dwgx@blog:~$dwgx
> cd ../posts

Writing a BLE Spam App for the Flipper Zero

// created

flipper-custom-apps is a set of custom apps for the Flipper Zero, built around an X-BLE Spam. The idea is straightforward: use the official furi_hal_bt_extra_beacon_* to send BLE advertising packets that spoof Apple, Samsung, Android, and Windows pairing advertisements, so nearby phones automatically pop up a pairing dialog.

It ships with 40 device profiles. On the Apple side there’s Proximity Pair (AirPods across generations, Beats, AirTag) and Nearby Action (Vision Pro, AppleTV, HomePod, HomeKit), plus Samsung Buds/Galaxy Watch EasySetup, Android Fast Pair, Windows Swift Pair, and a LoveSpouse thrown in. I added an [ALL] Rotate that auto-cycles through everything and randomizes the BLE MAC on every broadcast, so it doesn’t keep reusing the same address.

The UI is bare-bones: left/right to switch profiles, OK to start and stop, one line on screen reading Broadcasting BLE:OK, or BLE:ERR on failure, with a blue/red LED to tell the states apart. On exit it cleanly restores the Bluetooth state, otherwise the Flipper misbehaves later.

The part that took some thought is the ESP32 integration. Hook up an ESP32 running Ghost ESP or Marauder firmware over GPIO UART, and the app forwards commands to it so both radios fire together. The two firmwares use different command formats, so I just send both (blespam -apple and blespam -t apple) and let each firmware pick the one it recognizes; to stop, it sends blespam -s and stopscan. UART runs at 115200, and if no ESP32 is detected it skips the boost, so the Flipper working solo is unaffected.

Structurally it’s just one external FAP. application.fam declares it as FlipperAppType.EXTERNAL, built with ufbt (ufbt build, or ufbt launch to deploy directly), and the artifact drops into apps/Bluetooth/ to run. x_ble_spam.c is the entry point, UI, and packet construction; esp_boost.c/h handles the ESP32 UART side.

This is only for studying Bluetooth protocols and device fingerprinting myself. The repo is under a custom license, personal study only, no commercial use or redistribution.