← How-Tos
flipper-zero May 6, 2026 ◑ 33 views ◯ 10 min read

How to Use the Flipper Zero GPIO for Hardware Hacking: UART, SPI, I2C, and Debugging

by @jam3yy
flipper zerogpiohardware hackinguartspii2c1 wirejtagswdlogic analyzerflash dumpingembeddedhowto

Introduction

The GPIO header on the Flipper Zero transforms it from a wireless tool into a universal hardware hacking interface. With 18 pins providing UART, SPI, I2C, 1-Wire, PWM, ADC, and general-purpose digital I/O, the Flipper can talk to virtually any embedded device. Debug routers, dump SPI flash chips, read I2C sensors, emulate 1-Wire devices, drive LEDs and servos, and even function as a basic logic analyzer. This guide covers the complete GPIO pinout, protocol configuration, and the hardware workflows that let you interface with embedded systems at the electrical level.

GPIO Pinout and Capabilities

The Flipper Zero exposes an 18-pin expansion header on the top of the device:

Voltage levels: All GPIO pins are 3.3V logic. Do not connect 5V signals directly to the GPIO pins without a level shifter. The STM32WB55 MCU is not 5V tolerant on most pins.

Step 1: UART Serial Debugging

UART is the most common debug interface on embedded devices. Routers, IP cameras, smart home devices, and development boards expose UART for boot messages, shell access, and firmware updates.

Physical connection:

Finding UART pins on an unknown device:

  1. Look for a header with 3-4 pins near the main processor. Common labels: TX, RX, GND, VCC, DBG, UART, CONSOLE.
  2. Use a multimeter in continuity mode to find GND (connects to shielding, USB connector shell).
  3. Use a multimeter in DC voltage mode to find VCC (3.3V constant when powered).
  4. The remaining pins are TX and RX. TX will show voltage fluctuation during boot (0V to 3.3V).
  5. Use a logic analyzer or the Flipper's UART sniffing to identify which pin transmits data.

Configuring UART on the Flipper:

  1. Navigate to GPIO > USB-UART Bridge.
  2. Set the baud rate: Common values are 9600, 115200, 38400. If unknown, start with 115200 (most common for modern devices).
  3. Set data bits: 8 (standard)
  4. Set parity: None (standard)
  5. Set stop bits: 1 (standard)

Connecting to a router console:

  1. Power off the target router.
  2. Connect TX/RX/GND between router and Flipper.
  3. Open a serial terminal on your PC connected to the Flipper.
  4. Power on the router. Boot messages should appear immediately.
  5. If you see garbage characters, try different baud rates (common: 57600, 38400, 19200).

Common router baud rates:

Getting a root shell:

Many embedded Linux devices drop to a root shell on the UART console if you press a key during boot:

  1. Watch boot messages scroll by.
  2. When you see "Press any key to stop autoboot" or similar, press Enter.
  3. You land at a U-Boot prompt: =>
  4. From U-Boot: boot to continue booting, or modify environment variables.
  5. After the kernel boots, you often get a direct root shell without password.

Step 2: SPI Flash Chip Dumping

SPI flash chips store firmware on routers, motherboards, and embedded devices. Reading them extracts the firmware for analysis and modification.

What you need:

Pin mapping (Flipper to SPI Flash):

Using the SPI Flash app:

  1. Install the SPI Flash app from the Flipper App Catalog (or use the built-in SPI Mem Manager).
  2. Connect the SOIC8 clip to the flash chip.
  3. SPI Mem Manager > Read.
  4. Select chip type (Winbond W25Q128, Macronix MX25L6405, etc.). If unknown, try Auto-Detect.
  5. Set read speed: Start with 1 MHz. Increase to 4 MHz if stable.
  6. Start the read. A 16 MB chip takes about 2-5 minutes.
  7. Save the dump to the SD card.

Analyzing the dump:

Writing to SPI flash (firmware modification):

  1. Modify the extracted firmware (change configs, add backdoor, etc.).
  2. Repack the firmware image.
  3. SPI Mem Manager > Write.
  4. Select the modified image.
  5. Write to the flash chip.
  6. Verify with Read and compare.

Power note: Some boards power the flash chip through the main CPU. If reading fails, try powering the target device normally (the flash may be powered by the board's own 3.3V regulator) and only connect signal wires.

Step 3: I2C Sensor Reading

I2C is a two-wire protocol used by sensors, displays, EEPROMs, and peripherals.

Pin mapping:

Scanning for I2C devices:

  1. Connect the I2C device.
  2. Install the I2C Tools or I2C Scanner app from the App Catalog.
  3. Run a bus scan. The app displays all responding device addresses (0x00-0x7F).

Reading an I2C EEPROM (24Cxx series):

  1. Connect the EEPROM (pins: VCC, GND, SDA, SCL, WP to GND for write enable).
  2. Use the I2C Tools app to read sequential bytes.
  3. Specify the device address (0x50 for 24C02/04/08/16, 0xA0 shifted = 0x50).
  4. Read and save the EEPROM contents.

Reading I2C sensors:

Install the appropriate sensor app from the App Catalog, or use the I2C Tools app to manually send read commands.

Step 4: 1-Wire Bus Analysis

The Flipper has a dedicated 1-Wire pin (pin 17) with a contact pad for iButton keys. It can also interface with other 1-Wire devices.

Supported 1-Wire operations:

DS18B20 temperature sensor:

  1. Connect DS18B20 data pin to the Flipper 1-Wire contact (pin 17).
  2. Connect VCC (3.3V) and GND.
  3. Use the GPIO > 1-Wire menu or a dedicated DS18B20 app.
  4. Issue a temperature conversion command.
  5. Read the scratchpad for the 12-bit temperature value.

Step 5: PWM and Servo Control

The Flipper can generate PWM signals for controlling servos, LEDs, and motor drivers.

Servo control setup:

  1. Connect a servo signal wire to GPIO PA7 (pin 5).
  2. Connect servo power to 5V (pin 3) and ground to GND.
  3. Use the Servo Tester or PWM app from the App Catalog.
  4. Set PWM frequency to 50 Hz (standard servo frequency).
  5. Set pulse width: 1000 us = full left, 1500 us = center, 2000 us = full right.

LED brightness control:

Connect an LED (with current-limiting resistor) to a PWM-capable pin and vary the duty cycle from 0% (off) to 100% (full brightness).

Step 6: ADC (Analog Input)

GPIO PA4 (pin 7) supports analog-to-digital conversion. It can read voltage levels from 0 to 3.3V with 12-bit resolution (0-4095).

Reading analog voltage:

  1. Connect the analog signal to PA4 (pin 7).
  2. Ensure the voltage is between 0 and 3.3V. Use a voltage divider for higher voltages.
  3. Use the ADC app from the App Catalog.
  4. The app displays the raw ADC value and calculated voltage.

Voltage divider formula for measuring higher voltages:

Vout = Vin * R2 / (R1 + R2)

To measure a 12V battery: R1 = 10k, R2 = 3.3k. Vout = 12 * 3.3 / 13.3 = 2.98V (safe for the ADC).

Step 7: Using the Flipper as a USB-to-Protocol Bridge

The Flipper can act as a protocol bridge, connecting to embedded devices and forwarding data to your PC over USB.

UART bridge mode:

  1. GPIO > USB-UART Bridge.
  2. Set baud rate and parameters.
  3. The Flipper appears as a USB serial port on your PC.
  4. Open a terminal (PuTTY, screen, minicom) at the COM port.
  5. All data flows between the PC and the target UART device through the Flipper.

SPI/I2C bridge mode:

  1. Some apps support USB bridge mode for SPI and I2C.
  2. The Flipper acts as a USB-to-SPI/I2C adapter.
  3. Use Python with pyusb or custom drivers on your PC to send SPI/I2C commands through the Flipper.

Step 8: Logic Analyzer Mode (PulseView / Sigrok)

The Flipper can function as a basic logic analyzer using the Logic Analyzer app and PulseView on your PC.

Setup:

  1. Install the Logic Analyzer app from the App Catalog.
  2. Install PulseView (part of the Sigrok project) on your PC.
  3. Connect the Flipper via USB.
  4. Connect target signals to the Flipper GPIO pins.
  5. PulseView > Connect to Flipper > Select channels.

Capabilities:

Capturing UART traffic:

  1. Connect the target TX pin to a Flipper GPIO pin.
  2. Set PulseView to capture on that channel.
  3. Set a trigger (falling edge for UART start bit).
  4. Start capture and initiate target communication.
  5. Use the UART decoder in PulseView to view the data bytes.

Step 9: JTAG and SWD Debugging

The Flipper can interface with JTAG and SWD (Serial Wire Debug) for low-level MCU debugging.

SWD (Serial Wire Debug) - 2-wire:

JTAG - 4/5-wire:

OpenOCD integration:

  1. Install OpenOCD on your PC.
  2. Use the Flipper as a USB-to-JTAG/SWD adapter (some apps provide this bridge).
  3. Connect to the target MCU with the appropriate OpenOCD configuration.
  4. Use GDB for debugging, flash programming, and register inspection.

Alternative: Black Magic Probe firmware

The Flipper can run Black Magic Probe firmware on its STM32WB55, turning it into a full-featured ARM debug probe that works directly with GDB without OpenOCD.

Safety Rules for GPIO Hardware Hacking

Conclusion

The Flipper Zero's GPIO header is the bridge between wireless hacking and hardware hacking. With UART debugging, SPI flash dumping, I2C sensor reading, 1-Wire analysis, PWM control, and logic analyzer capability, the Flipper replaces a drawer full of specialized tools. The key to success is understanding voltage levels, using proper connections, and respecting the electrical limits of the STM32WB55. Master the GPIO functions and you unlock the full potential of the Flipper as a universal embedded systems tool.

Related How-Tos
Flipper Zero GPIO Pinout and Hardware Expansion: UART, I2C, ADC, 1-Wire, and Sensor WiringHow to Use a Logic Analyzer for Digital Signal Debugging: Saleae, Sigrok, and Protocol DecodingI2C vs SPI vs UART: How to Choose and Use Serial Communication ProtocolsRaspberry Pi GPIO: Complete Beginner Guide with Python ExamplesGPIO to External SPI Flash/EEPROM: Read/Write
Related Projects
Build a Flipper Zero GPIO Environmental Sensor Add-OnBuild a Flipper Zero-Controlled Robot Rover: Motor Driver, Servos, and a Custom Control AppSniffing Zigbee and Thread Traffic with a Flipper Zero and an External CC2652 Add-On BoardBuild a Flipper Zero Game Boy Cartridge Dumper and ROM Reader Add-OnDIY Home Security System: Combining Raspberry Pi, ESP32 Sensors, and Flipper Zero
Related Links
Plugin How-ToInstructables CNCRPi PinoutMicroPythonESP32 SPI Guide
Related Pastes
Flipper Zero — GPIO and Pin Reference1c3d.comFlipper Zero: Frequency Ranges1c3d.comRaspberry Pi — GPIO Pinout Quick Reference1c3d.comFlipper Zero — BadUSB Ducky Script Reference1c3d.comFlipper Zero — IR, Sub-GHz and NFC Cheat Sheet1c3d.com