Faulty Cat V2.2

Name: Faulty Cat V2.2 — Electromagnetic Fault Injection Tool
SKU: ECFauS006621
Price: 120.00 USD
Availability: OutOfStock
Rating: 5.00 (1 reviews)

Electromagnetic pulses and voltage glitching in one open-source board, with an SWD pinout scanner and 8-channel logic analyzer — for hardware you're authorized to test.

$120.00

Out of stock

Any target chip or board that exposes SWD or JTAG debug pins — the scanner brute-forces every pin permutation on the 8-channel header to find them. At firmware v3.0 the publicly exposed verb is `scan swd`; the direct JTAG/SWD verbs and the JTAG pinout scanner are marked work-in-progress for v3.1.
PulseView and sigrok, to decode the logic-analyzer capture on the host; the Arduino IDE, to program a target board and watch it over its Serial Monitor; and BusPirate v1 BBIO, OpenOCD-style JTAG and flashrom `serprog` v1 over the 8-channel scanner header.
Pre-flashed firmware, ready out of the box: no flashing needed for a basic EMFI test. The current firmware line is v3; the latest tagged release is v2.2.1.1 (28 July 2026). The same firmware runs on v2.1 and v2.2 boards — the change between the two was silkscreen labelling, not the electrical nets.
faultycmd, the Python 3.10+ CLI and TUI host tool — packaged installers for Windows, macOS 11+ (Intel and Apple Silicon), Debian/Ubuntu and Arch Linux.

In the box

Faulty Cat V2.2 board
USB cable

Not included

AA batteries are not included — the board runs on USB-C by default; 3x AA (1.5V) power it if you go battery-only. The board and USB cable are already in the box.

You also need

3x AA batteries if you want to run it without USB power, and a computer with the faultycmd CLI (Python 3.10+) for the full feature set beyond basic arm/pulse testing.

What is Faulty Cat?

Faulty Cat is a low-cost, open-source electromagnetic fault injection (EMFI) tool for hardware security research, designed specifically for self-study and hobbyist research. Fault injection means deliberately disturbing a running chip to see whether it skips an instruction, crashes or takes a wrong branch — and Faulty Cat does it in two independent ways. EMFI charges a flyback capacitor to around 240–250 V and discharges it into a coil on the SMA output, with pulse widths in microseconds. Crowbar uses a power MOSFET to briefly short the target’s supply to ground, with pulse widths in nanoseconds: roughly 1000x faster, and with no high-voltage capacitor involved. Either technique runs as a single shot in Direct mode, or as an automated delay, width and power sweep in Campaign mode. Use it only on hardware you own or have explicit permission to test.

Prove the target faults before you commit to it

Before spending an audit on a real target, confirm that the tool and the setup work. Program a Raspberry Pi Pico with a simple infinite-counter sketch, arm Faulty Cat, position the antenna near the microcontroller and press PULSE once the CHG and HV LEDs are lit, with the Arduino IDE Serial Monitor open. The serial counter stops and the board needs a manual reset — a reproducible instruction-skip fault you can point at. A published step-by-step tutorial walks through the whole setup. From there, switch to Campaign mode and let the board sweep delay, pulse width and power until you find the window that reproduces it, with up to 256 results held on the board itself; since firmware v2.2.1.1, stopping a sweep mid-run guarantees a safe disarm of the high-voltage section. Only on hardware you own or have explicit permission to test.

Find the debug pins, then watch the bus

Mapping an obfuscated debug interface on an unmarked target PCB is a pinout problem before it is a glitching problem. Wire the candidates to the 8-channel scanner header and let Faulty Cat brute-force every pin permutation against any target that exposes SWD or JTAG. At firmware v3.0 the publicly exposed verb is `scan swd`; the direct JTAG/SWD verbs and the JTAG pinout scanner are marked work-in-progress for v3.1. The same header doubles as a protocol-agnostic 8-channel logic analyzer over the SUMP/OLS transport, decoded on the host in PulseView or sigrok — no firmware change needed to support a new protocol. Only on hardware you own or have explicit permission to test.

Run a hands-on glitching workshop

Fault injection is easier to teach when the group can watch it happen, and easier to grade when the exercise is repeatable. A published training exercise pairs Faulty Cat with the RP2350’s hardware glitch detector: flash a modified RP2350 Security Playground Demo onto a DEFCON 32 badge used as the victim board, set the detector’s sensitivity level, and fire pulses at different power settings and antenna distances. The write-up shows how those two variables change the trigger behaviour — a controlled, repeatable lab rather than a demo that only works once. Because the board comes pre-flashed, a group can start on the ARMING and PULSE buttons and move to the host tool later. Every target in the room should be hardware the group owns or is explicitly authorized to test.

Start in 10 minutes

Turn Faulty Cat on with the ON/OFF switch (SW2). It runs on USB-C or on 3x AA batteries — USB-C takes priority when both are present.
For a basic EMFI test, no firmware flashing is needed: press ARMING to charge the high-voltage capacitor, then press PULSE once the CHG and HV LEDs light up.
For parameter sweeps, SWD scanning and the logic analyzer, install the faultycmd host CLI/TUI — a packaged installer for your OS, or pip install -e . from source.
Run faultycmd setup-env (Linux and macOS; with sudo on Linux) to install the udev rule and add your user to the dialout group, then check the link with faultycmd devices and faultycmd verify — see the installation guide.
Run faultycmd update to flash the firmware build that matches your host tool version, then confirm the exact version match in the CDC2 diag banner or with the version shell command before you rely on the pairing.

Weight	.80 g
Dimensions	18 × 12.5 × 3 cm
MCU	RP2040 — dual-core ARM Cortex-M0+ at 133 MHz, bare chip on the PCB (not a Raspberry Pi Pico module)
Memory	264 kB on-chip SRAM
Flash	W25Q16JV external QSPI flash, 16 Mbit (2 MB)
Power	USB-C or 3x AA alkaline batteries (USB-C takes priority); minimum working voltage ~3.8 V; 3.3 V I/O; no battery charger on board, High-voltage section: 0.47 µF capacitor charged to ~240–250 V through two step-up transformers (rated up to 630 V storage)
Fault injection	EMFI — ~240–250 V flyback capacitor discharged into a coil on the SMA output, pulse width in microseconds, Crowbar — power MOSFET briefly shorts the target VCC to GND, pulse width in nanoseconds, no HV capacitor involved
Pulse width range	Crowbar: 8 – 50,000 ns, EMFI: 1 – 50 µs
Execution modes	Direct — single shot, Campaign — automated sweep over the cartesian product of delay, width and power, with a 256-entry on-device result ring buffer
Debug and analysis	SWD/JTAG pinout scanner (JTAGulator-style brute force; `scan swd` exposed at firmware v3.0, JTAG verbs WIP for v3.1), 8-channel protocol-agnostic logic analyzer (GP0-GP7, SUMP/OLS, decoded in PulseView/sigrok), BusPirate v1 BBIO, OpenOCD-style JTAG and flashrom serprog v1 compatibility
Connectors	USB-C, 8-channel scanner header (GP0-GP7, Conn_01x10 with VCC and GND), External trigger input, 2 pins, level-shifted via TRIGGER_VREF, Analog target-monitor input (GP29/ADC3), SMA for the EMFI coil output, J6 connector for the 3x AA battery holder
USB interface	VID 1209 / PID FA17, 4 CDC interfaces: EMFI control, Crowbar control, scanner/shell and target-UART passthrough
Board dimensions	51.32 x 134.62 mm (board only, packaging not included)
License	Hardware: CC BY-SA 3.0 (adapted from Colin O'Flynn's ChipSHOUTER PicoEMP design), Firmware: BSD 3-Clause

Where can I download the FaultyCat firmware? Is the firmware source public, or only binary blobs in Releases?

The firmware is fully public, source included. It lives in its own repository, ElectronicCats/faultycat-firmware, which holds the v3 source and the tagged releases as RP2040 .uf2 files, under a BSD 3-Clause license; the latest tagged release is v2.2.1.1, published on 28 July 2026. You do not need it to get started — the board comes pre-flashed and a basic EMFI test needs no flashing at all. To update, hold BOOT/BOOTSEL while powering on so the board mounts as the RPI-RP2 volume and drag the .uf2 file onto it, or let `faultycmd update` handle the whole sequence for you.

What's actually different between Faulty Cat and PicoEMP?

Faulty Cat is an adaptation of Colin O’Flynn’s ChipSHOUTER PicoEMP design, ported to KiCad with changes to the BOM and dimensions, and released under the same CC BY-SA 3.0 license. What it adds is a second, independent fault-injection path — Crowbar, a power MOSFET that briefly shorts the target’s supply to ground in nanoseconds, alongside the EMFI coil — plus Campaign mode, which sweeps delay, pulse width and power automatically and keeps up to 256 results on the board; host-validated pulse bounds of 8 to 50,000 ns for Crowbar and 1 to 50 µs for EMFI; an 8-channel logic analyzer over the scanner header; an SWD/JTAG pinout scanner; and BusPirate, OpenOCD-style JTAG and flashrom serprog compatibility. The project’s own documentation benchmarks these trade-offs explicitly against ChipSHOUTER and PicoEMP.

Is the schematic available as a PDF, not just as KiCad source files?

The complete hardware design is public in the hardware repository, ElectronicCats/faultycat: the KiCad source files, the bill of materials and the schematics, licensed CC BY-SA 3.0. The wiki carries the technical specs and the connector pinout — the 8-channel scanner header, the external trigger input with its TRIGGER_VREF level shift, the analog target-monitor input and the SMA output for the EMFI coil.

What am I allowed to use Faulty Cat for?

Faulty Cat is a fault-injection tool intended solely for authorized security research and testing on hardware you own or have explicit permission to test. Electronic Cats and PWNLab hold no responsibility for unauthorized use or resulting damage. Every use case on this page assumes that condition: your own target boards, or a client’s, within an agreed scope.

Cart

Cart

Faulty Cat V2.2

In the box

Not included

You also need

What is Faulty Cat?

Prove the target faults before you commit to it

Find the debug pins, then watch the bus

Run a hands-on glitching workshop

Start in 10 minutes

Cart

Cart

Faulty Cat V2.2

Email when stock available

In the box

Not included

You also need

What is Faulty Cat?

Prove the target faults before you commit to it

Find the debug pins, then watch the bus

Run a hands-on glitching workshop

Start in 10 minutes

You may also like…

Flipper Add-On: Marauder

PAW Protector

MagSpoof V4