diff --git a/firmware/application/src/app_cmd.c b/firmware/application/src/app_cmd.c
index 7a6a507..53309a7 100644
--- a/firmware/application/src/app_cmd.c
+++ b/firmware/application/src/app_cmd.c
@@ -11,6 +11,7 @@
 #include "app_cmd.h"
 #include "app_status.h"
 #include "tag_persistence.h"
+#include "nrf_pwr_mgmt.h"
 
 
 #define NRF_LOG_MODULE_NAME app_cmd
@@ -52,6 +53,18 @@ data_frame_tx_t* cmd_processor_get_device_mode(uint16_t cmd, uint16_t status, ui
     return data_frame_make(cmd, STATUS_DEVICE_SUCCESS, 1, (uint8_t*)&status);
 }
 
+data_frame_tx_t* cmd_processor_enter_bootloader(uint16_t cmd, uint16_t status, uint16_t length, uint8_t *data) {
+    // restart to boot
+    #define BOOTLOADER_DFU_GPREGRET_MASK            (0xB0)      
+    #define BOOTLOADER_DFU_START_BIT_MASK           (0x01)  
+    #define BOOTLOADER_DFU_START    (BOOTLOADER_DFU_GPREGRET_MASK |         BOOTLOADER_DFU_START_BIT_MASK)      
+    APP_ERROR_CHECK(sd_power_gpregret_clr(0,0xffffffff));
+    APP_ERROR_CHECK(sd_power_gpregret_set(0, BOOTLOADER_DFU_START));
+    nrf_pwr_mgmt_shutdown(NRF_PWR_MGMT_SHUTDOWN_GOTO_DFU);
+    // Never into here...
+    while (1) __NOP();
+}
+
 
 #if defined(PROJECT_CHAMELEON_ULTRA)
 
@@ -520,7 +533,7 @@ static cmd_data_map_t m_data_cmd_map[] = {
     {    DATA_CMD_GET_APP_VERSION,              NULL,                        cmd_processor_get_version,                   NULL                   },
     {    DATA_CMD_CHANGE_DEVICE_MODE,           NULL,                        cmd_processor_change_device_mode,            NULL                   },
     {    DATA_CMD_GET_DEVICE_MODE,              NULL,                        cmd_processor_get_device_mode,               NULL                   },
-
+    {    DATA_CMD_ENTER_BOOTLOADER,             NULL,                        cmd_processor_enter_bootloader,              NULL                   },
 #if defined(PROJECT_CHAMELEON_ULTRA)
 
     {    DATA_CMD_SCAN_14A_TAG,                 before_hf_reader_run,        cmd_processor_14a_scan,                      after_hf_reader_run    },
diff --git a/firmware/application/src/data_cmd.h b/firmware/application/src/data_cmd.h
index 35ae0d6..45a25ad 100644
--- a/firmware/application/src/data_cmd.h
+++ b/firmware/application/src/data_cmd.h
@@ -17,6 +17,7 @@
 #define DATA_CMD_SET_SLOT_TAG_NICK              (1007)
 #define DATA_CMD_GET_SLOT_TAG_NICK              (1008)
 #define DATA_CMD_SLOT_DATA_CONFIG_SAVE          (1009)
+#define DATA_CMD_ENTER_BOOTLOADER               (1010)
 //
 // ******************************************************************
 
diff --git a/software/script/chameleon_cli_main.py b/software/script/chameleon_cli_main.py
index 4c5cb93..4d46732 100644
--- a/software/script/chameleon_cli_main.py
+++ b/software/script/chameleon_cli_main.py
@@ -75,6 +75,7 @@ class ChameleonCLI:
                     'openall': new_uint(chameleon_cli_unit.HWSlotOpenAll, "Open all slot and set to default data"), 
                     'help': "Emulation tag slot.",
                 },
+                'dfu': new_uint(chameleon_cli_unit.HWDFU, "Restart application to bootloader mode(Not yet implement dfu)."),
                 'help': "hardware controller",
             },
             'hf': {
diff --git a/software/script/chameleon_cli_unit.py b/software/script/chameleon_cli_unit.py
index 3d3d83f..a8f48a4 100644
--- a/software/script/chameleon_cli_unit.py
+++ b/software/script/chameleon_cli_unit.py
@@ -932,3 +932,18 @@ class HWSlotOpenAll(DeviceRequiredUnit):
         # update config and save to flash
         self.cmd_positive.update_slot_data_config()
         print(f' - Open all slot and set data to default success.')
+
+
+class HWDFU(DeviceRequiredUnit):
+
+    def args_parser(self) -> ArgumentParserNoExit or None:
+        return None
+    
+    # hw dfu
+    def on_exec(self, args: argparse.Namespace):
+        print("Application restarting...")
+        self.cmd_standard.enter_dfu_mode()
+        # 理论上，上面的指令执行完成后，dfu模式会进入，然后USB会重启，
+        # 我们判断是否成功进入USB，只需要判断USB是否变成DFU设备的VID和PID即可，
+        # 同时我们记得确认设备的信息，一致时才是同一个设备。
+        print(" - Enter success @.@~")
diff --git a/software/script/chameleon_cmd.py b/software/script/chameleon_cmd.py
index 721b71c..709183f 100644
--- a/software/script/chameleon_cmd.py
+++ b/software/script/chameleon_cmd.py
@@ -15,6 +15,8 @@ DATA_CMD_GET_SLOT_TAG_NICK = 1008
 
 DATA_CMD_SLOT_DATA_CONFIG_SAVE = 1009
 
+DATA_CMD_ENTER_BOOTLOADER = 1010
+
 DATA_CMD_SCAN_14A_TAG = 2000
 DATA_CMD_MF1_SUPPORT_DETECT = 2001
 DATA_CMD_MF1_NT_LEVEL_DETECT = 2002
@@ -391,6 +393,12 @@ class BaseChameleonCMD:
         """
         return self.device.send_cmd_sync(DATA_CMD_SLOT_DATA_CONFIG_SAVE, 0x00, None)
 
+    def enter_dfu_mode(self):
+        """
+            重启进入DFU模式(bootloader)
+        :return:
+        """
+        return self.device.send_cmd_auto(DATA_CMD_ENTER_BOOTLOADER, 0x00, None)
 
 
 class NegativeResponseError(Exception):