You may have seen news reports about the “secret” Flipper Zero firmware that allegedly hacks any car, as covered by The Verge, Gizmodo, 404 Media, and The Drive have all written about it.  Let’s dive in to see whether this claim holds up (major spoiler: it doesn’t).

What happened

Some darknet online stores have started selling so-called “private” firmware for Flipper Zero, claiming it can hack countless cars. They say new vulnerabilities have “leaked” online that make it possible to break dynamic protocols like KeeLoq.

In reality, all of these methods were published more than 10 years ago — nothing new at all. The authors of such firmware are simply recycling well-known vulnerabilities and presenting them as “new hacks.” And importantly, these vulnerabilities have nothing to do with real car theft, since they do not allow you to start the engine.

How the KeeLoq protocol works

KeeLoq was developed in the 1980s and used in older access systems like garage doors and early car alarms. It’s what’s called a rolling code or hopping code system. The idea is that every transmission uses a new unique signal, encrypted with a 64-bit manufacturer key. This manufacturer key is the weak spot of KeeLoq. The problem was that carmakers often used the same key across an entire model line. If that key leaked, an attacker could intercept signals from any remote of that brand.

The authors of these “hacker” firmwares are just redistributing old leaked manufacturer keys from various automakers. None of this is new — these vulnerabilities were thoroughly documented back in 2006: https://web.archive.org/web/20221206050746/https://www.cosic.esat.kuleuven.be/keeloq/

Since then, car manufacturers have moved on to more modern radio protocols with two-way authentication, where the car and the key exchange messages to verify authenticity.

You can “hack” it with just a piece of cable

Because analyzing the encrypted protocol is passive, all you need for an “attack” is to record the remote’s radio signal. You don’t need Flipper Zero — even a piece of wire connected to an audio jack would do.

How car theft actually works

Intercepting a remote signal is not enough to start a car. That’s why these KeeLoq attacks have nothing to do with real-world car theft.

Today, real thieves target keyless entry/start systems by attacking the key fob directly. They use a combination of relays and transmitters that proxy the signal from the real car key, tricking the car into thinking the key is nearby.

We covered this technique in detail in our article: Response to Canadian Government

TL;DR: Real car thieves don’t use Flipper Zero — they have purpose-built relay tools. Here’s a video showing how cars are actually stolen with these devices:

Conclusions

• The so-called hacker firmwares for Flipper Zero don’t add anything new — they just reuse techniques documented since 2006.
• Real car thieves use completely different, specialized tools.
• If your car could be attacked with Flipper Zero, it could just as easily be hacked with a piece of wire.

Meet the first major release of Flipper Zero firmware — version 1.0. In this release, we have completed work on many features that have been in development for 3 years and are now stable. In this post, we’ll show you what’s new in Firmware 1.0 and the challenges we faced during development.

What’s new in Firmware 1.0

• 3rd-party apps: We’ve introduced dynamic app loading support. Now you can install hundreds of community-developed apps from the Apps Catalog, and the number of apps continues to grow.
• New NFC subsystem: Completely rewritten from scratch, resulting in a significant increase in card reading speed. New NFC card types support and a new plugin system for user card parsers.
• JavaScript support: You can now develop apps for Flipper Zero using JavaScript.
• General system improvements: Battery life reaches 1 month in standby. Bluetooth data transfer speed with Android devices increased by up to 2x. Firmware updates now upload via Bluetooth 40% faster.

Apps on Flipper Zero

Initially, all features in Flipper Zero were implemented as part of the firmware. Every new feature or fix required a full firmware update. It was a pain on both ends: we had to compile and make a new release, and users then had to install it. One more problem was the system flash memory limit, which we had reached a long time ago. At some point, we could no longer add new features to our Flipper Zero firmware.

Dynamic app loading subsystem

To continue adding new features, we developed something unusual for embedded hardware: dynamic application loading. Thanks to it, Flipper Zero is now able to run applications right from FAP files on the microSD card (FAP stands for Flipper Application Package, our special format of compiled application files). A new firmware component named app loader handles loading and launching FAPs. This way, we could finally continue adding new features and store them outside the firmware, saving space on system flash memory.

Developers loved this idea and have created hundreds of applications! However, these were scattered across different communities and forums, making it difficult for users to find them. That’s why we created the Apps Catalog, where apps made by the community are available in one place. We are especially proud that all apps in our catalog are open source, and we’re grateful to our community’s enthusiasts for developing and maintaining them. Learn how to submit your app to the Apps Catalog.

How to install Apps on Flipper Zero

You can install apps on your Flipper Zero from the Apps Catalog, which is available via Flipper Mobile App and Flipper Lab. Installing apps on Flipper Zero is now as easy as on your phone:

For convenience, apps in the Apps Catalog are grouped into categories based on their features: Sub-GHz, NFC, RFID, Games, Media, Tools, and others.

JavaScript on Flipper Zero

We’ve added a scripting engine to the firmware, allowing you to run apps written in JavaScript, one of the most common programming languages. This also makes development much easier compared to using C/C++, as you don’t need to set up a development environment on your computer and learn the Flipper Zero firmware SDK.

To run a script on your Flipper Zero, add the JS file to the SD Card/apps/Scripts folder (via qFlipper or Flipper Lab) and run it from the Apps → Scripts menu. There is no need to compile JS scripts on a PC.

JavaScript support is based on the mJS scripting engine. Originally designed for microcontrollers, mJS utilizes system resources efficiently and operates relatively quickly. It requires less than 50k of flash space and 2k of RAM.

New NFC subsystem

NFC is one of the largest subsystems in Flipper Zero’s firmware and hardware. Previously, to work with NFC, we used the RFAL library by STMicroelectronics, the manufacturer of the NFC chip inside Flipper Zero. However, this library was poorly optimized for RTOS, consumed a lot of memory, and slowed down our NFC subsystem.

To address this, we’ve completely redesigned our NFC subsystem from scratch, significantly improving its speed and making it easier to support new NFC card protocols.

What’s new in the NFC subsystem

• FreeRTOS friendly: The old RFAL library required polling to get events from the NFC subsystem. The new library uses an event-driven approach, which is efficient when using RTOS. This simplified the code and eliminated unnecessary delays in the NFC subsystem. See the code on GitHub.
• Improved architecture: In the RFAL library, several protocols can be implemented within one huge file of thousands of lines, and a single protocol can be scattered throughout the library. This made it difficult to add and support NFC protocols. To address this issue, we restructured the library and strictly divided the protocols based on stack layers. See the protocols on GitHub.
• Parsers are now dynamic: Initially, card data parsers were integrated into the NFC app and loaded into RAM along with it, which occasionally caused a lack of RAM. Now, parsers are FALs (Flipper App Library) that can be loaded one by one. Community members can add support for their card types by creating parsers by implementing a simple interface. See the code on GitHub.
• New NFC card protocols: We added support for ICODE® SLIX and FeliCa™ Lite-S cards. Read more: docs.flipper.net/nfc/read

NFC speed up

By completely reworking the NFC library, we managed to speed up its performance in Flipper Zero. For example, the dictionary key matching function is now 2.7 times faster!

Editing NFC dumps in Flipper Mobile App

When a Flipper Zero reads NFC cards, it saves their data (dumps) to the microSD card. Previously, you had to use an external program to edit contents of the dumps. Now, dumps from MIFARE Classic® cards can be viewed and edited in Flipper Mobile App. You can edit data of sectors, keys, and access bits.

General system improvements

• The new low-power mode increased Flipper Zero’s battery life from 1 week to 1 month in standby. Check out this blog post for more info.
• Faster Bluetooth connection with Android devices: We optimized the BLE (Bluetooth Low Energy) connection settings. Now users have an average of a 2x speed increase. However, results may vary between Android-based operating systems. We are also exploring ways to enhance the BLE connection speed for iOS devices.
• Firmware update package uploads 40% faster: Previously, we were unable to properly compress update packages, but now the Flipper Zero updater supports the heatshrink compression algorithm. Now, the firmware update package is transferred to Flipper Zero in a compressed form, speeding up the update’s longest stage by 40%.

Sub-GHz improvements

• 89 radio protocols are supported by the Sub-GHz app and can be decoded by Flipper Zero. Find the full list in Flipper Docs.
• External Sub-GHz hardware module support: You now have the option to connect an external module with the CC1101 chip to use a more sensitive external antenna instead of the built-in one. In the Flipper Sub-GHz app, you can switch between the built-in and external radio modules.
• Listen to analog walkie-talkie: Now you can use your Flipper Zero to listen to voice communications through analog walkie-talkies. The sound quality isn’t perfect, but if speaking loudly enough into the walkie-talkie, you can hear the voice through the Flipper Zero piezo speaker.
• The new BinRAW file format allows you to store more signals and share them faster. BinRAW is a format for recording repetitive signals, and it is more compact than the RAW format. BinRAW contains only useful signal data without noise.

Infrared improvements

• Universal IR remotes: We added new universal IR remotes to control TVs, ACs, audio systems, and projectors and made simple and intuitive UIs for them.
• External Infrared hardware module support: The Flipper Infrared app now supports connecting an external Infrared module with more powerful LEDs to increase the range of the IR transmitter.

How to update firmware

To access all of the newest features, update firmware on your Flipper Zero. You can do so via Bluetooth using Flipper Mobile App or via USB using the qFlipper app on your PC. Download the apps: flipperzero.one/downloads

If you’re updating from a firmware version 0.63 or earlier, you’ll need to switch your Flipper Zero to DFU mode and then update the device via qFlipper as described in Flipper Docs.

MIFARE, MIFARE Classic, and ICODE are registered trademarks of NXP B.V.
FeliCa is a trademark of Sony Corporation.

In just a few years, Flipper Zero has become so popular that it’s now surrounded by many myths. It’s no wonder that people in power are trying to make Flipper Zero illegal. As you might have seen in the news, the Canadian government plans to ban Flipper Zero as part of their efforts to combat auto theft.

We believe that proposals like this are harmful to security and slow down technological progress. They are usually made by those who do not really understand how security works and will do nothing to solve the car theft problem. In this post, we’ll explain why banning Flipper Zero instead of fixing security threats is not the solution.

What happened?

At the National Summit on Combatting Auto Theft held on February 8, François-Philippe Champagne, the Canadian Minister of Innovation, Science and Industry, announced measures to combat the rise in car theft in Canada. As one of the measures to address this issue, he proposed to ban Flipper Zero because he claims the device is being used to steal cars with keyless entry systems🤯. (Spoiler: this is not true)

Community response

Francois-Philippe Champagne also tweeted about the announcement, which received close to 900K views and 800 replies, becoming one of the most criticized tweets in his career. Here are some replies:

By the way, at my CanSecWest conference some researchers recently showed how to use a Raspberry Pi to relay bluetooth to unlock poorly secured Bluetooth car locks. Does this mean you are going to try to outlaw computers too?

— dragosr (@dragosr) February 9, 2024

If you knew anything about technology you would know the flipper and others are just simple ARM processors with basic sensors attached. Nothing ground breaking this will not stop a thing but makes it look like your doing something. The trick of politicians everywhere and it is…

— Adam Taylor (@ATaylorFPGA) February 9, 2024

The announced plans to ban Flipper Zero also caused a discussion on Hacker News (see here and here). Many users have said this ban won't fix the issue of insecure cars:

The Canadian Repair Coalition has issued a statement regarding our situation.

Simplistic solutions, such as banning a device without a thorough understanding of its functions and benefits, are counterproductive, and we encourage the government to do better.

[Canadian Repair Coalition] Jasvinder Mann, Alana Baker & Dr. Alissa Centivany

How car theft actually works

The Canadian government news release mentions that the announced ban on Flipper Zero is one of the measures to combat the theft of cars with keyless entry systems. To find out if Flipper Zero can be used to steal such cars, it's important to understand how keyless entry systems work and what car thieves do to hack them.

What is a keyless entry system?

Cars with keyless entry systems are designed to unlock when the key fob is in close proximity without requiring the owner to press a button on the key fob. Simply touching the door handle is enough to trigger the car's sensors and unlock the doors. The engine then starts with a press of a button on the dashboard when the key is nearby. After that, the key fob won't be necessary until the next stop.

Once again, the engine will remain running and the doors unlocked — even if the original key fob is not in proximity of the car, which is exactly what car thieves exploit.

How thieves hack keyless entry systems

To steal a car with a keyless entry system, thieves work in pairs and use radio repeaters to trick the car into believing the key fob is nearby when it's actually inside the victim's house.

To do this, thieves establish a connection between the car and the key fob using two repeaters. They hold one repeater near the car and another as close as possible to the house to reach the key fob inside. The thief next to the house uses a repeater with a large antenna that can pick up signals even through a wall. Since key fobs are usually left near the front door, a thief with such a repeater can easily locate them. Once connected, the car and the key fob assume they are near each other, which allows the thieves to unlock the car door and start the engine.

To transmit signals to key fobs through walls, thieves need huge antennas and powerful repeaters. All video-documented cases of car theft show that theft equipment takes up a lot of space in thieves' backpacks.

What hardware thieves actually use

Car theft equipment for every car brand can be found on special websites for car thieves. Just google "keyless repeater" to get a long list of websites that offer car theft tools with worldwide shipping, with prices ranging from €5,000 to €14,000.

After learning about the sophisticated tools thieves use, let’s have a look at the Flipper Zero’s capabilities. Can it actually be used to steal cars?

Can Flipper Zero hack a car?

There are many videos on social media where kids promise to “hack the Pentagon” using a Flipper Zero to gain more views. Such content has created lots of myths and is used by journalists who don't bother with fact-checking. It's not surprising that some politicians have started to propose bans based on false information. To fix this, we'll try to bust some popular myths surrounding the Flipper Zero by answering the questions below:

— Can you steal a car with Flipper Zero?

We are not aware of any officially confirmed cases of theft using a Flipper Zero. This is because the device has limited functionality and can't be used as a repeater to attack keyless entry systems. Flipper Zero is equipped with only one sub-1 GHz radio module, while keyless repeaters have 4 radio modules: one for communication with the car, another one for communication with the key fob, and two for communication between the repeaters.

— But Flipper Zero operates at the same frequencies as remote controls

Yes, Flipper Zero can indeed receive and decode radio signals. However, intercepting the radio signal from the remote control won’t be enough to unlock a modern car because they use encryption to securely provide access. The most popular encryption system used in car keys is rolling code, where every press of the key fob button generates a different encrypted radio signal. This security feature helps prevent basic attacks that only require a $2 radio module.

— What is the difference between static and rolling code?

A static code is a fixed set of numbers access control systems use to grant access. Every time the user presses a button on a remote, the same set of numbers is sent. It is enough to capture such a signal once, which can then be endlessly replayed to grant access.

A rolling code is a changing set of numbers. This means that whenever the user presses a button on a remote, it generates a unique code based on a sequence known only by the access control system. Simply capturing a signal and replaying it wouldn't provide access since this set of numbers has already been used.

How to "hack" a radio signal with a piece of wire

Although cars using static codes were discontinued around 20 years ago, they are still in use. The main vulnerability of such cars is that their radio signals can be easily captured and replayed without sophisticated tools. In fact, static codes are so insecure that they can be "hacked" with a piece of wire connected to a PC's microphone input:

This example shows the absurdity of all attempts to ban devices like Flipper Zero. To protect against the interception of radio signals, it would be necessary to ban all electronics, including headphones, which is unrealistic.

The Flipper Zero is built with hardware components used in thousands of devices ranging from radio toys to educational DIY kits. For example, the CC1101 radio transceiver inside the Flipper Zero has been widely used since its release in 2007. The problem is not in the available radio hardware, but rather in the insecurity of outdated access control systems.

Security through obscurity doesn't work

Security through obscurity is a cybersecurity concept where a system's design is kept hidden from attackers to prevent them from exploiting its vulnerabilities.

However, once the inner workings of a system are exposed (which is only a matter of time), its vulnerabilities become evident, leaving it open to exploitation.

• In 2012, a vulnerability was discovered in hotel room locks manufactured by Onity. These locks were widely used in millions of hotel rooms across the globe. The discovery revealed that with a simple device that could be plugged into the DC port found on these locks, a person could bypass the card reader and open the lock within seconds.
• In the GSM mobile communication standard, the A5/1 encryption algorithm has been used for data encryption since 1987, with its security relying on the secrecy of the algorithm. The standard became widely adopted, but in 1994, the algorithms were disclosed, and millions of mobile phones became vulnerable to wiretapping. en.wikipedia.org/wiki/A5/1

Bans can't protect insecure systems

Instead of banning cybersecurity tools capable of finding vulnerabilities in security systems, these vulnerabilities must be fixed. The cybersecurity industry has long recognized that bans do not fix insecure systems, but instead only cause more problems by creating a false impression that proper measures have been taken. Let’s have a look at real-life examples.

HTTP vs HTTPS

The current state of access control systems can be compared to the evolution of the World Wide Web (WWW) protocol . In the past, websites used the insecure HTTP protocol, which lacked encryption. This made it vulnerable to data interception by anyone along the way or via Wi-Fi. Since internet traffic was routed through the equipment of many companies, there was a high risk of data interception.

The HTTP protocol was replaced by HTTPS ("s" meaning secure), which fixed security vulnerabilities by providing data encryption. HTTPS has become the standard for secure communication on the web.

Credit Cards: magnetic stripe vs chip

In the past, bank cards used magnetic stripe technology to store and transmit cardholder data. These magnetic stripes were easy to clone or skim. Criminals used skimming devices to steal card information, which allowed them to clone cards for unauthorized transactions.

To fight credit card fraud, chip cards were introduced. These cards use advanced technology with embedded microchips that generate unique transaction data for each transaction, making it extremely difficult for criminals to clone these cards.

Sign our petition to save Flipper Zero

We hope we've properly explained why banning Flipper Zero makes no sense. Such measures do nothing but harm innovation and security. Now, it is our objective to convey this information to the government of Canada. Please, sign the petition.

What else can I do?

• If you are in Canada, contact your Member of Parliament and share this information with them. If you are a member of a political party in Canada, please pass this information on to its representatives.
• Get in touch with us if you believe you can help pr@flipperdevices.com
• We express our gratitude to the Canadian members of our community who have created a public initiative to save Flipper Zero: saveflipper.ca

We're excited to announce the Video Game Module, our new product developed in collaboration with Raspberry Pi! The module is powered by the first chip designed by Raspberry Pi—the RP2040 microcontroller, the same as in the Raspberry Pi Pico board.

We slightly overclocked the microcontroller so it could generate a video signal. This allowed us to add the Video Out port for connecting to a TV and mirroring the Flipper Zero screen. The module also has a motion-tracking sensor that can be used in games and apps. As always, the firmware and schematics are completely open-source, so we’re excited to see the ideas our community will come up with.

Technical Specs

We decided to encase the module instead of leaving it as a bare PCB so that it could fit tightly on Flipper Zero and support the weight of a heavy video cable. The body of the module is made of the same plastic as Flipper Zero, so the devices look like a single unit when connected.

• Microcontroller: Raspberry Pi RP2040. Dual-core ARM Cortex-M0+ processor, clock running up to 133 MHz.
• SRAM: 264 kB on-chip.
• Gyroscope & Accelerometer sensor: TDK ICM-42688-P is a 6-axis MEMS motion-tracking sensor (IMU).
• USB Type-C port connected to the microcontroller. Acts as a USB device or host (with the limitation that USB power delivery is not supported).
• Video Out port: DVI-D signal in 640х480 px, 60 Hz. The port supports a well-known video standard that we can't name due to copyright limitations 🤫 The first letter is H, and the last one is I.
• GPIO breakout: 11 GPIO pins connected to the RP2040 microcontroller, two ground pins, and one 3.3 V power pin.
• Boot button: activates bootloader mode (for developers).
• Reset button: reboots the module hardware.

Video Out port

Playing games and using apps developed for Flipper Zero is much more fun on a bigger screen. The Video Out port can also be useful for practical purposes like displaying intercepted data on a larger screen while monitoring the broadcast on your Flipper Zero.

For the video out, we chose the most popular video port found in most modern TVs and monitors.

The module transmits the DVI-D video signal with a resolution of 640х480 px and a refresh rate of 60 Hz. The image resolution may seem low, but it’s important to remember that Flipper Zero’s screen resolution is 128х64 px, and such pixelated image looks very nice and sharp on a TV screen.

Video cables and their connectors are usually heavy, so we designed the module to fit Flipper Zero very tightly, making it hard to pull the module out of Flipper Zero when connected to a TV.

Gyroscope & Accelerometer Sensor

To add another input method, we installed a 6-axis MEMS motion-tracking sensor into the Video Game Module. This TDK ICM-42688-P sensor has a gyroscope and accelerometer. It can be used to control games and for more practical purposes like controlling a computer with an air mouse.

Independent access to the sensor from Flipper Zero

To make the motion-tracking sensor accessible not only for the Video Game Module microcontroller, we exposed the sensor's SPI pins at the Flipper Zero connector. This means that the motion-tracking sensor can be used directly by apps running on Flipper Zero, for example, Air Mouse.

The motion-tracking sensor is also connected to the Raspberry Pi RP2040 microcontroller inside the Video Game Module. This means that Video Game Module firmware and apps running on Flipper Zero have access to the sensor. Unfortunately, the sensor can’t be used by the module and Flipper Zero at the same time because of the SPI interface connection limitations.

Quick Start Guide

Make sure to read the Quick start guide carefully before starting the Video Game Module for the first time because these steps may not be immediately obvious:

1. Update firmware on your Flipper Zero. You’ll need firmware version 0.98.3 or later.
2. If you keep your Flipper Zero in a case, remove the silicone bumper before installing the module:

Demo Apps

The Raspberry Pi RP2040 microcontroller inside the Video Game Module makes it compatible with many open-source Raspberry Pi Pico projects. This means that the module can be used as a standalone device without connecting to Flipper Zero.

Here are several apps we prepared for Flipper Zero that work with the Video Game Module. We hope that trying them out will help you appreciate the sensitivity of the motion-tracking sensor and video out refresh rate. We’ll be happy if these apps inspire you with ideas for your own projects!

Oscilloscope (Scoppy project)

Scoppy is an open-source project that turns Raspberry Pi Pico into a simple 200 kHz Digital Oscilloscope. The Scoppy code can also run on the Video Game Module—just flash the module with Scoppy firmware and connect it to an Android smartphone via USB.

Scoppy Sources & Documentation: github.com/fhdm-dev/scoppy

Air Arkanoid game

Arkanoid is one of the most famous arcades in the world. Our version of the game is designed for Flipper Zero and supports the Video Game Module. Control the paddle in the game by tilting your Flipper Zero left or right and using the central button on the device’s directional pad.

To download Air Arkanoid, go to the Apps tab in the Flipper Mobile App.

Air Mouse app

The Air Mouse app turns Flipper Zero with the module into a computer mouse. Control the pointer on your computer by tilting and rotating your Flipper Zero with the help of the motion-tracking sensor inside the module. Simply connect your Flipper Zero to a computer or smartphone via Bluetooth or USB.

To download Air Mouse, go to the Apps tab in the Flipper Mobile App.

Flipper Zero Game Engine

To make it easier to develop games for Flipper Zero, we’re sharing our Flipper Zero Game Engine. The game engine helps game developers to do routine work faster, such as vector math, sprite caching, rendering, event and object behavior processing, etc. The Flipper Zero Game Engine also includes a motion-tracking sensor driver (ICM-42688-P), that can be used in games that support the Video Game Module. We’re also sharing an example of a simple demo game that uses the Flipper Zero Game Engine.

• Flipper Zero Game Engine: github.com/flipperdevices/flipperzero-game-engine
• Demo Game: github.com/flipperdevices/flipperzero-game-engine-example

Open-source Firmware and Schematics

As always, the firmware and schematics are fully open-source. We can’t wait to see the amazing use cases for the module the community will come up with. We also welcome commits to our official firmware repository.

• Firmware Sources: github.com/flipperdevices/video-game-module
• Schematics & Pinouts: docs.flipper.net/video-game-module/gpio

Compatibility with Raspberry Pi Pico

We exposed all unused RP2040 pins at the 14-pin GPIO breakout and Flipper Zero connector for you to use in your projects. You can compare the Video Game Module pinout and Raspberry Pi Pico board pinout below:

• GPIO pins 8-15 and 18-20 are used inside the Video Game Module for video out. These pins aren’t accessible via Video Game Module connectors.
• GPIO pins 0-7, 16, 17, 21, 22, 26-28 are exposed at the connectors in both the Video Game Module and the Raspberry Pi Pico board. Note that pins 2-7 are also connected to the motion-tracking sensor.
• GPIO pins 23-25 and 29 are used inside the Raspberry Pi Pico board and aren’t accessible via the connectors. In the Video Game Module, these pins are unused and are exposed at the 14-pin GPIO breakout.

How to Buy

The Video Game Module is now available for customers in the EU and US through our official shop and our official distributor, Lab401. Shipping to other regions through partner distributors will be available soon.

We are proud to announce that starting the firmware version 0.82, your Flipper Zero's battery life will last up to 1 month! It took us 2 years to resolve all firmware issues that prevented Flipper Zero from switching to power-saving mode, resulting in the same power consumption baseline in both idle and active states. As a result, Flipper Zero's battery life was approximately 1 week instead of the intended 1 month.

In this post, we will tell you about the new power saving mode and the challenges with the STM32 microcontroller we had to overcome to make the new mode a reality. We will also share updates about worldwide sales.

New Power-Saving Mode

The firmware version 0.82 is available — Update now! This version brings a new deep sleep feature that extends your device's battery life up to 1 month by dramatically decreasing power consumption when there are no running applications or connections on your Flipper Zero.

When Flipper Zero is not running any user applications, the device enters an idle state (sleep mode). Once an application starts, the device switches to an active state: the backlight activates, data exchange with the microSD card begins, and so on. In the active state, power consumption can reach up to 30 mA with a backlight, up to 400 mA with an active transceiver, and even up to 2 A with an active transceiver and connected external module.

The microcontroller used in Flipper Zero supports different sleep modes that have different levels of energy efficiency:

• Before, we used a mode that wasn't a true sleep mode. This mode was easier to implement but less energy efficient. In this Legacy sleep mode, Flipper Zero consumed 9 mA of power in the idle state.
• After resolving firmware issues, we enabled a new energy-efficient sleep mode, in which various microcontroller blocks are turned off, and the core clock is switched to a more energy-efficient clock generator. In this deep sleep mode, the power consumption baseline in the idle state is only 1.5 mA!

How to check new deep sleep mode

The implementation of the deep sleep feature was complex. There are several scenarios where this mode may not be activated, such as when a background application is running, second processing core tasks are active, or a Remote Procedure Call (RPC) session is ongoing over Bluetooth LE.

To verify if your Flipper Zero is properly entering deep sleep mode, go to Settings →  Power → Battery Info and wait for the LCD backlight to turn off. A Napping... message should appear in the battery status.

How to turn off deep sleep mode

This deep sleep mode is enabled by default. You don't need to disable it unless you have problems with your Flipper Zero. Mind that this deep sleep mode is still in its experimental phase. It may lead to unpredictable bugs and side effects. Our testing team has discovered and resolved most of the bugs, but there may still be some that we still need to identify. If you think the mode causes the bug, you can disable the mode for testing purposes and share the issue on the forum.

To disable the deep sleep mode on your device, go to Settings → System and set Sleep Method to Legacy.

Why was the deep sleep feature so challenging?

We tried to implement deep sleep mode for a long time, but we could not understand why the system crashed after exiting deep sleep mode.

Flipper Zero is based on an STM32WB series microcontroller. Firmware development with this microcontroller is highly challenging due to its dual-core architecture, shared peripherals, and closed-source firmware for the Core 2 without the ability to debug it🤯

Another problem was poor documentation and incomplete Real-Time Operating System (RTOS) support in the Software Development Kit (SDK). We had to add support for deep sleep inside the operating system ourselves. The furi_hal_os_sleep() function performs tick suppression inside the OS domain.

Although the ARM architecture was initially designed for mobile usage and low power consumption in mind, the implementation of power-saving functions is actually carried out by chip vendors. Vendors use various approaches to implement power-saving functions and provide examples and SDKs to simplify developers' lives. But that doesn’t guarantee success, especially on multicore, shared periphery chips.

Challenges with Core 2

A set of hardware semaphores and Inter-processor communication controller are used to control subsystem ownership and signaling between Core 1 and Core 2. Core 1 firmware must explicitly take some of them to control the clock, flash, and other critical stages. Combining work with a flash controller and active BLE connection is an exceptionally complex task: using a flash controller stalls instruction/data fetch from memory, which causes Core 2 to miss transmission deadlines. The whole system is quite sophisticated and we'll cover it in a separate post.

Challenges with Clock & Power

Almost every electronic device has oscillators inside. Flipper Zero MCU has 7 oscillators. An oscillator is a circuit consisting of a small crystal of quartz and an amplifier that generates even pulses, which provide precise timing for the MCU core and subsystems! These pulses are crucial for the microcontroller's internal operations.

Three of these oscillators are especially important:

• High-Speed External (HSE) and Low-Speed External (LSE) oscillators provide reference clocks, which are precise, but not energy efficient.
• High-Speed Internal (HSI) oscillator provides an internal clock, which is energy efficient, but not precise.

The LSE oscillator is continuously active, the HSE oscillator is activated when an application is running, and the HSI oscillator is activated when the device enters deep sleep mode. However, using the HSE oscillator during deep sleep is impossible, requiring all clock domains to be switched to HSI before entering deep sleep mode. Overcoming this challenge, we have developed the furi_hal_clock_switch_to_hsi() function that facilitates a smooth and efficient transition to the energy-efficient HSI oscillator, enabling deep sleep functionality.

Since going into sleep mode physically turns off peripheral subsystems, they must be in a disabled state. That brings API design to a new level of complexity, especially in multitask OS. It took us some time to design APIs to be compatible with deep sleep mode. The furi_hal_power_deep_sleep() function is responsible for the transition into deep sleep mode at the power domain level.

Challenges with Debugging

Another problem is debugging Core 1 firmware when in deep sleep mode: MCU Debug subsystem must be specially configured to wake the system up from sleep. Debugging is also impossible if the system is misconfigured, exiting, or entering deep sleep mode and something goes wrong. Also, halting MCU while in sleep will wake it up on the HSI clock, which is much slower than HSE and requires a special debug adapter configuration.

As you can see, developing and debugging with the STM32WB series microcontroller is a challenging task. That is why it took us so long to identify and resolve all the issues related to our firmware. But thanks to our team of developers, the battery life of your Flipper Zero will last up to 1 month, starting the firmware version 0.82.

How to buy Flipper Zero worldwide

Sales of Flipper Zero are gaining momentum around the world. More than 200 thousand devices have already reached their owners! At the same time, worldwide delivery is a big challenge for us. We engage reseller partners to sell Flipper Zero worldwide.

For your convenience, we have created a How To Buy page where you can select your country and view live information about all official partners. The page is currently in beta mode but will soon update data about partners in real time.

Due to the incredible popularity of Flipper Zero, many fraudulent accounts have appeared on the Internet. Only the websites listed here are trusted. We do not sell our products on social networks like Instagram, Telegram, or TikTok.

⚠️ If you are offered to buy Flipper Zero anywhere else, it is most likely a fraudulent seller. Don't send them money, you will most probably be scammed. Please report all scammers to us via the Abuse Report Form.

Good news, everyone! We've already shipped 90% of Kickstarter orders and are ready to start producing a new Flipper Zero batch that will be ready to ship in August 2022, only after the remaining 10% of the orders have been shipped.

We don't have devices in stock, and we need to estimate the demand, so we are opening pre-orders right now.

• Shipping in August 2022
• Only for 🇺🇸 the USA, 🇨🇦 Canada, 🇦🇺 Australia, 🇪🇺 European Union, and 🇬🇧 the United Kingdom.

One more thing

You can now order some Screen Protectors to keep your Dolphin safe! Bundle up with a Silicone Case for the best protection. All the usual accessories are also in stock.

At the moment, nearly 90% of all Flippers ordered on Kickstarter have been sent to backers. Most of these parcels are already delivered, and some are still on the way — either in transit warehouses, at the packing stage, or under customs clearance. But they will be delivered to the backers in the nearest future! These backers have already received the tracking numbers of their parcels.

Map legend

Shipped (orange) — countries for which parcels have been handed over to a logistics company. Those are either being packed, on their way, under customs clearance or have already been delivered.

Preparing (dark grey) — countries for which devices are still being prepared. The devices are produced and under processing for further dispatch to the logistics partner. Those will be shipped in July.

We have shipped 100% of orders to all the countries on the map above marked in orange. At the time of writing, some of the parcels to these countries are still on the way but already processed, have a tracking number, and will be delivered very soon.

At the same time, there remains a large number of backers who have not yet received the device and we still have a lot of work to do. In this update, we will talk about the process of delivery and production, as well as our plans for the future.

Shipping Methods

We are often asked why is delivery divided by country. Many backers feel it's unfair that we don't send parcels in order of backer number, they say "My backer number is 457, so I have to be under the same number in the shipping queue." We understand these feelings.

Unfortunately, logistics is much more complicated than it seems. Since we only operate legally, we need to prepare import documents for each individual country to make sure parcels get released by customs. At the same time, there are several different methods of shipping, and, depending on the chosen process, cargo clearance procedures are different.

Basically, shipping methods are divided into two types: bulk cargo shipping and individual parcel shipping.

Bulk delivery

In the terminology of logistics companies, bulk cargo shipping is called Direct Injection. This is when all parcels are packed into one large container that then goes to the country of destination. Upon arrival to the destination country, all orders in the shipment pass the customs clearance simultaneously — this significantly simplifies the clearance process.

Once customs releases the cargo, the container is opened and individual parcels are handed over to local couriers for the last mile delivery, without crossing borders and being delayed due to customs clearance. However, this type of shipping can only be used when there are enough orders for one country to meet the logistics company's requirements. That's why it was important for us to accumulate orders into one large shipment.

Bulk cargo shipping is the most efficient and safest delivery method, as it allows to move orders cheaper and faster, as well as using priority delivery channels that include insurance and support along the way. We used this method for all countries with enough order quantities: US/CA/AU/UK/EU/RU, which is basically 90% of all orders.

Individual parcels

Individual parcel shipping, or Direct to Customer in logistics language, is when the orders are packed in Hong Kong, address labels are placed on them, and sent directly to the recipient. In this case, each individual parcel crosses the border and goes through customs clearance, so much more paperwork is involved.

This method takes more time, is less reliable, and is more expensive. It takes more time for customs clearance and for delivery in general. That is why we've put it at the back of the queue.

We understand how frustrating it is to be at the very end of the line. But delivering so many parcels is a challenging task and this way we tried to minimize risks and work out reliable delivery channels.

Shipping to Rest of the World countries

Shipments to RoW countries are scheduled for this month. By the end of July, we hope to ship all 100% of Kickstarter orders. Very soon you will receive a tracking number on the e-mail you placed your order with.

Soon the shipping addresses will be locked, so please check your shipping address here and let us know if it needs to be changed as soon as possible: https://flipperzero.backerkit.com/

Thank you!

Thank you all for your trust and your patience. The Flipper Zero project was made possible thanks to you and your support! And this is just the beginning — soon we will share with you our new products and development plans. This is gonna be huge.

@flipper_zero

@flipper_zero

@flipperzero

Great news everyone. We were working on this for several months and are finally ready to announce a new firmware update subsystem. You can now update firmware and databases on the SD card via Bluetooth using our mobile app! Download the mobile app for Android and iOS. The new firmware update subsystem will be added to the qFlipper desktop application as well.

In this post we will talk about why the Over-the-Air update was so hard to implement on Flipper Zero, how memory is arranged inside our STM32WB55 microcontroller, and will look at the firmware update process before and after.

Download the Flipper Mobile App

The Problem of Classic OTA Update

All modern devices provide Over-the-Air (OTA) firmware updates. You don't need to connect your phone to a PC to update the firmware, it updates over the internet. We've all gotten used to it and it seems totally normal now, but that wasn't always the case. Updating firmware over the air is in no way a trivial process. It took Apple 4 years to develop OTA since the release of the iPhone. The first iPhone was released in 2007, but you could only update it over the air in 2011 with the release of iOS version 5.0 for iPhone 3Gs.

The hard part of OTA is that at any given time the device has to run some kind of firmware to supervise the update process. In theory, our microcontroller supports OTA updates. It needs the old firmware running during the update process to control data transfer over Bluetooth while the new firmware is being uploaded next to the old one.

According to the manufacturer, it should work like this:

1. The old firmware is running and manages data transfer over Bluetooth
2. The new firmware is transferred to the available space on MCU's Flash
3. When rebooting the old firmware is replaced by the new one

What's inside the Flipper Zero processor

Flipper Zero's firmware is stored in Flash memory on the STM32WB55RG microcontroller, the heart of the whole device. There are several hardware modules placed inside one chip:

1. The main compute core, 64 MHz ARM Cortex-M4 — this core runs our main firmware, the source code is available in the Flipper Zero Firmware Sources repository.
2. The secondary core, 32 MHz Cortex-m0 + radio modem — this core runs the proprietary firmware provided by ST which implements the Bluetooth LE or Zigbee radio stack. This core's firmware is completely closed-source and we have no control over it. ST provides pre-compiled binaries in their  STM32WB Co-Processor Wireless Binaries repository. The radio stack firmware plus proprietary Firmware Upgrade Services (FUS) takes about 300Kb of space on Flash in summary.
3. 256Kb of RAM — shared among the main and the secondary core.
4. Flash memory sized at 1MB — this is the non-volatile random-access memory which stores both our firmware and the co-processor binaries.

Data layout in Flipper Zero's Flash memory

The microcontroller's Flash memory is where the code is stored. Our STM32WB55RG processor has 1MB of Flash memory. This may seem like a very small amount and that's certainly true, that is why all user data, libraries, dolphin's graphics, dictionaries and keys are stored separately on the SD card.  

Flipper Zero MCU's Flash is separated into several sections:

• The main firmware — about 670-700KB in size. All the device's functions are here along with the UI menu, protocols, various drivers, the FreeRTOS operating system etc. We're approaching the limit of our available Flash memory, so we're fighting tooth and nail for each kilobyte of compiled binary firmware.
• Little File System — this memory area is used for the LittleFS embedded filesystem. Every time the firmware is updated everything between the main firmware and the radio stack is given (allocated) to LittleFS. All system files, user settings and bluetooth pairing keys are stored here. When using Flipper Zero without an SD card, user keys will also be saved here. However we don't recommend this since without an SD card half of Flipper Zero's functions won't work. You can view the contents of the filesystem using qFlipper's file manager.
• Radio Stack — the propriatery close-sourced firmware from ST, available from the Co-Processor Wireless Binaries repository. This firmware works with the radio modem and implements the radio protocol in software on the 2.4GHz frequency. You can choose firmware that implements Bluetooth LE, ZigBee or 802.15.4 protocols. We're using stm32wb5x_BLE_Stack_light_fw.bin. Only one protocol works at any given time, so if you want to use ZigBee on Flipper Zero you will need to re-flash the radio stack losing the Bluetooth LE in the process. ST doesn't allow installing arbitrary firmware for the Radio Stack, all firmware files are signed with a digital signature which is checked during the installation by FUS.
• FUS (Firmware Upgrade Services) — a little programm that checks the radio stack's digital signature and controls it's update process. Cryptographic protection of the second core is done through FUS.

As you can see, one third of Flipper Zero's Flash memory is occupied by additional entities which are necessary for the device to work. We only have about 860KB of memory to work with. It's hard to believe that all Flipper Zero's funcions fit in such a tiny amount of storage space. Therefore, we simply don't have the space that can be used for the classic OTA update, which is why we had to invent our own Over-the-Air firmware update subsystem.

The Update Server

Flipper Zero firmware automatically compiles from source by Github CI scripts and the binaries are uploaded to the update server update.flipperzero.one. All compiled firmware versions are listed in the directory.json file, this file is used to get information about available updates. You can download all binary files of the available firmwares here update.flipperzero.one/builds/firmware/.

Similarly, all branches inside firmware repo get compiled and uploaded to the update server after every commit. You can find different folders with separate branch names there. It's convenient when the developer is working on a feature and asks users to test their code.

The update package consists of several different files:

# Flipper Zero Firmware Update files

flipper-z-any-core2_firmware-0.58.1.tgz # Radio firmware bundle from ST
flipper-z-any-resources-0.58.1.tgz      # Applications resources installed on SD card
flipper-z-any-scripts-0.58.1.tgz        # Supplementary scripts

# Main Firmware
flipper-z-f7-full-0.58.1.bin            # Image in binary format
flipper-z-f7-full-0.58.1.dfu            # Image in dfu format
flipper-z-f7-firmware-0.58.1.elf        # Image in elf format (can be used for debug)
flipper-z-f7-full-0.58.1.json           # Metadata manifest in json format

# Updater tiny firmware
flipper-z-f7-updater-0.58.1.bin         # Image in binary format
flipper-z-f7-updater-0.58.1.dfu         # Image in dfu format
flipper-z-f7-updater-0.58.1.elf         # Image in elf format (can be used for debug)
flipper-z-f7-updater-0.58.1.json        # Metadata manifest in json 

flipper-z-f7-update-0.58.1.tgz          # Full OTA package: contains updater image, main firmware, radio firmware, resources and update manifest (the only thing you need to update your flipper)

In addition to the firmware itself, the update package contains the radio stack with which this firmware version is compatible, databases for the SD card, tiny updater firmware, the current version of build and debug scripts, as well as metadata for the update programs.

Firmware Release Cycle

Flipper Zero firmware can be updated through the Flipper Mobile App and qFlipper desktop app. You can select one of the three firmware update channels in the settings: Dev, RC (Release Candidate) and Release.

The difference between firmware releases:

• Dev — the current development ongoing build. All the features from other branches are merged into dev when work on them is finished.  This version of firmware is compiled for every new commit, sometimes several times per day. Dev contains all the latest features, it's bleeding edge. But be aware that it may be unstable, freeze, corrupt your data, or not work at all.
• RC (Release Candidate) — the release version that is submitted for validation testing to the QA department. If bugs are found during the testing phase, the version is amended and a new RC is released. If the release candidate successfully passes all the tests, it becomes the release version without further changes.
• Release — the final and stable version of the firmware, which has gone through testing and is recommended for general use.

You can select the update channel in the updater settings:

We recommend installing the Release version for everyday usage of Flipper Zero. Choose the Dev and RC channels if you are a developer, or if want to test new features, find bugs, and debug them. It would help if you know how to collect debug logs, are good with git, and know how to read the firmware commits.

Old Firmware Update Process

Until recently, the only way to update firmware on Flipper Zero was by USB cable, computer and the qFlipper desktop app. This process consists of several steps, during which Flipper is rebooted several times and reconnected to the computer in different modes as different devices. After each reboot, Flipper disconnects at the logical level and is rediscovered by the computer and qFlipper over and over again.

Step 1 — Downloading backup to PC

In the first step, Flipper connects to qFlipper in COM Port mode and downloads all data from LittleFS — user settings and Bluetooth pairing key files, because all flash memory will be erased in the next steps and these files will be lost. After completing this step, Flipper reboots to DFU mode.

Step 2 (Optional) — Updating Radio Stack

Radio stack updates are released by ST. It is usually updated every few months. qFlipper checks the version of the installed Radio Stack on the Flipper, and if there is an update, it installs the new version. So this process happens quite rarely, relative to our update releases. The Radio Stack update is controlled by the FUS, so we don't have much power over the process.

Step 3 — Installing Main Firmware

The main firmware update is also installed in DFU mode. There are special system flags in memory that may be set to incorrect values after a radio stack update, they are called option bytes. If a radio stack upgrade has been performed, option bytes will be checked and overwritten if necessary.

Step 4 — Installing Databases on SD card

After the main firmware was installed, Flipper reboots to basic mode again and connects as a COM Port. It starts uploading databases to the SD card. The contents of the databases can be viewed in this repository: flipperzero-firmware/assets/resources/. The version of the databases is pinned to the firmware version and is located in the same folder on the update server. The archive with the databases is called flipper-z-any-resources-X.XX.X.tgz

Step 5 — Restoring the backup

The backup made in step 1 is loaded into the LittleFS area. User settings will not be applied until the final reboot.

Step 6 — Final reboot

After restoring the backup, the last reboot is performed and user settings are applied. In total, Flipper can reboot about 5 times during the entire update process and reconnects to PC over and over again as a different device. Sick!🤯

Flipper Zero USB Connection Modes

To understand the update process, it is important to distinguish between the modes that Flipper Zero can be in when connected to a computer:

• COM Port — basic USB serial device
• DFU mode— update & recover mode

In the process of updating, Flipper switches between these modes several times. In the pictures above, describing the old update process, the green arrow shows when COM Port mode is used and the red one shows when it's in DFU mode.

Normal mode — Serial Port

In this mode, Flipper Zero connects to the PC as a COM Port, while our firmware is running. The code responsible for the operation of CDC Serial can be found in the furi_hal_usb_cdc sources. Flipper in this mode has USB Product ID: 0x5740 and Vendor ID: 0x0483. These are ST's default serial port IDs, and many other devices have the same USB IDs. Maybe we'll get our own Vendor ID from USB.org in the future so that Flipper Zero won't interfere with other devices. But we are not sure if the $5,000/year price tag for a custom Vendor ID is really worth it. What do you think?

In this mode, all the functions of the device are operational, and most importantly, there is access to the SD card because our firmware is running. Therefore, databases can be loaded to the SD card, and all operations with files during an update occur in this mode.

DFU Mode

In DFU mode, the microcontroller's built-in bootloader is activated and Flipper is connected to the PC as a DFU device. The bootloader code is located outside the main flash memory zone and is protected from writing or erasing. It cannot be damaged when updating the firmware, the disadvantage of this is that we do not have the opportunity to modify it. In DFU mode, the Flipper has Product ID: 0xDF11, just like many other devices in this mode. There is no way to understand from the properties of the USB DFU device that it is actually Flipper Zero, because in this mode it doesn't differ in any way from other devices based on ST chips.

DFU mode is activated automatically when the firmware is updating, but it can also be activated manually, see Reboot modes. If Flipper's firmware is damaged, DFU mode can also be activated, but the dolphin image will not be displayed on the screen: How to restore a bricked Flipper Zero.

Additionally, DFU mode is complicated by the fact that on Windows you need to install drivers for it 🤮. And although no drivers are actually needed, Windows prevents programs from accessing the device until any driver is installed for it. On Windows qFlipper's setup wizard installs this DFU driver. This is where the most problems arise — we have made a separate Debug DFU Mode on Windows instruction. Everything would be much easier if ST added a USB OS Feature Descriptor to the built-in hardware DFU bootloader code, telling Windows that the device supports the standard WinUSB driver, then there would be no need to install the driver.

In DFU mode, the radio stack and the main Flipper Zero firmware are updated, as well as restored in case of firmware damage. From the very beginning of the Flipper Zero development, we have been looking for a way to update the firmware without switching to DFU, and finally, this work is finished!

The NEW Updating System 🎉️

Since we have almost no free space on Flash memory, the only possibility for OTA update in our case is to download the update files to the SD card and then install updates from there. We have made a separate tiny firmware that gets uploaded to RAM, runs directly from there and does not depend on Flash memory data to govern the update process. In fact, this is the same firmware of ours, only cut down so as to fit entirely in the RAM. All functions are removed from it except for the update feature, SD card drivers, screen drivers, etc.

Now the update procedure looks much simpler for the user: files are uploaded to the Flipper and then the magic happens — Flipper updates itself completely offline.

Step 1 — Uploading update package to the SD card

During the first step, the full update bundle packed into flipper-z-f7-update-0.XX.X.tgz archive is downloaded by the update application (qFlipper or Mobile App) from the update server and unpacked locally in the application. Then the contents of this file are transferred via Bluetooth LE or USB to Flipper's SD card.
The Bluetooth LE protocol is very slow compared to regular Bluetooth, so uploading a ~650KB update file takes about 2-3 minutes, which is quite acceptable in our opinion.

Step 2 — The Magic (Flipper updating itself autonomously)

When the update package is uploaded to the SD card, the updater sends an UpdateRequest command to the Flipper and the magic begins!

Flipper reboots and loads a tiny updater firmware into RAM, it is located in the file flipper-z-f7-updater-X.XX.X.bin In fact, this is the usual Flipper firmware but it's cut down as much as possible in terms of functions. Everything is removed from it, except for the necessary drivers and update functions. It is so small that it fits entirely in RAM. And this means that the firmware on the Flash memory is not active and the updater can overwrite data on the entire Flash memory without fear of breaking something.

Updater performs all the same steps as the old update process, the only difference being it happens completely locally — it updates the radio stack if necessary, installs new firmware, installs databases, uploads files to LittleFS, etc. In this approach, it's Flipper that performs all the steps within itself so it no longer depends on external connections and programs.

OTA Update Live Demo

This is what the new update process through a mobile application looks like. In total, it takes about 2-3 minutes, which, in our opinion, is a very good result.

New Process vs Old One

The new update process is more reliable than the old one because all the update steps are controlled by our firmware and not by the user's PC. Due to the fact that users' computers have different operating systems, drivers, and installed programs, unexpected problems could often come up during the update. Now there's a lower chance of problems occurring. But, the main benefit of this is you can now update the firmware through a mobile application! Hooray 🤩!

Since the new update process is still in beta it may have bugs 🐞, we ask you to report them: How to report bug in Mobile App

Shipping status

You can check all the shipping news on ship.flipp.dev, where we publish frequent updates daily.

Follow us

@flipper_zero

Flipper Discord

@flipperzero

Many backers have already received their Flipper Zeros, and their number is growing by the day. At the time of writing, 23 thousand devices have already been shipped! We're getting a ton of feedback from users and it's amazing.

Unfortunately, there is still a considerable number of backers who are waiting for their deliveries. In this post, we will tell you how it's going so far and give an update on shipping and production schedules. We are also providing a guide on the first launch and initial setup of your device.

First Start Guide

This is a manual for the first launch of Flipper Zero: it explains how to update the firmware, install databases to an SD card, and more. Please read it carefully before using your Flipper Zero as it's a rather advanced piece of hardware, and many things may not be obvious. Read the First Start section of the documentation for more details.

Flipper Zero firmware is under active development and is constantly changing thanks to community input. Therefore, it is important to us that community members understand the device's internal architecture, how the firmware works, how to debug it and how to collect logs. We're counting on the community to improve Flipper Zero together with us.

Power ON

As a safety precaution, Flipper travels in the box in transport mode. In this mode, power is supplied only to the internal clock of the microcontroller. You can read more about the different power modes in the Power section of the documentation.

To turn on your device, push and hold the :back: button.

Install an SD card

Keys, cards, remotes, and databases are stored on the SD card. It's also required during firmware updates, so it's important to install the SD card BEFORE updating the firmware. Flipper supports large-capacity SD cards, but we recommend using an SD card no larger than 16GB or 32GB. Since Flipper Zero utilizes very small files rarely exceeding 1MB in size, it makes no sense to use large SD cards. You can read more in the SD card Setup section of the documentation.

The SD card should snap into place inside the port, in order for this to happen it needs to be pushed a little deeper into the case. You will need to push the card for it to lock inside using your fingernail or something thin. This may not always work with short nails – here is a video on how to push the SD card into the slot in such cases.

If the SD card is successfully mounted, you will find a little SD card icon on the top bar:

If your SD card fails to mount, it probably has an incompatible file system. Please format the SD card to exFAT or FAT32 format to use it: How to format SD card in Flipper.

Formatting the SD card

SD card support in Flipper's firmware is implemented using the FatFs library. In order for it to work, the SD card must be formatted to either FAT32 or exFAT.

We recommend formatting the SD card using Flipper's built-in format tool. You can do this by navigating to the following menu:  Settings -> Storage -> Format SD Card

What SD card to get?

Not all SD cards are made equal. High-quality branded SD cards have several physical interfaces that can be used for connecting to a device — SDIO and SPI.

There are many cheap counterfeit and off-brand SD cards on the market, which don't have all interfaces working stably. In some cases, one SD card works fine over the high-speed SDIO interface but works poorly and is unstable over SPI. Flipper uses SPI, so it's important to choose a high-quality branded SD card for your Flipper Zero.

You can test the speed of your SD card in SPI mode by going to Settings -> Storage -> Benchmark SD Card. You can find the average SD card speed on the SD Card speed test documentation page. It's ok if the values you're getting are slightly higher or lower. If you're having problems with an SD card, the best advice we can give is to simply try another one.

What is stored on the SD card?

The SD card is necessary to unleash the full potential of Flipper Zero. It stores auxiliary files that we call databases. Many Flipper Zero features will not work properly without a relevant database on the SD card. You can find a detailed description of files stored on the SD card here: flipperzero-sd-card-examples.

The databases are copied to the SD card during the last part of the firmware update process. That is why it's important to perform the update with the SD card already in place. All user keys, signals, cards, and remotes are also stored on the SD card. You can access these files through qFlipper or through the Flipper Mobile Apps.

You can also access files on an SD card at any time by plugging it into a computer. Almost all files used by Flipper Zero are stored in plain text and can be easily viewed and edited with your favorite text editor.

Firmware Update

Flipper Zero comes out of the factory with a very old firmware version. This version is tied to the production processes of testing and calibrating the device on the factory line. It is important to update the firmware to the latest version right after taking your device out of the box. Do not use the device running factory firmware, it is hopelessly outdated!

Update your Flipper Zero's firmware: flipperzero.one/update

qFlipper is a desktop application for updating Flipper Zero firmware. It's fully open-source and written in Qt. It works on all major operations systems — Windows/macOS/Linux. In addition to updating the firmware, the qFlipper application will install the databases (flipperzero-sd-card-examples) to the SD card.

Update Process Rework

Flipper Zero's firmware update consists of several stages:

1. First core firmware update (Flipper OS)
2. Second core firmware update (Bluetooth RadioStack)
3. Databases installation to the SD card

Right now the Flipper Zero update process is rather complicated: the device reboots several times into different modes. It switches from DFU to Serial, reconnects to the computer several times as different devices, etc. This causes unexpected issues on different operating systems during the update process.

We are working on simplifying this process by reducing 3 steps to just one. Our goal is to have the entire update package downloaded to the SD card, and then Flipper will perform all update steps locally without a computer. At the same time, this will allow us to update the device without a computer using the mobile apps. The first firmware update from the factory to up-to-date firmware will still need to be carried out via qFlipper from a PC. However, we plan to bump up the factory firmware version at some point as well.

How to report firmware update issues

If an error occurs during the update process, it is important for us that you describe it in detail. Since we don't collect any usage data and statistics from your computer, you will have to report the issue yourself by posting it to the forum:

1. Firstly, check the Firmware Update forum section and try to find your issue, it may be possible that the solution is already there
2. If you can't find an issue similar to yours, go to qFlipper and press the Logs button
3. Press the Open Full Log button, which will open the full update log in a txt file
4. Create a new topic on the forum, describe your issue, and your actions in detail, and attach the Full Log file

Most often, issues occur on the Windows operating system and are caused by drivers for DFU. Therefore, before checking the forum, you can try checking this guide: How To Debug Firmware Update on Windows.

Update via Mobile Apps (Work in Progress)

So far, qFlipper is the only recommended way to update the Flipper Zero firmware. But we are working hard on a way to update the firmware via mobile applications and this will be released soon. We'll make a separate post later to tell you more about it. For now, you can try other cool features in the Flipper Mobile App for Android and iOS.

Flipper Zero Documentation

The official Flipper Zero documentation is in progress and is 20% complete so far. Flipper's firmware features are being constantly updated and improved right now so it's hard to keep up at times. We're working on finalizing the firmware APIs and writing the documentation along with it. We hope to complete the main sections by the time all devices are shipped to backers.

Forum — the best place to discuss tech stuff

Our official forum is the best place to communicate with developers, discuss technical issues, post feature requests, report bugs, etc. We strongly encourage you to use the forum to discuss any issues related to the Flipper Zero, as any discussions in chats and comment sections will not be indexed and therefore will be impossible to google.

How to create a good topic on the forum

It's important to follow the rules for formatting messages on the forum if you want us to take a close look at your problem or request:

1. The title should be as specific and detailed as possible.
   Good title: qFlipper on Windows 10 freezes when VMware Player running
   Bad title: qFlipper freezes. HELP!
2. Specify your version of Flipper Zero firmware and operating system.
3. Attach logs, screenshots, and photos related to your problem or request

My remote/card doesn't work

We are constantly adding support for new types of cards, remotes, and protocols. If Flipper Zero can't read your remote or card, you can help us add support for your protocol by making a comprehensive request with all the necessary information. This applies to all features: 125khz RFID / NFC / Sub-GHz / Infrared.

Here's a manual on creating a request to add support for a new Sub-GHz protocol:

⚠️ My remote isn’t supported | How to add new Sub-GHz protocol in Flipper Zero

Abstract Flipper’s firmware is deeply under development, new features and protocols added everyday. We need your help to analyze and collect new protocols. Please follow this guide to create a report of your unsuported remote. Your report will help developers to implement new Sub-GHz protocols. По…

Flipper Zero Communityzhovner

And here's an example of a good request to add a new remote type:

⚠️Request: Linear Megacode Garage & Gate Remotes (Fixed/non-rolling code)

Request to support the Linear Megacode Protocol. Frequency: 318MHz Modulation: Amplitude Modulation (AM) FCC ID: EF4 ACP00872 MODEL: Linear ACT-31B FCC ID: EF4 ACP00728 MODEL: Linear MT-1B FCC ID: EF4 ACP00729 MODEL: Linear MT-2B Short: 1000 µs Long: 1000 µs Gap: 9000 µs Reset: 20000 µs…

Flipper Zero Communitynhx0

Community Feedback

We are extremely grateful to the community for all the feedback you provide us. It really energizes our team. If you've received the device and want to share your impressions, the best way to do this is by publishing it on your favorite social network like Instagram, Twitter, Facebook, Youtube or your personal blog with the hashtag #flipperzero. Our whole team reads such posts and it makes us very happy. Thank you for doing this!

If you want to read backers' feedback so far, the best places are:

1. Subreddit r/flipperzero (lots of activity)
2. Twitter @flipper_zero where we retweet interesting tweets. Just search #flipperzero hashtag for more
3. Instagram posts
4. Videos on Youtube

Funny stuff from the community

Using Flipper Zero to open Tesla car charging port hatches! This trick uses Sub-GHz RAW signal read and emulate features. Original post in Tiktok.

Flipper communicating with an old pager. Original tweet.

Flipper Zero emulates Amiibo tags for Nintendo Switch. The original tweet by @CommodoreKazz.

A cool and detailed video review @DarthDomo.

Also, Reddit user @DroomOne wrote a great tutorial on How to create a plugin for flipper zero from scratch.

Shipping Update

At the time of writing this post, we have already shipped 23,109 devices. That means that we've fully shipped 45% of all Kickstarters orders, or all orders to the US, CA, and AU regions.  

You can track the total number of devices shipped on our special tracking site, where we also publish frequent small updates on the progress.

Shipping plan

Here is the updated shipping status and schedule:

• ✅ USA — Fully shipped, mostly delivered
• ✅ Canada — Fully shipped, mostly delivered
• ✅ Australia — Fully shipped, got stuck on customs for Biological check
• 🔄 EU & UK — Early June, the batch is in production right now
• 🔄 Russia — Mid June, material preparation
• 🔄 Rest of the World — Late June, material preparation

Why is there a delay again?

Unfortunately, we still experience production and supply issues that cause shipping delays. Here is what we faced and solved since the last post:

• TI CC1101, the chip powering the Sub-Ghz feature, is in extreme shortage. To date, the supplier has shipped just a fraction of our initial order. The same situation is with our LED driver — TI LP5562. To overcome this we have to purchase these components on the spot-buy market at a much, much higher price (3-5x for CC1101 and 20-30x for LP5562)
• Battery supply chain issues. We've sourced a new supplier and reworked our supply chain to be more redundant in the battery department
• The last batch of USB cables we received was partially corroded on the metal part. Units packed with such cables had to be reworked and incoming quality control procedures had to be improved
• 8k pieces of Top Cover body part had an excess rib in the internal structure that caused a failed assembly. Those parts had to be reworked if possible and replaced completely if not

Our production team works 24/7 to keep the production running non-stop and overcome these issues as well as many less significant, but still disturbing ones. However, we've come a long way already and we are sure that all the orders will be shipped despite all the difficulties and challenges. We thank you for your patience and continuous support.

Afterword

Here is an afterword, unedited text from the co-founder of the project Pavel @Zhovner, all punctuation, and spelling are preserved:

Today we can confidently say that we have won. This is a real genuine victory! Every day new problems and issues threatened us with a complete fail. Component crises, supply disruptions, production problems, lockdowns, COVID and wars – all this at any moment could turn us into another scam project from Kickstarter that did not fulfill its obligations.

Despite the fact that this is the most exciting and interesting project in my entire life, at the same time it's the most difficult, humiliating, painful and exhausting. My worst nightmare is being the person who failed, didn't live up to their commitments, and scammed 40k backers. This is a very strong emotional pressure, as such a shame can never be washed off. Therefore, my entire reputation, professional career and, in fact, life in general, have always been at stake, no matter how loud it may sound.

At the moment we've shipped 45% of all orders and we can confidently say that we are guaranteed to ship all 100% of orders from our backers. Yes, many still have not received their devices, but this is temporary, there is no doubt that everyone who trusted us and supported the project will receive their orders. And that's why I think that we have won.

We are a small team of enthusiasts who are opposed to a huge bureaucratic machine, global crises and other circumstances that are much bigger than us. But we are convinced that true passion and love for your work is stronger than any obstacles. That is why our entire team works hard every signle day on the Flipper Zero, being truly in love with the project.

At the moment, we havn't made any profit on this project, we have spent all the fund raised on development and production. But we are only at the beginning of the journey, and what's next will be even more interesting and exciting.

As we announced in the previous update, we began shipping Flippers in January. In this post, we will report the current status of manufacturing and shipping and will cover all the difficulties we faced.

First United States Batch

A batch of 4541 orders including 4700 white Flippers, lots of cases, and protoboards, was transferred to the Hong Kong warehouse and handed over to our logistics partner on February 17th. This batch covers all Kickstarter orders and most pre-orders that head to the United States and do not contain black Flippers or Wi-Fi devboards. Other United States orders will be shipped within the coming batches.

Our logistics partner needed more time than we expected to pack all orders in individual parcels and prepare them for shipping. COVID restrictions also impacted flight schedules a lot, so the plane with the batch has landed in Chicago on March 4th. We expect people to start getting USPS tracking updates on March 7th, after parcels go through customs.

GPIO Header Failure

We have multiple levels of quality assurance set up in our factories to prevent faulty devices from getting to customers. Recently one of our testing lines revealed an issue with GPIO header plastic that suddenly started exploding in an SMT oven.

The only appropriate solution was to pause the processes, recall affected PCBs, replace faulty GPIO headers, and fix the origin of the issue, which took more than a week.

Hong Kong COVID Spike

Due to the large COVID spike in Hong Kong, authorities required all its residents to get tested and imposed new restrictions for businesses, which also affected our logistics partner and warehouse.

The number of warehouse workers is now limited and random testings of the facility take place. As warehouse reports, this might slow down their work and affect shipping performance.

Russo-Ukrainian Conflict

Ongoing conflict doesn't impact our business as Flipper Devices Inc. is a U.S.-based company. Our devices are manufactured in China and shipped from Hong Kong, so logistics is not directly affected too.

However, it is now obviously impossible to ship to Ukraine, and we can't predict if it will be possible to ship to Russia. If we face any logistics restrictions, we will hold these parcels until the world stabilizes and shipping options appear. If you are leaving Ukraine, Russia, or Belarus, we can update your shipping address. Just write support@flipperdevices.com from the email you used to place an order and include your new full address.

More than 8,000 of our customers live in the involved countries. We stand with you during these difficult times and hope for peace. Please stay strong and take care of yourself and your family.

Adjusted Shipping Plan

Considering the difficulties we mentioned above, we now plan to deliver all orders by Mid May 2022. We also reordered the detailed schedule a little:

• USA / 5k (already shipped)
• Australia and Canada / 5k + USA / 5k (Late March)
• USA / rest (Mid April)
• EU and UK / 20k (Late April)
• Russia / 7k (Mid May, if all goes well)
• Rest of the world (70+ countries) / 3k (Mid May)

Please note that per-batch volume numbers and timeframes are approximate and may be adjusted. This schedule includes both Kickstarter orders and pre-orders.

Where is My Flipper?

You will get an email with a tracking number as soon as we ship your order. However, you can also check your order manually.

I backed on Kickstarter

Check your BackerKit survey using the email you used on Kickstarter to look up the status.

We notify twice before locking addresses: a ~week and 48 hours prior to lock.

If your Flipper was shipped, you will see a clickable tracking number on your BackerKit order confirmation page.

I pre-ordered in the store

Check your order confirmation email and click the blue "View your order" button.

If your Flipper was shipped, you will see a clickable tracking number.

Stay Tuned

Our social media subscribers get all the Flipper Zero news first! Join in and get access to sneak peeks, insides, and more.

@flipper_zero

@flipper_zero

@flipperzero

Oh, man. Flippers are gradually starting shipping. This is probably the most exciting moment in the project's life so far. We’re getting everything ready to ship 5k units. It’s a tedious process since we have to coordinate shipping to over 120 countries! We had to get a lot of paperwork done: customs documents, radio, cryptographic certificates, tons of other stuff. Hell of a lot of paperwork.

We’re still facing challenges related to component shortages that hinder our production. Let’s take a look at how we’re getting everything ready for shipping, take a peek at how the production’s going, and what we’re going to do next.

Compliance & Customs Documents

It's important for us that Flipper Zero is absolutely legal for import into all countries. We’re getting all the necessary certificates and customs documents to make this work.

In addition to radio, cryptographic, electronic, and ecological certifications we also had to get over 20 different tax IDs in the EU, Great Britain, Australia, and Canada.

You can find all the latest compliance documents here: flipperzero.one/compliance
We will be keeping this page updated as new documents arrive.

Production

Right now our production line is outputting 5 thousand devices per week, and we’re working hard to get it up to 10k/week till February.

We’re still experiencing issues with global components shortage, and we are constantly seeking ways to overcome them to keep the production line going. Something that was readily available yesterday may just disappear altogether tomorrow, or the supplier may suddenly cancel the delivery without any warning.

Large-scale production is all about finding things to optimize. Every second saved during the assembly equals to more devices per day.

It's impossible to solder the Sub-GHz antenna and the LCD screen by the reflow oven, so we had to construct a special rig that holds these parts in place while a robotized solder iron whooshes around and attaches them to the PCB.

It’s important to test all the elements of every PCB before assembling the device. To test the buttons on the Main board, we made a pneumatic poking machine that physically presses all the buttons. Turned out pretty cool!

Each person on the production line does only one simple task. This leads to fewer mistakes which in turn leads to fewer defects during the final assembly. It simplifies the necessary training as well, so scaling the production line is as easy as just adding more people to every stage.

After the assembly and testing the devices are packed in shipping boxes, with 50 Flippers in each. The boxes are then palletized. The resulting pallets are loaded into containers heading for direct injection to our major regions. To countries with fewer orders quantity, orders will be sent out by individual parcels.

Production flaws

We’re facing a lot of flaws during the production at the moment. These are problems that only turn up when ramping up the production, and they are hard to detect during the early stages. Most of them simply don't occur unless the devices are assembled in large numbers.

The good news is that we’re catching defects right on the production line using our thorough testing stations, so the defective devices aren’t going to be shipped to the end-users. Every Flipper goes through 7 stages of testing before assembly and two more before finally getting into the box. We’ve spent a tremendous amount of time and effort to fine-tune this process to be as smooth as possible.

Defect rate

• Main PCB — 7%
  - The SD card holder is placed incorrectly. This leads to the detect pin not getting soldered and the SD card doesn’t work. We’re remaking the placer’s suction cup to make it all suck less.
  - Plastic parts of the GPIO contacts are bubbling up due to high temperatures in the reflow oven. We’re making changes to the process so this won’t happen in the future.
  - The Sub-GHz antenna placement at times deviates more than it should, which leads to problems during the assembly. We’re fixing the solder jig to keep it within acceptable tolerances.

• iButton PCB — 1.4%
  - Crooked pogo pins. We were putting on too much soldering paste, so the pogo pins were drifting when baked in the reflow oven. This leads to the pins not poking out through the case when assembled.

• Assembled device and mechanics — 4%
  - The molding factory messed up some of the post-processing. The sprew wasn’t removed well enough on the lower lid. When assembling the case this results in a gap, and gaps suck.

Shipping

Shipping 60k devices to 120+ countries is a very challenging task. We’re tightly working with our logistics partner to make this process as seamless and predictable as possible.

Thanks to COVID-19 we constantly have to route around the local restrictions. Just recently several countries have imposed flight bans due to Omicron variant, which has an impact on moving stuff around the world as well.

• We will hand over the first 5 000 orders to the logistics before the end of January, this batch will be heading to the United States. We’re sending only orders with white Flippers without the ESP WiFi board to keep any possible defects from getting out of the factory while we improve the process further.
• We will be sending out 20k more by the end of February. And we plan to ship the rest of the orders by the end of March, both Kickstarter and pre-orders from our shop, if all goes smoothly.
• Since the pandemic situation is far from stable (of course we had to get this Omicron right when we were about to ship) and we want to keep the defect rate predictable, we’ve formed a plan of sequential shipping by regions:
  - USA / 20k
  - EU and UK / 20k
  - Russia / 7k
  - Australia and Canada / 5k
  - Rest of the world (70+ countries) / 3k
• All parcels will be sent by airmail. After your order is transferred to the shipping partner, delivery will take from 6 to 18 business days, depending on your region and distance to the nearest local warehouse.

FAQ

When will I receive my Flipper?

We are doing our best to ship everything out in Q1 2022. Please be patient and don’t bug us with this question, as we’re really busy with the production and logistics. We’re working non-stop and this question will not make it happen any faster.

How do I check if it's shipped?

All sent orders will be marked accordingly in BackerKit. You can always check the status yourself, just get a link to your account here (use your Kickstarter email).

When your order ships its status will change to “Your order is shipping” and you will get the tracking number. Check out the screenshots on the right for an example of how it looks:

How do I change the shipping address?

You can change your shipping address in your account now and we will warn you before blocking all changes to the shipping addresses. The first warning will come prior to a week, and the last warning two days before locking in the address. After it is locked, changing the address will no longer be possible.

I still haven’t paid for shipping

If you haven’t managed to pay for shipping and add-ons on BackerKit before this option became unavailable, your account may have an outstanding debt. We will enable PayPal in February to provide you the option to cover this debt. Please wait for a separate email, and don’t worry — your order will not be forgotten or lost.

Good news everyone! The LCD displays have finally arrived. This means that we now have all the components necessary to start mass-producing Flippers. We have 60000 screens, enough for all the devices backed on Kickstarter and for some part of the pre-orders made on our website. Here's what we've been doing while we had to wait for the screens and the latest production and delivery plan.

We are now making about 150 devices per week, but the production line will achieve a few thousand devices per week in a month. More on the production plan and estimated delivery time at the end of this blog post.

What's new?

While we waited for the necessary components we kept working on the firmware non-stop. Flipper's firmware is receiving updates, bug fixes, and new features every day. All the firmware commits are logged in our GitHub repo for everyone to see.

More than 30 people are working on Flipper Zero full-time. A tremendous amount of work has been done already, and there is still a lot more to do. Here is what we've done, as a brief review:

• Wrote over 90k lines of code
• Completed more than 2000 tasks in Jira
• 85% of all the advertised Flipper features are working
• We've got the first app prototypes for Android and iOS
• Our desktop app qFlipper is available for Windows/macOS/Linux
• For 20 hard-to-get electrical components, more than 60 alternatives were selected and tested (THIS WAS A REAL PAIN)

In addition to development we've been dealing with a lot of other tasks: logistics, accounting, certification, financial planning, procurement, organizing production, testing, packaging, customs declarations and permits, searching for alternatives during the component crisis, and negotiating with the suppliers. We've got a real dream team that handles all this load. Thank you all for the work done in these difficult circumstances.

New Sub-GHz features

Our new Sub-GHz app can decrypt signals from more than 50 different keyfob manufacturers, and it's constantly being extended. We hope that with the help from the community, we will have the most complete open database of radio protocols from different manufacturers.

Frequency analyzer

In order to be able to receive a signal you first need to tune the receiver to the required frequency. But what if you don't know the frequency that the keyfob is working on? To help you with that, we have the frequency analyzer feature added to Flipper. It scans all available frequencies and displays the one that has the strongest signal nearby.

Of course, this feature can't replace a full-fledged frequency analyzer. The results displayed may be inaccurate and there is always a certain margin of error, but it will be able to tell you the frequency range you need. Most often it's one of the channels from a popular 315/433/868 MHz band.

Signal interception

The main subjective of our Sub-GHz subsystem is to analyze the signals it captured. And right now the signal interception feature has become really powerful. You can easily find out the protocol for a particular keyfob and have the decoded signal displayed immediately. The lock icon shows if the protocol is encrypted or not.

Capturing RAW signals

There may be cases when Flipper isn't familiar with a certain protocol, but even in this case it still can capture the raw signal. This feature allows recording all the signals and dumps them straight to the SD card without trying to process anything.

The recorded signal can be replayed right after the recording, or it can be saved for further analysis. This way you can capture even those signals that aren't recognized by Flipper yet and work on decyphering them with the community.

Wild BadUSB appeared!

The BadUSB is working! We've spent a lot of effort on the USB HID mode and on switching it back to normal mode afterward. This feature is now stable and reliable.

The scripting language for BadUSB is compatible with Rubber Ducky Language, so you can reuse the scripts that are already available for USB Rubber Ducky and other such devices.

Right now our BadUSB is still a prototype with no GUI, but it'll be finished soon. We plan to have a couple of demo scripts bundled with the firmware with safe actions such as opening the notepad and the calculator for all operating systems.

USB <-> UART bridge

Thanks to Flipper's GPIO you can use it as a universal USB bridge for a variety of industrial protocols. Right now we implemented the UART as the most popular protocol, the de-facto standard for debug ports and hardware consoles. You won't need a USB-UART adapter anymore if you have a Flipper.

This mode supports DTR/RTS pins as well, so you can flash devices like ESP8266/ESP32, which require flow control signals in addition to the RX/TX data lines.

The USB Serial interface you see is still a draft, but soon the user interface is going to look like this:

This mode has several options available:

• COM Port — the virtual USB COM-port to use. When choosing 0 (CLI) the main Flipper console will be used. When choosing 1 a second COM-port will be created, with the main OS console still available on its original port.
• Baud rate — determines the UART speed. You can set it manually depending on your device, or switch to Host mode so that the baud rate will be chosen automatically when connecting to the port in tools like screen or minicom
• UART Pins — Flipper has two hardware UARTs on pins 13,14 (USART) and 15,16 (LPUART)
• DTR/CTR — the pins for the flow control signals. Since they are implemented in software, you can choose any digital pin on the GPIO

The new qFlipper

qFlipper — is a cross-platform desktop tool that can be used to update firmware and the databases, create backups, and a lot more. It is Qt-based and works in all the popular operating systems: Windows/macOS/Linux.

It's being actively developed right now, but you can already update the firmware, the radio core, and the databases.

Flipper Protobuf RPC

Flipper now has a Protobuf RPC API, available both through USB, and Bluetooth LE. This protocol is used when updating the databases on the SD card and for any other external interactions. For example, you can stream Flipper's screen using this protocol:

In this demo, the graphics are rendered using symbols right in the terminal, similarly to the programs that use ncurses. This means that such screen streaming can be used without any GUI at all, for example through SSH.

We've prepared a high-level library in Go for convenience, it allows you easy access to Flipper's API. We hope that implementations in other popular languages will soon follow.

The components of suffering

Due to the crisis, we had to replace the already tried and tested components on the go. We've replaced about 20 components in total. At times it was easy, but there were other times when the PCB had to be redesigned. This was quite an ordeal, because some components had a surprise in store, baffling us with things unforeseen. Here's one that was a particular source of irritation. There were actually a lot more of them, but let's showcase this one.

The power struggle

This one brought us a lot of pain. In one of the previous blog posts, we've noted that we have trouble buying the DC-DC converters. So we had to switch to an alternative. For example, we've switched TI TPS62743 for a TI LM3281YFQR.

Judging by the datasheets alone everything should fit perfectly. We tested it in actual device circuits, and when we were about to approve the new design, it turned out that Bluetooth LE starts misbehaving under certain conditions. The insidiousness of this problem lies in that it couldn't always be reliably reproduced in tests at first.

It turns out, that 3.3v line pulsations were to blame. Despite the fact that there is nothing in the STM32WB55 datasheet about pulsations disturbing the operation of the CPU. Here's a thread on the ST forum about this issue: Power supply ripple/pulsation causing BLE TX to fail

This is the problem itself and the solution on the oscillogram:

The red line shows the output signal from LM3281 in ECO-mode, that matches the datasheet completely. You can see pulses in the range of 40mV. This is completely normal for this microcircuit and is not a problem in itself. However, during testing, it turned out that if the rising edge happens to be faster than 6mV/us it breaks Bluetooth LE. In yellow you can see the signal we've achieved after a little refinement.

We had to deviate from the LM3281 datasheet: we've managed to pat down the spikes by worsening the Q factor of L14 in the LC-circuit by the means of additional resistance; and we've also added another LC-filter, to distance ourselves from the value that caused so much trouble.

Stable subsystem work and the resulting power consumption was our top priority. If you worked with LM3281 you may want to bring up the question of PWM-mode that this chip supports having no pulsations. Unfortunately switching to PWM-mode had to be discarded early on due to additional power drain and lack of guarantees from ST that this problem only affects BLE.

Wi-Fi Module

The first version of the developer board extension was based on the ST-Link V3 module, which is currently not available for purchase. We have been negotiating with ST for a long time, hoping to get 6 thousand of these boards ordered by backers, but so far it seems that this module will not be on sale for a long time.

We got out of this sticky situation by designing a completely new board based on the ESP32-S2. It also allows debugging Flipper with Black Magic Probe software, which was updated by our developers to support Flipper Zero.

Thanks to onboard Wi-Fi, the board can handle a much wider range of tasks and is now useful not only for developers. After all the backers' orders are shipped, the board will be available in our shop. Don't worry if you haven't ordered it in BackerKit.

Production Plan

We have officially entered the MP (Mass Production) stage with our factory. Within 4 weeks, the production line will reach a capacity of 1k units per week and will gradually increase to 10k units per week.

Shipments to backers will begin in December. Due to the complexity of logistics, we need to accumulate a certain volume of parcels for import to each specific country. This is due to the limitations imposed by the logistics broker. We expect to ship most of the backer orders by the end of January.

Stay Tuned

Our social media subscribers get all the Flipper Zero news first! Join in and get access to sneak peeks, insides, and more.

@flipper_zero

@flipper_zero

@flipperzero

RFID is a contactless radio-tag technology. It is quite common and you may see it in a lot of places: intercoms, bank cards, public transport passes, office passes, they are used to track domestic animals, for toll collection, etc. The two main RFID tag types are high frequency and low frequency.

• Low-Frequency tags (125 kHz) — work at a higher range. Despite being insecure and dumb, they are still used in primitive access control systems: in building intercoms, offices, sports facilities, museums.
• High-Frequency tags (13.56 MHz) — have a lower effective range when compared with the low-frequency ones but have more complex protocols. They support encryption, authentication, and cryptography. These tags are commonly used in contactless bank cards, to pay for public transport, and in high-security access control systems.

Here we will compare these two types of tags, take a look at the main protocols and learn to work with them using Flipper Zero — we will read, emulate, save and clone them. You will see how you will be able to save your office, sports, home whatever RFID keys you have and we'll take a glimpse at what Flipper can read from a bank card.

How RFID Tags Work

Most RFID tags are passive tags with no internal power source. The chip inside is completely turned off until the tag is exposed to a reader's electromagnetic field. As soon as it comes within range, the tag's antenna begins absorbing energy from the reader's EM field and the chip receives power. The chip then turns on and begins communicating with the reader. It's worth mentioning, that a tag's antenna is tuned to a specific frequency, so the tag can only activate when it is inside a suitable electromagnetic field.

RFID Tag Types

On the outside RFID tags can be quite different: cards both fat or thin, key fobs, bracelets, coins, rings, or even stickers. Judging by the visuals alone it's almost impossible to distinguish the frequency or protocol the tag operates on.

Quite often manufacturers use similar plastic cases for different types of RFID fobs operating on different frequencies. Two absolutely visually similar tags might be totally different inside. It is worth considering when you try to distinguish the type of tag you have. In this article, we will be looking at the two most popular types of RFID tags that are used in access control systems. Flipper Zero supports both their frequencies.

There is a variety of RFID protocols working on other frequencies. UHF for example uses the 840-960 MHz range. They are used for tracking assets in warehouses, paying for toll roads, tracking wild animals during their migration and so forth. These tags may have a battery and work from a couple of meters to kilometers. They are quite rare though, and you may not encounter them unless you go looking for them specifically. We will omit them entirely for the purpose of this article.

125 kHz & 13.56 MHz – Which is Which?

The easiest way to understand what range of the RFID tag is operating on is to look at the antenna. Low-frequency tags (125 kHz) have an antenna made of a very thin wire, literally thinner than a hair. But such antennas have a large number of turns, therefore, such an antenna looks like a solid piece of metal. High-frequency cards (13.56 MHz) have a significantly smaller number of thicker turns, with visible gaps between them.

You can shine some light through an RFID card to see an antenna inside. If the antenna has only a few large turns, it is most likely a high-frequency antenna. If the antenna looks like a solid piece of metal with no gaps between the turns, it is a low-frequency antenna.

Low-frequency tags are often used in systems that do not require high security: building access, intercom keys, gym membership cards, etc. Due to their higher range, they are convenient to use for paid car parking: the driver does not need to bring the card close to the reader, as it is triggered from further away. At the same time, low-frequency tags are very primitive, they have a low data transfer rate. For that reason, it's impossible to implement complex two-way data transfer for such things as keeping balance and cryptography. Low-frequency tags only transmit their short ID without any means of authentication.

High-frequency tags are used for a more complex reader-tag interaction when you need cryptography, a large two-way data transfer, authentication, etc.
It's usually found in bank cards, public transport, and other secure passes.

Low-Frequency 125 kHz Tags

• Long Range — lower frequency translates to higher range. There are some EM-Marin and HID readers, which work from a distance of up to a meter. These are often used in car parking.
• Primitive protocol —  due to the low data transfer rate these tags can only transmit their short ID. In most cases, data is not authenticated and it's not protected in any way. As soon as the card is in the range of the reader it just starts transmitting its ID.
• Low security — These cards can be easily copied, or even read from somebody else's pocket due to the protocol's primitiveness.

High-Frequency 13.56 MHz Tags

• Low range — high-frequency cards are specifically designed so that they would have to be placed close to the reader. This also helps to protect the card from unauthorized interactions. The maximum read range that we managed to achieve was about 15 cm, and that was with custom-made high-range readers.
• Advanced protocols — data transfer speeds up to 424 kbps allow complex protocols with full-fledged two-way data transfer. Which in turn allows cryptography, data transfer, etc.
• High security — high-frequency contactless cards are in no way inferior to smart cards. There are cards that support cryptographically strong algorithms like AES and implement asymmetrical cryptography.

RFID in Flipper Zero

Flipper supports both high-frequency and low-frequency tags. To support both frequencies we developed a dual-band RFID antenna that is situated on the bottom part of the device.

A separate NFC controller (ST25R3916) is used for high-frequency protocols (NFC). It takes care of everything related to hardware interaction with the cards: reading and emulation. Low-frequency 125 kHz protocols are implemented programmatically via a custom analog frontend, that works in cooperation with MCU and also allows to read, write and emulate.

The top part of the PCB is shielded with a ferromagnetic layer which isolates the rest of the electronic components from interference and extends the operating range by reflecting the high-frequency field.

During assembly, the antennas are glued into Flipper's back panel. It connects to the PCB with pogo-pins. This greatly simplifies the assembly, as no cables are used and no UFL connectors are required.

Low-Frequency 125 kHz Protocols

Low-frequency tags store a short ID, just a couple bytes long. The tag's ID is compared to IDs stored in the database of a controller or an intercom. However, the card will transmit its ID to anyone asking as soon as it receives power. Quite often the ID is inscribed on the card itself, so you can take a picture and input it into the Flipper manually.

Popular 125 kHz protocols:

• EM-Marin — EM4100, EM4102. The most popular protocol in CIS. Can be read from about a meter because of its simplicity and stability.
• HID Prox II — low-frequency protocol introduced by HID Global. This protocol is more popular in the western countries. It is more complex and the cards and readers for this protocol are relatively expensive.
• Indala — very old low-frequency protocol that was introduced by Motorola, and later acquired by HID. You are less likely to encounter it in the wild compared to the previous two because it is falling out of use.

In reality, there are a lot more low-frequency protocols. But they all use the same modulation on the physical layer and may be considered, in one way or another, a variation of those listed above. At the time of writing Flipper can read, save, emulate and write all three protocols. There may be other ones, which are not supported in Flipper's firmware, but as the 125 kHz subsystem is implemented programmatically, we can add them in the future.

EM-Marin

EM-Marin is the most common format we have in CIS. It is simple and has no copy-protection. EM-Marin cards usually have EM4100 chips inside, but there are others as well. For example, you can have an EM4305 which can be re-written unlike the EM4100.

To read a low-frequency card go into the Flipper menu 125 kHz RFID —> Read and place the tag on the back of the device. Flipper will attempt to determine the protocol and on success will display it alongside the card's ID. Since Flipper is trying all the protocols in one go it takes a bit of time. For example, you will need a couple of seconds to read an Indala card.

EM4100's unique code is 5 bytes long. Sometimes you can find it on the card itself. The unique code may be written both as a decimal or in hex. Flipper displays the code in hex, however, EM-Marin cards usually just have the 3 lower bytes written on them, and not the full 5-byte number. If there is no way to read them from the card, the other 2 bytes can be brute-forced.

To emulate an RFID tag we need to go into the menu 125 kHz RFID —> Saved, choose the necessary tag and then press Emulate.

Some intercoms try to protect themselves from key duplication by sending a write command prior to reading. If the write succeeds, that tag is considered fake. When Flipper emulates RFID there is no way for the reader to distinguish it from the original one, so no such problems occur.

HID Prox

HID Global — is the largest manufacturer of RFID devices in the world. They have several high and low-frequency RFID protocols. The most popular low-frequency HID protocol is the 26-bit H10301 (also known as HID26 or HID PROX II). The unique code is 3 bytes (24 bits) long, and 2 more bits are used for parity check (to ensure the integrity of data).

Some HID26 cards have numbers written on them - they are the sales order number and the card's ID. You can't figure out the whole 3 bytes with that information alone, the card only has the 2 bytes printed on it in decimal format. That is the card's ID.

Flipper can only work with the HID26 protocol of the HID family. In the future, we plan to extend this list. HID26 is the most popular one since it is compatible with most digital access control systems.

Indala

Indala is an RFID protocol developed by Motorola and later acquired by HID. It's a very old protocol that you won't find in modern access control systems. Rare as it is, you may sometimes find it in the field. At the time of writing Flipper works with Indala I40134.

Same as with HID26, cards using Indala I40134 have a unique code that is 3 byte long. Unfortunately, Indala's data structure is proprietary and everyone who wishes to support this protocol is forced to choose whichever byte order they want, and also how they interpret the signal on the hardware level.

All these protocols are so simple that the card's ID may be entered manually without the original card. Having your card's ID in text format, anyone owning a Flipper could enter it manually.

Manually Entering the Card's ID

To add the card's ID go to the menu and choose 125 kHz RFID —> Add manually, then the protocol and enter the ID. The card added will be saved to the SD-card, and may then be emulated or written to a blank.

Writing to a Blank Card

There are special blank cards that support any of the three protocols mentioned above (EM-Marin, HID Prox, Indala). T5577 is the most popular blank card type. To write an ID to a blank card go to the menu 125 kHz RFID —> Saved, then choose the key you want and press Write.

High-Frequency 13.56 MHz Protocols

High-frequency 13.56 MHz tags are a set of standards and protocols. They are usually referred to as NFC, but that's not always correct. The basic protocol set used on the physical and logical levels is ISO 14443. High-level protocols, as well as alternative standards (like ISO 19092), are based upon it.

ISO 14443-A seems to be the most common implementation. Almost all of the public transport and office passes use it, and it's used in bank cards as well.

To put it simply, NFC's architecture works like this: the transmission protocol is chosen by the company making the cards and implemented based on the low-level ISO 14443. For example, NXP invented its own high-level transmission protocol called Mifare. But on the lower level, Mifare cards are based on ISO 14443-A standard.

Flipper can interact with both the low-level ISO 14443 protocol, as well as Mifare Ultralight data transfer protocol and EMV used in bank cards. We're working on adding support for Mifare Classic and NFC NDEF. A thorough look at the protocols and standards that make up NFC is worth a separate article which we plan to have up later.

Plain UID of the ISO 14443-A Standard

All high-frequency cards based on ISO 14443-A standard have a unique chip ID. It acts as the card's serial number, like a network card's MAC address. Usually, the UID is 4 or 7 bytes long, but can rarely go up to 10. UIDs are not a secret and they are easily readable, sometimes even printed on the card itself.

There are many access control systems that rely on UID to authenticate and grant access. Sometimes this happens even when RFID tags support cryptography. Such misuse brings them down to the level of the dumb 125 kHz cards in terms of security. Virtual cards (like Apple Pay) use a dynamic UID so that phone owners won't go opening doors with their payment app.

Since UID is a low-level attribute, you might find yourself in a situation when UID is already read, but the high-level data transfer protocol is still unknown. You can read, emulate and manually input UID using Flipper for the primitive readers that use UID for authorization.

Reading the UID VS Reading the Data Inside

In Flipper, reading 13.56 MHz tags can be divided into two parts:

• Low-level read — reads only the UID, SAK, and ATQA. Flipper tries to guess the high-level protocol based on this data read from the card. You can't be 100% certain with this, as it is just an assumption based on certain factors.
• High-level read — reads the data from the card's memory using a specific high-level protocol. That would be reading the data on a Mifare Ultralight, reading the sectors from a Mifare Classic, or reading the card's attributes from PayPass/Apple Pay.

To use a specific high-level protocol when reading data go to NFC —> Run special action and choose the type of tag you want to read.

To try and guess the type of tag and to read the UID go to NFC -> Read card. So far Flipper can only detect Mifare Ultralight and EMV bank card.

Mifare Ultralight

Mifare is a family of contactless smart cards with several high-level protocols. The simplest of those is Mifare Ultralight. In its basic version, it has only 64 bytes of embedded flash memory and no cryptographic protection. Flipper can both read and emulate Mifare Ultralight cards. Such tags are often used as passes granting access to offices, houses and public transport. Moscow public transport tickets for example are using Mifare Ultralight.

EMV Bank Cards (PayPass, payWave, Apple Pay, Google Pay)

EMV (Europay, Mastercard, and Visa) — is the international standard set for bank cards. Bank cards now are full-fledged smart cards with complex data exchange protocols and support for asymmetric encryption. Apart from simply reading the UID, you can extract a lot more data from a bank card. It's possible to get the full card number (the 16 digits on the front of the card), validity date, and in some cases even the owner's name along with a list of the most recent transactions.

Since the EMV standard might be implemented differently, the data that can be extracted may vary from card to card. You can't read the CVV this way (the 3 digits on the back of the card).

Bank cards are protected from replay attacks, so copying it with Flipper and then trying to emulate it to pay for something won't work.

Tokenized Apple Pay Card VS Physical Bank Card

Compared to a plastic bank card, the virtual card you have in your phone provides less information and is safer for offline payments.

Apple Pay and Google Pay have several advantages:

• They don't allow using captured data for online payments – a normal card can be used for Card-Not-Present transactions (CNP), you can sometimes pay online or on the phone. Intercepted virtual card data can't be used in this manner. After registering a card with Apple Pay all payments go through the virtual token and all operations are cryptographically signed. Reading Apple Pay data results in a PAN and an expiration date of the virtual token, not the original physical card. Thus if someone tries to use the data intercepted from a virtual card to pay online such payment will be declined without a specific signature.
• They don't disclose the card owner's name — some contactless cards can transfer the cardholder name and recent transactions data. Virtual cards don't do that.

Bank card support in Flipper is implemented solely for high-level protocol demonstration purposes only. We do not plan to extend this function further. Contactless bank cards security is good enough not to worry that devices such as Flipper can be used to attack bank cards.

Stay Tuned

Our social media subscribers get all the Flipper Zero news first! Join in and get access to sneak peeks, insides, and more.

@flipper_zero

@flipper_zero

@flipperzero

FAQ

We understand the backers' anxiety caused by the delay. We are highly stressed by this situation too and would like to address some of the most pressing questions in this FAQ.

When will I get my Flipper?

We will start mass production as soon as we get the LCD displays. It would be a lie to give you an exact date because the component delivery time was moved back several times already. If our supplier will follow through with their last promise, we will start manufacturing in October, and we’ll begin shipping closer to November.

But to be honest, from what we’ve experienced dealing with the component crisis so far, the situation is far from stable. We are constantly working on gathering all the available components and switching to alternatives when possible, but since we don’t have any significant control over it, all we can do is be as honest and transparent as possible.

Why not switch to another LCD Display?

The LCD display is one of the central Flipper parts, around which the rest of design is made. So if we switch to another LCD now, most of the electronical and mechanical engineering would have to be re-made. This can’t be done in one go, and it would throw us many steps back and postpone the shipping even more.

The best strategy now is to wait for the displays which were validated and tested. We already received samples of the new LCD and they are fully compatible with our current design.

What are you doing right now?

We’re focused on Flipper’s firmware, Android and iOS mobile apps, and on the firmware updater apps. The development team is independent of the manufacturing team, so we don’t compromise one for the other.

Is there anything I can do to help?

Unfortunately, no. Unless you have a few tens of thousands of LCDs laying around. The best thing to do right now is to keep calm, keep your fingers crossed, and wait for the displays to arrive.

For the Early Adopters

The Early Adopters knew that their devices could have a hardware flaw, and there was one: the NFC and Sub-GHz subsystems in these units had problems in antenna path and were working worse than designed.

Flippers of the 10.F6B8C5 revision which were shipped to Early Adopters will be deprecated. There will be no further firmware updates after the deprecation. This is due to the changes in RFID 125 kHz hardware design. All Kickstarter backers will receive fully functional devices without these issues.

Firmware Sources Are Open

The firmware sources on Github are completely open now https://github.com/flipperdevices/flipperzero-firmware! They are licensed under the GPL 3.0. This means that other projects, including commercial ones, can use our code, but in this case their source code must be open as well.

⬇️ How to Update the Firmware

Firmware is constantly improved, so it's important to update frequently. You can get the latest firmware here: update.flipperzero.one. The firmware can be updated in two ways:

1. Using the WebUSB updater directly from the web browser. Supports Chrome and Edge.

2. Using the qFlipper utility — that's our desktop companion for Flipper Zero. It works on all platforms: Windows, Linux, and macOS.

We provide three update options:

• Release — fully tested and stable,
• Release Candidate — currently under testing, may have bugs,
• Dev — not tested and may be unstable, but with all the latest features.

Developers and Early Adopters can use the Dev firmware to test the newest features — it's auto-compiled after each commit to the master branch. This firmware doesn't undergo thorough testing and may be unstable.

🐞 Reporting Bugs

We're using GitHub Issues for bug reports. Please, don't PM developers about the bugs! Check our current open issues and create a new one only if your bug is not mentioned there. Our team uses Jira tickets for development, so you won't see the team discussing bugs and fixes in the public bug reports.

⚙️ Building firmware from source

Instructions for building the firmware can be found in the Readme. We use Docker to compile the firmware. The native IDE-like compiling, as in VS Code, for example, is not ready yet.

Current Firmware Status

The firmware is a huge part of Flipper development, and not all features are implemented yet. We improve functionality, fix bugs, and add new features on the daily basis. Check out all those commits on GitHub!

Sub-GHz

✅  Receiving and decoding signals at 315/433/868 MHz frequencies

CAME 12-bit
CAME 24-bit
Nice FLO 12-bit
Nice FLO 24-bit
Princeton (Any Те)
Bytec (Princeton)
Tantos-Proteus (Princeton)
GSN (Princeton)
Nero Sketch
Gate TX

iDo 117/111 (PT4301-X)
faac_slh
Nice FLOR-S

DoorHan
AM-Motors
Stilmatic
HCS101
Alligator D-810, Alligator D-930 
Alligator S-750RS
Alligator S-275
Alligator NS, NS-105, NS-205, NS-305, NS-405, NS-505, NS-605
Alligator M-550, M-500
Alligator L330
Pantera SLR-5100
Pantera CLK-355	Pantera SLK-2i, SLK-2i/3i/4i/5i/7i, SLK-25SC
Pantera CL-500, CL400, CL600
Pantera XS-1500, XS-2000, XS-1000, XS-1700, XS-100, XS-110
Pantera XS-2600, XS-2700
Jaguar JX-1000, XS-2700
KGB FX-1
Tomahawk 9010, TW-9000, TW-9010, TW-7000, LR-950, TZ-9010, SL-950, D-700, D-900, S-700
Guard RF-311A
Cenmax A-900
Sheriff ZX-600
Sheriff APS-35 PRO	Sheriff APS-25 PRO	Sheriff APS-2400	Sheriff ZX- 925, ZX-900, ZX-910, APS-75	Mongoose 800C, IQ-215
Mongoose 7000 RF, AMG-850C
Leopard LS50/10
Partisan RX-1
A.P.S. 3000, 2550, 2450
A.P.S 2300, 2500, 2000, 1500, 1000, 500

Cenmax ST-5A, Cenmax Vigilant V-5A
Cenmax ST-7A, Cenmax Vigilant V-7A	KGB FX-5
Tomahawk 9030, TW-9030, TW-7010, TW-9020,  TZ-7010, TZ-9020, TZ-9030, H1, H2
Tomahawk Z5, Z3, X3, X5
StarLine A6, A7, A8, A9
StarLine Moto V7
StarLine A1, A2, A4
StarLine B6, B9 (extended)
Harpoon BS-2000
Jaguar EZ-Beta

✅  Saving to an SD-card
     ⚠️ Due to security concerns we are limiting the ability to save signals with  dynamic protocols. Only static codes can be saved.
✅  Generating new remotes from scratch
✅  Channel hopping in scan mode
🛠️  Adding new protocols
🛠️  FSK modulation is not implemented yet. Only OOK modulation is supported right now. This too is a work in progress
🛠️  A simple frequency analyzer is planned but not implemented yet

RFID 125 kHz

✅  Reading
     ✔ EM-4100
     ✔ Indala (I40134)
     ✔ HID Prox II (H10301)
✅  Saving to SD-card
✅  Emulating
✅  Writing to blank T5577 cards
✅  Adding IDs manually
🛠️  Animal tags 134 kHz (not implemented yet)

NFC

✅ Reading
     ✔ NFC A (ISO-14443A)
           ✔ Mifare Ultralight
           ✔ EMV Bank cards
           ✔ UID only
           🛠️ Mifare Classic (not implemented yet)
     🛠 NFC B (not implemented yet)
     🛠️ NFC F (not implemented yet)
✅ Saving to SD-card
✅ Emulating
🛠️  Writing to blank Mifare 1k cards

Infrared

✅  Reading
     ✔ NEC / NEC-ext
     ✔ Samsung32
     ✔ RC5
     ✔ RC6
     ✔ RAW (any protocol without parsing)
✅  Saving to SD-card
✅  Emulating
✅  Brute force
     ✔ TVs
     🛠️ Air conditioners (work in progress)
     🛠️ Music centers (work in progress)

iButton

✅  Reading
     ✔ 1-Wire (DS19****)
     ✔ Cyfral
     ✔ Metakom
✅  Saving to SD-card
✅  Emulating
✅  Writing to blank RW19**** keys

BadUSB

🛠️ Work in progress. Dealing with USB stack issues

U2F token

🛠️ Work in progress. Dealing with USB stack issues

Arduino / VS Code compatibility

🛠️ Work in progress

Independent Reviews

Part of the small initial batch was destroyed during reliability tests to ensure that design is long-lasting and reliable. Another part was sent to Early Adopters, and some of them made reviews.

The famous hardware hacker MG got our Dolphin:

Grand One-hour Review

The reviewer developed his own plugin and even tinkered a hardware module for it! This review is in Russian, but you can switch on the subtitles with an auto-translate feature, and everything will be clear.

Disclaimer! During the review, author had troubles reading RFID tags. It is important not to fiddle the card while reading, here is a demo:

One more review in Russian

Тамагочи для хакера - Flipper Zero

Этот девайс наделал много шума в DIY сообществе, как самый успешный отечественный продукт на кикстартере — за месяц ребята собрали 5M долларов! Мне удалось получить устройство раньше основных поставок, вписавшись ...

MYSKU.rudarkbyte

Zero Nights Conference

We've attended the Zero Night conference in Saint Petersburg, where we showed Flipper and told about our development process and firmware architecture. Visitors could play with Flipper features using our test stand equipped with all kinds of RFID and Sub-GHz readers.

Many visitors took photos with our Flipper Zero samples. You can find all of them on Instagram (#flipperzeronights), and here are some of them:

Stay Tuned

Our social media subscribers get all the Flipper Zero news first! Join in and get access to sneak peeks, insides, and more.

@flipper_zero

@flipper_zero

@flipperzero

TV, AC, and home audio remotes transmit commands via the infrared port. The infrared port in Flipper Zero allows you to control all IR devices: capture the signals and save them to an SD card, bruteforce unknown protocols, and load your own codes.

This article covers:

• How infrared receivers and transmitters work
• Varieties of digital signals from IR remotes
• Capturing and analyzing infrared signals
• Mastering the infrared with Flipper Zero

How the Infrared Port Works

Infrared light is invisible to humans. IR wavelength is from 0.7 to 1000 microns. Household remotes use an IR signal for data transmission and operate in the wavelength range of 0.75..1.4 microns. A microcontroller in the remote makes an infrared LED blink with a specific frequency, turning the digital signal into an IR signal.

To receive IR signals a photoreceiver is used. It converts IR light into voltage pulses, which are already digital signals. Usually, there is a dark light filter inside the receiver, which lets only the desired wavelength through and cuts out noise.

Infrared in Flipper Zero

The Flipper Zero IR port has a special dark window, which lets through only the IR light. This helps extract the desired IR signal and mitigates interference from visible light. The transceiver components are hidden behind that window. Flipper Zero's IR port can both receive and transmit signals.

A printed circuit board is located just behind the IR window. There are 3 IR LEDs on both sides of it — these are signal transmitters. Multiple LEDs are used to increase the transmission power. There is also a TSOP photoreceiver on the bottom side of the PCB. The TSOP receives an IR signal and outputs a digital signal, which is processed by the STM32 microcontroller.

Below you can see an interactive schematic and a 3D model of the iButton board, on which IR LEDs, a TSOP receiver, a speaker, and iButton contacts are installed:

IR Signal Receiver in Flipper Zero

Flipper uses a digital IR signal receiver TSOP, which allows intercepting signals from IR remotes. There are some smartphones like Xiaomi, which also have an IR port, but keep in mind that most of them can only transmit signals and are unable to receive them.

The Flipper infrared receiver is quite sensitive. You can even catch the signal while remaining somewhere in between the remote and the TV. Pointing the remote directly at Flipper's IR port is unnecessary. This comes in handy when someone is switching channels while standing near the TV, and both you and Flipper are some distance away. For example, when you're in a cafe and the bartender starts channel hopping, and you want to take control of the TV by capturing the signal.

As the decoding of the infrared signal happens on the software side, Flipper Zero potentially supports the reception and transmission of any IR remote codes. In the case of unknown protocols which could not be recognized - it records and plays back the raw signal exactly as received.

The interface of the saved remotes in the Flipper is displayed vertically. This way it is more convenient to hold the device in your hand while pointing the IR port towards the receiver at the same time.

To read the IR signal, it must get into the Flipper's IR window, which should be easy if you are indoors because the signal will most likely reflect from various surfaces and will hit the IR port eventually.

In order to read the IR signal navigate Infrared -> Learn new remote. The captured signal can then be saved to a new remote. It is possible to add several signals to one remote by selecting the desired remote in Infrared -> Saved remotes. You can add an unlimited number of signals (buttons) to a single remote.

Flipper Zero as Universal Remote

Flipper Zero can be used as a universal remote to control any TV, air conditioner, or media center. In this mode, Flipper bruteforces all known codes of all supported manufacturers according to the dictionary from the SD card. You don't need to choose a particular remote to turn of a restaurant TV.

It is enough to press the power button in the Universal Remote mode, and Flipper will sequentially send "Power Off" commands of all the TVs it knows: Sony, Samsung, Panasonic... and so on. When the TV receives its signal, it will react and turn off.

Such brute-force takes time. The larger the dictionary, the longer it will take to finish. It is impossible to find out which signal exactly the TV recognized since there is no feedback from the TV.

To use the Universal Remote mode, navigate Infrared -> Universal library and select the type of device you want to control.

To check or edit the dictionary, you need to open or create the corresponding file on the SD card. For example, for TVs, the dictionary file looks like this:

#Button name #Protocol  #Address #Command
POWER        NEC        A:08     C:17
VOL+         NEC        A:08     C:00
VOL-         NEC        A:08     C:01
CH+          NEC        A:08     C:02
CH-          NEC        A:08     C:03
MUTE         NEC        A:08     C:0B
....

We plan to have dictionaries bundled with the firmware while keeping them in a separate repository, where all users will be able to offer their codes and keys.

Other Universal Remotes to Switch Off Any TV

There are devices specially designed for those who are annoyed by TVs. Such devices contain a database of signals for turning off TVs from different manufacturers. The principle of operation is the same as on Flipper: the device simply tries all known signals from its dictionary, hoping that at some moment the signal will work. Such a signal database is usually embedded in the firmware, and it is not easy to update it.

• Knopkus by Artemy Lebedev — a simple and beautiful device in a rubberized case with one button. After clicking the button, the code search begins. Unfortunately, the list of signals is not very large and it didn't work for TVs in our office and at home. There is no way to update the signal database in this device: there is some kind of off-brand microcontroller inside, and it's unclear how to flash it.
• TV B GONE — a well-known old project with open firmware and hardware. 4 powerful IR diodes at once make it very long-range. You can add your own codes, but you will need a chip programmer for this.

Flipper's main difference is that its brute-force dictionary is stored on the SD card and can be easily updated. Users can also create their own dictionaries for new classes of household appliances and automation. Flipper is also able to receive signals, so it can be trained to memorize any remote buttons that for some reason were not found in the brute-force dictionary.

TSOP Infrared Receiver

As the IR receiver Flipper uses a TSOP-75338 chip. This component filters the signal itself and maintains it at the constant logical level, amplifying if necessary. Therefore, the TSOP-75338 is able to receive even a very weak signal from small discharged remotes or signals reflected from walls. And the built-in amplifier allows you to get the same voltage levels, regardless of the IR signal strength. This greatly simplifies the software signal processing on the microcontroller side.

There is an RC filter in the power supply scheme for the TSOP-75338 photodetector. It is needed because the microcontroller interferes with the power lines, which is why the output digital signal of the photoreceiver may not correspond to the received signal. A diode is used for voltage-matching of the TSOP receiver and the STM32 microcontroller. TSOP outputs a digital signal, which gets processed by the STM32 microcontroller.

Functional blocks of TSOP-75338 IR receiver:

• IR light filter
• Sensitive IR photoreceiver
• Bandpass amplifier
• Automatic gain control
• Demodulator for getting a signal envelope

For transmission, a frequency-modulated signal is usually used. Our receiver demodulates the 38 kHz signal. Most remotes work on 36..38 kHz carrier waves.

Why Frequency Modulation

There is almost always some background noise when receiving an IR signal, it is there because lots of objects emit IR light, even ordinary lamps. Therefore, the receiver usually gets signal mixed with noise.

• Background IR noise is created by many light sources because the source of IR light is the generated heat. Therefore, the background IR noise is random. For clarity, it is depicted as a sinusoid in the video above.
• Modulated IR signal — IR pulse bursts from remote. The ideal pulse burst looks like a smooth meander, but such a signal can only be seen if there is no noise at all. In reality, the meander will always be superimposed on the noise and summed up with it.

Frequency modulation allows distinguishing signal from noise. When the signal flashes at a frequency of 38 kHz, the IR pulses are picked out from the background noise. Thus, the photoreceiver can determine the presence of a signal and distinguish it from the lamp illumination.

IR Signal Transmitter in Flipper Zero

The IR signal transmission is directly controlled by the STM32 Flipper microcontroller. It sends pulses to the LEDs through an external transistor. To increase its transmitting power, 3 IR LEDs are used instead of one.

As in remotes, data from Flipper Zero is transmitted with pulse bursts. The receiver demodulator forms envelopes (meanders) from pulse bursts which are then handled digitally. Often, the digital signal at the receiver output is an inverted envelope.

To increase the power of the transmitter, pulse bursts are used, rather than a whole meander. At the same time, the average power decreases or remains the same, so it doesn't affect the energy consumption.

Usually, transmitters work on 30..50 kHz carrier waves. This carrier range showed the lowest level of interference. Not to be confused with the frequency of the IR light, which corresponds to a wavelength of 940 nm (318.93 THz).

Analyzing IR protocols with Arduino

For rapid IR testing and debugging, we used the Arduino IRMP library. You can find instructions on how to assemble a device for analyzing IR protocols on the GitHub repository.

After collecting all office IR remotes we made sure that almost all of them have different IR protocols. But you can't fully trust the self-built analyzer. If the IR protocol is unknown, the Arduino IRMP analyzer may recognize it as the Siemens protocol.

To receive the IR signal with Arduino IRMP, we used the Flipper IR board directly. The variety of well-known IR protocols in the IRMP library allows faster firmware development.

Variety of IR Protocols

IR protocols differ in 3 factors:

• bit encoding
• data structure
• carrier frequency — often in range 36..38 kHz

Bit encoding ways

1. Pulse Distance Encoding

Bits are encoded by modulating the duration of the space between pulses. The width of the pulse itself is constant.

2. Pulse Width Encoding

Bits are encoded by modulation of the pulse width. The width of space after pulse burst is constant.

3. Phase Encoding

It is also known as Manchester encoding. The logical value is defined by the polarity of the transition between pulse burst and space. "Space to pulse burst" denotes logic "0", "pulse burst to space" denotes logic "1".

4. Combination of previous ones and other exotics

Data structure

• control command
• device address
• checksums
• any other service info

There are IR protocols that are trying to become universal for several types of devices. The most famous ones are RC5 and NEC. Unfortunately, the most famous does not mean the most common. In my environment, I met just two NEC remotes and no RC5 ones.

Manufacturers love to use their own unique IR protocols, even within the same range of devices (for example, TV-boxes). Therefore, remotes from different companies and sometimes from different models from the same company, are unable to work with other devices of the same type.

Exploring IR signal with an oscilloscope

The most reliable way to see how the remote IR signal looks like is to use an oscilloscope. It does not demodulate or invert the received signal, it is just displayed "as is". This is useful for testing and debugging. I will show the expected signal on the example of the NEC IR protocol.

Usually, there is a preamble at the beginning of an encoded packet. This allows the receiver to determine the level of gain and background. There are also protocols without preamble, for example, Sharp.

Then data is transmitted. The structure, preamble, and bit encoding method are determined by the specific protocol.

NEC IR protocol contains a short command and a repeat code, which is sent while the button is pressed. Both the command and the repeat code have the same preamble at the beginning.

NEC command, in addition to the preamble, consists of an address byte and a command-number byte, by which the device understands what needs to be performed. Address and command-number bytes are duplicated with inverse values, to check the integrity of the transmission. There is an additional stop bit at the end of the command.

The repeat code has a "1" after the preamble, which is a stop bit.

For logic "0" and "1" NEC uses Pulse Distance Encoding: first, a pulse burst is transmitted after which there is a pause, its length sets the value of the bit.

Infrared oscilloscope probe

For capturing IR pulses with an oscilloscope I used a self-made Silver Bullet, developed by AnalysIR author. It is just an IR LED and a resistor, soldered to an RCA audio connector, which is then connected to an oscilloscope via a BNC->RCA adapter. It can be assembled in five minutes from that are generally available and easy to find.

While the IR light of the remote hits the IR LED of the probe, a small current begins to pass through the LED. This current raises a voltage at the LED pins, which is distinctly visible on the oscilloscope. It is important to lean the IR transmitter close to the probe, to get a clear signal on the oscilloscope.

What is wrong with Air Conditioners

Air conditioner remotes are full-fledged devices with a display. They control a lot of settings such as temperature, fan power, etc. At the same time, the remote does not know whether the air conditioner has received the signal, it simply sends a signal every time the settings on the remote are changed.

But what will happen if we change the temperature on the remote from another room, so the air conditioner does not get that signal? For example, the value of 19°C was set on the air conditioner, we went to another room and completely changed all the settings on the remote, setting it to 30°C. Then we return to the air conditioner and raise the temperature by 1°C up. If the remote simply sent a code of each button, as other remotes do, the temperature would be set to 20°C on the air conditioner, and we would see 31°C on the remote screen. The result would be a data desynchronization between the remote and the AC.

Therefore, air conditioner remotes, unlike other remotes, do not transmit the code of the pressed button, but all the parameters. In another word, these remotes always send ALL the remote data in one large packet. Such protocols are very complex.

The data structure of air conditioner remotes may be completely different for various models. Air conditioners may have different temperature or power ranges, humidity control options, etc. Therefore the data structure may be so large, so it has to be transmitted in several batches.

Creating a universal user interface for such remotes is a challenging task, due to the inability to test multiple air conditioners and their functions. Therefore we can work with several air conditioners, but support for a large number of models has not been already implemented yet.

How to analyze IR-signals on PC

To work with IR signals on PC I use the AnalysIR. This is a program for analyzing IR protocols and which supports different devices for IR-capturing. The most common way is to make a homemade receiver with TSOP and Arduino, and connect it via USB. I am using IR-toy V2 as a receiver. List of supported receivers: AnalysIR.pdf.

AnalysIR shows the envelope of the IR signal instead of pulses, unlike an oscilloscope. The program calculates the delays and durations of pulse bursts and logs this info. It helps analyze unknown IR protocols. AnalysIR knows more than 100 IR protocols and is able to recognize them automatically. By the way, the author of the program suggested adding support for a Flipper as an IR receiver. Great idea, isn't it?

Pre-order Now

Our first priority is to fulfill all Kickstarter orders, so our backers will get the first production batch.

If you missed our Kickstarter campaign, you can pre-order now and get your device in Fall 2021, as soon as the second batch is ready. Your pre-orders help us to plan the production and logistics.