How to Use the Flipper Zero GPIO for Hardware Hacking: UART, SPI, I2C, and Debugging

Introduction

The GPIO header on the Flipper Zero transforms it from a wireless tool into a universal hardware hacking interface. With 18 pins providing UART, SPI, I2C, 1-Wire, PWM, ADC, and general-purpose digital I/O, the Flipper can talk to virtually any embedded device. Debug routers, dump SPI flash chips, read I2C sensors, emulate 1-Wire devices, drive LEDs and servos, and even function as a basic logic analyzer. This guide covers the complete GPIO pinout, protocol configuration, and the hardware workflows that let you interface with embedded systems at the electrical level.

GPIO Pinout and Capabilities

The Flipper Zero exposes an 18-pin expansion header on the top of the device:

Pin 1: 3.3V - Regulated 3.3V output, max 150 mA
Pin 2: GND - Ground reference
Pin 3: 5V (USB VBUS) - 5V when USB connected, max 500 mA (USB limited)
Pin 4: GND - Ground reference
Pin 5: GPIO PA7 - General purpose I/O, SPI MOSI, TIM1_CH1N
Pin 6: GPIO PA6 - General purpose I/O, SPI MISO, TIM3_CH1
Pin 7: GPIO PA4 - General purpose I/O, SPI NSS, ADC_IN4
Pin 8: GPIO PB3 - General purpose I/O, SPI SCK, TIM2_CH2
Pin 9: GPIO PB2 - General purpose I/O, I2C SDA
Pin 10: GPIO PC3 - General purpose I/O, I2C SCL
Pin 11: GPIO PC1 - General purpose I/O, UART RX (LPUART)
Pin 12: GPIO PC0 - General purpose I/O, UART TX (LPUART)
Pin 13: GPIO PC6 - General purpose I/O
Pin 14: GPIO PC7 - General purpose I/O
Pin 15: GPIO PB6 - General purpose I/O, UART TX (USART1)
Pin 16: GPIO PB7 - General purpose I/O, UART RX (USART1)
Pin 17: 1-Wire / iButton - Dallas 1-Wire bus, iButton contact
Pin 18: GND - Ground reference

Voltage levels: All GPIO pins are 3.3V logic. Do not connect 5V signals directly to the GPIO pins without a level shifter. The STM32WB55 MCU is not 5V tolerant on most pins.

Step 1: UART Serial Debugging

UART is the most common debug interface on embedded devices. Routers, IP cameras, smart home devices, and development boards expose UART for boot messages, shell access, and firmware updates.

Physical connection:

Target TX (transmit) - Flipper RX (PC1, pin 11)
Target RX (receive) - Flipper TX (PC0, pin 12)
Target GND - Flipper GND (pin 2, 4, or 18)
Do not connect target VCC to Flipper 3.3V - the target powers itself

Finding UART pins on an unknown device:

Look for a header with 3-4 pins near the main processor. Common labels: TX, RX, GND, VCC, DBG, UART, CONSOLE.
Use a multimeter in continuity mode to find GND (connects to shielding, USB connector shell).
Use a multimeter in DC voltage mode to find VCC (3.3V constant when powered).
The remaining pins are TX and RX. TX will show voltage fluctuation during boot (0V to 3.3V).
Use a logic analyzer or the Flipper's UART sniffing to identify which pin transmits data.

Configuring UART on the Flipper:

Navigate to GPIO > USB-UART Bridge.
Set the baud rate: Common values are 9600, 115200, 38400. If unknown, start with 115200 (most common for modern devices).
Set data bits: 8 (standard)
Set parity: None (standard)
Set stop bits: 1 (standard)

Connecting to a router console:

Power off the target router.
Connect TX/RX/GND between router and Flipper.
Open a serial terminal on your PC connected to the Flipper.
Power on the router. Boot messages should appear immediately.
If you see garbage characters, try different baud rates (common: 57600, 38400, 19200).

Common router baud rates:

TP-Link: 115200
Netgear: 115200
Linksys: 115200
Ubiquiti: 115200
D-Link: 57600
Older devices: 9600

Getting a root shell:

Many embedded Linux devices drop to a root shell on the UART console if you press a key during boot:

Watch boot messages scroll by.
When you see "Press any key to stop autoboot" or similar, press Enter.
You land at a U-Boot prompt: =>
From U-Boot: boot to continue booting, or modify environment variables.
After the kernel boots, you often get a direct root shell without password.

Step 2: SPI Flash Chip Dumping

SPI flash chips store firmware on routers, motherboards, and embedded devices. Reading them extracts the firmware for analysis and modification.

What you need:

SOIC8 clip or pogo pins to connect to the flash chip without desoldering
Jumper wires to connect the clip to the Flipper GPIO

Pin mapping (Flipper to SPI Flash):

Flipper PA7 (pin 5) - SPI MOSI - Flash DI (Data In)
Flipper PA6 (pin 6) - SPI MISO - Flash DO (Data Out)
Flipper PA4 (pin 7) - SPI NSS/CS - Flash CS (Chip Select)
Flipper PB3 (pin 8) - SPI SCK - Flash CLK (Clock)
Flipper GND - Flash GND
Flipper 3.3V (pin 1) - Flash VCC (power the flash chip)

Using the SPI Flash app:

Install the SPI Flash app from the Flipper App Catalog (or use the built-in SPI Mem Manager).
Connect the SOIC8 clip to the flash chip.
SPI Mem Manager > Read.
Select chip type (Winbond W25Q128, Macronix MX25L6405, etc.). If unknown, try Auto-Detect.
Set read speed: Start with 1 MHz. Increase to 4 MHz if stable.
Start the read. A 16 MB chip takes about 2-5 minutes.
Save the dump to the SD card.

Analyzing the dump:

Use binwalk on your PC to extract the firmware: binwalk -e flash_dump.bin
Look for file systems (SquashFS, JFFS2, CramFS)
Extract the kernel, rootfs, and configuration files
Search for hardcoded passwords, certificates, and backdoors

Writing to SPI flash (firmware modification):

Modify the extracted firmware (change configs, add backdoor, etc.).
Repack the firmware image.
SPI Mem Manager > Write.
Select the modified image.
Write to the flash chip.
Verify with Read and compare.

Power note: Some boards power the flash chip through the main CPU. If reading fails, try powering the target device normally (the flash may be powered by the board's own 3.3V regulator) and only connect signal wires.

Step 3: I2C Sensor Reading

I2C is a two-wire protocol used by sensors, displays, EEPROMs, and peripherals.

Pin mapping:

Flipper PB2 (pin 9) - I2C SDA (Data)
Flipper PC3 (pin 10) - I2C SCL (Clock)
Flipper GND - Device GND
Flipper 3.3V - Device VCC (for powering small sensors)

Scanning for I2C devices:

Connect the I2C device.
Install the I2C Tools or I2C Scanner app from the App Catalog.
Run a bus scan. The app displays all responding device addresses (0x00-0x7F).

Reading an I2C EEPROM (24Cxx series):

Connect the EEPROM (pins: VCC, GND, SDA, SCL, WP to GND for write enable).
Use the I2C Tools app to read sequential bytes.
Specify the device address (0x50 for 24C02/04/08/16, 0xA0 shifted = 0x50).
Read and save the EEPROM contents.

Reading I2C sensors:

BMP280: Temperature and pressure sensor (address 0x76 or 0x77)
SHT30: Temperature and humidity sensor (address 0x44 or 0x45)
MCP9808: Precision temperature sensor (address 0x18)
ADS1115: 16-bit ADC (address 0x48-0x4B)
SSD1306: OLED display (address 0x3C or 0x3D)

Install the appropriate sensor app from the App Catalog, or use the I2C Tools app to manually send read commands.

Step 4: 1-Wire Bus Analysis

The Flipper has a dedicated 1-Wire pin (pin 17) with a contact pad for iButton keys. It can also interface with other 1-Wire devices.

Supported 1-Wire operations:

Read iButton: Touch the key to the iButton pad. The ROM ID is read and saved.
Emulate iButton: The Flipper acts as an iButton key with a saved ROM ID.
Write RW1990: Program a rewritable iButton key with a captured ROM ID.
Search ROM: Discover all devices on a 1-Wire bus.
Read/write scratchpad: Access DS18B20 temperature sensors and memory devices.

DS18B20 temperature sensor:

Connect DS18B20 data pin to the Flipper 1-Wire contact (pin 17).
Connect VCC (3.3V) and GND.
Use the GPIO > 1-Wire menu or a dedicated DS18B20 app.
Issue a temperature conversion command.
Read the scratchpad for the 12-bit temperature value.

Step 5: PWM and Servo Control

The Flipper can generate PWM signals for controlling servos, LEDs, and motor drivers.

Servo control setup:

Connect a servo signal wire to GPIO PA7 (pin 5).
Connect servo power to 5V (pin 3) and ground to GND.
Use the Servo Tester or PWM app from the App Catalog.
Set PWM frequency to 50 Hz (standard servo frequency).
Set pulse width: 1000 us = full left, 1500 us = center, 2000 us = full right.

LED brightness control:

Connect an LED (with current-limiting resistor) to a PWM-capable pin and vary the duty cycle from 0% (off) to 100% (full brightness).

Step 6: ADC (Analog Input)

GPIO PA4 (pin 7) supports analog-to-digital conversion. It can read voltage levels from 0 to 3.3V with 12-bit resolution (0-4095).

Reading analog voltage:

Connect the analog signal to PA4 (pin 7).
Ensure the voltage is between 0 and 3.3V. Use a voltage divider for higher voltages.
Use the ADC app from the App Catalog.
The app displays the raw ADC value and calculated voltage.

Voltage divider formula for measuring higher voltages:

Vout = Vin * R2 / (R1 + R2)

To measure a 12V battery: R1 = 10k, R2 = 3.3k. Vout = 12 * 3.3 / 13.3 = 2.98V (safe for the ADC).

Step 7: Using the Flipper as a USB-to-Protocol Bridge

The Flipper can act as a protocol bridge, connecting to embedded devices and forwarding data to your PC over USB.

UART bridge mode:

GPIO > USB-UART Bridge.
Set baud rate and parameters.
The Flipper appears as a USB serial port on your PC.
Open a terminal (PuTTY, screen, minicom) at the COM port.
All data flows between the PC and the target UART device through the Flipper.

SPI/I2C bridge mode:

Some apps support USB bridge mode for SPI and I2C.
The Flipper acts as a USB-to-SPI/I2C adapter.
Use Python with pyusb or custom drivers on your PC to send SPI/I2C commands through the Flipper.

Step 8: Logic Analyzer Mode (PulseView / Sigrok)

The Flipper can function as a basic logic analyzer using the Logic Analyzer app and PulseView on your PC.

Setup:

Install the Logic Analyzer app from the App Catalog.
Install PulseView (part of the Sigrok project) on your PC.
Connect the Flipper via USB.
Connect target signals to the Flipper GPIO pins.
PulseView > Connect to Flipper > Select channels.

Capabilities:

8 digital channels (using available GPIO pins)
Sample rates up to 4 MHz (limited by USB bandwidth)
Trigger on rising edge, falling edge, or level
Protocol decoding: UART, SPI, I2C, 1-Wire, CAN, JTAG, PWM

Capturing UART traffic:

Connect the target TX pin to a Flipper GPIO pin.
Set PulseView to capture on that channel.
Set a trigger (falling edge for UART start bit).
Start capture and initiate target communication.
Use the UART decoder in PulseView to view the data bytes.

Step 9: JTAG and SWD Debugging

The Flipper can interface with JTAG and SWD (Serial Wire Debug) for low-level MCU debugging.

SWD (Serial Wire Debug) - 2-wire:

SWDIO (Data I/O) - Connect to Flipper GPIO
SWCLK (Clock) - Connect to Flipper GPIO
GND - Common ground
NRST (Reset) - Optional, connect for reset control

JTAG - 4/5-wire:

TMS (Test Mode Select) - Flipper GPIO
TCK (Test Clock) - Flipper GPIO
TDI (Test Data In) - Flipper GPIO
TDO (Test Data Out) - Flipper GPIO
TRST (Test Reset) - Optional
GND - Common ground

OpenOCD integration:

Install OpenOCD on your PC.
Use the Flipper as a USB-to-JTAG/SWD adapter (some apps provide this bridge).
Connect to the target MCU with the appropriate OpenOCD configuration.
Use GDB for debugging, flash programming, and register inspection.

Alternative: Black Magic Probe firmware

The Flipper can run Black Magic Probe firmware on its STM32WB55, turning it into a full-featured ARM debug probe that works directly with GDB without OpenOCD.

Safety Rules for GPIO Hardware Hacking

Voltage limit: Never exceed 3.3V on any GPIO pin. The STM32WB55 is not 5V tolerant.
Current limit: Max 8 mA per pin, 150 mA total for all pins combined.
Short circuit: Do not short 3.3V or 5V to GND. The Flipper's regulator will shut down or be damaged.
Power sequencing: Connect GND first, then signals, then power. Disconnect in reverse order.
ESD protection: Touch grounded metal before handling bare boards. Static discharge can destroy the MCU.
Current limiting resistors: Always use resistors when driving LEDs or into unknown circuits. 220-1k ohm is typical for LEDs.
Level shifters: When interfacing with 5V devices, use a bidirectional level shifter (TXS0108E, BSS138-based, etc.).

Conclusion

The Flipper Zero's GPIO header is the bridge between wireless hacking and hardware hacking. With UART debugging, SPI flash dumping, I2C sensor reading, 1-Wire analysis, PWM control, and logic analyzer capability, the Flipper replaces a drawer full of specialized tools. The key to success is understanding voltage levels, using proper connections, and respecting the electrical limits of the STM32WB55. Master the GPIO functions and you unlock the full potential of the Flipper as a universal embedded systems tool.

Related Guides

Loading_