Modded T-Embed Flipper Zero Port

A personal mod of the Flipper Zero Port firmware for the LilyGo T-Embed CC1101 (ESP32-S3). It takes some of the look and feel from the Momentum firmware and makes it work on affordable ESP32 hardware.

What's modded in this fork

Interface settings (Settings → Interface)

A new Interface tab in Settings with:

• Menu Styles — pick the main-menu look: Default (list), DSi, Wii
• Lock Screen — pick the lock screen style: Default (normal Flipper lock screen) or Momentum (Momentum-style lock screen)
• Add item / Remove item — edit the main menu: add and remove apps, both Main apps (built-in) and External (FAP) apps
• Status bar — customize the top bar:
  • Battery Icon — OFF, Bar, %, Inv. %, Bar %
  • Show Clock — toggle the clock on/off

Spoofing Options (Settings → Spoofing Options)

• Flipper Name — rename the device (max 8 chars, letters/numbers). Persisted in NVS (works without an SD card). The name is used everywhere:
  • Passport / About screens
  • Bluetooth device name (qFlipper mobile)
  • USB device name (qFlipper desktop)
• Shell Color — spoof the shell color shown by qFlipper / Flipper Lab:
  • Real Default / Black / White / Transparent
  • Advertised publicly over BLE (service UUID 0x3081/0x3082/0x3083) — qFlipper mobile shows the right color on the scanning screen, no connect needed

Web flasher

Firmware can be flashed from the browser, no toolchain required: T-Embed Webflasher

• Works in Chrome/Edge via WebSerial
• Serves the latest firmware release automatically from this repo's GitHub Releases
• Optional "Erase device" before flashing

---

Supported Boards

Board	MCU	Display	Input	SubGHz	NFC	IR	SD
LilyGo T-Embed CC1101	ESP32-S3	ST7789 320×170	Encoder + button	CC1101	PN532 (I2C)	RMT TX+RX	SPI

How to Flash

Browser (easiest)

1. Open the web flasher in Chrome/Edge
2. Connect the board via USB, click Connect T-Embed CC1101, pick the device
3. Click Flash Now and wait — the device reboots automatically

Windows (local build)

Requires Python 3 and ESP-IDF v5.4.1 (default C:\Espressif\frameworks\esp-idf-v5.4.1, override via ESP_IDF_DIR):

:: One-time: install ESP-IDF python env
python winbuild.py setup

:: Build T-Embed CC1101 (default board)
python winbuild.py build

:: Flash (port defaults to %ESPPORT% or COM14)
python winbuild.py flash --port COM14

Flashing the .bin files (esptool)

The release contains three .bin files. Flash them at these offsets:

File	Offset
bootloader.bin	0x0
partition-table.bin	0x8000
furi_esp32.bin	0x10000

Windows (with esptool from the ESP-IDF python env):

python -m esptool --chip esp32s3 -p COM14 write_flash --flash_mode dio --flash_size 16MB --flash_freq 80m 0x0 bootloader.bin 0x8000 partition-table.bin 0x10000 furi_esp32.bin

Linux / macOS:

python3 -m esptool --chip esp32s3 -p /dev/ttyACM0 write_flash --flash_mode dio --flash_size 16MB --flash_freq 80m 0x0 bootloader.bin 0x8000 partition-table.bin 0x10000 furi_esp32.bin

Linux / macOS

./buildAndFlash_T-Embed.sh          # build + flash T-Embed
./buildAndFlash_T-Embed.sh --build-only

SD card

After flashing, extract sdcard.zip onto a FAT32 SD card — most apps need files there (universal IR DBs, NFC dictionaries, Bad USB layouts, WiFi tools, animations).

Features (highlights)

• Sub-GHz — CC1101 RX/TX 433–868 MHz: receive, RAW capture, frequency analyzer, hopper, transmit, brute-force, playlists, TPMS decoders
• WiFi — scanner, connect, deauther, PCAP sniffer, handshake capture, AirSnitch, beacon spam, port scan, web crawler, evil portal (with internet bridge)
• Mesh / Buddy (ESP-NOW) — pair cheap headless ESP32 boards to offload WiFi handshake capture
• BLE — spam (Apple/Google/MS/Samsung/Xiaomi), walk scanner, FindMy (AirTag/SmartTag/Tile), HID, Bad USB over BLE
• NRF24 — spectrum analyzer, jammer, MouseJacker
• Infrared — learn/browse/send, universal remote DBs (TV, AC, audio, projectors, fans, LEDs), brute-force, protocols: NEC, NEC42, Samsung32, RC5/RC5X, RC6, SIRC, Kaseikyo, RCA, Pioneer
• NFC (PN532) — read/save/emulate/write, Mifare dictionary attack, Ultralight-C, SLIX, DESFire, 14 protocols, 30+ parsers
• Bad USB — Ducky scripts over USB OTG (T-Embed) or BLE
• Lock menu toggles — qFlipper bridge (VID/PID spoof + CDC RPC), USB storage, Bluetooth, mesh clients
• Archive, JS Runner, Doom, Snake, dolphin desktop animations

SD Card Layout

Path	Used by
/ext/Manifest	Desktop presence check
/ext/dolphin/ + manifest.txt	Idle animations
/ext/apps_data/nfc/plugins/	NFC card-parser plugins
/ext/badusb/	Bad USB scripts + layouts
/ext/infrared/assets/	Universal remote DBs
/ext/nfc/assets/	MIFARE & EMV dictionaries
/ext/subghz/assets/	SubGHz keystores
/ext/wifi/<ssid>.txt	Saved WiFi passwords
/ext/wifi/evil_portal/	Captive-portal templates + captured creds

Porting Approach

The port preserves the original Flipper Zero architecture as closely as possible: Furi OS on FreeRTOS, same service/record patterns, HAL maps STM32 peripherals to ESP-IDF drivers (SPI → esp_lcd, I2C → PN532, RMT → IR, Bluedroid → BLE, TinyUSB → USB-HID). The 128×64 mono framebuffer is upscaled 2× to RGB565 for the color LCD. malloc is redefined to calloc (STM32 heap starts zeroed, ESP32 does not).

Disclaimer

I do not take responsibility if you damage your board or property. This project is for educational purposes only — proceed at your own risk.