Flipper Zero: Getting Started with BadUSB, Sub-GHz, and NFC

The Flipper Zero is a portable multi-tool for hardware hacking, RF analysis, and automation — but the stock firmware only exposes a fraction of what it can do. This guide covers the essential features, how to use them effectively, and the community tools that unlock the rest.

Firmware: Stock vs Community

The stock Unleashed or official firmware is the safe, legal starting point. Community forks like Unleashed and RogueMaster remove region restrictions, add extra Sub-GHz frequencies, and bundle community plugins. To update:

1. Install qFlipper on your desktop
2. Connect via USB-C
3. For stock: update directly in qFlipper. For Unleashed: download the .tgz from the GitHub releases page, drag it onto the Flipper's SD card under update/, and select it in the firmware update menu

Note: Transmitting on frequencies outside your region's legal bands is illegal. Know your local RF regulations before using Sub-GHz transmit features.

BadUSB: USB HID Attacks and Automation

When plugged into a computer, the Flipper Zero can appear as a USB keyboard and type keystrokes at machine speed. This is useful for automating repetitive tasks, demonstrating attack vectors in security training, and running scripts on locked systems where you have physical access.

BadUSB scripts use DuckyScript syntax. Basic example:

DELAY 2000 GUI r DELAY 500 STRING powershell -WindowStyle Hidden -Command "whoami" ENTER

Drop .txt files in SD/badusb/. Navigate to BadUSB in the main menu, select your script, plug into USB, and run.

Practical uses (on your own systems):

• Auto-type long passwords or keys during setup
• Deploy SSH public keys to new machines
• Run a system info collection script quickly
• Demonstrate USB attack surface in security training

Troubleshooting: Windows SmartScreen or antivirus may block PowerShell scripts. Add a longer initial DELAY (3000–5000ms) if the target computer is slow to recognize the HID device before typing begins.

Sub-GHz: Reading and Replaying RF Signals

The Flipper can receive and transmit in the 300–928 MHz range. Common use cases:

• Garage door remotes — Fixed-code remotes (older systems) can be captured and replayed. Rolling-code systems (KeeLoq, etc.) cannot be replayed without special attacks.
• Weather stations — Most 433 MHz sensors can be decoded and monitored
• Car key fobs — Fixed-code only. Modern rolling-code fobs are not vulnerable to simple replay
• IoT devices — Many cheap 433 MHz smart plugs, door sensors, and remotes use fixed codes

Capturing: Go to Sub-GHz → Read. Point the remote at the Flipper and press the button. If a signal is received, you'll see it on screen. Save it and it can be replayed later.

Analyzing: The Flipper will attempt to decode and identify the protocol automatically. Many common protocols (Princeton, CAME, Nice, Holtek) are recognized. Unknown signals are saved as RAW and can be analyzed in external tools.

Frequency analyzer: Sub-GHz → Frequency Analyzer shows live RF activity across the spectrum. Good for finding what frequency a device uses before trying to capture it.

NFC and RFID: Cards and Tags

The Flipper handles two separate technologies:

• NFC (13.56 MHz): Modern access cards (MIFARE Classic, MIFARE Ultralight, NFC-A/B/V), payment cards (read UID only — no payment data cloning), and NFC tags
• 125 kHz RFID: Older proximity cards (EM4100, HID, Indala) used in many older building access systems

Reading a card: NFC → Read. Hold the card flat against the back of the Flipper. It will read and identify the card type. Save the read to SD card.

MIFARE Classic: The Flipper can crack MIFARE Classic encryption using known default keys and a built-in dictionary attack. Many older access cards use default keys and are fully readable. Cards with custom keys require tools like Proxmark for deeper analysis.

Emulation: The Flipper can emulate saved cards — useful for consolidating multiple access cards or badges. Emulation support varies by reader type; some readers detect timing differences from genuine cards.

IR: Universal Remote Replacement

The Flipper has an IR transmitter/receiver compatible with most consumer IR devices. It ships with a large built-in library covering TVs, projectors, A/V receivers, and AC units. To learn a remote:

1. Infrared → Learn New Remote
2. Point the original remote at the Flipper's top IR sensor
3. Press each button and name it
4. Save the remote — it appears in your custom remotes list

SD Card Organization

Keep your SD card organized — the Flipper's menus reflect the directory structure:

SD/ ├── badusb/ ← .txt DuckyScript files ├── subghz/ │ ├── saved/ ← Captured signals │ └── raw/ ← Raw captures for analysis ├── nfc/ ← Saved NFC reads ├── lfrfid/ ← 125kHz RFID saves ├── infrared/ ← IR remotes └── music_player/ ← .fmf music files

What You Can't Do (Legally or Technically)

• Clone rolling-code key fobs for vehicle entry — modern car fobs use cryptographic rolling codes
• Intercept or inject Bluetooth — the hardware doesn't support it without a GPIO module
• Read EMV payment card data beyond the UID
• Transmit on aircraft or emergency service frequencies — illegal regardless of device

The Flipper Zero is a legitimate security research and hardware exploration tool. Use it responsibly — only on systems and devices you own or have explicit permission to test.