Flipper Zero hardware & wireless hacking tool gets an app "store" with open-source app

Flipper Zero portable multi-tool for pentesters and hardware hackers has now gotten an app “store” with currently around 100 free and open-source apps available through the device’s Android or iOS app.

I missed it at the time, but the Flipper Zero launched on Kickstarter in July 2020 and was massively popular with close to 5 million dollars raised from almost 38,000 backers. The tool looks like a toy but it allows hacking with GPIOs and short-range wireless protocols such as Bluetooth, RFID, NFC, and infrared.

Flipper Zero specifications:

Wireless MCU – STMicro STM32WB55RG with Arm Cortex-M4 application core @ 64 MHz, Arm Cortex-M0+ network core @ 32 MHz, 1024 KB flash, 256KB SRAM
Storage – MicroSD card slot up to 64GB
Display – 1.4-inch monochrome LCD (black on orange background) with 128×64 resolution via ST7565R SPI display controller
Connectivity
- Bluetooth 5 LE & 802.15.4 via STM32WB55 microcontroller
  - Bluetooth LE – Tx power 0 dBm max, -96 dBm RX sensitivity, up to 2 Mbps data rate
- Sub-GHz module based on TI CC1101
  - TX Power: 0 dBm max
  - Frequency bands (depends on your region): 315 MHz, 433 MHz, 868 MHz, or 915 MHz
- Infrared with 800-950 nm wavelength, 300 mW Tx power
- NFC at 13.56 MHz with support for ISO-14443A/B, NXP Mifare Classic/Ultralight/DESFire, FeliCa, and NFC Forum protocols
- RFID @ 125 kHz with support for EM400x, EM410x, EM420x, HIDProx, and Indala cards
I/Os
- 18-pin with GPIO, ADC, UART, I2C, SPI, SWD, etc…; 3.3V I/O voltage
- iButton 1-Wire supporting Reader/Writer/Emulator modes, Dallas DS1990A & CYFRAL protocols
USB – 1x USB 2.0 Type-C device port also used for charging
Misc
- Buzzer with 100-2500 Hz frequency, 87 dB sound output
- Vibration Motor with 30N force, 13500 RPM
- 5-button joystick, back button, reboot button (back+Left buttons for 2 seconds)
- Status LED
- Hand strap hole
Power Supply
- 5V via USB-C port
- 2,000 mAh LiPo battery good for about 7 days
Dimensions – 100 x 40 x 25 mm
Weight – 102 grams
Materials: PC, ABS, PMMA
Temperature Range – 0 to 40°C

With the default firmware, it can emulate remotes for popular garage doors and barriers, but the Flipper Zero is quite versatile and customizable, so it can be used as a signal analyzer, a U2F security token, an infrared transceiver, a “bad” USB drive for red team hacking, a generic hardware hacking tool thanks to the I/Os it exposes, and the list goes on.

The Flipper Zero’s firmware was supposed to be open-source after shipping started, ~~but the relevant GitHub account is still empty~~ [Update: the account has changed, and all information can be found in the flipperdevices account]. The firmware itself can be downloaded from the website. The documentation looks thorough, and the SDK for Arduino and PlatformIO+VSCode can be found in the developer section. The Verge did note that finding apps for the Flipper Zero involves looking for various projects on GitHub, at least so far, as now or soon around 100 free apps can be installed on the hacking device using the Android or iOS app, and you’ll find the source code for each app there by clicking on the GitHub link provided, for example, the “all-the-plugins” repository.

The Flipper Zero started shipping to backers in January 2022, but it took a while before everyone/most got their device. Now the company says they’ve shipped 350,000 devices, and I assume many people are just using those as universal remote controls be it as a car key, to control house appliances, or open a garage door. The hacking tool can also be used as a credit card skimming device and other nefarious use cases so it’s not without its own controversies. The Flipper Zero can still be purchased for $169 plus shipping.

Via Liliputing

Jean-Luc Aufranc (CNXSoft)

Jean-Luc started CNX Software in 2010 as a part-time endeavor, before quitting his job as a software engineering manager, and starting to write daily news, and reviews full time later in 2011.