Bruce Firmware Beta Validation Report (05e3af3) - @IncursioHack

[IncursioHack]

Test Environment

Firmware

Bruce Beta 05e3af3
Build date: 2026-07-27 22:51

Hardware

StackChan (CoreS3)
Cardputer ADV
SanDisk 32GB microSD
Windows 11
Android smartphone

Objective

This report summarizes functional testing performed across multiple Bruce Firmware modules. The goal was to validate implemented features, identify reproducible issues, document limitations, and provide improvement suggestions.

StackChan Validation

SD Card

• SD initialization successful.
• Read/write operations worked as expected throughout all tests.

WiFi

Features validated

The following features worked as expected during testing:

• Turn On WiFi
• Capture Handshake (4-way handshake successfully captured and saved)
• Information
• Clone Portal
• Deauth + Clone
• Deauth + Clone + Verify
• Beacon Spam
• Evil Portal (Default)
• Evil Portal (Custom HTML)
• SOCKS4 Proxy
• Sniffer (PCAP successfully generated)
• Channel Analyzer
• Scan Hosts
• MAC Address Change
• Add Evil WiFi
• Remove Evil WiFi
• Evil WiFi Settings

Observations

• Deauth
  The attack executed normally.
  No visible deauthentication effects were observed on my Windows 11 PC or Android device during testing.
  This may depend on the target hardware and wireless infrastructure.

• Deauth Flood
  Executed for approximately three minutes at approximately 4200 frames/sec.
  No visible client disconnections were observed.

• Enhanced Deauth
  Station Deauth executed successfully.
  Approximately 72,000 packets transmitted at around 108 frames/sec.
  No visible deauthentication effect was observed on nearby clients.

• Karma Attack
  Executed for several minutes while manually changing channels up to channel 11.
  Observed results:
  Total Requests: 112
  Unique: 84
  Active: 3
  Pending: 0
  Queue: 0
  Beacons: 0
  Karma: 3
  Clone: 0
  Handshakes: 0
  PMKID: 0
  No handshakes were captured during testing.
  Additional Karma configuration options were not evaluated.

• Listen TCP
  Initially accepted the connection.
  Shortly afterward the firmware reported:
  Client Disconnected

• Channel Analyzer
  Feature worked correctly.
  Measurements were cross-validated using a second SDR receiver.
  The interface refreshes frequently, making long observations somewhat difficult.

• Rogue Detect
  Successfully detected deauthentication activity generated from another Bruce device.
  During repeated testing the firmware rebooted unexpectedly on some occasions.

BLE
Features validated

The following features worked as expected:

• Presenter
• Media Commands
• Bad BLE
• Android Device Alert
• Windows Swift Pair
• Apple Action Modal
• Apple Pairing Prompt

Observations

• Samsung BLE Spam continuously generated Bluetooth advertisements but no Samsung notification was received.

• Apple "Not Your Device" generated advertisements but no Apple notification was observed.

• Presenter functionality worked correctly. Minor UI improvements for CoreS3 navigation would improve usability.

Files

The following modules worked as expected:

• Web UI
• Mass Storage
• SD Card Browser
• LittleFS

RFID

• Scan Tag

Successfully:

• Read tag
• Saved tag
• Emulated tag

Tested using the built-in ST25R3916 reader with a MIFARE condominium access tag.

Infrared

Validated successfully:

• TV-B-GONE
• IR Read
• IR Jammer

IR Jammer appeared to operate correctly when observed using a camera. A dedicated infrared camera would be required for further validation.

GPS

• GPS Tracker
  Tested using the original M5Stack GPS v1.0 module.
  GPS fix required some time due to environmental conditions but operated correctly afterward.

• Wardriving
  Executed for approximately five minutes.
  Coordinates and WiFi information were collected successfully.

RF433

Validated successfully:

• Scan / Copy
• Spectrum
• Full Power Jammer
• Intermittent Jammer
• Brute Force (4096 Nice 12-bit)

Observation
Intermittent mode appeared more effective than continuous transmission during testing.

Other Features

Validated successfully:

• Clock
• QR Codes
• BadUSB
• Display Brightness
• Display Timeout
• Orientation
• UI Color
• Instaboot
• WiFi Startup
• Startup Application
• Hide/Show Apps
• Clock Configuration
• Toggle BadUSB/BLE
• BLE Name
• Network Credentials
• Factory Reset

Cardputer ADV Validation

CC1101

Successfully validated:

• Scan / Copy
• Spectrum (RSSI)
• Full Jammer
• Intermittent Jammer
• Noise Storm
• Frequency Sweep
• Custom Sub-GHz
• Brute Force

GPS

• GPS Tracker and Wardriving operated correctly after satellite acquisition in an open area.

• Wardriving executed for approximately seven minutes.

NRF24

Validated:

• Spectrum
• NRF Jammer

The jammer was effective only at short range. A higher gain antenna may improve performance.

LoRa

• LoRa Chat successfully transmitted and received messages between multiple LoRa devices.

Confirmed Issues

The following issues were consistently reproducible during testing and will be reported individually.

WiFi

1. Brucegotchi did not capture any handshake after approximately seven minutes of execution.
2. Client TCP immediately reported "Client Disconnected" after entering the listening port.
3. NetCut was executed against multiple targets without any observable effect.

RFID

4. Chameleon connects successfully but freezes immediately after connection, preventing any interaction.

USB

5. USB Keyboard produced unexpected keyboard lock on Windows 11.
6. USB Clicker was not recognized as a mouse on Windows 11.

Audio

7. Audio menu only displays the Back button.

User Interface

8. ESC button visibility is inconsistent on CoreS3/StackChan.
9. BLE Suite interface is inconsistent with the rest of Bruce.
10. Several BLE Suite screens do not correctly display navigation buttons.
11. BLE Scan frequently displays "" even with multiple nearby BLE devices.
12. Deep Diving reports "Found: # devices" without displaying the actual number.

Untested Features

The following features could not be validated due to unavailable hardware or test environment:

• Ethernet (W5500)
• PN532 BLE
• PN532 UART
• Amiibolink
• iButton
• USB U2F
• BLE API
• iBeacon (requires iPhone validation)
• Ninebot
• MouseJack
• WireGuard
• WiFi Password Recovery
• Telnet
• SSH
• Responder

Feature Requests

QR Code

• Allow selecting TXT files stored in a predefined "BruceQRCode" directory instead of manually typing large QR contents.

Audio

• Add MP3/WAV playback support.
• This would enable future media player functionality within BruceApps.

WiFi

• Rename Rogue Detect/Jam Detect to better distinguish future NRF24 jamming detection features.

BLE

• Move Ninebot into BruceApps.
• Review BLE Suite implementation and overall stability.

LED

• Provide LED control (GPIO, colors, effects) configurable through BrucePins.conf.

Keyboard

• Add native support for M5Stack external keyboards, similar to Bruce Launcher.

Pins

• Centralize all hardware pin assignments (GPS, RFID, NFC, ST25, PN532, CC1101, RF433, NRF24, Ethernet, Audio, LEDs, IR, sensors, etc.) inside BrucePins.conf or configuration menus.
• Allow multiple I2C buses for platforms such as CoreS3, StackChan, and Cardputer ADV.

FM

• Consider moving FM support out of the firmware into BruceApps JavaScript modules.

UI

• Reduce screen refresh frequency for Channel Analyzer and Rogue Detect to improve readability.

Microphone

• Enable microphone functionality for CoreS3/StackChan, which includes dual microphones already supported by M5Stack libraries.

Final Remarks

Overall, Bruce Firmware Beta demonstrated excellent stability and a high level of feature completeness across multiple hardware platforms.

Most core features operated as expected. The identified issues are primarily related to specific modules, UI consistency, or platform-specific behavior rather than widespread firmware instability.

Individual GitHub Issues will be opened for each reproducible bug listed above.

[IncursioHack]

Additional Notes

The issues listed above will be reproduced again before opening individual GitHub Issues. I'll collect additional logs and evidence whenever possible, and the issues will be created throughout the week.

Regarding the feature requests, if possible, please reply with a simple "OK" or "No" for each suggestion. This will help contributors focus on features that fit the project's roadmap and avoid unnecessary work or duplicate implementations.

Once a feature is approved, I can open dedicated Issues or submit Pull Requests where appropriate.

[bmorcelli]

Issues found

USB

• USB Keyboard produced unexpected keyboard lock on Windows 11.

I have tested it with W11 too, during development, it didn't lock anything on my side.. what kind of lock are you talking about? how can I reproduce it?

The clicker I haven't test.. need to check it out

Several BLE Suite screens do not correctly display navigation buttons.

is it missing the navigation bar on the bottom of the screen?

Audio menu only displays the Back button.

Config > Audio Config > [menu] are only available for devices where BUZZ_PIN or HAS_NS4168_SPKR are defined, not the case of CoreS3 and many other devices

Features Requested

Audio

• Add MP3/WAV playback support.
• This would enable future media player functionality within BruceApps.

It is supported on supported devices (Cardputer for example),
Files > SD Card/LittleFS > Select file audio > Play Audio' it currently runs: MP3, WAV, FLAC, AAC, OPUS, MOD, RTTTL on devices where HAS_NS4168_SPKR` is defined

Microphone

• Enable microphone functionality for CoreS3/StackChan, which includes dual microphones already supported by M5Stack libraries.

Pins are hardcoded now, there is this #2319 that exposes the I2S Pinouts, which can be good, but the biggest problem we are facing is configuring the ES8311 codec.
Microphone could be configured this way too, I think..

Pins

• Centralize all hardware pin assignments (GPS, RFID, NFC, ST25, PN532, CC1101, RF433, NRF24, Ethernet, Audio, LEDs, IR, sensors, etc.) inside BrucePins.conf or configuration menus.
• Allow multiple I2C buses for platforms such as CoreS3, StackChan, and Cardputer ADV.

Modules that use UART, SPI or I2C buses have its configuration set on Config > Dev Mode > Here you are but for that you need to activate Dev Mode by cicle through the whole Main Menu in the NEXT direction 5 times. I will move this section to Config > Advanced > Config Pins > {menu}` so it will be accessible to everybody, on their own risk.

ESP32 can work with 2 simultaneous I2C buses (Except for ESP32-C6 where Arduino Nesso N1 has only one bus, and is is shared by many internal ICs)

Some devices use one of them to drive its internal components, like PMIC, Gauge, TouchScreen and IO Expanders, so it makes things a little more complicated, because sometimes these pins are exposed and can be used by other external modules, sometimes it is not, and should not be changed.

On the boards/<env>/platformio.ini or pins_arduino.h files you will see:

*platformio.ini*
	;Default I2C port
	-D GROVE_SDA=5
	-D GROVE_SCL=4
	-D SYS_I2C_SDA=10
	-D SYS_I2C_SCL=8

*pins_arduino.h*

// Set Main I2C Bus
#define GROVE_SDA 8
#define GROVE_SCL 18
#define SYS_I2C_SDA 8
#define SYS_I2C_SCL 18

GROVE_SDA and GROVE_SCL are the pins we set for default bruceConfigPins.i2c_bus.[sda,scl] which can be changed in the menu I mentioned. It will be used by all I2C modules you connect to the device, and it will use the global TwoWire Wire (Wire0) object to drive the modules, because the library we use to control PN532 over I2C can only work with this port (hardcoded and will be reviewed)

SYS_I2C_SDA and SYS_I2C_SCL are new in 1.16, and introduce the bruceConfigPins.sys_i2c.[sda,scl] which SHOULD NOT be changed. and it usually use the global TwoWire Wire1 object to not conflict with the extposed I2C bus. The problem is when the device has this bus exposed and there is no other option, as are: T-Embed CC1101, T-LoraPager, M5Core, M5Core2, Smoochiee-board and Reaper.. in these case src/core/bus_HAL.h will drive sys_i2c to Wire instead of Wire1, so PN532 can work over I2c, as is on T-Embed CC1101.

Changing bruceConfigPins.sys_i2c.[sda,scl] is dangerous, because it breakes PMIC, RTC and Touchscreen, leading to lagged UI navigation, unresponsive screens, etc..

As we talked earlier, It is a good idea give the user the freedom to choose between this port and the external port. The examples ar:

• Cardputer ADV: sys_i2c is tied to pins 8 and 9, available on the pin header and exposed by the Lora Cap and Grove connector is the default I2C bus on pins 1 and 2.
• CoreS3 (Stackchan): sys_i2c is tied to pins 11 and 12, and default I2C bus is tied to Port A, pins 1 an 2

Using NFC Unit or RFID 2 on the Grove port will work as expected, but connecting to that port on the Lora Cap won´t work, withou effort.
Stackchan has a ST25R3916 module connected into the sys_i2c bus, and can only be used if you change the pins on Config > Dev Mode > I2C Bus, but then every other I2C module you connect to Port A won´t work..

So I will add an option on the RFID to choose bewteen SYS_I2C and the other, so you don´t need to remap the bus.

Keyboard

• Add native support for M5Stack external keyboards, similar to Bruce Launcher.

It brings up the I2C bus in use.. on Launcher it was added for M5Stack devices using the decault Grove connector, but it attached to the sys_i2c, it won't work..
I will add one more device pulling from I2C, but asyncronously (in other task) with other devices such as NFC Unit and RFID 2, which can cause WDT restarts if not done carefully.. and both these modules need high pulling rate to work, so using a CardKb for navigation could be complicated.. maybe only for keyboard entries it can be good.

LED

• Provide LED control (GPIO, colors, effects) configurable through BrucePins.conf.

• Colors, Effects and brightness configuration is on bruce.conf file, common to all devices you have, so you set it on one device and it will be applied in every device when sharing the same SDCard
• GPIO, Led type and number of LEDs are hardcoded by device.. it can be configured, externally, but will increase the binary a little bit on devices that don´t have RGB Led.. don't really know how it would benefit

BLE

• Move Ninebot into BruceApps.
• Review BLE Suite implementation and overall stability.

BruceApps are for JavaScript an Themes, there are no interface between BLE and Javascript, so it is not doable atm.

About BLE, I am thinking on encapsulate the SPAMs that are known to fail 99% of the times into dev mode, and keep it as WIP.. who wants it, can enable it knowing that it probably won´t work (probably because was patched on the target side)

FM

• Consider moving FM support out of the firmware into BruceApps JavaScript modules.

Agreed, now that Interpreter can make use of I2C and SPI, this section can be removed and use JS instead.

[IncursioHack]

Good morning, my brother! @bmorcelli

It's always a pleasure to contribute to this project with you. If every software project had maintainers with your responsiveness and technical mindset, we'd probably see much faster progress across the industry.

Issues found

I have tested it with W11 too, during development, it didn't lock anything on my side.. what kind of lock are you talking about? how can I reproduce it?
The clicker I haven't test.. need to check it out

I can test the keyboard again. My first impression was that it worked as a real-time keyboard, but from what I observed it seems to buffer the input and then send it to the target device. In my case, for some reason, it left the CTRL and ALT keys stuck on Windows 11 until I rebooted. It may have been an isolated issue, so I'll reproduce it carefully, collect logs if possible, and then open a dedicated issue.

is it missing the navigation bar on the bottom of the screen?

Yes, exactly. Since the UI is different, the navigation buttons disappear on the CoreS3/StackChan display.

Config > Audio Config > [menu] are only available for devices where BUZZ_PIN or HAS_NS4168_SPKR are defined, not the case of CoreS3 and many other devices

If a device doesn't support audio, I think it would be better to hide the Audio menu entirely (similar to how the Microphone menu is handled) rather than displaying an empty menu. For the StackChan, however, it makes sense to keep it if audio support is implemented.

Features Requested

It is supported on supported devices (Cardputer for example),
Files > SD Card/LittleFS > Select file audio > Play Audio' it currently runs: MP3, WAV, FLAC, AAC, OPUS, MOD, RTTTL on devices where HAS_NS4168_SPKR` is defined

During my research I found both MIC and Speaker support in the M5Unified library, although I suspect pulling in the entire library might be too heavy for Bruce.

Pins are hardcoded now, there is this #2319 that exposes the I2S Pinouts, which can be good, but the biggest problem we are facing is configuring the ES8311 codec.
Microphone could be configured this way too, I think..

Still, I believe it could simplify part of the implementation process.

Modules that use UART, SPI or I2C buses have its configuration set on Config > Dev Mode > Here you are but for that you need to activate Dev Mode by cicle through the whole Main Menu...

Moving the pin configuration would greatly help support new projects and previously unknown hardware.

Dev Mode could still exist as a place to test experimental features. For example, if a developer submits a PR with a new feature, it could initially be added to the Dev Mode menu so the community can test it. Once it's considered stable, it could be promoted to the main menu in a future release.

In that sense, Dev Mode would effectively serve as a beta testing area for new features.

Regarding your I2C suggestions, I completely agree. This would allow us to support many more use cases. Besides the scenarios we already discussed, I also have a USB-C to Grove adapter that I'd like to test with this approach.

It brings up the I2C bus in use.. on Launcher it was added for M5Stack devices using the decault Grove connector, but it attached to the sys_i2c, it won't work....

Even if it's only used for keyboard input, it would already be a great addition. For example, you could use a StackChan or a CYD touchscreen as a mouse to navigate the interface, while using a CardKB to enter text. This would be especially useful for features like SSH and Telnet, but it would also make entering Wi-Fi passwords, credentials, and even playing some games much more convenient.

Colors, Effects and brightness configuration is on bruce.conf file, common to all devices you have, so you set it on one device and it will be applied in every device when sharing the same SDCard...

That makes sense. The Cardputer already has a menu to control the LEDs on one of its pins, which I only discovered over a year later. Wouldn't it be possible to reuse that same menu for the StackChan by pointing it to its LED pins? If I remember correctly, the LED library already supports a wide range of devices.
One more thought—and now I'm stretching a bit to find a hacking-related use case 😄-, a while ago I saw a proof of concept where keyboard LEDs were used to exfiltrate data in Morse code, captured by a security camera. It would be a pretty fun feature to experiment with.
If this ever gets implemented, the first thing I'll do is make it blink "BRUCE" in Morse code. ^^

BruceApps are for JavaScript an Themes, there are no interface between BLE and Javascript, so it is not doable atm.

I agree with moving features that have limited practical value or are currently not working reliably to a different section. Following my previous suggestion, if Dev Mode serves as a beta testing area, those features could live there until they're more mature or fully functional.

Agreed, now that Interpreter can make use of I2C and SPI, this section can be removed and use JS instead.

I think that approach makes more sense. It would also be worth checking whether removing it could break existing themes or affect the theme generator website.

[Ninja-jr]

Great work and observations from both of you whose work I highly appreciate.

For the ble suite, when I first coded it, I was on a tembed and made the mistake of hardcoding certain positioning in px instead of dynamic adapting them to different screens...yup rookie mistake I know and I own up to it...but many of those have been fixed, but I suppose there are still bits left indeed.

For the ble spams...well at least on my tests on a samsung phone, both samsung and general android ones work and in plus the android ones can distinguish when its a samsung device from comparing with the oui list and deliver the correct payload for them. The last person that finished fixing the Apple ones said they had tested them on apple recently and it worked... now I dunno if they have patched it again on the latest ios version which is possible. I don't own any apple device to teqt that.

Anyway appreciate you guys and your work and it just motivates me to also contribute a little on what I can even if my knowledge are quite limited compared yo you.

[Dead3ch]

Version 1.12 of the NRF 24 jams through three walls. Version 1.11 jammed in open spaces up to 100 meters away. The new version 1.16 doesn't even jam from one meter away... I use Cardputer ADV.

[IncursioHack]

Version 1.12 of the NRF 24 jams through three walls. Version 1.11 jammed in open spaces up to 100 meters away. The new version 1.16 doesn't even jam from one meter away... I use Cardputer ADV.

My tests consider the version BETA mentioned above, you performed tests with the version Beta in the same conditions as version 1.11 and 1.12 (considering distance and barriers)?

[bmorcelli]

Issue Tracker

WiFi

• Brucegotchi did not capture any handshake after approximately seven minutes of execution. -> PR refactor: internal refactoring and optimization of Brucegotchi #2724 refactor: internal refactoring and optimization of Brucegotchi #2724
• SSH/Telnet fixes for non keyboard devices and fixed crash that occurs when acessing SSH while not connected to any network -> 706d5c7
• Station Deauth fixes -> ffadadc
• Reduce screen refresh frequency for Channel Analyzer and Rogue Detect to improve readability. -> e80f670
• Client TCP immediately reported "Client Disconnected" after entering the listening port. b2d20d4
• NetCut was executed against multiple targets without any observable effect. b2d20d4

BLE

• ESP32-C5 crashing when using BLE Span and some other BLE Funcions -> 7b37b73
• Overall BLE Spam fixes -> 0ecc6fd c2ad620 7b37b73

RFID

• Chameleon connects successfully but freezes immediately after connection, preventing any interaction. -> Tested and working as expected with a Chameleon Ultra clone

USB

• USB Keyboard produced unexpected keyboard lock on Windows 11. -> Can´t reproduce
• USB Clicker was not recognized as a mouse on Windows 11. b2d20d4

Audio

• Audio menu only displays the Back button. -> Fixed on d0425ba

Pins

• "Legaxy" pinout on StickCPluses was broke due to SPI conflicts with SD Pinouts -> c23c63c
• CoreS3 SDCard wasn't working due to conflicts with M5Unified and Bruce. Reason why CoreS3-SE wasn't working too. -> 1c3484d
• T-LoraPager encoder running oposite directon and navigation issues -> 706d5c7
• Move Config > Dev Mode > { pin settings } to Config > Advanced > Pin settings > { bus } -> e80f670

Interpreter

• Fixed BadUSB not being executed using Interpreter -> 95a251d

User Interface

• ESC button visibility is inconsistent on CoreS3/StackChan. -> d0425ba
• Several BLE Suite screens do not correctly display navigation buttons. -> d0425ba
• Fixe M5Stack StickS3 jumping bootscreen inconditionally -> da055a7
• BLE Scan frequently displays "" even with multiple nearby BLE devices. -> e80f670
• Deep Diving reports "Found: # devices" without displaying the actual number. -> e80f670

Maybe on next Major version

• BLE Suite interface is inconsistent with the rest of Bruce. -> Need Refactoring, next major version
• QR Code: Allow selecting TXT files stored in a predefined "BruceQRCode" directory instead of manually typing large QR contents.
• WiFi: Rename Rogue Detect/Jam Detect to better distinguish future NRF24 jamming detection features.
• Keyboard: Add native support for M5Stack external keyboards, similar to Launcher.
• CoreS3: Enable microphone functionality for CoreS3/StackChan, which includes dual microphones already supported by M5Stack libraries.
• FM: Move FM support out of the firmware into BruceApps JavaScript modules.
• I2C HAL: Provide a way to select/use SYS_I2C or I2C_BUS when they are diferente (Cardputer ADV I2C_BUS points to 1/2 and SYS_I2C to 8/9, choose which to use without change I2C_BUS pinouts
• LED: Provide LED setup (GPIO and number of leds) configurable through BrucePins.conf.
• Mic and Speaker: setup (GPIO and type) configurable through BrucePins.conf.