Module Setup & Field Guides

• Host Device: Flipper Zero
• Compatible Flipper Firmware: Official, Momentum, or Unleashed.
• Required App File: Download the latest 5ghost_wifi_lab.fap from GitHub Releases:

https://github.com/pingequalab/5ghost-wifi-lab

• Hardware Note: The PINGEQUA 5Ghost board ships preloaded. No wiring, soldering, or module flashing is required for first-time setup.
• Antenna Note: Tighten the external SMA antenna before use.
• SD Path: Copy the .fap file to /ext/apps/GPIO/ on your Flipper microSD card.
• Support Note: Built for the PINGEQUA 5Ghost BW16 board only. Other BW16 / RTL8720DN boards are not supported.

ISSUE App does not appear in Apps → GPIO.

FIX Confirm the file name is 5ghost_wifi_lab.fap and that it was copied to /ext/apps/GPIO/ on the microSD card. Reinsert the SD card or reboot the Flipper if needed.

ISSUE Board is not detected after installation.

FIX Power OFF the Flipper, remove the board, and reseat it on the top GPIO header without tilting the pins. Make sure the external antenna is tightened correctly before use. This board is designed for the PINGEQUA 5Ghost BW16 hardware only; other BW16 / RTL8720DN boards may not work correctly.

ISSUE Deauth does not work on some networks.

FIX This is usually not a hardware fault. PMF / 802.11w and WPA3-protected APs can ignore deauth by design. 5Ghost is designed to flag these protected targets instead of failing silently.

ISSUE Handshake capture is empty or inconsistent.

FIX Select a 5 GHz target AP when capturing WPA/WPA2 handshakes. On this platform, 5 GHz is the reliable capture path.

ISSUE Module firmware needs recovery or the board stops responding.

FIX Open https://flash.pingequa.com/devices/bw16-5ghost in Chrome or Edge on desktop, or Chrome on Android. Connect the board by USB-C and click Flash. If auto-entry fails, hold BOOT, tap RESET, release BOOT, and try again.

• Hardware: CC1101 Sub-GHz GPIO module with external high-gain antenna.
• Variants: Standard, and a High-Gain edition tuned for 433 MHz — nominal 20 dBm output (verified 18.6 dBm) for longer range. Setup is identical for both.
• Firmware: [CRITICAL] Unleashed (highly recommended) or other 3rd-party forks (Momentum / RogueMaster).
• Firmware link: https://flash.pingequa.com/devices/flipper-firmware
• Note: Official firmware does not support external CC1101 modules via GPIO by default. Update firmware before installing.

ISSUE "External Module Not Found" or no signal.

FIX Re-check the [Module] setting in Sub-GHz Radio Settings — it must be set to External. Ensure you are on Unleashed or compatible firmware. Check the physical connection; no bent or misaligned pins.

• Hardware: ESP32-S2 Wi-Fi dev board with an 18-pin gold GPIO header (Black or Green — identical board).
• Firmware (board): ships pre-flashed with ESP32-Marauder — no flashing needed out of the box.
• Firmware (Flipper): Official, Momentum or Unleashed — all include the WiFi Marauder companion app.
• Note: the board provides the Wi-Fi radio; the Flipper runs the companion app over GPIO UART. Flipper Zero host NOT included.

ISSUE Marauder app shows no response, or the board is not detected.

FIX Re-seat the board (no bent or misaligned pins). Confirm the board has power (LED on). Update the WiFi Marauder companion app from the Flipper app catalog so its UART protocol matches the board firmware.

• Hardware: Horizon 433 Pro — 433 MHz Sub-GHz GPIO module for Flipper Zero, built on the E07-433M20S RF module with PA/LNA control and a 4-layer impedance-matched PCB.
• Antenna: external SMA connector — use an antenna matched to the 433 MHz band.
• Output: up to 20 dBm (module rated), PA/LNA controlled, for longer range.
• Firmware: [CRITICAL] Momentum or Unleashed recommended for external CC1101 support.
• Firmware link: https://github.com/DarkFlippers/unleashed-firmware
• Note: Official firmware does not support external CC1101 modules via GPIO by default. Update firmware before installing.

ISSUE "External Module Not Found" / "CC1101 not found" or no signal.

FIX In Sub-GHz Radio Settings, confirm the radio is set to [External CC1101] and CC1101 SPI is [Default 4]. Use Momentum or Unleashed firmware. Reseat the module on the GPIO header and check for bent or misaligned pins.

ISSUE Weak or short range.

CAUSE Antenna not matched to 433 MHz, a loose SMA connection, or nearby interference.

FIX Make sure the SMA antenna is fully attached and rated for 433 MHz; move away from sources of interference.

ISSUE Unstable behavior when connecting.

FIX Always power the Flipper OFF before seating or removing the board.

• Functional specs: 2.4 GHz RF transceiver (GFSK). Sniffs and injects wireless HID packets (mice / keyboards).
• Core capabilities:
• Sniffing: capture hardware addresses of unencrypted 2.4 GHz wireless devices.
• Mousejacking: inject BadUSB payloads into vulnerable wireless receivers (e.g. Logitech Unifying).
• Scanning: 2.4 GHz spectrum interference analysis.
• Required firmware: [CRITICAL] Momentum or Unleashed. Official firmware lacks the SPI drivers and GPIO apps.
• App path: Applications → GPIO → [NRF24 Sniffer / MouseJacker].

ISSUE "NRF24 Module Not Found" error.

FIX Confirm you are on third-party firmware (Official FW will not work). Check for bent pins or debris in the GPIO headers. Ensure stable 3.3V power (Pin 9).

ISSUE Sniffer captures nothing.

CAUSE Most modern "Bluetooth" mice use BLE encryption that NRF24 cannot crack; this module is effective against older 2.4 GHz GFSK protocols (early Logitech, Microsoft, non-brand wireless mice). High-traffic Wi-Fi can also drown out the sniffer.

FIX Move closer to the target receiver.

• Hardware: GPS + GLONASS module for Flipper Zero, built on the Quectel L86-M33. Receive-only — no transmitter.
• [CRITICAL] Outdoor use only: GPS cannot receive satellites indoors. Use it outside in an open area with a clear view of the sky — away from windows, walls, and metal — or you will get no fix. This is normal for any GPS receiver.
• App: Install the GPS NMEA app from the Flipper app catalog.
• App link: https://lab.flipper.net/apps/gps_nmea
• Firmware: Official or Momentum (Momentum also has a built-in GPS feature).
• Note: Uses the Flipper default GPIO pins 13/14 — no wiring changes and no pin remapping.

ISSUE No fix / no location shown.

CAUSE You are almost certainly indoors, or your view of the sky is blocked.

FIX Go outside to an open area, away from windows, walls, and metal. Give it a clear view of the sky and wait a couple of minutes.

ISSUE No data at all in the GPS NMEA app.

FIX Long-press [Up] in the app to set the baud rate to 9600, and confirm the module is seated on the default pins 13/14.

ISSUE First fix is very slow.

CAUSE A cold start with no stored data always takes longer.

FIX Stay outdoors with open sky and keep the module still. Later restarts are much faster thanks to the supercapacitor.

ISSUE Lost the fast-restart benefit after long storage.

CAUSE The supercapacitor holds for hours, not days.

FIX Do a normal first fix outdoors; restarts will be quick again afterward.

• Compatibility: Flipper Zero (Momentum firmware recommended).
• Critical SPI config — Path: START → PROTOCOLS → GPIO PINS. Set [NRF24 SPI] to [Extra 7] (mandatory for this module).
• Notice: Smart Auto-Switching enabled — no physical toggle needed.

ISSUE NRF24 Scanner / Jammer not working.

CAUSE These apps use hardcoded pin definitions in their current version. This is a software limitation, not a hardware defect — we are working with developers on compatibility updates.

ISSUE CC1101 "External Module Not Found".

FIX Re-check Sub-GHz settings so [External] is active. Inspect GPIO pins for alignment issues or debris.

## What you need

• A **Flipper Zero** — [[Momentum|https://momentum-fw.dev]]" target="_blank" rel="noopener">[[Momentum|https://momentum-fw.dev]] firmware recommended (bundles the Marauder app and can remap the GPS UART to GPIO 15/16; stock firmware cannot)
• A **microSD card** (FAT32) — Wardrive logs are written here as WigleWifi CSV. Card not included.
• The Scout Lite board and its **dual-band SMA antenna** — screw it onto the SMA connector before powering on
• A **USB-C cable** if you plan to re-flash or update Marauder

## Good to know

• Scout Lite ships pre-flashed with **[[ESP32 Marauder|https://github.com/justcallmekoko/ESP32Marauder]]** — wardriving works out of the box
• The onboard **ESP32-C5-WROOM-1U** covers 2.4 and 5 GHz Wi-Fi 6; 5 GHz is scan / enumeration only
• The **Quectel L86-M33** GPS (GPS / GLONASS / Galileo) tags every logged network with a coordinate
• The board draws power from the Flipper's GPIO header; attach the antenna **before** powering on to protect the RF front-end

[ISSUE] The Flipper GPS app shows no fix

[CAUSE] GPS UART not mapped to GPIO 15/16, or a cold start with no clear sky view

[FIX] Map the pins: `MNTM` → `Protocols` → `GPIO Pins` → `NMEA GPS UART` → **Extra 15,16**; give the antenna a clear view of the sky — a cold start can take a minute

[ISSUE] No networks are logged

[CAUSE] No FAT32 microSD inserted, or you started plain Scan instead of Wardrive

[FIX] Insert a FAT32 card and select **Wardrive**; rows only get coordinates once the GPS has a fix

[ISSUE] Can I capture 5 GHz handshakes?

[CAUSE] 5 GHz on the ESP32-C5 is scan / enumeration only

[FIX] Scout Lite surfaces 5 GHz networks that 2.4 GHz-only boards miss; handshake capture itself is a 2.4 GHz activity

[ISSUE] Does it support BeiDou?

[CAUSE] The L86-M33 tracks GPS, GLONASS, and Galileo

[FIX] These give accurate positioning worldwide for WiGLE-grade fixes; BeiDou is not required

[ISSUE] Marauder app does not appear on the Flipper

[CAUSE] Board not fully seated, or firmware without the ESP32 GPIO app

[FIX] Reseat the board firmly; use Momentum or another build that includes `[ESP32] WiFi Marauder`

One module family, one setup. The Hydra RF 424 / 824 / 924 are the same board — only the CC1101 band tuning differs — so these steps apply to every model in the series.

• Models & bands: [424] 433 MHz · [824] 868 MHz (EU / Intl ISM) · [924] 915 MHz (US ISM).
• Compatibility: M5Stack Cardputer ADV version ONLY. Using on Cardputer v1.1 or older causes detection failure and possible firmware errors.
• Radios: CC1101 (Sub-GHz) + nRF24L01+ (2.4 GHz), with AutoBand smart switching — no physical toggle.
• Firmware: Bruce 1.14 (recommended). [NOTE] Avoid v1.15 — a known bug can reboot the Cardputer (e.g. during RF Scan); 1.14 is stable. Source: https://github.com/BruceDevices/firmware
• For one-click flashing: a desktop with Chrome or Edge + a USB-C data cable (Safari / Firefox not supported).
• Docs (pin reference, setup guide, troubleshooting): https://github.com/pingequalab/cardputer-adv-hydra-rf

ISSUE Module not found, or a config error, after flashing.

FIX Once the device reaches the Bruce main screen, click [Apply module config] on the flasher page to retry. If the SD card holds an old brucePins.conf, delete it or format the card. Last resort — set pins manually: https://github.com/pingequalab/cardputer-adv-hydra-rf

ISSUE No serial port shows in the flasher picker.

FIX Use a USB-C data cable (not charge-only) and try a different port. Flashing works only in Chrome / Edge (desktop) or Chrome (Android).

ISSUE Failed to connect, or wrong chip detected.

FIX Unplug and replug the device, then click Connect again. Close any app holding the port (Arduino IDE, serial monitor).

ISSUE RF / Sub-GHz menus show no radio.

FIX The Hydra RF module must be plugged into the Cardputer ADV — without it there is no RF hardware to drive.

ISSUE Cardputer reboots unexpectedly (e.g. during RF Scan).

CAUSE A Bruce v1.15 firmware bug — not a hardware fault.

FIX Re-flash the stable Bruce 1.14 from the one-click flasher.

ISSUE Reboot during Record Raw or high-power TX.

CAUSE The Cardputer shared SPI bus can congest under high-speed traffic — a hardware limitation, not a module defect.

FIX Remove the SD card during Record Raw, or connect external USB-C power for long sessions.

• Host device: M5Stack Stick S3.
• Firmware: [CRITICAL] Bruce v1.14 or later (Latest / Beta).
• Flasher: https://flash.pingequa.com/devices/sticks3-bruce
• Warning: DO NOT use v1.12 or v1.13 — only v1.14+ has the SPI & power patches required for hardware recognition. If the module is not detected, check the version first.

ISSUE "CC1101 Not Found" error.

CAUSE Typical firmware mismatch — older versions fail to power the module via SPI.

FIX Use Bruce v1.14 or a newer Beta.

ISSUE Module unresponsive or freezing.

FIX Check the Stick S3 physical power switch (side) is ON. Re-plug the module so pins are aligned and not bent. For stable RF transmission, keep battery above 30%.

• Host device: M5Stack Cardputer / M5StickC Plus 1.1 & 2.
• Firmware: [CRITICAL] latest Beta from https://flash.pingequa.com/devices/stickc-plus2-bruce
• Firmware alert: DO NOT use v1.13 / v1.14 Stable — these have SPI bus timing issues on M5StickC / Cardputer hardware. The Beta includes AXP2101 power-management patches for 100% recognition.
• In the box: RF board, microSD interface, Grove cable.

ISSUE "Module Not Found" error.

FIX Re-verify you are on the latest Beta firmware. Ensure the Grove cable is firmly seated and the physical switch is in the correct position.

ISSUE Limited NRF24 jammer range.

CAUSE Low-power hardware design and 2.4 GHz anti-interference naturally limit range — a design characteristic, not a defect.

FIX For advanced config see https://github.com/pr3y/Bruce/wiki