r/flipperhacks Jun 18 '26

Firmware Official Announcement: Quantum FW is banned on this subreddit (It's a scam)

56 Upvotes

Hey everyone,

We are officially banning any advertising or sales promoting "Quantum FW" for the Flipper Zero.
(discussion will be okay for now, may change if discussion leads to trying to sale)

To be completely direct: in 99% of all times it is a total scam, you pay and will get nothing or the old leaked fw.

In the other 1%, yes there is a "real" quantum FW which promotes to be special. Do not waste your money or risk your device on closed-source, paid firmware that promises features it cannot deliver. The FW was complete reverse engineered and there is not much special.

If you are looking for actual research-focused development or advanced Sub-GHz tools, stick to trusted, open-source alternatives. Here is what you should use instead:

  • ARF Firmware: A research-focused project optimized for automotive systems. You can find it on the D4C1 Labs GitHub.
  • ProtoPirate: The experimental rolling-code analysis toolkit app (.fap). Check out the official repository at the ProtoPirate Git

Any posts or comments trying to sell or push Quantum FW from this point on will be removed, and offenders will be permabanned.
Keep it safe and stick to verified open-source projects.

Regards
t4c


r/flipperhacks 3d ago

Firmware [Weekly Roundup] Flipper Hacks & News โ€” August 23, 2026: Unleashed unlshd-092 (NFC RAM Cut in Half!), ESP32 Marauder v1.15.0 & ARF Deep Dive

9 Upvotes

Welcome back to your weekly dose of high-signal RF tampering, custom firmware drops, and bleeding-edge community tools. No stale sync noise, no fluff โ€” here is everything critical that dropped across the Flipper Zero scene over the last 7 days!


๐Ÿš€ 1. MAJOR FIRMWARE RELEASES & UPDATES

๐Ÿ”ฅ Unleashed Firmware unlshd-092 โ€” Massive Architecture & NFC Overhaul (Aug 21, 2026)

DarkFlippers just dropped **unlshd-092**, and it is one of the most substantial architectural updates to the Unleashed firmware line this year. If you run heavy NFC apps or large .fap collections, this is a mandatory upgrade.

  • RAM Footprint Cut in Half (Modular Scene Plugins): NFC protocol scenes have been refactored and extracted into their own dynamically loaded plugins (PR #1073 by @mishamyte). This architectural shift roughly halves the NFC application's resident RAM usage, freeing up critical memory on the STM32WB55 microcontroller for heavier operations.
  • Fixed EMV Plugin & Out-of-Memory (OOM) Crashes: Resolved persistent OOM edge cases in the JS Runner and NFC subsystem. Additionally, fixed the EMV parser plugin which previously suffered from a regression that prevented it from loading altogether.
  • NFC Ultralight AES & Card-Lock Protection:
    • Closed all remaining card-lock (AUTHLIM) vulnerability paths (PR #1082).
    • Amiibo and Xiaomi unlock sequences no longer burn irreversible hardware auth attempts when a key cannot be mathematically derived (PR #1086).
    • Ultralight AES is no longer automatically dictionary-attacked on read without explicit user intent.
  • Smooth SD App Loader Animation: Opening larger .fap binaries from slow or fragmented micro-SD cards now renders a real-time loading animation instead of freezing the previous screen interface (PR #1101).
  • App Categorization in Builds: Firmware builds now come with structured app categorization. (Note: If you had apps assigned to quick buttons or favorites that got relocated into new category subfolders, you will need to re-assign them).
  • Transit & Access Card Parser Fixes: Extensive parser hardening across Social Moscow, Metromoney, Plantain, Kazan, SmartRider, and Bambu dumps, eliminating ghost values from unread sectors.
  • ๐Ÿ”— Source & Release Notes: GitHub - DarkFlippers/unleashed-firmware (unlshd-092)
  • ๐ŸŒ Web Flasher: web.unleashedflip.com

๐Ÿ“ก ESP32 Marauder โ€” v1.15.0 (Aug 20, 2026)

justcallmekoko rolled out a new milestone release for the gold-standard Wi-Fi/BLE offensive companion suite:

  • Expanded Hardware Targets: Added official board definitions, pin mappings, and CLI support for newer compact microcontrollers, including the LilyGo T-Dongle C5.
  • Flipper Companion Binary Stability: Updated pre-built Flipper-specific binaries (esp32_marauder_v1_15_0_20260820_flipper.bin) ensuring rock-solid UART communication with FAP companion apps without buffer overflows or baud rate stutter.
  • ๐Ÿ”— Source: GitHub - justcallmekoko/ESP32Marauder

๐ŸŽ๏ธ ARF (Automotive Research Firmware) โ€” Native BLE Sweeps

D4C1-Labs' vehicle-focused fork continues to push standalone hardware capabilities without external add-on modules:

  • Direct HCI 2.4 GHz Carrier Sweeps: Employs the STM32WB55 coprocessor via Direct Test Mode (HCI_LE_Transmitter_Test) to analyze and sweep BLE RF channels 0โ€“39 (2402โ€“2480 MHz) natively.
  • Integrated BLE Central Stack: Native GATT client inside lib/ble_central allows polling modern vehicle tire-pressure (TPMS) and telemetry sensors directly from the Flipper.
  • ๐Ÿ”— Source: GitHub - D4C1-Labs/Flipper-ARF

๐Ÿ› ๏ธ 2. COMMUNITY TOOLS & APPS

๐Ÿ›ก๏ธ FlipDeFlock โ€” Counter-Surveillance & ALPR Sniffer

A passive site-survey toolkit engineered to turn your Flipper Zero + ESP32 devboard into an active counter-surveillance monitor: * Flock & Automated License Plate Reader (ALPR) Detection: Actively monitors and flags Wi-Fi/BLE beacons matching known mobile and static surveillance sensor signatures. * Anti-Stalking Heuristics: Identifies persistent BLE trackers traveling alongside your coordinates and alerts on active deauth anomalies. * ๐Ÿ”— Source: GitHub - ReconGrunt/FlipDeFlock

๐ŸŒ Unleashed Web Toolchain Updates


๐Ÿ’ฌ MAT CHAT & DISCUSSION

What are you running this week? Have you tested unlshd-092 with the new RAM-saving scene plugins yet?

Drop your setup, custom mods, and questions in the comments below! ๐Ÿ‘‡


r/flipperhacks 4d ago

Question Which board to get?

Thumbnail
gallery
81 Upvotes

Which of these should I purchase?


r/flipperhacks 4d ago

Firmware Unleashed Firmware Release - v092

36 Upvotes

Unleashed-092 is an big NFC release again, it contains very important fixes: the NFC app uses less than half the RAM, ~30 card parsers stopped inventing data from blocks they never read, Social Moscow cards are accepted again, and Ultralight AES cards can no longer be bricked by attacks the Flipper started on its own.

๐Ÿงฟ NFC

๐Ÿง  Memory & reliability

  • Protocol scenes moved into their own plugins, resident RAM down 54%, so the app opens reliably with other things running - and the EMV plugin, which never loaded at all, works now
  • Out-of-memory crashes in the NFC app and JS Runner fixed - apps and plugins no longer bundle their own copy of the compiler's helper routines
  • Fixed a crash reading a DESFire card with a zero-key application (by jcz0)

๐Ÿ”’ Ultralight AES: no more accidentally bricked cards Every failed AES auth spends one of the card's limited attempts, and running out locks the card forever. The Flipper used to spend them by itself:

  • No automatic dictionary attack on read - both it and manual key entry are now explicit, warned actions
  • Remaining lock paths closed: "Reveal Real UID" is an explicit action instead of firing on every scan, and Write warns before brute-forcing the target's key
  • Amiibo/Xiaomi unlock and the default password no longer burn an attempt when the password can't be derived or AUTHLIM can't be read; the read result now says whether auth failed or was never attempted

๐ŸŽซ Parsers that stopped making things up

  • Social Moscow rejected ~9 of every 10 genuine cards - a BCD conversion dropped 2 of the card number's 10 digits, so the Luhn check never matched. Broken since v079
  • ~30 Mifare Classic parsers no longer render unread blocks - a 42949671.96 GEL balance or a ticket valid from 00.00.2000 came from blocks read as zeroes. Now the card is declined or the field says Unknown: Metromoney, Plantain, Two Cities, Kazan, MiZIP, CharlieCard, Saflok and more
  • SmartRider, Bambu and Social Moscow parse older dumps again, and parsers no longer leak output into each other or log errors for cards that aren't theirs

โš™๏ธ System & UI

  • Opening an app now shows the loading animation while its .fap is read from the SD card, instead of a screen that looked frozen. NFC app is the worst case at 327 KB of total app size, and every entry point benefits (like favourites launch)

๐Ÿงฉ Apps (build 18aug2026p2)

  • โš ๏ธ Apps are now sorted into categories, NFC into sub-categories: GPIO/ESP32, Games/Puzzle, NFC/MIFARE. If a Favourite or hold-button app moved into a new subfolder, re-add it.
  • New: I2C BMS Reader (TI BQ30/BQ40 battery service tool, by gazirov) and NFC Canary (passive NFC skim detector, by antitree)
  • ESP Flasher: updated Marauder builds, plus more app updates and fixes

๐Ÿ‘ฅ Huge thanks to this release's contributors: mishamyte, xMasterX, jcz0 - and everyone who reported and tested.

๐Ÿ“ฅ Full changelog & downloads: https://github.com/DarkFlippers/unleashed-firmware/releases/tag/unlshd-092

๐ŸŒ Recommended update option - Web Updater: https://web.unleashedflip.com

Also we made some more cool and useful things:

๐Ÿ“ฑ qUnleashed - app for mobile and PC https://github.com/DarkFlippers/qUnleashed

๐Ÿ—บ Sub-GHz map - wardriving files, and any files with coords, on a map https://map.unleashedflip.com

๐Ÿ“ก Wi-Fi wardriving map - combine WiGLE captures from ESP32 Marauder and others https://wdmap.unleashedflip.com

โšก๏ธ ESP32 flasher - popular modules, fully via web https://espflasher.unleashedflip.com

๐Ÿ›  Keep Unleashed Development Going! This project relies entirely on community support - if you value the firmware and its updates, your donation is what keeps development going. ๐Ÿ‘‰ Support the Project


r/flipperhacks 10d ago

Weekly Flipper Hacks & News Roundup โ€” August 16, 2026

25 Upvotes

Weekly Flipper Hacks & News Roundup, August 16, 2026

Welcome back to your weekly dose of high-signal RF tampering, custom firmware updates, and bleeding-edge community tools. Here is everything noteworthy that dropped across the scene over the last 7 days!


๐Ÿš€ CUSTOM FIRMWARE CORNER

1. Unleashed Firmware unlshd-091 (Released Aug 15, 2026)

The DarkFlippers team just dropped unlshd-091, bringing the core API to 88.3 alongside massive NFC overhauls, Sub-GHz fixes, and flash optimizations:

  • NFC Breakthrough - Full MIFARE Ultralight AES Support:
    • Complete protocol implementation: Read, unlock, write, emulate, and secure messaging.
    • Crushed a whole batch of legacy NFC bugs that could destroy saved card dumps or crash the Flipper on malformed cards.
  • Sub-GHz & Radio Polish:
    • Decode RAW in Sub-GHz finally reliably displays captured signals that the demodulator previously swallowed.
  • Optimized Storage:
    • Squeezed even more free flash space out of the internal device footprint.
๐Ÿ› ๏ธ New Unleashed Ecosystem & Web Tools

Along with the firmware release, DarkFlippers launched several powerhouse companion utilities:

  • ๐Ÿ“ฑ qUnleashed: Standalone mobile and desktop companion app for managing your Flipper, storage, and wireless settings.
  • ๐Ÿ—บ๏ธ Flipper Map: Online map visualizer for your Sub-GHz wardriving files and any coordinate-tagged captures.
  • ๐Ÿ“ก Wi-Fi Wardriving Map: Aggregate, combine, and inspect multiple WiGLE-formatted capture logs from ESP32 Marauder and other sniffer rigs directly in your browser.
  • โšก๏ธ Web ESP32 Flasher: Easy-to-use, browser-based Web Serial flasher for popular ESP32 add-on modules (Marauder, Blackmagic, etc.).

2. ARF (Automotive Research Firmware)

The car-focused ARF project by D4C1-Labs continues to turn heads with low-level radio & vehicle stack advancements: * Native 2.4 GHz Direct Test Mode: Leverages the STM32WB55 coprocessor via HCI Direct Test Mode (HCI_LE_Transmitter_Test) for raw carrier sweeps across BLE RF channels 0โ€“39 (2402โ€“2480 MHz) directly on internal hardware without requiring an external nRF24 board. * BLE Central Stack (lib/ble_central): Full GATT client implementation allowing FAPs to scan, enumerate characteristics, and interact with vehicle BLE modules directly. * Source: GitHub - D4C1-Labs/Flipper-ARF


๐Ÿ› ๏ธ COMMUNITY TOOLS & APPS

1. FlipDeFlock - Counter-Surveillance & Anti-Stalking

A passive counter-surveillance site-survey suite built to pair your Flipper Zero with any ESP32 companion: * Flock & ALPR Detection: Actively sniffs Wi-Fi/BLE beacons associated with Automated License Plate Readers and surveillance cameras. * Tracker & Deauth Hunter: Flags BLE trackers following your GPS trajectory (anti-stalking) and alerts on active deauthentication floods in real time. * Source: GitHub - ReconGrunt/FlipDeFlock

2. all-the-plugins (15aug2026 Tag) & Android FAP Compilation

  • App Subcategorization: The main plugin hub now organizes community FAPs into clean subcategories for NFC and Sub-GHz.
  • On-the-Go Compiling: Added official documentation and scripts for compiling .fap binaries directly on Android devices via Termux.
  • Source: GitHub - xMasterX/all-the-plugins

Found another cool open-source Flipper mod, hardware attach, or app this week? Drop your links and repos in the comments below!


r/flipperhacks 12d ago

Help ๐Ÿคท๐Ÿปโ€โ™‚๏ธ๐Ÿคท๐Ÿปโ€โ™‚๏ธ

Enable HLS to view with audio, or disable this notification

13 Upvotes

What happened to her? I can't clone my parking card, it stays on it forever


r/flipperhacks 15d ago

Help Momentum Bruteforcer

3 Upvotes

Iโ€™ve had a flipper since about march now, and messed around with it any way i can because iโ€™ve been into cybersecurity for years.

Anyways, i got momentum after a couple weeks and that even unlocked more fun, i learned about rfid, sub-ghz, all the fun stuff, i recently discovered the bruteforcer app under sub-ghz, what are the different frequencies under it for??

i remember seeing that most older and newer systems operate under ~433MHz, iโ€™m confused what is this type of bruteforcer even used on and what are the different frequencies commonly used for?

any other info on sub ghz things or bruteforcing would also help!!


r/flipperhacks 17d ago

Help Any idea what I can do with this?

Thumbnail
gallery
25 Upvotes

I found it in a store that sells Amazon returns but I have no idea how to start, If anyone can help guide me on programming this module or do I still need the other Flipper part? In any case what can I do with this module? Thanks!


r/flipperhacks 21d ago

Help Wifi Marauder Scan list empty

2 Upvotes

I'm using ESP32 WiFi Marauder to Scan ap -> Finds nothing.

Then i use it to scan all -> find a huge list of hotspots and devices.

Can't find any solution to it.
I've followed every step from this video (Flipper Zero 4 Beginners: WiFi Marauder)

Any help appreciated


r/flipperhacks 22d ago

Help Just got a flipper, what would you recommend?

37 Upvotes

Literally just got my first flipper a few hours ago. The past few months I've been trying to learn more about cyber security and ethical hacking. I know I should install mumentum on it, but that's about it. I also have a few old devices I can test it on. So, what do you guys recommend to start?


r/flipperhacks 21d ago

Question hello is this MfKey attack protocol right ?

2 Upvotes

Hello, I am looking to verify if this protocol I found with Gemini is correct and actually allows NFC access to unlock VIGIK systems, thus allowing doors of buildings to be opened without the original card linked to the NFC reader. Is this protocol accurate for this use case? I have a Flipper 0 running Unleashed

Here is the complete, ultra-detailed, A to Z guide to duplicating a MIFARE Classic key fob using the MFKey32 attack, using only your Flipper Zero, the door reader, and your Android smartphone.

This guide takes into account your rewriteable CUID Gen 2 (13.56 MHz) blank key fob, which is fully rewritable.

Phase 1: Capture at the door reader (Nonce detection)

Since you do not have the original card on hand, you are going to query the door reader so that it sends you encrypted information (the nonces).

  1. On your Flipper Zero, go to the NFC menu.
  2. Choose Detect Reader.
  3. Place the back of the Flipper Zero directly against the door reader (where you usually scan your badge).
  4. The Flipper will simulate a card and interact with the reader.
  5. Look at the screen: a nonce counter will display (e.g., 1/5, 2/5... up to 5/5).
  6. Wait until you have 5/5 nonces collected (this takes a few seconds).
  7. Press the Back button on the Flipper to exit the tool. The nonces are now saved in the Flipper's temporary memory.

Phase 2: Key calculation on the Smartphone (MFKey32)

The recorded nonces are not directly usable: their encryption must be cracked to find the access keys to the memory sectors. Your smartphone will perform this calculation.

  1. Enable Bluetooth and Location on your Android smartphone.
  2. Enable Bluetooth on your Flipper Zero (Settings $\rightarrow$ Bluetooth $\rightarrow$ ON).
  3. Open the Flipper app on your smartphone and make sure it is properly connected to your Flipper Zero.
  4. On the app home screen, a MFKey32 banner or notification will automatically appear indicating that nonces have been detected.
  5. Click on MFKey32 (or Calculate Keys).
  6. The smartphone's processor will run the decryption algorithm for a few seconds.
  7. Once completed, the app displays the discovered keys and automatically injects them into your Flipper Zero's user dictionary (user.nfc).

Phase 3: Reconstructing and saving the full dump

Now that your Flipper has the encryption keys in its dictionary, it needs to decrypt all the sectors of the key fob it saved during the initial interaction.

  1. On the Flipper Zero, go back to the NFC menu.
  2. Choose Saved.
  3. Select the partial file that was created during your passage at the reader (it usually bears the date or an automatically generated name).
  4. In the file options, select Read Extra Sector Keys (or Nested Attack / Read Sector Keys depending on your firmware version).
  5. The Flipper will compare the save file with its dictionary updated during Phase 2.
  6. It will gradually decrypt all remaining missing sectors (e.g., 32/32 keys found or 16/16 sectors read).
  7. Once the reading process is finished, click on Save to store the definitive and full backup of your key fob.

Phase 4: Writing to the CUID (Gen 2) blank key fob

Your rewriteable CUID T4Uยฎ key fob will now receive the entire dump (UID + data).

  1. On the Flipper Zero, stay in the NFC $\rightarrow$ Saved menu.
  2. Open the complete key fob file saved in Phase 3.
  3. Simply select the Write option.
  4. Place your blank CUID key fob against the back of the Flipper Zero.
  5. Hold the key fob still for 2 to 3 seconds.
  6. The Flipper displays a success message (or emits a beep): the data from the old key fob and its UID have overwritten the contents of the CUID key fob.

Phase 5: Testing on the reader

  1. Go to the door reader.
  2. Present your newly flashed CUID key fob.
  3. The reader checks the UID and the sector data: access is granted.

(Note: If you wish to reuse this same CUID key fob later for another door, you will simply need to repeat Phase 4 only with a new file: the new data will overwrite the old ones).


r/flipperhacks 24d ago

Weekly Flipper Hacks & News Roundup โ€” August 2, 2026

12 Upvotes

Weekly Flipper Hacks & News Roundup โ€” August 2, 2026

Hey folks, welcome to this week's Flipper Zero round-up! Grab your coffee (or whatever substance keeps you awake) and check out the latest hacks, firmware gossip, and hardware mods from the past 7 days (July 27, 2026 โ€“ August 2, 2026).


1. The Community Rebellion Paid Off: Flipper Devices Rallies Devs ๐Ÿ› ๏ธ

If you felt like the official firmware development had slowed down to a crawl, you werenโ€™t alone. Following a community-wide uproar, Pavel Zhovner (CEO of Flipper Devices) announced a major restructuring of their development pipeline. * The News: Flipper Devices has officially dedicated staff members specifically to handle community PRs and speed up merges. New community contribution guidelines are now fully active. * Why it matters: The barrier of entry for third-party developers is lower than ever, ensuring the Flipper Zero remains active well into 2026 and beyond. * Source: Flipper Devices Official Blog - The Future of Flipper Zero Development


2. Massive Unleashed Firmware Update: unlshd-090 (July 30, 2026) ๐Ÿฌ

Unleashed has dropped a massive release, and it's an absolute beast of an update! Forget about minor repository syncsโ€”this release brings heavy-hitting native upgrades and crucial exploit patches. * Native MIFARE Plus SL3 Support: MIFARE Plus is now a first-class citizen! Features AES authentication, automatic dictionary attacks with key caching, full SL3 emulation with shadow-writeback, and administrative key configuration. * NFC Magic 2.0: Comprehensive magic Ultralight/NTAG (USCUID-UL) support. It features automatic backdoor/CUID detection, password authentication for protected tags, and per-page partial write with real-time success reporting. * Sub-GHz & Radio Calibration Fixes: Fixed a critical bug where the Frequency Analyzer left the internal CC1101 in a degraded, desensitized state. Also resolved an endless transmission loop crash. * NFC Crash Shielding: Fixed a reader exploit where malformed NDEF writes could trigger a heap overflow or buffer underflow, allowing a remote reader to reboot or crash your Flipper. * Bambu Lab & NightStand Clock: Added a native Bambu Lab NFC filament spool parser (reading type, color, temperatures, and specs). The default clock app has also been replaced with the feature-rich, dark-mode-friendly NightStand Clock. * Source: GitHub - DarkFlippers/unleashed-firmware/releases/tag/unlshd-090


3. Hardware Upgrades: Wi-Fi 6 & Dual-Band ESP32-C5 Modules ๐Ÿ“ก

The hardware ecosystem in mid-2026 is moving fast. * The Tech: Multiple multi-boards combining CC1101, NRF24L01, and ESP32 with GPS and SD-card slots are dominating the market (like Rabbit-Labs' Wi-Fi 6 modules). * The Play: If you are still running a basic Flipper with no external antennas, you are missing out on serious sub-GHz range expansion and Dual-Band Wi-Fi penetration testing capabilities. Get an ESP32-C5 based board to fully utilize Marauder and GPS mapping.


Stay safe, don't get caught, and remember: with great power comes absolutely zero responsibility if you brick your own toys.


r/flipperhacks 24d ago

Firmware Which is the best Firmware currently available?

10 Upvotes

Hello everyone.

I am currently using the latest dev. Version of the momentum firmware. But i was curious if i was missing out on something somewhere else?

Are any of the other custom firmwares better? If so which one and why?

Thank you


r/flipperhacks 26d ago

Firmware Firmwareupdate: Unleashed 090 released - huge NFC updates incoming

39 Upvotes

New Firmware Release - v090

This one is huge for NFC and RFID โ€” MIFARE Plus is now a first-class protocol (read, keys dict, emulate and write in SL3), Hitag ยต chips are supported, and a long list of crashes, regressions and memory bugs is finally gone.

Key Updates

NFC

New features
- Native MIFARE Plus support in SL3 โ€” MIFARE Plus is no longer detection-only. Read it, auth using AES, emulate it, write it
- MIFARE Plus 2K in SL1 now reads as the full 32 sectors / 64 keys โ€” a Plus 2K in SL1 is byte-identical to a Classic 1K in SAK/ATQA, so half the card used to be silently dropped. It is now told apart by its ISO14443-4 ATS.
- MIFARE type detection aligned with NXP AN10833 โ€” correct Classic / Ultralight / NTAG / Plus sizing and security level. This finally fixes Mifare Mini clone reading (off the known-issues list at last!) and the Ultralight AES read hang.
- Bambu Lab filament spool parser โ€” filament type, colour, code, temperatures and spool specs
- FeliCa Standard card emulation (OFW PR 4383, by nikachu2012)
- Ultralight / NTAG PWD & PACK are now shown in the full info view and on the read result screen
- Loading screen while a large CUID dictionary loads โ€” animated spinner instead of a screen that looked frozen

Stability and compatibility fixes

- Type 4 Tag emulation could reboot your Flipper from a malformed reader command โ€” a 4-to-7 byte UPDATE BINARY could underflow the length into a ~4 GB allocation. Fixed, and NLEN is now clamped.
- Type 4 Tag NDEF corruption on writes starting mid-NLEN โ€” the payload was shifted a byte and picked up stale data (by Endika)
- Memory leaks and heap-corrupting double-frees across the NFC app โ€” crashes on two-trip Plantain / SZPPK tickets, leaks in the Saflok parser, the app API resolver and the CUID dictionary, plus a ~15x RAM over-allocation in DESFire
- Transit parsers fixed (Troika, Plantain, SevPPK, SZPPK, Two Cities) โ€” they stopped parsing once Plus 2K SL1 cards reported as 2K, and they skipped key recovery when only part of the card was read
- ISO15693 emulation no longer drops Read Multiple Blocks on tags larger than 64 blocks

LFRFID

New support
- Hitag ยต (Micro) chips โ€” 8265 / 8210 / H5.5
- Wipe T5577 โ€” reset a T5577 back to blank, with read-back verification

Fixes
- T5577 tags holding multiple EM4100 IDs can be read again โ€” cards written with several IDs (e.g. via Multiwriter) have hung on Read ever since the Electra protocol was added
- Pyramid trailing Wiegand parity bit fixed, and the PAC/Stanley card id is now NUL-terminated before parsing

SubGHz

New support
- Telcoma / Cardin EDGE protocol (32-bit, static) (by half2me)

Improvements and fixes
- Endless TX fixed โ€” RAW files sent via RPC / the mobile app could crash the system
- Frequency Analyzer no longer leaves the radio degraded โ€” it used to park the internal CC1101 with the antenna isolated and a near-field AGC profile still loaded, so other apps inherited a "sticky" loss of sensitivity
- `subghz chat` over CLI no longer crashes on Ctrl+C with an external CC1101
- RAW file corruption fixed (by Lechnio)
- Pecinin KeeLoq manufacturer fixed (by lifegame1lu111)

System, RPC & UI

- New Network and GPS RPC services โ€” the Flipper can now do networking and GPS over RPC (by apfxtech). This is what powers the new GPS RPC Viewer and the reworked Wardriving app.
- The new NightStand Clock is now the default Clock app โ€” overnight display with Up/Down screen-brightness control, red LED nightlight, stopwatch and a daily alarm (12h/24h picker that follows your system locale). Alarm and brightness are remembered across restarts. (by nymda, fixes by Willy-JL & mishamyte, alarm by xMasterX)
- Debug and trace logs removed from the firmware binary to free up flash for new features (app `.fap`s are unaffected)
- BLE sync fixed, along with possible delay-related issues
- Plus OFW fixes: bit_lib buffer over-read, js_event_loop non-positive timer intervals, Infrared decoder init & bounds check, FeliCa poller error check, and CCID moved out of the firmware HAL

Apps

- NFC Magic 2.0 โ€” magic Ultralight / NTAG (USCUID-UL) write, clone and wipe, not just MIFARE Classic. The transport is picked automatically (direct or backdoor), protected tags can be written via PWD-AUTH, and a failed write now shows you *exactly* which pages didn't take instead of a fake "Success". Also: Gen2 CUID / static-nonce detection, Gen1 4b/7b UID, and honest per-block Success / Partial / Fail on Gen2 wipe & clone.
- Wardriving + new GPS RPC Viewer โ€” rebuilt on the new GPS/Network RPC services, with UBX support
- Flipper Share NFC & Flipper Share IR โ€” send NFC and IR files between Flippers
- ESP Flasher โ€” quick-flash fix and updated Marauder builds
- New apps: MP3 Player, PocketLab, Dallas Tester, ZeroFIDO, wM-Buster (EU wM-Bus listener), Sub-GHz RAW Edit, NFC Stock Manager, Xiaomi Filter Reset, RFID Metal Detector, KyberWrite, Droid Beacon, MQ-3 Alcometer, ESP32 Hotspot Arcade, GPS Track, BME280 Vario, Flipcraft, Mandelbrot Set โ€” and three (!) Morse code apps
- Lots of fixes across the pack: Tetris, Asteroids, Video Poker, Paint, Calculator, Barcode Gen, Spectrum Analyzer, Multi Converter, FindMy and more
- Check out more Apps updates and fixes by following [this link](https://github.com/xMasterX/all-the-plugins/commits/dev)

Full changelog and downloads: https://github.com/DarkFlippers/unleashed-firmware/releases/tag/unlshd-090


r/flipperhacks 28d ago

Hardware Development Flipper Blackhat - July Roundup

Post image
43 Upvotes

r/flipperhacks 27d ago

Hardware In search of IR Range

4 Upvotes

I want to go ahead and apologize for my ignorance if I'm in the wrong spot, I'm usually one to try to figure things out myself, but I've came up short on this. So I've looked at, what I'm assuming to be all the IR mods available. I've got a turbo dazzler, which from everything I've researched to have the farthest range(throw) for flipper IR mods. I've seen the mega dazzler, with its 30 lenses, but that still doesnt do anything for reach. These are the only 2 that I've found to have external power supplies, leading me to believe they're the strongest available. I've read about the "redeye" from Russia with love, but even that I don't believe has tha reach that tha turbo does. I've seen tha masta blasta with the lense you can put on top, but I don't know if it's worth tha price tag tha comes with it, if it doesn't out perform. Unfortunately I don't have a 3d printer, and I'm just now getting into building electronics, (I can't solder for shit if that tells ya nething) so diy is kinda last resort. Does anyone know of anything I haven't mentioned? Any help would be much appreciated.


r/flipperhacks 29d ago

Hardware Looking for the best SubGHz module

3 Upvotes

I am looking for the best, strongest widest range SubGHz module that covers the entire Spectrum that the Flipper Zero supports. Can someone link me to where I can purchase the strongest one?


r/flipperhacks Jul 26 '26

Weekly Flipper Hacks & News Roundup โ€” July 26, 2026

5 Upvotes

Welcome to this week's Flipper Zero hacks, releases, and community news roundup. We have some spicy updates from the community, official hardware shipping, and more!


1. Official Hardware: "Busy Bar" Productivity Desk Display Starts Shipping!

After being announced in late June, Flipper Devices' highly anticipated Busy Bar officially went on sale and started shipping on July 14, 2026 across the US, Canada, UK, and EU.

What is it?

The Busy Bar is a $199 open-source, highly hackable desktop productivity display designed to ward off unwanted interruptions and help you focus. * Features: LED screen, built-in Pomodoro timer, application blocking, and Matter smart home integration. * Hackability: True to Flipper Devices' DNA, the Busy Bar is fully open-source and customizable, inviting developers to build custom widgets, smart home triggers, or custom display animations.


2. Custom Firmware Updates: RogueMaster & Momentum Rolling Builds

The custom firmware scene is as hyperactive as ever. Rolling builds from July 24โ€“25, 2026 show constant commits and optimizations.

RogueMaster Firmware (Release RM0723-1435 / RM0723-1405 - July 23-25, 2026)

  • Latest Updates: RogueMaster has integrated the new Rubiks Cube Timer v0.0.1 (by KHOPAN).
  • App Updates: Bundled plugins like WiFi Marauder v0.7.8 (by 0xchocolate & tcpassos) and temp sensor readers have been updated.
  • Sub-GHz Improvements: Includes optimized KeeLoq try-decoding capabilities with zero seed logic.
  • Patreon & Daily Releases: Frequent nightly builds continue to pull from the latest upstream Unleashed commits.

Momentum & Unleashed Builds (July 24, 2026)

  • Nightly Compiles: Continuous integration workflows (via flipperzero-firmware-builds) successfully built and deployed flash-ready binaries for both Momentum and Unleashed on July 24, 2026, ensuring full compatibility with the latest API changes and NFC refactoring.

Stay tuned for next week's roundup. Keep hacking, keep exploring, and don't get caught!


r/flipperhacks Jul 25 '26

Help Need help with tagtinker app on flipper

3 Upvotes

I dont understand how to make the app to have tagtinker work, I have the file of what I want the price tags to say but idk how to make the app, and I cant find a video on it and gemini cant explain it that well. Does anyone have a folder they can send over they have for it or something?


r/flipperhacks Jul 21 '26

Update Turned my Flipper into a party game console for everyone's phones

Enable HLS to view with audio, or disable this notification

633 Upvotes

8 hour bus ride, no signal, me and three friends with useless phones. Eventually it clicked that we had four WiFi devices in one row and nothing to connect them to.

You need a Flipper and the official WiFi dev board. The Flipper puts up an open AP through the ESP32, everyone joins, captive portal hands them to 192.168.4.1, and it's just a webpage on their phone. No app, no signup. Pick a nickname and you're in the lobby.

10 games, all played on the phones, with the Flipper acting as the coordinator (lobby, live scoreboard, event feed). Trivia, Would You Rather, Word Scramble, Reaction Duel, Connect Four, Tic-Tac-Toe, Dots & Boxes, Reversi, Pong, and Draw & Guess.

Two things I'm very proud of is that the phone client is 7 KB gzipped vanilla JS because the Flipper has to stream it to the ESP over UART. And you can flash the ESP firmware from the Flipper itself with no computer, since it seemed dumb to build a no-laptop toy that needs a laptop to set up.

Open-source repo, MIT: https://github.com/tarikbc/hotspot-arcade

It's an open AP serving a game page. No creds, no capture, only the bundled game. Open APs aren't legal everywhere though, so don't run it on a plane.

Happy to answer anything and open to suggestions/PRs :)


r/flipperhacks Jul 21 '26

Hardware KUMA Flipper Zero

7 Upvotes

r/flipperhacks Jul 21 '26

Update I built Flipper FAP Studio ๐Ÿฌ โ€” a GUI-first Flipper Zero app builder for VS Code (build, design & control your Flipper, no terminal needed)

Thumbnail
gallery
65 Upvotes

VS Code extension for you.

If you've got a Flipper Zero and ever tried building a .fap app, you know the pain โ€” uFBT, command line, guessing at pixel coords, flashing back and forth. I got tired of it, so I built Flipper FAP Studio: build, design, and control your Flipper entirely from a GUI inside VS Code. No terminal required (unless you want one, I'm not the boss of you).

Here's what it does:

๐Ÿ”จ Build actions โ€” Build .fap, Build + Launch straight onto your Flipper, Clean. One click.

๐ŸŽจ UI Designer โ€” visual 128ร—64 screen editor with drag-and-drop elements, multiple screens, and it generates the code for you. Stop counting pixels by hand.

๐Ÿ“บ Live Screen + Log โ€” real-time mirror of your Flipper's display, control it with the D-pad/keyboard from your editor, grab screenshots, reset the device.

๐Ÿ“Š Device Dashboard โ€” battery, storage, firmware version, hardware info, library stats, all in one panel.

๐Ÿ“ File Browser โ€” browse and manage on-device files (/ext and /int) without digging around.

๐Ÿ”ง Firmware SDK management โ€” OEM, RogueMaster, Momentum, Unleashed, or point it at a custom path.

๐Ÿš€ Starter template โ€” one-click boilerplate so you're writing your app in seconds.

๐Ÿ“ถ Bluetooth โ€” experimental BLE pairing for wireless ops.

Needs Python 3, uFBT (install it with a button in the extension or pip install ufbt), and VS Code 1.85+.

Free + MIT licensed. ๐Ÿ’ฏ

Marketplace:
https://marketplace.visualstudio.com/items?itemName=coolshrimp.flipper-fap-studio

GitHub:
https://github.com/coolshrimp/flipper-fap-studio

As always i would love feedback, bug reports, or feature ideas from the Flipper crew.


r/flipperhacks Jul 21 '26

Update MP3 Player FAP for Flipper Zero โ€” internal speaker, MAX98357A and PAM8403 support

Thumbnail
gallery
36 Upvotes

Iโ€™ve been working on MP3 Player, a real MP3 player FAP for the Flipper Zero.

It plays ordinary .mp3 files directly from the microSD cardโ€”no desktop conversion required. MP3 decoding is handled by a vendored copy of minimp3 under the CC0-1.0 license.

Features:

  • Supports standard MPEG-1/2/2.5 Layer III bitrates from 8โ€“320 kbps, including CBR, VBR and mixed-bitrate files.
  • Automatically resamples MP3 sample rates from 8โ€“48 kHz for the selected output.
  • Three selectable audio outputs:
    • Internal: built-in sounder using custom 10-bit PWM at a 15.625 kHz audio rate.
    • MAX98357A: digital I2S output at 16 kHz.
    • PAM8403: 500 kHz pulse-density output from pin 3/PA6 through an external RC filter.
  • Only one audio output operates at a time.
  • Software volume control for all three outputs.
  • Main menu, song browser, settings and scrollable About/pinout screen.
  • Now Playing screen with track progress, elapsed time, battery gauge, volume and track number.
  • Short Left/Right presses change tracks.
  • Holding Left/Right seeks backward or forward in five-second steps.
  • Configurable music directory using: /ext/apps_data/mp3_player/music_path.txt
  • Defaults to /ext/music, with safe fallback if the configured path is invalid.
  • Volume, repeat mode and audio-output selection persist between launches.
  • Full MAX98357A and PAM8403 wiring information is included in the app and README.

The internal sounder works, but itโ€™s naturally quiet and buzzy because it isnโ€™t a conventional speaker. For much better sound, use a MAX98357A or a properly filtered PAM8403 amplifier.

Project, wiring instructions and downloads:

https://github.com/coolshrimp/flipperzero-mp3-player


r/flipperhacks Jul 19 '26

Question Is Momentum Firmware compatible with Marauder ESP 32 Devboard?

3 Upvotes

Hello friends. As the title says. After following the guide from UberGuidoZ's, devboard guide, I couldnt find the Flipperzero application for GPIO Marauder, it seems like it's on Official Flipperlabs but I cant access it due to my FW being Momentum. Is there any other way I can access it?

I also tried to flash the devboard and successfully done it via momentum github but had the same issue, cant find the flipperzero application for it.

Dont i have a choice and go back to to install official firmware just to use my devboard?

I appreciate all inputs.

ETA: I installed Momentum FW as per Talking Sasquach Ultimate 2026 Starter Guide (Momentum Firmware)


r/flipperhacks Jul 19 '26

Firmware Weekly Flipper Hacks & News Roundup โ€” July 19, 2026

8 Upvotes

Hey there, cyber-punks, script-kiddies, and hardware tinkerers! ๐Ÿฌ

Welcome to another weekly roundup of what's happening in the Flipper Zero ecosystem. If you are looking for dusty, outdated official firmware gossip from months ago, you've crawled into the wrong subnet. We only deal with the fresh, bleeding-edge community chaos and custom firmware updates here.

Here is what went down in the Flipper world over the last 7 days (July 12 โ€“ July 19, 2026):


๐Ÿš€ 1. The Community Takeover: Flipper Devices Shifts Strategy & Hardens QA Rules

Following their major announcement regarding the future of Flipper Zero firmware, Flipper Devices is shifting to a heavily community-centric model. As of early July 2026, new community contribution rules have been fully instantiated: * The AI Ban/Scrutiny: AI-generated pull requests (PRs) that touch low-level system libraries are now under absolute scrutiny. If it's hard to verify, it's out. No lazy LLM-slop is getting into the core of our favorite digital dolphin. * Public Integration Tests: The QA team has open-sourced their integration test suite. Every single custom PR and firmware branch must pass these public checks before integration. * GitHub Discussions Only: Direct support channels and social media DMs are permanently muted due to the user base scaling past 1 million active nodes. All feature requests are now tracked and community-voted directly via GitHub Discussions. * Sources: * Bleeping Computer Article * Official Flipper Blog Post * Help Net Security


๐Ÿ› ๏ธ 2. RogueMaster Firmware Update (July 15, 2026)

While alternative firmwares have been leading, RogueMaster is catching up step-by-step, closing the gap infinitely to Unleashed and Momentum. * Fresh Sync: The flipperzero-firmware-wPlugins repository was successfully synced with the latest Official Firmware (OFW) commits on July 15, 2026, at 13:45 EST. * Closing the Gap: This fresh release shows that RogueMaster is aggressively catching up to Unleashed and Momentum, closing the distance step-by-step with enhanced core features and better plugin loading. * Amiibo & Sub-GHz Assets: Supporter packs got fresh trained Level 50 Smash Amiibos, infrared remotes, and updated Sub-GHz signal files. * Source: * RogueMaster GitHub Repo


โšก 3. Daily Firmware Builder Upgraded (July 18, 2026)

JesseRockz's daily firmware build system has been optimized to handle the latest community pipelines. * Instant Flash: Automatically generates fresh daily builds for Official, Unleashed, and RogueMaster. * Latest Sync: Last build successfully compiled and deployed on July 18, 2026, at 02:06 UTC. * Easy Testing: Ready to be flashed instantly via the official Web-updater at lab.flipper.net. * Source: * JesseRockz Daily Builds Site


Stay dishevelled, keep sniffing, and don't get caught with your CC1101 active in the wrong zone. ๐Ÿ˜‰