Skip to content

Releases: at0m-b0mb/Hermes-FlipperZero

Hermes v1.3 — recap card, hex send, live baud nudge, markers

Choose a tag to compare

@at0m-b0mb at0m-b0mb released this 25 Jul 16:09

A "power console" pass: four additions that make the live session do more, and a recap so you can see what it did.

Drop hermes.fap onto your Flipper at SD Card / apps / GPIO /, then open Apps → GPIO → Hermes.

The session recap

Press Back and Hermes no longer just drops you out — it shows what the session was: bytes received, average throughput, framing errors and duration, in four tiles, with a one-word verdict of the link's health (clean link / noisy / wrong framing?) and the log filename if you captured one. It's the answer to "did that actually work?" without scrolling back through the log. A second Back returns to the menu.

The throughput, error-rate and duration arithmetic is pure integer code — rounds to nearest, guards divide-by-zero, no overflow at speed, and formats ms → "1m 23s" / bytes → "1.5 KB" without floating point — and it's host-tested under ASan/UBSan.

Send raw bytes

Text isn't always what you need to send. Ctrl palette → Send hex… asks how many bytes, then gives you a hex grid to fill — for a binary command, a magic packet, an exact escape sequence, or a literal 0x00 the keyboard can't type. What you compose is sent verbatim and echoed into the hex view.

Nudge the baud, live

Detection landed one row off? Ctrl palette → Baud + / Baud − steps to the next or previous standard rate and re-opens the link in place, keeping your framing, logging and armed watch. It's the fastest way to walk the neighbours when a rate is close but the text isn't quite clean — no trip back to the detect screen.

Log markers

Mid-capture, Ctrl palette → Drop marker (shown only while logging) writes a numbered, timestamped divider into the log, so a long session has points you can jump to later.

Notes

  • Leaving the console is now Back → recap → Back → menu. The recap reads the session while the link is still open, then the link and any log close as before.
  • Hex send is a two-phase picker (length, then bytes) because the byte grid edits a fixed-length field.
  • The baud nudge re-opens the link rather than reconfiguring it live, so the health counters and watch reset cleanly to the new rate.

GND first, always. 3.3V logic only. RS-232 swings ±12V and will destroy your Flipper — use a MAX3232. Detection releases the TX pin, and the console only transmits what you ask it to. For your own boards, or ones you are authorised to test.

Verified

Release API 87.1 and dev API 88.2 both green in CI, alongside three host test suites — the autobaud fit, the watch matcher, and the session arithmetic — under ASan/UBSan.

Hermes v1.2 — watch, link health, break, script replay

Choose a tag to compare

@at0m-b0mb at0m-b0mb released this 20 Jul 15:35

Five additions, all aimed at the live session — the part of the workflow earlier versions still left you doing by hand.

Drop hermes.fap onto your Flipper at SD Card / apps / GPIO /, then open Apps → GPIO → Hermes.

Watch for a string, and look away

A slow boot is a bad thing to babysit. Ctrl palette → Watch for… arms a string; when it appears in the stream, the Flipper buzzes and flashes — so you can set login: (or Password, or a panic string you are hunting) and go do something else.

An armed watch shows as an inverted strip along the bottom with a live hit count, so you can confirm at a glance it is live. Matching is case-insensitive and works even when the pattern straddles two DMA chunks or is wrapped in colour codes — it watches the raw stream, not the cooked screen. The matcher is KMP with a precomputed failure table, unit-tested against overlaps and byte-at-a-time delivery.

Link health

The console status bar now shows ERR n — hardware framing, parity and noise errors counted since the link opened. A count that climbs with the traffic is the surest sign the framing is wrong even though the rate is right. (Overruns stay excluded — those are the Flipper being slow, not the line being wrong.)

Send break

Some bootloaders, and the Linux magic SysRq, listen for a UART break — the line held low past the end of a frame. That is a deliberate framing violation, so it cannot be sent as a byte. Ctrl palette → Send break takes the TX pin off the UART, holds it low by hand for 25 ms, and hands it back idle-high, without disturbing RX.

Script replay

Ctrl palette → Run script… picks a .txt off the SD card and sends it line by line — a login, a set of U-Boot commands, a recovery sequence you would otherwise peck out one Flipper-keyboard character at a time. Lines are paced ~250 ms apart, blank lines and # comments are skipped, and playback runs off the UI tick so the target replies keep scrolling in between. Progress shows as SCRIPT n/m. A commented example_login.txt is in the repo to copy across and adapt.

Notes

None of these block the GUI thread — they run off the UI tick or a brief bounded hold, so the boot log keeps rendering throughout. An armed watch shrinks the terminal from six rows to five to make room for its strip; the terminal genuinely gives up the row rather than being drawn over.

GND first, always. 3.3V logic only. RS-232 swings ±12V and will destroy your Flipper — use a MAX3232. Detection releases the TX pin, and the console only transmits what you ask it to. For your own boards, or ones you are authorised to test.

Verified

Release API 87.1 and dev API 88.0 both green in CI, alongside two host test suites (the autobaud fit and the trigger matcher) under ASan/UBSan.

Hermes v1.1 — self test, logging, custom rates

Choose a tag to compare

@at0m-b0mb at0m-b0mb released this 18 Jul 15:52

Four additions, each closing a gap v1.0 left open.

Drop hermes.fap onto your Flipper at SD Card / apps / GPIO /, then open Apps → GPIO → Hermes.

Self Test — is it me, or them?

The worst half-hour in hardware work is the one spent debugging a target that was fine, because a jumper wasn't.

Bridge TX to RX with a single wire and Hermes sends a pattern out and checks it comes back, at 9600 / 115200 / 460800 / 921600. The three outcomes are genuinely different diagnoses:

  • All four echo → the Flipper, its pins and your wire are good. The silence is the target's.
  • Slow rates pass, fast ones fail → the link works, but not at speed. Long dupont leads do this. Shorten them.
  • Nothing comes back → the jumper isn't on the pins you think it is.

The pattern leads with 0x55 0xAA 0x00 0xFF — alternating bits, then all-low and all-high — so a wire that only passes certain levels gets caught rather than flattered.

Session logging

Settings → Log to SD writes each console session to /apps_data/hermes/hermes_YYYYMMDD_HHMMSS.log, headed with the rate, framing and port — so a file you find months later still says what it came from.

The file keeps the raw bytes, escape sequences and all. The screen strips ANSI to stay readable, but a log you will later grep, diff or replay should be exactly what the wire said. A filled dot in the status bar shows a capture is running. Opt-in — writing to your card is your call.

Custom baud entry

Manual Console → Custom rate… accepts anything from 50 to 2,000,000, lifting v1.0's restriction to the built-in table. Hermes asks the hardware whether a divider actually exists for the rate and refuses it if not, rather than opening a link that cannot work. The check only acquires the handle — it never inits it — so it does not touch the target's line.

Stop autoboot

Hit any key to stop autoboot: 3 gives you about a second, and by the time you have read it and reached for a key it is usually gone. The Ctrl palette now has a Stop autoboot action that hammers Enter for four seconds, so you can arm it before powering the board and let it catch the window for you. The status bar counts down while it runs.

It is driven from the UI tick rather than a blocking delay loop, so the screen keeps redrawing and the incoming boot log still renders while it fires.

Fixed

  • The self-test result screen drew its fourth rate row through the footer text. Found while regenerating the screenshots from the real layout constants; the row block now has an explicit vertical budget.

Verified

Release API 87.1 and dev API 88.0 both green in CI, alongside the host autobaud suite (21 checks under ASan/UBSan, driving the real interrupt handler with synthetic waveforms).

GND first, always. 3.3V logic only. RS-232 swings ±12V and will destroy your Flipper — use a MAX3232. For your own boards, or ones you are authorised to test.

Hermes v1.0 — UART baud detector + console tap

Choose a tag to compare

@at0m-b0mb at0m-b0mb released this 16 Jul 18:56

Clip onto an unknown serial line. Hermes measures the bit time on the pin, checks its answer against the real UART, and hands you the console.

Drop hermes.fap onto your Flipper at SD Card / apps / GPIO /, then open Apps → GPIO → Hermes.

How it finds the rate

Two stages, because they fail in opposite directions.

It measures. The RX pin becomes an interrupt input and every edge is timestamped with the ARM cycle counter — 15 ns resolution. Every run on a UART line is a whole number of bit times, so the question becomes which bit time turns these measurements into integers? Each standard rate is tested directly, and the slowest rate that explains the data wins: the faster ones are harmonics, and they give themselves away by needing more bits in a run than a frame can physically hold.

It checks. The same pin is reopened as a real UART, and each candidate is scored on hardware framing errors and printable ratio — evidence, not inference. That pass also settles the framing, which is why the answer is 115200 8N1 and not just a number. Overruns are tracked but never scored: an overrun means Hermes was too slow, not that the rate is wrong.

Edge timing works off a single boot burst but tops out near 230400; the UART sweep needs live traffic but is accurate to 921600. When the timing fit comes up empty, Hermes sweeps the whole table instead. When the line goes quiet, the verdict says timing only rather than dressing a guess up as a measurement.

In the app

  • Live scope — reconstructs the target’s actual square wave from the captured timings.
  • Verdict — confidence, provenance (412 edges · 96% fit), and a ladder of runner-ups you can open directly.
  • Console — DMA receive, 96 lines of scrollback, ASCII/hex, an ANSI parser so boot logs read as text, a Ctrl-key palette (Ctrl+C/D/Z, Esc, Tab), CR/LF/CRLF.
  • Wiring guide — animated, relabels itself per port profile, plus the rules.
  • Ports — USART on 13/14, LPUART on 15/16.

Before you clip on

GND first, always. 3.3V logic only. RS-232 swings ±12V and will destroy your Flipper — use a MAX3232. Flipper RX (14) goes to target TX; RX and TX always cross.

Detection releases the TX pin outright, so the target’s RX line is never driven until you open the console and type. Settings → Transmit: OFF keeps a whole session read-only.

Verified

Built against official firmware fw 7 / API 87.1, and CI also builds against the dev SDK (API 88.0). The fit ships with a host test suite (make -C test) that compiles the real autobaud.c against a stubbed HAL and drives the actual interrupt handler with synthetic waveforms — 21 checks under ASan/UBSan, green in CI alongside both channels.

For your own boards, or ones you are authorised to test.