Module Setup & Field Guides

• Host Device: Flipper Zero
• Compatible Flipper Firmware: Official, Momentum, or Unleashed.
• Required App File: Download the latest 5ghost_wifi_lab.fap from GitHub Releases:

https://github.com/pingequalab/5ghost-wifi-lab

• Hardware Note: The PINGEQUA 5Ghost board ships preloaded. No wiring, soldering, or module flashing is required for first-time setup.
• Antenna Note: Tighten the external SMA antenna before use.
• SD Path: Copy the .fap file to /ext/apps/GPIO/ on your Flipper microSD card.
• Support Note: Built for the PINGEQUA 5Ghost BW16 board only. Other BW16 / RTL8720DN boards are not supported.

ISSUE App does not appear in Apps → GPIO.

FIX Confirm the file name is 5ghost_wifi_lab.fap and that it was copied to /ext/apps/GPIO/ on the microSD card. Reinsert the SD card or reboot the Flipper if needed.

ISSUE Board is not detected after installation.

FIX Power OFF the Flipper, remove the board, and reseat it on the top GPIO header without tilting the pins. Make sure the external antenna is tightened correctly before use. This board is designed for the PINGEQUA 5Ghost BW16 hardware only; other BW16 / RTL8720DN boards may not work correctly.

ISSUE Deauth does not work on some networks.

FIX This is usually not a hardware fault. PMF / 802.11w and WPA3-protected APs can ignore deauth by design. 5Ghost is designed to flag these protected targets instead of failing silently.

ISSUE Handshake capture is empty or inconsistent.

FIX Select a 5 GHz target AP when capturing WPA/WPA2 handshakes. On this platform, 5 GHz is the reliable capture path.

ISSUE Module firmware needs recovery or the board stops responding.

FIX Open https://flash.pingequa.com/devices/bw16-5ghost in Chrome or Edge on desktop, or Chrome on Android. Connect the board by USB-C and click Flash. If auto-entry fails, hold BOOT, tap RESET, release BOOT, and try again.

• Hardware: CC1101 Sub-GHz GPIO module with external high-gain antenna.
• Variants: Standard, and a High-Gain edition tuned for 433 MHz — nominal 20 dBm output (verified 18.6 dBm) for longer range. Setup is identical for both.
• Firmware: [CRITICAL] Unleashed (highly recommended) or other 3rd-party forks (Momentum / RogueMaster).
• Firmware link: https://flash.pingequa.com/devices/flipper-firmware
• Note: Official firmware does not support external CC1101 modules via GPIO by default. Update firmware before installing.

ISSUE "External Module Not Found" or no signal.

FIX Re-check the [Module] setting in Sub-GHz Radio Settings — it must be set to External. Ensure you are on Unleashed or compatible firmware. Check the physical connection; no bent or misaligned pins.

• Hardware: ESP32-S2 Wi-Fi dev board with an 18-pin gold GPIO header (Black or Green — identical board).
• Firmware (board): ships pre-flashed with ESP32-Marauder — no flashing needed out of the box.
• Firmware (Flipper): Official, Momentum or Unleashed — all include the WiFi Marauder companion app.
• Note: the board provides the Wi-Fi radio; the Flipper runs the companion app over GPIO UART. Flipper Zero host NOT included.

ISSUE Marauder app shows no response, or the board is not detected.

FIX Re-seat the board (no bent or misaligned pins). Confirm the board has power (LED on). Update the WiFi Marauder companion app from the Flipper app catalog so its UART protocol matches the board firmware.

• Hardware: Horizon 433 Pro — 433 MHz Sub-GHz GPIO module for Flipper Zero, built on the E07-433M20S RF module with PA/LNA control and a 4-layer impedance-matched PCB.
• Antenna: external SMA connector — use an antenna matched to the 433 MHz band.
• Output: up to 20 dBm (module rated), PA/LNA controlled, for longer range.
• Firmware: [CRITICAL] Momentum or Unleashed recommended for external CC1101 support.
• Firmware link: https://github.com/DarkFlippers/unleashed-firmware
• Note: Official firmware does not support external CC1101 modules via GPIO by default. Update firmware before installing.

ISSUE "External Module Not Found" / "CC1101 not found" or no signal.

FIX In Sub-GHz Radio Settings, confirm the radio is set to [External CC1101] and CC1101 SPI is [Default 4]. Use Momentum or Unleashed firmware. Reseat the module on the GPIO header and check for bent or misaligned pins.

ISSUE Weak or short range.

CAUSE Antenna not matched to 433 MHz, a loose SMA connection, or nearby interference.

FIX Make sure the SMA antenna is fully attached and rated for 433 MHz; move away from sources of interference.

ISSUE Unstable behavior when connecting.

FIX Always power the Flipper OFF before seating or removing the board.

• Functional specs: 2.4 GHz RF transceiver (GFSK). Sniffs and injects wireless HID packets (mice / keyboards).
• Core capabilities:
• Sniffing: capture hardware addresses of unencrypted 2.4 GHz wireless devices.
• Mousejacking: inject BadUSB payloads into vulnerable wireless receivers (e.g. Logitech Unifying).
• Scanning: 2.4 GHz spectrum interference analysis.
• Required firmware: [CRITICAL] Momentum or Unleashed. Official firmware lacks the SPI drivers and GPIO apps.
• App path: Applications → GPIO → [NRF24 Sniffer / MouseJacker].

ISSUE "NRF24 Module Not Found" error.

FIX Confirm you are on third-party firmware (Official FW will not work). Check for bent pins or debris in the GPIO headers. Ensure stable 3.3V power (Pin 9).

ISSUE Sniffer captures nothing.

CAUSE Most modern "Bluetooth" mice use BLE encryption that NRF24 cannot crack; this module is effective against older 2.4 GHz GFSK protocols (early Logitech, Microsoft, non-brand wireless mice). High-traffic Wi-Fi can also drown out the sniffer.

FIX Move closer to the target receiver.

• Hardware: GPS + GLONASS module for Flipper Zero, built on the Quectel L86-M33. Receive-only — no transmitter.
• [CRITICAL] Outdoor use only: GPS cannot receive satellites indoors. Use it outside in an open area with a clear view of the sky — away from windows, walls, and metal — or you will get no fix. This is normal for any GPS receiver.
• App: Install the GPS NMEA app from the Flipper app catalog.
• App link: https://lab.flipper.net/apps/gps_nmea
• Firmware: Official or Momentum (Momentum also has a built-in GPS feature).
• Note: Uses the Flipper default GPIO pins 13/14 — no wiring changes and no pin remapping.

ISSUE No fix / no location shown.

CAUSE You are almost certainly indoors, or your view of the sky is blocked.

FIX Go outside to an open area, away from windows, walls, and metal. Give it a clear view of the sky and wait a couple of minutes.

ISSUE No data at all in the GPS NMEA app.

FIX Long-press [Up] in the app to set the baud rate to 9600, and confirm the module is seated on the default pins 13/14.

ISSUE First fix is very slow.

CAUSE A cold start with no stored data always takes longer.

FIX Stay outdoors with open sky and keep the module still. Later restarts are much faster thanks to the supercapacitor.

ISSUE Lost the fast-restart benefit after long storage.

CAUSE The supercapacitor holds for hours, not days.

FIX Do a normal first fix outdoors; restarts will be quick again afterward.

• Compatibility: Flipper Zero (Momentum firmware recommended).
• Critical SPI config — Path: START → PROTOCOLS → GPIO PINS. Set [NRF24 SPI] to [Extra 7] (mandatory for this module).
• Notice: Smart Auto-Switching enabled — no physical toggle needed.

ISSUE NRF24 Scanner / Jammer not working.

CAUSE These apps use hardcoded pin definitions in their current version. This is a software limitation, not a hardware defect — we are working with developers on compatibility updates.

ISSUE CC1101 "External Module Not Found".

FIX Re-check Sub-GHz settings so [External] is active. Inspect GPIO pins for alignment issues or debris.

入手先

• SigRoam アプリを入れる: https://flash.pingequa.com/devices/flipper-sigroam
• アプリの説明とファイル: https://github.com/pingequalab/sigroam-wardriving
• 最新のアプリファイル: https://github.com/pingequalab/sigroam-wardriving/releases/latest
• ボードのファームウェアを更新: https://flash.pingequa.com/devices/scout-lite
• ボードのファームウェアファイル: https://github.com/pingequalab/ESP32Marauder/releases/tag/scout-lite-v1.0.0
• 短い手順: https://github.com/pingequalab/scout-lite
• 問い合わせ: support@pingequa.com または https://www.pingequa.com/pages/contact

必要なもの

• Flipper Zero。Official、Momentum、Unleashed、RogueMaster で SigRoam アプリを動かせます。インストーラが Flipper のファームウェアに合うファイルを選びます。
• Scout Lite ボード用の FAT32 microSD カード。ログはここに書かれ、Flipper のカードには書かれません。カードは付属しません。
• Scout Lite ボードと付属のデュアルバンド SMA アンテナ。電源を入れる前にアンテナをねじ込みます。
• アプリのインストールまたはボードの更新には USB-C データケーブル。充電専用ケーブルでは接続できません。

知っておくこと

• ボードには Scout Lite 専用カスタム Marauder が最初から入っています。使い始めるために書き込む必要はありません。
• SigRoam は調査画面です。Marauder アプリは汎用メニューです。どちらも Flipper のアプリです。アプリを切り替えてもボードを再書き込みしません。
• SigRoam は Flipper に入れます。アプリを ESP32 に書き込まないでください。
• 無線は 1 系統で、2.4 GHz と 5 GHz を扱います。5 GHz はスキャンと列挙です。
• GPS はボード上の Quectel L86-M33（GPS、GLONASS、Galileo）です。測位には上空が開けた場所が必要です。
• Flipper はピン 1 でボードに給電し、ピン 13 と 14 で通信します。ピン 9（3.3 V）から給電しないでください。
• Wardrive はチャネルを切り替えながら送信します。

ISSUE アプリが開かない、またはシリアルポートが使用中

CAUSE Flipper の Settings → System → Log Device がピン 13 と 14 を使っています。qFlipper や Flipper のスマホアプリも USB ポートを掴んでいることがあります。

FIX Log Device を Off にしてから、アプリを開き直します。ブラウザでインストールする前に qFlipper とスマホアプリを閉じます。

ISSUE カードに何も書かれない

CAUSE カードが無い、FAT32 ではない、または Flipper に挿してあって Scout Lite にない。屋内では調査が始まらないことがあります。

FIX FAT32 カードを Scout Lite のスロットに入れます。屋外で GPS の fix を待ってから、Wardrive を開始するか Dash で OK を押します。

ISSUE アプリを ESP32 に書き込みますか？

CAUSE アプリとボードのファームウェアは別です

FIX アプリは https://flash.pingequa.com/devices/flipper-sigroam から Flipper に入れます。ボードの更新は https://flash.pingequa.com/devices/scout-lite だけから行います。アプリのファイルを Scout Lite に書き込まないでください。

ISSUE ブラウザがボードを認識しない

CAUSE Safari、スマホのブラウザ、充電専用ケーブル、またはボードがダウンロードモードではない

FIX Chrome、Edge、またはデスクトップ版 Firefox と、USB-C データケーブルを使います。BOOT を押したまま挿し、BOOT を離してから Connect。手順: https://flash.pingequa.com/devices/scout-lite

ISSUE ボードが以前、別のスキャナーファームウェアを動かしていた

CAUSE そのイメージは配置が違います

FIX https://flash.pingequa.com/devices/scout-lite で Erase entire flash をオンにしてから、Scout Lite のファームウェアを書き込みます。

ISSUE 5 GHz のハンドシェイクは取得できますか？

CAUSE このボードの 5 GHz はスキャンと列挙です

FIX 調査は 5 GHz のネットワークを一覧します。ハンドシェイク取得は 2.4 GHz の動作です。

ISSUE メニューに Marauder アプリが無い

CAUSE ボードが奥まで挿さっていないか、その Flipper ファームウェアに WiFi Marauder アプリがありません

FIX ボードを挿し直します。Flipper のアプリカタログから WiFi Marauder を入れるか、https://github.com/pingequalab/sigroam-wardriving から SigRoam を入れます

ISSUE メニューに SigRoam が 2 つある

CAUSE 古いアプリファイルが apps/GPIO に残っています

FIX 古いファイルを消します。インストーラは SD Card/apps/GPIO/ にアプリを 1 つ書きます

ISSUE Flipper の GPS アプリが fix を出さない

CAUSE Wardriving が使うのは Scout Lite 上の GPS で、Flipper の GPS アプリではありません

FIX ボードに上空が開けた場所を与えます。NMEA は GPIO 15 と 16 にも出ます。そのピン割り当ては任意で、座標をログするのに必須ではありません。

ISSUE BeiDou を使いますか？

CAUSE L86-M33 が使うのは GPS、GLONASS、Galileo です

FIX WiGLE の fix にはこれで足ります。BeiDou は使いません。

ISSUE Ignore list がネットワークを除外しなかった、または Split size が戻った

CAUSE Ignore list は SD ログのその名前だけを飛ばします。Split size は再起動まで保持されます。

FIX そのネットワークは電波上に残っています。再起動後、Split size は 1024 KB に戻ります。

ISSUE まだ解決しない

CAUSE 上の手順では直らなかった

FIX support@pingequa.com に、注文番号、Flipper のファームウェア名、開いたアプリを書いて送ってください。WiGLE トークンは送らないでください。連絡先: https://www.pingequa.com/pages/contact

One module family, one setup. The Hydra RF 424 / 824 / 924 are the same board — only the CC1101 band tuning differs — so these steps apply to every model in the series.

• Models & bands: [424] 433 MHz · [824] 868 MHz (EU / Intl ISM) · [924] 915 MHz (US ISM).
• Compatibility: M5Stack Cardputer ADV version ONLY. Using on Cardputer v1.1 or older causes detection failure and possible firmware errors.
• Radios: CC1101 (Sub-GHz) + nRF24L01+ (2.4 GHz), with AutoBand smart switching — no physical toggle.
• Firmware: Bruce 1.14 (recommended). [NOTE] Avoid v1.15 — a known bug can reboot the Cardputer (e.g. during RF Scan); 1.14 is stable. Source: https://github.com/BruceDevices/firmware
• For one-click flashing: a desktop with Chrome or Edge + a USB-C data cable (Safari / Firefox not supported).
• Docs (pin reference, setup guide, troubleshooting): https://github.com/pingequalab/cardputer-adv-hydra-rf

ISSUE Module not found, or a config error, after flashing.

FIX Once the device reaches the Bruce main screen, click [Apply module config] on the flasher page to retry. If the SD card holds an old brucePins.conf, delete it or format the card. Last resort — set pins manually: https://github.com/pingequalab/cardputer-adv-hydra-rf

ISSUE No serial port shows in the flasher picker.

FIX Use a USB-C data cable (not charge-only) and try a different port. Flashing works only in Chrome / Edge (desktop) or Chrome (Android).

ISSUE Failed to connect, or wrong chip detected.

FIX Unplug and replug the device, then click Connect again. Close any app holding the port (Arduino IDE, serial monitor).

ISSUE RF / Sub-GHz menus show no radio.

FIX The Hydra RF module must be plugged into the Cardputer ADV — without it there is no RF hardware to drive.

ISSUE Cardputer reboots unexpectedly (e.g. during RF Scan).

CAUSE A Bruce v1.15 firmware bug — not a hardware fault.

FIX Re-flash the stable Bruce 1.14 from the one-click flasher.

ISSUE Reboot during Record Raw or high-power TX.

CAUSE The Cardputer shared SPI bus can congest under high-speed traffic — a hardware limitation, not a module defect.

FIX Remove the SD card during Record Raw, or connect external USB-C power for long sessions.

• Host device: M5Stack Stick S3.
• Firmware: [CRITICAL] Bruce v1.14 or later (Latest / Beta).
• Flasher: https://flash.pingequa.com/devices/sticks3-bruce
• Warning: DO NOT use v1.12 or v1.13 — only v1.14+ has the SPI & power patches required for hardware recognition. If the module is not detected, check the version first.

ISSUE "CC1101 Not Found" error.

CAUSE Typical firmware mismatch — older versions fail to power the module via SPI.

FIX Use Bruce v1.14 or a newer Beta.

ISSUE Module unresponsive or freezing.

FIX Check the Stick S3 physical power switch (side) is ON. Re-plug the module so pins are aligned and not bent. For stable RF transmission, keep battery above 30%.

• Host device: M5Stack Cardputer / M5StickC Plus 1.1 & 2.
• Firmware: [CRITICAL] latest Beta from https://flash.pingequa.com/devices/stickc-plus2-bruce
• Firmware alert: DO NOT use v1.13 / v1.14 Stable — these have SPI bus timing issues on M5StickC / Cardputer hardware. The Beta includes AXP2101 power-management patches for 100% recognition.
• In the box: RF board, microSD interface, Grove cable.

ISSUE "Module Not Found" error.

FIX Re-verify you are on the latest Beta firmware. Ensure the Grove cable is firmly seated and the physical switch is in the correct position.

ISSUE Limited NRF24 jammer range.

CAUSE Low-power hardware design and 2.4 GHz anti-interference naturally limit range — a design characteristic, not a defect.

FIX For advanced config see https://github.com/pr3y/Bruce/wiki