HydraBus Team RHME2 challenges write-up released for all challenges(22) see https://github.com/hydrabus/rhme-2016


HydraBus Team have participated to Riscure, RHME2 and we are 1st !!
Thanks to all participants and Riscure for those amazing challenges


HydraBus boards are now back in stock (with same price as before) and new features:

  • New PCB v1.0 Rev1.2+ (add capacitor for MicroSD +3V3 for even more stable supply for big microSD/SDIO …)
  • Replaced MCU STM32F405 by STM32F415 with hardware cryptographic acceleration for:
    • AES 128, 192, 256
    • Triple DES
    • HASH (MD5, SHA-1), and HMAC
  • Added Clear laser-cut acrylic case with screws

For more details see https://hydrabus.com/buy-online



HydraESP32 HydraBus v1.0 Shield for ESP-WROOM-32 V1.1 Rev1.0 is alive







This new version allow to measure ESP32 power consumption (and/or manage power ON/OFF of ESP32 with any MCU…)
This version can be fully managed using HydraBus STM32 MCU
For more details (BOM, Eagle board …) see OSHPark link: https://oshpark.com/projects/dgKJqznH


This 1st part is mainly how to connect  FTDI C232HM DDHSL-0 to ESP32 DevKitC (also called ESP32-CoreBoard V2)














For more details on JTAG /GDB /ESP32 OpenOCD see https://github.com/espressif/esp-idf/blob/master/docs/openocd.rst


HydraBus Shield / Breakout board for ESP-WROOM-32 new version 1.1(rev1.0)







This shield can be used with or without HydraBus board, you can even cut HydraBus specific right side (on the line) to have a tiny ESP-WROOM-32 breakout board.

  • New features versus previous version V1.0 Rev1.1:
    • Added LDO (TPS73633DBVR SOT23-5) to convert 5V(VUSB) to a clean VCC (+3.3v) for ESP32 and which can be enabled by an HydraBus Pin or with a JUMPER on J7 (which connect +3.3V from HydraBus to EN of the LDO)
    • Added VCC connector in order to measure ESP32 current/power consumption (if not used to measure current just add a JUMPER on VCC to power the ESP32)
    • Added J6 connector to have access to ESP32 SPI FLASH IOs (now all pins are available)
  • This shield can be used only on bottom of HydraBus board (in order to use other shields on top of HydraBus)
  • The HydraBus board is a small (60mm x 37mm) and low cost, multi-tool extensible board with STM32F405 Cortex M4F 32bits MCU @168MHz with a fully open source firmware hydrafw and full online documentation hydrafw wiki
  • The ESP-WROOM-32 is a low-power 32-bit 240 MHz dual core MCU Wi- Fi+BLE combo module that highly integrates TCP/IP network stacks, 12- bit ADC and HSPI/SDIO/UART/PWM/I2C/I2S interfaces. See ESP32 Overview, ESP-WROOM-32 link/info, Espressif Products Overview including ESP-WROOM-32 PDF
  • Design based on official esp_wroom_32_datasheet_en.pdf (August 8, 2016)

OSH Park Link: https://oshpark.com/shared_projects/dgKJqznH


New feature NFC sniffer ISO14443A real-time infinite trace mode:







For more details see:


Now HydraESP32 shield is alive
See a simple test (to communicate with ESP32 using UART) by wiring ESP32 UART RXD0/TXD0 pins respectively to HydraBus PA9(UART1 TX)/PA10(UART1 RX) and by forcing EN to 3v3
(just plug ESP32 EN on GND then remove it / connect it to +3V3 after bridge mode is enabled)
It is recommended to use latest HydraBus firmware hydrafw v0.8 in order to use UART bridge @115200 bauds 8N1
See asciinema video:

For information we can also interact with ESP32 during bridge mode by connecting a 2nd MicroUSB connector on HydraBus in order to have an other terminal to interact with ESP32 I/O for example to set EN pin to +3.3V or GND … (or even to test different boot mode / communication …)


See HydraESP32 build step by step in this video


13.10.2016 – HydraFW v0.8 Beta

HydraBus specific:
HydraNFC specific:
  • Added command sd (sdcard commands)
  • Added Example bbio_hydranfc_init.py for HydraNFC init using Console mode + switch to bbIO mode for SPI2 Init & communication with TRF7970A (HydraNFC shield)
  • Read / Display / Save Mifare Ultra Light tag data (64bytes raw data of the Tag)
  • Emulate Mifare Ultra Light tag (Beta version does not work with phone) (7Bytes UID and 64bytes data support only READ command)
    • emul-mf-ul command add optional filename (same 64bytes raw file previously written to microsd by read-mf-ul)
    • See commit [d569fcd8] 27-May-2016 (https://github.com/bvernoux/hydrafw/commit/d569fcd853415d7d56e54ef773315abb45015285) (modified scan command)
    • This feature is a Beta version and will be rewritten using low level mode SDM TX/DM1 RX in order to be hard real-time & ISO compliant, which will also fix the emulation when using a Phone…
  • NFC sniffer improvements and NFC sniffer command cleanup
    • Modified NFC RX Gain Reduction from 10dB to 5dB & use ISO14443A mode
    • The sniffer now use native ISO14443A mode instead of previous hybrid mode ISO14443B/A, those modifications (with NFC RX Gain reduction set to 5dB) give better sniffing sensitivity and bigger range to sniff PICC(NFC Tag) and PCD(NFC Reader) configured using @6.3Mbauds(in reality it is 8.4Mbauds) 8N1 with Putty on Win7
    • Removed sniff-dbg (replaced by parity & frame-time sub commands)
    • Added following sniff sub commands:
      • trace-uart1 to trace in real-time sniffed data to UART1 PA9 @8.4Mbauds 8N1, validated with FTDI C232HM-DDHSL-0
      • bin (Force binary sniff trace(UART1 only))
      • parity (Add parity bit information in binary sniff trace(UART1 only))
      • frame-time (Add start/end frame timestamp(in CPU cycles))
    • Moved sniff-raw command to sniff sub command raw