>|<track2> — magnetic-stripe swipe emulation.
  • WAIT / APDU: / RELEASE — APDU passthrough over ISO-DEP.
• Support for Mastercard PayPass and other brands (not just Visa). Reading now dynamically selects the AID that the card advertises in its PPSE, instead of always assuming Visa, allowing successful reads of Mastercard, Amex, Mercado Pago, and more.
• Automatic card brand identification based on the PPSE AID, instead of a hardcoded value.
• New flashing options in flash_bombercat.sh to generate and flash UF2 files.

Improvements

• New reusable core library. Common modules — MagStripe, TagReader, HexUtils, EmvKernel, and a unified NfcController — were extracted, and the existing sketches (MagSpoof, MifareClassic, DetectReaders, DetectTags, WiFiWebServer, Relay NFC) were migrated to use them. This reduces duplication and makes the firmware easier to maintain.
• More robust EMV reading with large responses. EMV responses larger than 255 bytes and responses fragmented across multiple blocks (e.g., Mastercard SFI records) — which could previously be truncated — are now handled correctly.
• Case-insensitive serial commands and improved control-channel polling during wait states, for smoother interaction.
• Much clearer diagnostics: APDU status codes (SELECT AID, GPO, GENERATE AC) are now logged with hex dumps whenever the card rejects a command.

Bugfixes

• The device no longer becomes unresponsive after an EMV transaction. A blocking wait (waitForTagRemoval()) was replaced with a safe re-arming of NFC discovery (drainAndRearm()), so the USB control channel keeps responding even if the card stays on the reader.
• Fixed the GENERATE AC failure (SW=6985) on Mastercard. The amount (tag 9F02) is now encoded as packed BCD, as required by the standard, allowing correct cryptogram generation (ARQC/ATC/IAD).
• GENERATE AC is now best-effort on non-qVSDC cards: if the card rejects the command, the PAN and Track 2 are still reported, avoiding loss of card identification.
• Track 2 on Mastercard: the track is now sought in both tag 0x57 (Visa/EMV) and 0x9F6B (Mastercard mag-stripe), scanning the records listed by the AFL instead of guessing a single one.
• Optimized hexCompact for efficient APDU payload handling, plus improved APDU error logging.

Breaking Changes

• Reorganization around the core library. If you maintain your own sketches or integrations based on the previous code, note that the hex, magstripe, tag-reading, and EMV functions now live in core/src/ and are consumed as a library. The official sketches are already migrated; custom ones will need to update their #includes and calls to the new modules (HexUtils, MagStripe, TagReader, EmvKernel, NfcController).
• There are no changes that break normal device use for end users.

Installation Notes

• Flash the firmware with flash_bombercat.sh, which now supports generating and flashing UF2 files (handy if you prefer to drag the .uf2 onto the RP2040 drive in bootloader mode).
• To use EMVyBomberCat, connect over serial at 115200 baud and control the modes with the commands described above (ping, SCAN, CARDSCAN, TAG, MAG:, EMU:, EMUEMV, STOP, REBOOT). See EMVyBomberCat/README.md for the full command table.

Credits

The EMVyBomberCat firmware was contributed by Glitchboi-sudo in ElectronicCats/bombercat-firmware#4. These emvy CLI commands drive that firmware over its control link.

V1.2.1.0

Release Notes — BomberCat Firmware [v1.2.1.0]

Highlights

This release introduces full Mifare Classic card reader support via the PN7150, including card detection, authentication, block read/write, sector reads, and an interactive REPL session — along with several reliability fixes discovered during development.

New Features

• Mifare Classic core support: authentication (Key A/B), block read/write, and sector read implemented using the PN7150's proprietary raw commands.
• Interactive REPL session: new mifare auth/read/write/sector/keys commands. The card stays selected across commands, with the session closing automatically on idle timeout or physical removal.
• Automatic card probing: on tag detection, a default block is automatically probed with common keys, reported via a new :mifare event.
• Indexed key names in Mifare key emission for clearer identification.
• Documentation: Mifare Classic reader entry added to descriptions.json and README.

Bug Fixes & Reliability Improvements

• Fixed Key B authentication: MIFARE_KEY_B was incorrectly defined as 0x11 instead of 0x90 (per NXP UM10936, Table 38), which caused silent authentication as Key A instead of failing as expected.
• Prevented "session-riding" false positives: authentication attempts now force card re-selection via a new session-tracking mechanism (mifareBeginAuth()), so a warm Crypto1 session can no longer make an incorrect key/key-type appear to succeed (previously affected mifare check results).
• Non-blocking card removal detection: replaced a blocking vendor library call with a polled approach, keeping the device responsive to host commands while waiting for card removal.
• More reliable key sweeps: added automatic card re-selection (mifareReselect()) after a failed authentication attempt, fixing premature failures during mifare check and dictionary sweeps.
• More reliable block probing: ensured card re-selection after the last key attempt during automatic probing.
• Improved sector read diagnostics: added an authOk output parameter to distinguish authentication failures (wrong key) from block read denials (access bits).

Affected Files

MifareClassic/MifareClassic.ino, MifareClassic/MifareClassic.h, MifareClassic/MifareCommands.cpp, MifareClassic/MifareCommands.h, descriptions.json, README.md

V1.2.0.0

BomberCat Firmware v1.2.0.0

Highlights

NFC Card Reading & Emulation (PN7150)

• Integrated the PN7150 NFC controller for advanced tag/reader operations.
• Added VISA MSD emulation for contactless transactions.
• New nfcread command to extract Track 2 data from EMV/Visa cards, with optional card name for targeted storage.
• Added SEL_RES control to support both emulation and reader modes.
• Per-card NFC mode configuration via setNfcMode.
• Improved Track 2 reading reliability and diagnostics.

MagSpoof Overhaul

• Multi-card database with flash-backed persistent storage.
• Automatic migration of legacy card records (config version 2 → 3).
• New button-triggered track mode handling and reporting.
• Streamlined and more reliable track playback logic, including improved leading-zero handling and debounce logic.

Reader & Tag Detection

• Enhanced DetectTags and DetectReaders sketches with detailed event emission and protocol identification.

Serial Control

• Lightweight BomberCatControl / SerialControl interface for basic firmwares.
• Standardized baud rate and firmware name (fw_name) reporting across firmwares.

Other Changes

• Added a legal usage disclaimer for penetration testing use cases.
• Minor cleanup: removed unused Makefile, fixed missing includes, and standardized hex formatting via HexUtils.

Upgrade Notes

• Card configuration storage is automatically migrated from legacy formats on first boot; no manual action required.

v1.0.1.0-beta

What's Changed

• Feature/refactor by @Darcko123 in #1

New Contributors

• @Darcko123 made their first contribution in #1

Full Changelog: https://github.com/ElectronicCats/bombercat-firmware/commits/v1.0.1.0-beta