What Is Subdriving on the Flipper Zero? Sub-GHz Wardriving Explained (2026)

PINGEQUA Lab · Flipper Sub-GHz · 7 min read · Updated 2026-08-03

Subdriving only touches the Flipper's own Sub-GHz radio — it never sees Wi-Fi, so GPS-tagged Wi-Fi wardriving still needs a separate 2.4/5 GHz radio running alongside it.

Quick answer Subdriving is Sub-GHz wardriving — logging Sub-GHz signals with GPS coordinates — a long-standing feature of the Flipper Zero's Unleashed firmware and its Xtreme/RogueMaster forks, not a Wi-Fi tool. It complements Wi-Fi wardriving, which still needs a 2.4/5 GHz radio such as a standalone ESP32-C5 unit like PINGEQUA's Scout Lite ($64.98, onboard L86 GPS, pre-flashed Marauder).

What Subdriving is (Sub-GHz + GPS logging) and which firmware has it

Subdriving is a Flipper Zero firmware feature that pairs a GPS module with the Flipper's onboard CC1101 Sub-GHz radio: as you scan or capture Sub-GHz signals — garage/gate remotes, TPMS sensors, weather stations, RF doorbells, alarm fobs — each capture gets tagged with the GPS fix at that moment, building a location-tagged log of where Sub-GHz signals were seen. It is a long-standing feature of Unleashed firmware (DarkFlippers) and has carried into its sibling forks, Xtreme and RogueMaster, both of which share large parts of Unleashed's codebase. (9meters.com, Unleashed Firmware Explained & Links; awesome-flipper.com, Unleashed firmware; Hackster.io on Rabbit-Labs TinyGPS for "Subdriving")

We could not pin down the exact build or date Subdriving was first added to Unleashed, because it predates the current release cycle and isn't flagged as "new" in any recent changelog we checked (we searched unlshd-060 through unlshd-090 directly and found no mention). What we can verify from the official release notes: unlshd-090 (2026-07-30) did not add Subdriving. Its actual GPS-related change was "Add Network and GPS RPC services" (PR #1013) — a plumbing feature for RPC/companion-app access to network and GPS data, unrelated to Subdriving itself. (DarkFlippers/unleashed-firmware, unlshd-090 release notes)

Subdriving vs Wi-Fi wardriving — different radio, different data

"Wardriving" originally means Wi-Fi: driving around with a Wi-Fi radio and GPS, logging access points to a map (classically uploaded to WiGLE). Subdriving swaps the radio, not the concept — same scan-plus-GPS-tag idea, but over Sub-GHz instead of 2.4/5 GHz Wi-Fi.

That radio swap changes everything downstream:

  • Different receiver. Wi-Fi wardriving needs a 2.4/5 GHz radio — the Flipper Zero has none built in, so it's done with an external ESP32 board running Marauder. Subdriving uses the Flipper's own onboard CC1101 Sub-GHz radio; no extra Wi-Fi hardware is involved, just GPS.
  • Different targets. Wi-Fi wardriving finds APs and clients. Subdriving finds Sub-GHz devices — garage/gate remotes, TPMS sensors, weather stations, RF doorbells, alarm sensors — whatever is transmitting on Sub-GHz nearby.
  • Different data pipeline. Wi-Fi wardriving logs are WiGLE-shaped (BSSID, SSID, GPS, signal strength), and the tooling increasingly uploads them directly — recent ESP32 Marauder builds (v1.14.0, 2026-07-22 and v1.14.1, 2026-08-01) added direct upload to WDGWars and WiGLE. (ESP32Marauder v1.14.0 release notes; v1.14.1 release notes) Subdriving's Sub-GHz logs are a different shape entirely and are not part of that WiGLE pipeline — see the section below.

Bottom line: Subdriving and Wi-Fi wardriving are parallel activities that happen to share the word "wardriving" and the GPS half of the setup. Doing one doesn't give you the other.

Hardware Subdriving needs

To run Subdriving you need:

  1. A Flipper Zero on Unleashed (or Xtreme/RogueMaster) firmware — Subdriving is a firmware feature, not a separate app to download.
  2. A GPS module wired to the Flipper's GPIO header over UART. Several small GPS boards exist for the Flipper. Wiring and pin assignment are a common trip-up: if your GPS shows connected but Subdriving isn't getting a usable fix, walk through our dedicated wiring guide rather than guessing at pinouts — GPS Wardriving on Flipper Zero — GPIO 15/16 UART Fix.
  3. An actual GPS fix before you start logging. Subdriving only tags a capture with location once the GPS module has locked on to enough satellites. If your GPS shows "detected" but never gets a fix, that's a separate, common problem — see Flipper Zero GPS Detected But No Fix.

No Wi-Fi hardware, no ESP32, no extra radio — Subdriving only needs the Flipper's own Sub-GHz radio plus GPS.

What Subdriving does NOT do

Subdriving is a Sub-GHz feature only. It does not:

  • Scan or log Wi-Fi networks
  • Do anything at 2.4 GHz or 5 GHz
  • Replace an ESP32 Devboard/Marauder setup

The Flipper Zero has no built-in Wi-Fi radio at all, whether or not Subdriving is running. If you also want Wi-Fi wardriving (or Wi-Fi scanning, packet capture, Evil Portal), you still need a separate 2.4/5 GHz radio. In the PINGEQUA lineup that means:

  • Wi-Fi Devboard (ESP32-S2, $29.99) — 2.4 GHz only, no onboard GPS; built for scanning/capture/Evil Portal, not wardriving on its own.
  • 5Ghost (BW16, $39.99+) — dual-band 2.4/5 GHz, no onboard GPS.
  • Scout Lite (ESP32-C5, $64.98) — dual-band 2.4/5 GHz with onboard L86 GPS, pre-flashed with ESP32 Marauder — the only board in the lineup built to do GPS-tagged Wi-Fi wardriving out of the box.

None of these touch Sub-GHz — that stays the Flipper's job, with Subdriving as the way to GPS-tag it. To be clear, wardriving itself is passive scanning plus GPS logging — it doesn't require deauth or other active attacks, so none of this changes our existing caution about 5 GHz attack support still being immature on ESP32-C5 boards. Scanning and wardriving on C5 hardware (like Scout Lite) is a different, more mature use case than deauth.

Need the Wi-Fi half of the picture?

Scout Lite is the one PINGEQUA board with onboard GPS — ESP32-C5 dual-band Wi-Fi 6 + onboard L86 GPS, pre-flashed with ESP32 Marauder, ready to log to WiGLE out of the box. $64.98.

Scout Lite for Flipper Zero →

Running both: Flipper Subdriving (Sub-GHz) + a C5 unit (Wi-Fi) side by side

Because Subdriving and Wi-Fi wardriving use completely separate radios, you can run them at the same time without conflict:

  • The Flipper Zero runs Subdriving off its own external GPS module, logging Sub-GHz captures with location.
  • A Scout Lite (or any GPS-equipped ESP32-C5/Wi-Fi board) runs Marauder off its own onboard L86 GPS, logging Wi-Fi APs/clients with location.

Each device keeps its own GPS fix and its own log — there's no shared app or merged output between Subdriving and Marauder. In practice, one drive can produce two separate datasets: a Sub-GHz log from the Flipper and a Wi-Fi log from the Scout Lite, covering both halves of the RF picture you'd otherwise need two separate trips (or two separate tools) to capture.

Where does Subdriving data go — does WiGLE take it?

Be careful here: WiGLE is a Wi-Fi/cellular/Bluetooth database — it is not built to ingest Sub-GHz data, and nothing in Subdriving's design or in the recent Marauder/WiGLE integration changes that. The direct-upload pipeline added in ESP32 Marauder v1.14.0 (2026-07-22) and refined in v1.14.1 (2026-08-01) — sending logs straight to WDGWars and WiGLE — is a Wi-Fi-side feature of Marauder running on an ESP32 board, not a Flipper/Subdriving feature. (ESP32Marauder v1.14.0, v1.14.1)

Exactly where Subdriving's own Sub-GHz + GPS logs are saved (file format, whether they're exportable to any mapping tool) is a detail we have not independently verified. If your goal is a WiGLE map, that's a Wi-Fi job, done with GPS-tagged Marauder logs (e.g., from a Scout Lite), not Subdriving.

FAQ

What is Subdriving on the Flipper Zero?
Subdriving is Sub-GHz wardriving: a Flipper Zero firmware feature that tags Sub-GHz signal captures (garage remotes, TPMS, weather stations, RF fobs) with GPS coordinates as you scan, building a location-tagged log of Sub-GHz activity. It uses the Flipper's built-in CC1101 radio plus an external GPS module — no Wi-Fi hardware involved.
Which firmware has Subdriving?
Subdriving is a long-standing feature of Unleashed firmware (DarkFlippers) and is also present in its sibling forks, Xtreme and RogueMaster, which share much of Unleashed's codebase. It is not new to any specific recent build — the exact build where it was first introduced is unverified. It is not present on stock/official Flipper firmware.
Is Subdriving the same as wardriving?
It's a Sub-GHz variant of the same idea. Classic "wardriving" means Wi-Fi: scanning APs/clients with GPS. Subdriving applies the scan-plus-GPS-tag concept to Sub-GHz signals instead — different radio, different data, same underlying pattern.
Does Subdriving need a GPS module?
Yes. Subdriving only tags a Sub-GHz capture with location once a GPS module wired to the Flipper's GPIO header has a fix. Without GPS connected and locked on, you get Sub-GHz captures with no location data attached.
Can the Flipper Zero do Wi-Fi wardriving too?
Not on its own. The Flipper Zero has no built-in Wi-Fi radio, so Wi-Fi wardriving requires an external 2.4/5 GHz board (an ESP32 Devboard or C5-based board) running Marauder, plus a GPS source. Subdriving does not add Wi-Fi capability — it only covers Sub-GHz.
Subdriving vs Wi-Fi wardriving — which should I use?
They're not competing — they cover different signals. Use Subdriving (Flipper + GPS) to map Sub-GHz devices like remotes and sensors. Use Wi-Fi wardriving (an external 2.4/5 GHz board with GPS, such as Scout Lite) to map Wi-Fi networks. Many users run both side by side to cover the full RF picture on one trip.

Related reading: If your GPS won't lock, start with our GPIO 15/16 UART wiring fix or the GPS detected but no fix troubleshooter, and for the Wi-Fi half of wardriving see our 2026 GPS + WiGLE guide and the ESP32-C5 single-chip dual-band explainer. Still picking a firmware fork? Check our Unleashed vs Momentum comparison.

Sources & further reading: 9meters.com — Unleashed Firmware Explained & Links · awesome-flipper.com — Unleashed firmware · Hackster.io — Rabbit-Labs TinyGPS for Subdriving · DarkFlippers/unleashed-firmware — unlshd-090 release notes · ESP32Marauder — v1.14.0 release notes · ESP32Marauder — v1.14.1 release notes

For authorized security testing and education only. Test only devices and networks you own or have explicit written permission to test. You are responsible for compliance with local law and radio regulations. "Flipper Zero", "ESP32 Marauder", "Apex 5" and other names are referenced for compatibility; PINGEQUA is independent and not affiliated with or endorsed by their owners.

Retour au blog