Flipper Zero with WiFi board and Video Module Raspberry Pico

Having recently purchased a new Flipper Zero together with a Wi-Fi Dev module and a Video Game (Raspberry Pi) module, I'm writing an updated guide on how to make the best use of these devices.

Let’s be clear on one thing: depending on what do you want to achieve, there is generally better hardware for a lower price that can help you on your “hacking” (by which I mean learning the intricacies of hardware) path. The Video Game Module is a Raspberry Pi Pico (with the RP2040 microcontroller) and a “TDK ICM-42688-P motion-tracking sensor”, which has little use otherwise. The Wi-Fi Dev module is a ESP32 S2 WROVER which can run the Marauder firmware.

To update and / or modify the above I used a Windows laptop and a browser. I looked briefly at a few instruction videos and found them all to be quite outdated.

For the Flipper Zero (the main unit), I first inserted a micro-SD card (which can be as small as 32 GB, anything more is probably wasted), then I connected the main unit to the laptop, then navigated to lab.flipper.net where I updated the firmware to the latest, then installed the Marauder ESP32 app.

One could probably use the app for their respective OS but the web connection is the easiest first step, since you can update the firmware and install additional apps all from the same “lab” official website.

The Wi-Fi Dev board can also be connected directly to the laptop and updated over the Internet. One can use fzeeflasher in either the .com (fzfc) or .io (fzfi) incarnations. This means:

• disconnect the main unit and connect the ESP32 Wi-Fi module alone to the laptop using the USB-C cable
• navigate with your browser to either “flasher” website
• click connect
• choose your board from the drop-down list (mine was “S2”)
• choose the latest firmware (mine was Marauder v1.3.0, though others are also available)
• click “program” and wait for the flashing to proceed

The log was:

ESP Web Flasher loaded.
Connecting...
Connected successfully.
Try hard reset.
Chip type ESP32-S2
Connected to ESP32-S2 @ 115200bps
MAC Address: 68:B6:B3:0B:4B:20
Uploading stub...
Running stub...
Stub is now running...
Detecting Flash Size
FlashId: 0x16405E
Flash Manufacturer: 5e
Flash Device: 4016
Auto-detected Flash size: 4MB
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!   FLASHING STARTED! DO NOT UNPLUG  !!!
!!!     UNTIL FLASHING IS COMPLETE!!   !!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Image header, Magic=0xE9, FlashMode=0x02, FlashSizeFreq=0x2F
Writing data with filesize: 14496
Erase size 14496, blocks 1, block size 0x4000, offset 0x1000, encrypted no
Took 149ms to write 14496 bytes
Erase size 0, blocks 0, block size 0x4000, offset 0x0000, encrypted no
---> Finished flashing bootloader.
Image header, Magic=0xAA, FlashMode=0x01, FlashSizeFreq=0x02
Writing data with filesize: 3072
Erase size 3072, blocks 1, block size 0x4000, offset 0x8000, encrypted no
Took 129ms to write 3072 bytes
Erase size 0, blocks 0, block size 0x4000, offset 0x0000, encrypted no
---> Finished flashing partitions.
Image header, Magic=0x01, FlashMode=0x00, FlashSizeFreq=0x00
Writing data with filesize: 8192
Erase size 8192, blocks 1, block size 0x4000, offset 0xE000, encrypted no
Took 127ms to write 8192 bytes
Erase size 0, blocks 0, block size 0x4000, offset 0x0000, encrypted no
---> Finished flashing boot_app0.
Image header, Magic=0xE9, FlashMode=0x02, FlashSizeFreq=0x2F
Writing data with filesize: 980288
Erase size 980288, blocks 60, block size 0x4000, offset 0x10000, encrypted no
Took 12773ms to write 980288 bytes
Erase size 0, blocks 0, block size 0x4000, offset 0x0000, encrypted no
---> Finished flashing firmware.
---> FLASHING PROCESS COMPLETED!
Restart the board or disconnect to use the device.
[Object.debug:223] Finished read loop

Once the Dev board has this firmware, turn off the Flipper, connect the Wi-Fi board, turn on the Flipper and the app can communicate with the board. See below for some of “hacks” that can be done.

On first use, you might be asked if you want to save packets to the card, which you might want to answer with yes, but you might want to consider answering “no” to saving all the logs as that can eat up your space with junk.

Finally, while the Wi-Fi Dev board from Flipper Zero is useful, you could get an expansion board with more functionality (NRF Mousejacker and a High Gain CC1101) for only a few bucks more: antenna+.

I purchased the Video module without spending much time researching it first; it turns out that the Raspberry Pico it’s based on is too underpowered to use it for much else, so that’s pretty much a write off, given that I don’t play that many games.

Sources / More info: f0-1, buy, apps, fzfc, fsfi, ocw-attck

Thus Consumed Consumer (.org): #hardware, #flipper, #flipper zero, #hack, #hacking, #wifi, #wi-fi, #wireless, #firmware, #marauder, #exploitation, #module (Tags)