Mayhem v2 expansion for Flipper Zero adds Wi-Fi, BLE, camera, microSD card slot, and NRF24 or CC1101 radio support

Erwin Ried‘s Mayhem v2 is an all-in-one ESP32 and NRF24L01-based expansion board designed for Flipper Zero. This board adds Bluetooth and Wi-Fi through an ESP32-S module, features 2MP camera with flashlight, a microSD card slot, and support for either an NRF24L01 module (for sniffing and mousejacking) or a CC1101 module (for external radio communication). These features make this Flipper Zero add-on board useful for WiFi and Bluetooth penetration testing, motion detection, QR code reading, and as a nanny cam with remote access.

Previously we have written about similar expansion boards like the Flipper Zero ESP8266 Deauther which adds de-authentication capabilities and the Flipper Add-On CANBus which can be used to sniff, send, and log CAN bus packets directly from the Flipper Zero. Feel free to check those out if you are interested in those tools.

Mayhem v2 Flipper Zero add-on board specification

• Wireless Module – ESP32-S WiFi 802.11 b/g/n + Bluetooth 4.2 LE module with PCB antenna, u.FL connector, 32Mbit SPI flash, 4MBit PSRAM
• External Storage – MicroSD card slot up to 4GB
• Camera
  • FPC connector
  • Support for OV2640 (sold with board) or OV7670 cameras or OV2640 21MM 66/120 degree camera module
  • Image Format – JPEG (OV2640 support only), BMP, grayscale
  • LED flashlight
• Connectivity
  • WiFi 802.11 b/g/n via ESP32 module
  • NRF24L01 2.4 GHz ISM radio
  • 433 MHz CC1101 low-power RF module with external antenna
• GPIO – Usable GPIOs for connecting sensors and prototyping (exact PINs are not mentioned)
• Dimensions – Not Mentioned

The Mayhem v2 supports ESP32 Marauder firmware which enables features like Wi-Fi scanning, de-authentication attacks, packet sniffing, creating evil twin access points, Bluetooth Low Energy (BLE) device discovery, and more. The firmware also allows you to dump PCAP files to the microSD card. More information about the firmware can be found on GitHub. You can also find additional documentation along with 3D-printed cases and covers for the board on that same repository.

The device can also capture photos and videos with its 2MP camera and offers functionalities like motion detection, QR code reading, and “nanny cam” functionality. The flashlight can also be used for Morse code transmission, and the add-on also supports external radios like NRF24L01 for sniffing and mouse jacking or CC1101 for broader radio communication.

If you are planning to purchase a Mayhem v2 addon board for yourself, Erwin Ried offers three different options: a kit and two pre-soldered, tested modules. The kit is the most affordable one and costs you only $103.55, it includes the PCB, all necessary headers, the NRF module, and the ESP32 cam module. Alternatively, you can purchase the “Essentials” module, which comes pre-assembled with the NRF24L01 and fully tested by Erwin, priced at $160.55. For $5 more, you have the option to get the “Deluxe Ultimate” module, which will include a TI CC1101 module, available for $165.30. All three options are available at Erwin Ried’s Tindie store.

You can also make a DIY version of yourself by purchasing all the necessary components like the ESP32 CAM with OV7670 cameras or OV2640 21MM 66/120-degree camera module, pin headers, and the CC1101 433MHz module which are all available on AliExpress.

Support CNX Software! Donate via cryptocurrencies, become a Patron on Patreon, or purchase goods on Amazon or Aliexpress