Login

r/flipperhacks

▲ 4 r/flipperhacks+1 crossposts

so i made this (https://github.com/Master-YCK/DIY-Flipper-DevBoard/tree/main) bored for my flipper i am using a ESP-WROOM-32 and my flipper is running Unleashed Firmware but i have a problem when i try to run anything it just says press back to send stopscan. and the few times it doesn't it either dose not work at all or works perfectly the only thing i have got to work is the scan function. i have tried many times to reflash the bored i am not sure if i am using the wrong bored or what any help would be nice (sorry for bad English)

reddit.com
u/Pristine_Rise7438 — 14 days ago
▲ 1 r/flipperhacks+1 crossposts

I bought an external CC1101 (E07-M11010 V2.0 433Mhz). I tried all wiring diagrams, none of them worked. I have an NRF24, i can connect that and flipper sees it, it works perfect. But when it comes to Ext CC1101, it just doesnt work. I cant see the option External. I tried the Default 4, Extra 7 options too. None of them worked. Is my module damaged or is there another problem? Can someone send me the right wiring diagram and the settings, if thats the problem. Thanks.

reddit.com
u/Emotional_Union80 — 13 days ago
▲ 3 r/flipperhacks

Managed to achieve stable Single-Chip RollJam. Wrote a custom Bit-Banging SPI driver, DWT Cycle-Accurate Replay, and Continuous Jamming. (PoC Video)

Ciao a tutti, sono c0d3r_SubGHz.

Tutti dicevano che RollJam stabile sul Flipper era troppo inaffidabile a causa della latenza del sistema operativo e dei punti ciechi di commutazione RX/TX. Ho passato gli ultimi mesi a riscrivere l'approccio da zero. Ecco come ho risolto il problema in questa PoC:

  1. SPI software personalizzato (Bit-Banging): furi_hal blocca il bus SPI hardware, mandando in crash il sistema operativo se si tenta di sostituire i moduli a caldo. Ho scritto un driver SPI software bare-metal per il CC1101 per bypassare completamente il sistema operativo del Flipper.

  2. Jamming asincrono continuo e offset dinamico: Ho abbandonato il vecchio metodo TDM (switching). Il modulo esterno ora emette un "muro di fuoco" continuo (CW sul pin GD0) utilizzando un offset di frequenza selezionabile dinamicamente (da -900 kHz a +900 kHz). Il Flipper ascolta simultaneamente, completamente insensibile al jammer ma captando perfettamente il telecomando bersaglio.

  3. Filtraggio intelligente di squelch e tono pilota: L'app filtra dinamicamente il rumore. Attende un preambolo di oltre 1000 µs e si aggancia a 16 impulsi validi prima di registrare, eliminando dinamicamente i frame corrotti.

  4. Eccesso di interferenza post-cattura: Una volta catturato il segnale, emette istantaneamente un muro di interferenza di 1,5 secondi per coprire il tempo di reazione del dito umano e prevenire sblocchi accidentali.

  5. Riproduzione DWT bare-metal: La riproduzione viene eseguita all'interno di un blocco FURI_CRITICAL_ENTER() utilizzando il contatore di cicli DWT ARM (DWT->CYCCNT) per l'aggancio di fase assoluto e la trasmissione a jitter zero sul pin GD0.

A causa delle regole del subreddit relative ai binari compilati e agli exploit, non posso ospitare il .fap su repository pubblici.

La documentazione completa su GitHub e il link di accesso al Project Hub sono disponibili nella mia biografia/profilo Reddit.

reddit.com
u/c0d3r-SubGHz — 5 days ago
▲ 4 r/flipperhacks

Looks for a USB Intervalometer app for photography

I am a photographer, using my camera to often times shoot astrophotography and other kinds of time lapses and scenes where an Intervalometer is very important. But I always have the bad habit of leaving my Intervalometer behind, and with mine recently breaking, i looked at the flipper (which always sits in my pocket) and wondered if this device can do the job.

I noticed that there is an IR Intervalometer app, sending an infrared signal to a camera with a reciever to do that job, however my camera uses a wired connection to its MicroUSB port for such devices. And I couldn't find any USB Intervalometers for the Flipper Zero.

Does anyone here know of a good/functional app for the F0 that will allow me to use it as an Intervalometer on my camera?

reddit.com
u/Virotine — 3 days ago
▲ 0 r/flipperhacks

My rolljam attack did not succed.Why?

I used ECRF V2 for my jammer and my flipper zero to catch the signal from the fob.I caught the signal and the car did not unlock because the jammer was jamming it.When i stopped the jammer and sent the unused code.The car still did not open.Why?

Thanks!

reddit.com
u/_nazwa_ — 1 day ago
▲ 9 r/flipperhacks

Field Testing the Single-Chip RollJam: Overcoming Near-Field Desensitization (Hardware vs Software solutions) 📡

Hey everyone, c0d3r_SubGHz here with a development update on the Single-Chip RollJam PoC.

Thanks to some incredible field testing from early adopters in the community, we ran into a fascinating physical limitation and found two ways to bypass it.

The Problem: Near-Field Desensitization Since the v1.0 uses a custom bare-metal SPI driver to blast Continuous Wave (CW) Jamming (a literal wall of RF fire) instead of the old TDM switching, the external module is extremely loud. Because the internal RX antenna and the external TX antenna are just an inch apart, the jammer effectively "blinds" the Flipper's internal receiver. It can't hear the target's keyfob over its own noise.

Here is how we are beating physics:

Solution 1: The Hardware Approach (See Picture 📸) As figured out by us, using an SMA extension cable to physically distance the jamming antenna from the Flipper's body prevents desensitization. The external module screams, the target car's AGC gets blinded, but the Flipper's internal radio stays clean enough to capture the rolling code.

Solution 2: The Software Approach (Jam Offset) If you don't want to carry cables around, I coded a dynamic 'Jam Offset' feature in the app's UI. By pushing the jamming frequency further away (e.g., +/- 120kHz to 900kHz from the center freq), you give the Flipper's internal receiver enough "breathing room" to catch the preamble, while still being close enough to corrupt the signal reaching the car's ECU.

Side note: I decided to keep the transition between Signal A and Signal B manual (requiring a button click) rather than auto-switching. This acts as a safety buffer so residual RF noise or bounced signals don't instantly trigger a garbage Signal B capture.

Massive thanks to the community for the data. Pushing the CC1101 hardware to its absolute limit is a fun ride.

(As always, due to subreddit rules, I don't post binaries here. Full documentation and project access are in my Bio/Profile).

u/c0d3r-SubGHz — 2 days ago