Flipper Zero Toolkit v3.2 — Rebuilt from Clean Sources

Flipper Zero Toolkit v3.2 — Rebuilt from Clean Sources

Author: Ansfidine Youssouf
Firmware: Momentum SDK (API 87.1, Target 7)
Date: June 2026

Apps (4 .fap binaries)

App	File	Size	Description
Sub-GHz Easy CN	subghz_cn_easy.fap	12 KB	RAW capture + replay, 315/433.92 MHz
Sub-GHz Pentest	subghz_pentest.fap	27 KB	Category scan + capture + transmit
BadUSB Manager	badusb_manager.fap	14 KB	DuckyScript engine w/Mac+Windows payloads
GPIO Sensor Bridge	gpio_sensor_bridge.fap	5.6 KB	I2C sensor scanner + bridge

Build Fixes

• BadUSB: Replaced undeclared HID_VID_DEFAULT/HID_PID_DEFAULT with Logitech defaults
• SubGHz Easy: Fixed directory structure, clean build from all modules
• SubGHz Pentest: Added all scenes/*.c files to .fam sources list
• GPIO Sensor: Rebuilt with corrected include paths

Warning

These are compiled binaries. Source code is in the repo under apps/<app>/. Do not install unless you know what you're doing. ISM band transmission requires proper authorization in China.

v2.3.0 - UI Fix + Icons + Crash Fix

Bug fixes:

• BadUSB: fixed stuck modifier keys, 5ms keystroke delay, 128x64 UI alignment, 10x10 icon
• SubGHz: real async signal capture/replay (not jammer), .sub file save, 315/433.92 MHz only, 128x64 UI alignment, 10x10 icon
• Both: proper attribution, no text overlap

Flipper Zero Toolkit v3.1.1 — Boss Spec Compliant

Flipper Zero Toolkit v3.1.1 — Boss Spec Compliant

Author: Ansfidine Youssouf
Firmware: Momentum SDK mntm-012 (API 87.1, Target 7)
Collaboration: Hermes + Steve

Fixes in v3.1.1

Issue	Fix
Custom Scan range 300-928 MHz	Fixed → 315/433.92 MHz only
subghz_cn_easy.c source missing	Restored → Full RAW capture/replay source
BadUSB payload path wrong	Fixed → /ext/apps_data/badusb/
Duplicate payload folders	Consolidated → All 12 payloads in apps/badusb/payloads/

What's Included

Apps (3 .fap binaries):

App	File	Version	Description
Sub-GHz Easy	subghz_cn_easy.fap	v3.0	RAW capture + replay, 315/433.92 MHz
Sub-GHz Pentest	subghz_pentest.fap	v0.5.2	Category scan + capture + transmit
BadUSB Manager	badusb_manager.fap	v1.1	DuckyScript engine, Mac+Windows payloads

Payloads (12 DuckyScript files):

• win_test.txt — Windows Notepad smoke test
• win_reverse_shell.txt — PowerShell reverse shell (192.168.50.98:4444)
• win_wifi_dump.txt — WiFi profile + password dump
• mac_test.txt — Mac TextEdit smoke test
• mac_reverse_shell.txt — bash reverse shell
• mac_wifi_dump.txt — WiFi password dump
• hello_world.txt — Universal hello world
• lock_screen.txt — Lock screen command
• matrix_rain.txt — Matrix rain effect
• rickroll.txt — YouTube rickroll
• wifi_dump.txt — Generic WiFi dump
• china_freq_ref.txt — Chinese frequency reference

Safety Notes

• Reverse shells target 192.168.50.98:4444 — update for your lab
• WiFi dumps require admin/UAC privileges
• All payloads for authorized testing only

Attribution

Built by Ansfidine Youssouf for Flipper Zero Momentum firmware.

v3.1.0 — Frequency Fix + Payload Consolidation

v3.1.0 — Frequency Fix + Payload Consolidation

Fixes

• Sub-GHz frequencies locked to Boss spec: All categories now use ONLY 315 MHz or 433.92 MHz (no sweep ranges)
  • Car Remotes, Garage Doors, Alarm Systems → 315 MHz
  • Weather Sensors, Smart Home, E-Scooter, Parking Barrier, LED Controller, E-Door Lock → 433.92 MHz
  • Custom Scan still allows manual frequency entry (300-928 MHz)
• Payloads consolidated: All payloads now in apps/badusb/payloads/ (removed apps_data/badusb/ duplicates)
• subghz_cn_easy.c source restored to repo

BadUSB Manager v1.0.1

• Fixed submenu NULL callbacks (menu items were non-interactive)
• Fixed dialog NULL result callback (confirm dialog was broken)
• 12 DuckyScript payloads included (6 original + 6 Mac/Windows)

Apps

App	Size	Notes
subghz_pentest.fap	~27KB	315/433.92 MHz only, capture/save/replay
badusb_manager.fap	~14KB	DuckyScript runner, 12 payloads

Built against Momentum SDK API 87.1, Target 7

v3.0 — Real RAW Capture & Replay + BadUSB Manager

Sub-GHz Easy v3.0 — THE REAL DEAL

✅ RAW Signal Capture using
✅ Real Replay using
✅ .sub file save — Flipper-compatible format
✅ Chinese frequencies: 315 MHz, 433.92 MHz

How to use

1. Select frequency (UP/DOWN: 315 ↔ 433 MHz)
2. Press OK → Capture Screen
3. Press OK again → Start recording (5s auto-stop or OK to stop)
4. Press DOWN → Save as .sub file
5. Press OK → Replay captured signal

Controls

• Main Screen: UP/DOWN = switch freq, OK = capture, BACK = exit
• Capture Screen: OK = start/stop recording, DOWN = save to file
• Replay Screen: OK = transmit signal, BACK = go back

Files saved to

BadUSB Manager v2.2 — Keyboard Safety

• Stuck modifier keys fixed
• HID auto-switch for Momentum firmware
• Keystroke delay (5ms)
• Text truncation for long filenames

Built Against

• Momentum SDK mntm-012 (API 87.1, Target 7)
• Flipper Zero F7 hardware

Built by Ansfidine Youssouf

v2.2.1 — BadUSB Safety Fixes + Momentum SDK

Flipper Zero Toolkit — v0.5.1

📱 Apps (Momentum SDK, API 87.1, Target 7)

#	App	File	Size	Description
1	Sub-GHz Pentest	subghz_pentest.fap	27KB	Frequency scanner + signal capture + replay
2	BadUSB Manager	badusb_manager.fap	14KB	DuckyScript payload runner
3	GPIO Sensor Bridge	gpio_sensor_bridge.fap	5.7KB	I2C sensor scanner with real-time readings
4	hello_flipper	hello_flipper.js	~4KB	Smoke test script (JS runtime)

Sub-GHz Pentest v0.5.1 — Capture + Save + Replay

• Signal Capture: Async RX with protocol auto-detect (SubGhzReceiver)
• Protocol Decode: PT2262, EV1527, Keeloq, CAME, Nice FLO, SMG5326, etc.
• Save as .sub: Official Flipper Format for replay
• Signal Replay: Transmit captured signals via SubGhzTransmitter
• China Frequencies: Car Remotes 310-395 MHz, E-Door Lock 433 MHz
• UI Flow: Scan → OK=Capture → Save → Send

BadUSB Manager v1.0 — NEW

• Native C FAP: No JS runtime dependency
• DuckyScript parser: STRING, STRINGLN, DELAY, DEFAULT_DELAY, modifiers
• Payload browser: Scans /badusb/ directory on SD card
• Sample payloads: hello_world, china_freq_ref, wifi_dump, lock_screen
• Safety: release_all before/after, HID auto-switch for Momentum

Install

1. Download .fap files to Flipper SD card:
   • subghz_pentest.fap → /apps/Sub-GHz/
   • badusb_manager.fap → /apps/USB/
   • gpio_sensor_bridge.fap → /apps/GPIO/
   • hello_flipper.js → /apps/Scripts/
   • BadUSB payloads ( files) → /badusb/
2. Open from Flipper app menu

Built against Momentum SDK mntm-012 (API 87.1, Target 7). Compatible with official firmware.