Porting Flipper BLE Spam to OFW + Boosting Range with an ESP32

ble-spam-esp32-boost is an external app (.fap) for the Flipper Zero that broadcasts BLE advertising packets to trigger pairing dialogs, notifications, and device-discovery prompts on nearby phones and computers. It started when I flashed my Flipper back to the official firmware OFW 1.4.3: the Momentum BLE Spam relied on a pile of Momentum-only APIs and was completely dead under the official firmware, so I ported Momentum BLE Spam v6.6 over and, while I was at it, added an ESP32 boost to extend broadcast range.

It ships with 11 attacks: Apple Continuity, Google FastPair, Samsung EasySetup, Microsoft SwiftPair, plus NameFlood and LoveSpouse. It runs on the Flipper alone, using the BLE radio on the onboard STM32WB, with a range of one to three meters.

ESP32 dual-radio

The onboard power is low, so signal drops off once you get a little farther away. That’s why I built an optional boost: hook up an ESP32 flashed with Ghost ESP firmware over GPIO UART, fire both radios at once, and range stretches to fifteen or twenty meters. Wiring isn’t complicated: connect the Flipper’s TX (pin 13), RX (pin 14), GND, and 3V3 across to the ESP32, at 115200 baud.

Detection is automatic. On startup the app grabs the USART channel, sends an info probe, and if it gets through, enables boost and the title bar changes to “BLE Spam+ESP”. After that, each attack you select is mapped to the corresponding Ghost ESP command blespam -apple / -google / -samsung / -ms / -random and sent over UART, so both chips fire simultaneously. The two LoveSpouse ones have no matching ESP command and run on the Flipper only, so they still work with no ESP32 plugged in.

Porting gotchas

The API differences between OFW and Momentum were the bulk of the work; two stuck with me. FontBatteryPercent is a Momentum-only font enum that OFW doesn’t have, so I swapped it for FontSecondary. OFW also doesn’t provide the variable_item_list_get() getter, so I had to stash the VariableItem* reference myself and reuse it. The rest was SDK version alignment: build against the 1.4.3 SDK with ufbt, then drop the output dist/ble_spam.fap into the Flipper’s apps/Bluetooth/ and you’re done.

This is for playing with your own devices and studying the BLE advertising protocol. It interferes with people around you, so don’t use it to harass anyone. The upstream framework and protocol implementations are the work of Willy-JL, ECTO-1A, and Spooks4576; what I did is the ESP32 boost and the OFW 1.4.3 port, based on Momentum BLE Spam v6.6, GPL v3.0. Repo: https://github.com/dwgx/ble-spam-esp32-boost