Now HydraBus is supported officially in blacksphere/blackmagic github
Thanks to Gareth McMullin and please support his amazing Black Magic Probe hardware.

See documentation here:

For more details see:

See commit


16.04.2016 – HydraFW v0.7 Beta

HydraBus specific:
  • Added freeform string as byte sequence (in addition to freeform integers) (thanks to Baldanos)
  • Added Binary Modes full documentation in wiki
  • Added Binary Modes (USB CDC compatible with BusPirate BBIO/Bitbang) with:
  • CAN (thanks to Baldanos)
    • Corrected filters handling. Now works for both CAN interfaces
    • Fixed bsp_can_rxne()
    • Fixed error in can2 pin description
    • Added speed change for CAN
  • Optimized sump critical part and Lock Kernel during get_samples()
  • JTAG scanner/debugger mode like JTAGulator (thanks to Baldanos)
    • Add support for TRST
    • Add support for MSB/LSB when reading
HydraNFC specific:
  • Added in standalone mode sniffing LED indication #36 LED 2 ON for Standalone mode
  • Fixed IRQ bug (stopped when enter/exit from sniffer or emul mode)
  • Fixed Trf797xInitialSettings with workaround of Errata SLOZ011A–February 2014–Revised April 2015
  • HydraNFC emulation commands are in alpha stage and they will be fixed in next version of HydraFW
    • Added in emul-mifare display of UID parameter when started
    • Added in emul-mifare 4 bytes UID parameter
    • Added emul-mf-ul command for Mifare Ultralight Emulation preliminary/work in progress code
  • Added dm0 command => Direct Mode 0 Sniffer Test work fine mainly for test with a Logic Analyzer on PC2
  • Added dm1 command => Direct Mode 1 Test (Work in Progress to test TX SDM & RX DM1)

HydraBus v1.0 Rev1.2 Released on GitHub
Contains: CadSoft Eagle v7.1 files (board & schematic) + BOM (Excel) + Schematic (PDF)
Hardware license CC BY NC (like previous revision R1.1)


Thanks to Antti Nykänen for the Open Hardware HydraBus Shield Template for KiCad
This template is based on the official Eagle template



29.11.2015 – HydraFW v0.6 Beta

  • Update of tokenline, now both T_ARG_INT and T_ARG_FLOAT take k, m and g suffixes and apply a decimal factor on both argument types. It is always compatible with old syntax khz, mhz, ghz (only first character is checked).
HydraBus specific:
  • Added 2-wire mode (support frequency up to 1MHz) (thanks to Baldanos)
  • Added random command new token ~ (T_TILDE) to write random byte (thanks to Baldanos)
    • Random number generator (using STM32 hardware RNG) returns a 32bit random number in hex (thanks to Baldanos)
  • Added jtag scanner/debugger mode (thanks to Baldanos)
    • Classic JTAG (TDI/TDO/TMS/TCK)
    • Can be used with command line
    • BusPirate-compatible OpenOCD binary mode (openocd command)
    • Can scan a JTAG bus with IDCODE and BYPASS methods (idcode and bypass commands)
    • Can try to find JTAG bus on all GPIOB pins (like JTAGulator) (brute command)
  • Added sump mode, Logic Analyzer up to 1MHz 16chan with SUMP support (thanks to Baldanos)
  • Added can mode (thanks to Baldanos & smillier)
    • Needs a dedicated shield like HydraOBD to communicate with a real CAN bus
      • Support CAN bus 1 or 2 (speed up to 2M)
      • Support read, read continuous, write, id and filter commands
  • Added in uart mode the bridge command to be used as UART Raw sniffer (thanks to Baldanos)
  • UART: fix bug in baudrate->BRR (thanks to doegox)
HydraNFC specific:
  • HydraNFC Tag Emulation UID Mifare 1K & ISO14443A
    • Mifare Emulation (Anticol+UID+HALT) see new command emul-mifare
    • ISO14443A Emulation (TRF7970A hardware Anticol/UID) see new command emul-3a
  • Rename command mifare to typea (ISO14443A) as it was not specific to MIFARE
  • scan command now support 4 and 7bytes UID (thanks to NicoHub)
  • Sniffer new command sniff-dbg with following new features:
    • Add after each 8bits/byte the parity (ASCII char “0” or “1” + space)
    • End Of Frame Timestamp + RSSI

See all commands here:
HydraFW Link:
Release with pre-built firmware:


See the excellent Peter Fillmore conference slides from SyScan2015: Crash & Pay: Owning and Cloning NFC Payment cards
For more details on Symposium on Security for Asia Network (SyScan) see


Update HydraFW v0.5-beta-1-g4897d50 add HydraNFC Tag Emulation UID ISO14443A (Mifare 1K) command emul_uid_14443A
See github pre-built dfu firmware
See source code GitHub HydraFW
See also specific code for ISO14443A UID Emulation:


Updated commands:

For more details see:


HydraFW v0.5 Beta

  • New USB VID_0x1d50/PID_0x60a7 using OpenMoko HydraFW, update with new drivers
  • Added USB DFU boot by pressing UBTN at PowerOn/RESET for easier future update of the firmware (does not requires any wire).
  • Added Log command (thanks to biot):
    • Log all commands/answer in the Terminal to HydraBus SD card file: logging on off sd
  • Added command debug test-rx (debug rx) in order to test USB CDC reception performance.
  • Added PWM command:
    • Configurable PWM frequency between 1Hz to 42MHz and duty cycle from 0 to 100%: pwm, frequency, duty-cycle
    • Give feedback of real PWM frequency & duty cycle after configuration.
  • Added DAC command:
    • Configurable DAC1(PA4 used by ULED) or DAC2(PA5) with following modes:
      • raw (0 to 4095), volt (0 to 3.3), also returns feedback of raw/volt DAC value after configuration.
      • triangle (5Hz / 3.3V Amplitude), noise (0 to 3.3V Amplitude)
      • dac exit disable DAC1/2 & Timer6/7 and reinit GPIO for PA4 & PA5
  • UART:
    • UART returns real baud rate+% error after configuration.
    • Check and correct min/max value for UART baudrate.
  • I2C added scan (thanks to biot).
  • SPI:
    • Fixed cs on / off bug with Infinite Loop.
    • Fixed SPI mode slave.
    • Fixed configuration for phase & polarity (was always set to 0).
  • HydraNFC:
    • Fixed HydraNFC detection/init/cleanup and autonomous sniffer mode started with K4.
    • Fixed some potential problems/crash with scan/continuous.
  • Add full help for commands.
  • Lot of cleanup and fixes in code.

See all commands here:
HydraFW Link:
Release with pre-built firmware:


HydraFW HydraNFC/TRF7970A Tutorial added for HydraBus/HydraNFC and latest firmware (at least version HydraFW_v0.4-beta-56-g09d47ac see release).


The tutorial details how to:

  • Initialize GPIO & SPI to communicate with TRF7970A/HydraNFC
  • Initialize & read ISO15693/Vicinity Tag
  • Initialize & read ISO14443A/Mifare Tag
  • Use TRF7970A commands (SLOS743K – August 2011 – revised April 2014)