FlipperZero 5G Expansion Board — Official Manual

Section 01

Product Overview

The OpenSourceSDRLab FlipperZero 5G Expansion Board (also known as the ESP32 Marauder Module) is a compact wireless security research tool that connects to your Flipper Zero's GPIO port — giving it four new research capabilities.

📶

WiFi 2.4 GHz + 5 GHz

Dual-band scan, monitor, and test WiFi networks using the ESP32C5 chip. Supports 802.11 b/g/n/ax.

🔵

Bluetooth BLE

Scan Bluetooth devices, detect card skimmers, run BLE testing across Apple, Samsung, and Windows devices.

🛰️

GPS Module

Record real-time location + network data for wardrive mapping. Hot-swappable active antenna.

📻

433M RF Module

Sub-GHz signal research via Flipper Zero's Sub-GHz menu. A07 RF module, 10 dBm output.

Think of it as a portable multi-band wireless research tool that fits in your pocket. All data is logged to a microSD card for later review.

Section 02

What's in the Box

✓
ESP32C5 Marauder Module
Assembled, with 3D-printed shell & 2.8” screen
✓
WiFi Antenna
Dual-frequency 2.4G+5G · 11 cm · 3 dBi · SMA
✓
GPS Antenna
Circular active · 20 dBi · SMA connector
✓
433M RF Antenna
Short stub · 3 dBi · SMA connector
✗
Flipper Zero
Not included — purchase separately
✗
microSD Card
Not included — FAT32, max 32 GB

Section 03

Hardware Diagram

Front View

Back View — Port Label Reference (from product photo)

Hardware overview redrawn from actual product photographs · OCR-analyzed via Qwen2.5-VL-72B

📷 Diagram based on actual product photos. 4 SMA ports confirmed: 433M A (top-left) · GPS (top-right) · 2.4G (left wing) · 2.4G/5G (right wing). Labels are printed on the back shell of the device.

Key Hardware Notes

4 SMA Antenna Ports (confirmed from product photos)

Port Label	Position	Antenna / Function
433M A	Top edge, left	433 MHz RF (A07 module) · 3 dBi
GPS	Top edge, right	Active GPS antenna · 20 dBi · ceramic face UP
2.4G	Left wing, lower	WiFi 2.4 GHz only
2.4G/5G	Right wing, lower	WiFi dual-band 2.4 GHz + 5 GHz

Gold-Plated Pins & TVS Protection

All signal pins are gold-plated. Each pin has a built-in TVS (Transient Voltage Suppressor) for surge protection when connecting to Flipper Zero.

GPS Antenna Orientation

🛰️

The GPS antenna is directional despite the manufacturer label saying omnidirectional. The ceramic patch face MUST point toward the sky to get a GPS fix.

4× LED Battery Level

LEDs	Battery Level
🟢🟢🟢🟢	~100%
🟢🟢🟢⚫	~75%
🟢🟢⚫⚫	~50%
🟢⚫⚫⚫	~25%

Section 04

Specifications

Parameter	Value
Dimensions	90 mm × 58 mm × 15 mm (excluding antennas)
Shell Material	3D-printed plastic
Available Colors	Black / White / Transparent / Red / Blue
Chipset	ESP32C5
WiFi	2.4 GHz + 5 GHz dual-band (802.11 b/g/n/ax)
WiFi Ports	2 separate SMA ports: "2.4G" (left wing) + "2.4G/5G" dual-band (right wing)
Bluetooth	BLE + Bluetooth Classic
GPS	Active GPS module · auto power-switching · cold-start
GPS Antenna	Circular · 20 dBi active · SMA connector
433M RF	A07 module · 10 dBm output
433M Antenna	Short stub · 3 dBi · SMA connector
Screen	2.8” display · built-in Marauder UI · on/off switch
Pin Protection	Gold-plated + TVS on each signal pin
Battery	800 mAh Li-Po · hot-swappable via connector
Charge Time	~2 hours
Input Voltage	5V / 2A (USB-C)
Output to Flipper	5V / 2.4A
SD Card	microSD · FAT32 format · max 32 GB
Charging Port	USB-C (top front)
Flash Port	USB-C (front left — firmware flashing only)
Firmware	ESP32 Marauder 5G (open source)

Section 05

Getting Started

1

Prepare Your microSD Card

The module uses the SD card to store all captured data. Before first use:

Use a microSD card 32 GB or smaller
Format it as FAT32 (not exFAT, not NTFS)
Insert it into the slot on the right side of the module

💡

Mac: Disk Utility → Select SD card → Erase → Format: MS-DOS (FAT32)
Windows: Right-click SD card in Explorer → Format → FAT32

2

Attach the Antennas

The module has three SMA screw-type antenna ports. Connect them as follows:

🔵 Round/circular antenna (GPS, 20 dBi) → GPS port
📶 Blade antenna (WiFi dual-band, 11 cm) → WiFi port
📻 Short stub antenna (433M RF, 3 dBi) → RF port

ℹ️

The WiFi antenna covers both 2.4 GHz and 5 GHz — no need to swap or distinguish antennas by band.

3

Connect to Flipper Zero

Power OFF your Flipper Zero first
Align the GPIO connector on the module with the top GPIO port of the Flipper Zero
Press gently until it sits flush and is firmly seated
Power ON your Flipper Zero

4

Configure GPIO Pins on Flipper Zero

Before using each feature, set the correct GPIO pins in the Flipper Zero settings:

For GPS:

Momentum → Protocol Settings → GPIO Pin Settings → GPS Pin
Set to: Pin 13 or Pin 14
Then: APP → GPIO → [NAME] GPS

For ESP32C5 (WiFi / BT / Marauder):

Momentum → Protocol Settings → GPIO Pin Settings → ESP32 Pin
Set to: Pin 15, 16
Then: APP → GPIO → ESP → [ESP32] WiFi Marauder

For 433M RF:

Flipper Zero → Sub-GHz menu → Advanced Settings
Change module to: External

For the 2.8” Screen:

Turn the switch on the front left of the device to the UP position.

5

Charge the Battery

Connect a USB-C cable to the module's charging port (top front — NOT the flash port). The 4 LEDs will indicate charge level. Full charge takes approximately 2 hours.

⚠️

Use the top USB-C port for charging. The left USB-C port is only for firmware flashing.

Section 06

Menu Guide — WiFi

🛡️

Sniffer tools passively listen — they do not send any signals. Safe for monitoring.

Menu Item	What it does	Tip
Probe Request Sniff	Shows nearby devices broadcasting their preferred networks	See what devices are around
Beacon Sniff	Live list of all nearby WiFi signals	Like "Available Networks" but detailed
Deauth Sniff	Detects WiFi disconnect attacks in your area	Check if someone is attacking networks nearby
EAPOL/PMKID Scan	Captures authentication handshakes	Must scan & select a WiFi first
Packet Monitor	Real-time graph of 3 types of WiFi traffic	Shows Beacons, Deauths, Probes
Scan AP	Scan for WiFi networks	Do this first before any operation
Raw Capture	Shows RSSI signal strength of nearby MAC addresses	Technical use
Stations Sniff	Shows which device is connected to which WiFi	Useful for network mapping
Signal Monitor	Monitors signal changes (updates every 5 RSSI units)	Must select a WiFi first
Wardrive	GPS-tagged WiFi logging → saved to SD card as CSV	Requires GPS fix + SD card
Stations Wardrive	GPS-tagged device logging → saved to SD card	Requires GPS fix + SD card

💾

All captures are saved as .pcap files on your SD card. Open them with Wireshark.

⚠️

Authorized Use Only — These tools should ONLY be used on networks you own or have explicit written permission to test. Unauthorized use is illegal.

Menu Item	What it does
Beacon Spam List	Broadcasts fake WiFi network names from a saved list
Beacon Spam Random	Broadcasts random fake WiFi network names
Rick Roll Beacon	Broadcasts a famous internet joke as a fake WiFi name
Probe Req Flood	Sends mass probe requests
Evil Portal	Creates a fake WiFi login page (requires SD card setup)
Deauth Flood	Disconnects devices from a selected WiFi — requires selecting target first
AP Clone Spam	Clones all WiFi names from your scanned AP list
Deauth Targeted	Targeted disconnect test on a specific device

Menu Item	What it does
Generate SSIDs	Auto-generate WiFi network name lists
Save/Load File	Save your SSID list or load from SD card
Add SSIDs	Manually add a network name
Clear SSIDs	Wipe the SSID list
Clear APs	Clear the scanned networks list
Select APs	Choose a WiFi target from the scanned list
Select Stations	Choose a connected device from the scanned list
Select EP HTML File	Choose which HTML file to use for Evil Portal

Section 07

Menu Guide — Bluetooth

Menu Item	What it does
Bluetooth Sniffer	Scans nearby Bluetooth devices and shows signal strength (RSSI)
BT Wardrive	GPS-logs all detected Bluetooth devices to SD card
Detect Card Skimmers	Looks for Bluetooth-controlled credit card skimmer devices

⚠️

Authorized Testing Only — These tools are for security research on devices you own.

Menu Item	Target	What it does
Sour Apple	🍎 Apple iOS	Triggers popup notification spam on iPhones/iPads
Swiftpair Spam	💻 Windows PCs	Triggers Bluetooth pairing popup spam on Windows
Samsung BLE SPAM	📱 Samsung	Triggers popup spam on Samsung Galaxy devices
BLE Spam ALL	All above	Runs all three spam attacks simultaneously

Section 08

Menu Guide — Device & Settings

Menu Item	What it does
Update Firmware	Flash new firmware from SD card — select V6 version
Language	Interface language (English only currently)
Device Info	Shows hardware details, firmware version, MAC address
Settings	Toggle LED lights on/off · enable/disable PCAP saving
GPS Data	Live GPS display: latitude, longitude, altitude, UTC time
NMEA Stream	Raw GPS sentence output (technical use)

🕐

Time Zone Note: GPS time is reported in UTC+0. If you're in China (CST), add +8 hours to get local time.

Section 09

Common Workflows

🔍

Workflow A — Scan & Monitor WiFi Networks

Beginner

Go to WiFi → Sniffers → Scan AP
Wait 5–10 seconds for networks to appear
Press back to stop scanning
Go to WiFi → Sniffers → Beacon Sniff to see live traffic

✅

This workflow is passive — no signals are sent. Safe for learning and monitoring.

⚡

Workflow B — Deauth Flood Test

Intermediate

⚠️

Own Networks Only! Only use this on networks you own or have explicit permission to test.

Go to WiFi → Sniffers → Scan AP — wait for your network to appear
Go to WiFi → General → Select APs — select your target network
Go to WiFi → Attacks → Deauth Flood — it will start automatically

🎣

Workflow C — Evil Portal Setup

Advanced

⚠️

Authorized Penetration Testing Only. See official tutorial: Evil Portal Workflow

Create index.html (your fake login page) and save to SD card root
Create ap.config.txt in the SD card root directory
Go to WiFi → Sniffers → Scan AP, then General → Select APs
Go to WiFi → General → Select EP HTML File → select your index.html
Go to WiFi → Attacks → Evil Portal → start the portal

🗺️

Workflow D — GPS Wardrive (Network Logging)

Intermediate

📋

Requirements: GPS fix achieved + microSD card inserted

Take the device outside (GPS needs clear sky view)
Point the GPS antenna ceramic face upward toward the sky
Wait for GPS fix — cold start can take 5–15 minutes
Verify fix: Device → GPS Data (should show valid coordinates)
Go to WiFi → Sniffers → Wardrive — auto-logs networks with GPS coordinates
Data is saved as wardrive_*.csv files on SD card

🔓

Workflow E — EAPOL/PMKID Handshake Capture

Advanced

⚠️

Authorized Testing Only. Only capture handshakes on your own networks.

Go to WiFi → Sniffers → Scan AP
Go to WiFi → General → Select APs → choose the target
Go to WiFi → Sniffers → EAPOL/PMKID Scan
Select channel CH1–CH13 as needed
Wait — handshake packets are saved as .pcap on SD card

Section 10

FAQ & Troubleshooting

Make sure the ceramic face of the GPS antenna is pointing UP toward the sky
Go outside — GPS doesn't work reliably indoors
Cold start takes time: the device downloads satellite almanac data (~5–15 min first time)
Make sure you have the correct (round/circular) antenna connected to the GPS port

Check that the GPIO connector is fully seated — press firmly until flush
Restart your Flipper Zero
Make sure the module battery is charged or connected to USB-C
Verify GPIO pin settings in Momentum firmware (see Getting Started, Step 4)

Check format: must be FAT32 (not exFAT or NTFS)
Check capacity: must be 32 GB or less
Try reformatting from your computer
Make sure the card is fully inserted into the slot

Go to Device → Settings and make sure PCAP saving is enabled
Check SD card is inserted properly and recognized
Try a different SD card

GPS must be active and have a valid fix first
Confirm GPS is working via Device → GPS Data (should show valid coordinates, not 0.000)
Make sure SD card is inserted

Use the V6 firmware from the official releases page:
→ github.com/justcallmekoko/ESP32Marauder/releases

Round/circular antenna = GPS
Blade/flat antenna = WiFi
Pre-2024-09-30 units: WiFi Right, GPS Left
Post-2024-09-30 units: GPS Right, WiFi Left — check the label on your device

Section 11

Firmware Update

V6 Recommended Always use ESP32 Marauder V6 for this hardware

Update via SD Card

1

Download Firmware

Download the latest V6 firmware from the official releases page:

↗ ESP32 Marauder Releases

2

Copy to SD Card

Copy the .bin firmware file to the root directory of your FAT32 microSD card.

3

Flash the Firmware

Insert SD card into the module
Go to Device → Update Firmware
Select the firmware file from the list
Wait for the process to complete — do not disconnect power
Device will restart automatically

🚫

Do not interrupt the update process. Disconnecting power during firmware flashing may brick the device. Always use V6 firmware for this hardware revision.

Section 12