Momuntum_Flipper_For_T_Embed

[!CAUTION]

🚨 SECURITY WARNING — DO NOT FLASH “L15Dev” FIRMWARE 🚨

A firmware build distributed under the name “L15Dev” / “Bitwire” has been reported to contain malware (a virus) and a backdoor. Do not download, flash, or run it under any circumstances.

Only use the official builds from this repository / the web flasher. If you already flashed an “L15Dev” image, re-flash a clean official build and treat any credentials/data on the device (WiFi passwords, captures) as compromised.

WARNING: I do not take responsibility if you damage your board or property. This project is for educational purposes only — proceed at your own risk.

Momentum T-Embed — Flipper Zero ESP32 Port

A port of the Flipper Zero firmware — with the Momentum feature set — to the LilyGo T-Embed CC1101 and other ESP32 boards. It brings the Flipper Zero UI, services, and application framework to affordable ESP32 hardware — no Flipper Zero required.

✨ New in v2 — written for this fork

Added for the LilyGo T-Embed by ElicoftZ. These are original to this fork — present in neither the Sor3nt port nor Momentum. Per-feature provenance is verified in CREDITS.md.

• Dual Boot — install and switch between multiple firmwares from a boot menu, with a hardware side-button recovery escape hatch. Dynamic multi-boot partition layout with interrupted-update recovery.
• Power Profiler — live power-draw trace from the BQ27220 fuel gauge.
• Wardriving — passive WiFi + BLE + Sub-GHz logger to PSRAM, built on the port’s WiFi stack.
• BLE Detector — rapid Bluetooth device scanning & profiling, with unbounded scan lists.
• Macro Pad — USB/BLE HID macro recorder & playback.
• Mic & audio tools — microphone level, sonar, waterfall and logger, tone generator, ultrasonic, voice notes.
• Hotspot Arcade — ESP-IDF integration of tarikbc’s arcade (the game itself is © tarikbc, MIT).
• Settings backup, plus the under-the-hood NimBLE integration the wireless apps depend on.

🔀 Inherited from the Sor3nt ESP32 port

These come from Sor3nt/Flipper-Zero-ESP32-Port, the port this repository is forked from — not written here:

• WiFi suite — Evil Portal, AirSnitch, Probe Sniffer, Smart Deauth, SMB Browser, Web-Filesystem, Android TV Remote.
• OTA firmware updates — Settings → Update Firmware, over WiFi, with SD-card sync.
• Streaming — unified music & video (AirPlay, Chromecast, DLNA).
• U2F / FIDO2 (CTAP2) security key, dolphin passport, and the Interface / Spoofing settings.
• ESP-NOW and NRF24 tooling.
• Community apps — NFC Magic, MIFARE Fuzzer, NFC/RFID Detector, RFID2 Reader, Reverse Shell, Roulette, WMBuster, TagTinker — plus the full base Flipper app set (NFC, SubGHz, Infrared, BadUSB, …).

The Momentum feature set that came in through the merge — the Momentum settings app, Control Centre, dolphin levels, passport and menu styles — originates with Momentum Firmware.

Exact per-directory breakdown (19 written here · 3 from Momentum · 175 from the port, across 197 directories) is in CREDITS.md.

See RELEASE_NOTES_v2.md for the full v2 changelog.

Supported Boards

Board	MCU	Display	Input	SubGHz	NFC	IR	SD Card
LilyGo T-Embed CC1101	ESP32-S3 (Xtensa LX7)	ST7789 320×170	Rotary encoder + button	CC1101	PN532 (I2C)	RMT TX + RX	SPI
Waveshare ESP32-C6-LCD-1.9	ESP32-C6 (RISC-V)	ST7789V2 320×172	CST816S touch	—	—	—	SPI
Waveshare ESP32-C6-LCD-1.47 ⚠️	ESP32-C6 (RISC-V)	JD9853 320×172	AXS5106L touch	—	—	—	SPI
DIY ESP32-S3 with 2.8” TFT ⚠️	ESP32-S3 (Xtensa LX7)	2.8” ILI9341 320×240	6× Tactile buttons	CC1101	PN532 (I2C)	TX	SPI

⚠️ Waveshare ESP32-C6 boards — limited. The ESP32-C6 has only 512 KB SRAM and no PSRAM, so RAM-heavy apps are effectively non-functional. In particular WiFi monitor mode / handshake capture fails (esf_buf_setup_static: alloc eb fail → ESP_ERR_NO_MEM). Treat these boards as usable only for lightweight apps. The full feature set targets the PSRAM-equipped T-Embed.

How to Flash

The easiest way is the web flasher — no toolchain required, just a Chrome/Edge browser and a USB cable:

▶ Flash via Browser

Connect your board, click flash, done. After flashing, copy the contents of sdcard.zip onto a FAT32 SD card and insert it — most apps need files there to function.

Firmware Update

The T-Embed can update itself — no PC toolchain or re-flashing required:

• Over WiFi (OTA): Settings → Update Firmware checks the release server for a newer build, downloads and installs it in the background, then reboots. It also keeps your SD card files in sync.
• Dual Boot: install and switch between multiple firmware images from the boot menu; hold the side/Back button at power-on for ~3 s for a hardware recovery back to this firmware.

OTA requires the dual-OTA partition layout. A device on the old single-app layout has to be flashed once via the web flasher before wireless OTA updates work.

Apps

📡 Wireless / RF

Sub-GHz (external CC1101, 433–868 MHz) — receive & decode, Read RAW to .sub, frequency analyzer, HackRF-style RF spectrum analyzer, band hopper, transmit/manual signal creation, brute-force with manufacturer dictionaries, playlists, and TPMS decoding (Schrader, Citroën, Ford, Renault, Toyota, generic). AES-encrypted manufacturer keystores are not decryptable on this port.

WiFi — full pentest toolkit:

• Scanner, Connect (WPA/WPA2/WPA3 + saved passwords), Deauther & Smart Deauth, Sniffer (PCAP), Handshake capture (EAPOL), AirSnitch, Probe Sniffer, Beacon Spam
• Network Scan / Port Scan, Web Crawler
• Evil Portal — captive portal with credential harvesting, custom templates, and an optional internet bridge (STA uplink + NAPT + DNS)
• Web-Filesystem — HTTP SD-card server (drag & drop), SMB Browser (Windows/macOS/NAS), Android TV Remote
• WiFi toggle — persistent global on/off from the Control Centre, auto-reconnect
• Wardriving — passive WiFi + BLE + Sub-GHz logger

Mesh / Buddy (ESP-NOW) — pair headless ESP32 “buddy” boards to offload WiFi handshake capture with durable store-and-forward.

Bluetooth — BLE Spam (Apple/Google/Microsoft/Samsung/Xiaomi), BLE Walk (GATT scanner), BLE Detector, WhisperPair, BLE Clone, FindMy (AirTag/SmartTag/Tile), BLE HID.

NRF24 (external nRF24L01) — 2.4 GHz spectrum analyzer, jammer, MouseJacker.

Infrared (RMT TX/RX) — learn/replay, universal remotes (TV/AC/audio/projectors/fans/LEDs), brute force.

🪪 NFC (PN532 over I2C)

Read/save/emulate/write cards, dictionary attacks, 14 protocols, 30+ card auto-parsers (Charlie Card, Clipper, EMV, Gallagher, HID, Opal, Troika, …), plus NFC Magic, MIFARE Fuzzer, NFC/RFID Detector, and the Passport (MRTD) reader.

🔑 Security — U2F / FIDO2

USB security-key support: U2F/FIDO1 and full FIDO2/CTAP2 (PIN, resident keys/passkeys, self-attestation via mbedtls). Cert/key in /ext/u2f/assets/. Requires USB-OTG (T-Embed).

⌨️ HID / USB

Bad USB (Ducky-script over USB or BLE, ~30 layouts) and Macro Pad (USB/BLE HID macro record & playback).

🎵 Media

Streaming — unified music (.mp3) & video (.mp4) player: play locally or stream to AirPlay, Chromecast/Google Cast, and DLNA devices.

🎮 Games

Doom (needs doom1.wad), Snake, Hotspot Arcade, and 30+ user FAPs (Asteroids, Blackjack, Pong, Roulette, Tamagotchi, Tetris, Texas Hold’em, …).

🛠 System / Tools

Control Centre (lock-menu quick settings + sliders), Dual Boot, Archive (SD browser), JS Runner (mJS), qFlipper bridge & USB Storage (USB-OTG), and a 30-level Momentum dolphin with animated idle desktop.

⚙ Settings

Bluetooth, backlight, clock, dolphin/passport, expansion port, input, notification, power, storage, system info, factory reset, Update Firmware (OTA), Interface (main-menu customization), and Spoofing (device name / shell color).

SD Card Layout

Path	Used by
/ext/Manifest	Desktop (presence check)
/ext/dolphin/ + manifest.txt	Idle animations
/ext/apps_assets/nfc/plugins/	NFC protocol plugins (.fal)
/ext/apps_data/doom/doom1.wad	Doom
/ext/badusb/	Bad USB scripts + assets/layouts/*.kl
/ext/infrared/assets/	Universal remote DBs
/ext/nfc/assets/	MIFARE & EMV dictionaries
/ext/subghz/assets/	SubGHz keystores
/ext/u2f/assets/	U2F cert + key
/ext/wifi/<ssid>.txt	Saved WiFi passwords
/ext/wifi/evil_portal/	Custom captive-portal templates

A complete starter kit is in sdcard.zip — extract it onto a FAT32 SD.

Building

Requires ESP-IDF v5.4.1 (exact version).

Linux / macOS

./buildAndFlash_T-Embed.sh            # T-Embed (build + flash)
./buildAndFlash_T-Embed.sh --build-only

Windows

:: source ESP-IDF v5.4.1 first (C:\Espressif\frameworks\esp-idf-v5.4.1\export.bat)
idf.py -B build_multiboot -DFLIPPER_BOARD=lilygo_t_embed_cc1101 -DSDKCONFIG=build_multiboot/sdkconfig build

The dual-boot shipping image is built in build_multiboot/. Flash the app at offset 0x20000.

Build a FAP

./buildFap.sh applications/main/my_app   # firmware must be built first

Porting Approach

Preserves the original Flipper Zero architecture as closely as possible:

• Furi OS on FreeRTOS with the same thread/mutex/event/record API
• HAL maps STM32 peripherals to ESP-IDF (SPI → esp_lcd, I2C → PN532/CST816S, RMT → IR, NimBLE → BLE, TinyUSB → USB-HID)
• Display renders the original 128×64 mono framebuffer, then 2× upscales to RGB565
• Crypto uses real mbedtls (no Flipper-Enclave key — affects encrypted SubGHz keystores only)

Credits & Acknowledgements

This project stands entirely on the work of others. It is a fork built on top of, and grateful to:

• Flipper Zero firmware — Flipper Devices Inc. The original firmware, UI, Furi OS, services and application framework that everything here derives from. (GPLv3)
• Momentum Firmware — the Momentum team. The custom-firmware feature set (dolphin, passport, settings, apps) this port brings over. (GPLv3) — see NOTICE_MOMENTUM_PORT.md.
• Flipper-Zero-ESP32-Port — Sor3nt. The ESP32 / ESP-IDF port this repository is a fork of; the HAL, board bring-up, web flasher and much of the wireless tooling originate there.
• ESP-IDF — Espressif Systems. The SDK and toolchain this port targets.

T-Embed fork maintained by ElicoftZ.

Bundled third-party components

Each retains its own license — see the LICENSE / COPYING / NOTICE file next to it in the tree:

Component	Used for	Upstream
doomgeneric	Doom	ozkl/doomgeneric
Helix	MP3 decoding (Streaming)	RealNetworks Helix
libsmb2	SMB2/3 client	sahlberg/libsmb2 (LGPL-2.1)
heatshrink	compression	atomicobject/heatshrink
mJS	JS Runner	cesanta/mjs
Hotspot Arcade	arcade app	tarikbc/hotspot-arcade
WPair	WhisperPair	zalexdev/wpair-app — see NOTICE
ESP32Marauder payloads	some BLE Spam advertisements	justcallmekoko/ESP32Marauder — see NOTICE (MIT)

Additional community apps under applications_user/ — TagTinker, Flipper Authenticator, xRemote, Tamagotchi (tamalib), Blackjack, ProtoPirate, WMBuster, Wolf3D (Wolf4SDL) and others — each ship under their own LICENSE.

No Momentum asset-pack artwork is redistributed here. If you add asset packs, audit and preserve each asset’s own license and attribution before distributing.

License

Licensed under the GNU General Public License v3.0, inherited from Flipper Zero and Momentum. Bundled components are covered by their own licenses listed above.

If you distribute binaries of this firmware, you must comply with GPLv3 — make the complete corresponding source available and preserve the license texts and attribution of every bundled component. This README is not a substitute for the full license texts or legal advice.

This site is open source. Improve this page.