Complete User Guide

About Fox ESP32 Firmware

Fox ESP32 Firmware is a single Arduino sketch that runs on a cheap ESP32 dev board and talks to your Flipper Zero over a plain wired UART connection (no BLE pairing, no WiFi bridge between the two devices — just four wires). Your Flipper sends it plain-text commands one line at a time; the ESP32 does the actual WiFi/Bluetooth/internet work and reports back. A suite of companion Flipper Zero apps gives you a menu-driven interface to the firmware so you never have to type raw commands by hand — though you always can, via the Terminal.

The eight pieces of the project:

What you can do with it:

• WiFi reconnaissance — scan access points and stations, monitor signal strength, sniff beacons/deauths/probes/raw frames, flag likely PMKID/SAE handshake activity, export a real .pcap file straight to Wireshark, or log a GPS-tagged wardrive to CSV.
• WiFi attacks (gated) — broadcast or targeted deauth, custom or random beacon spam, probe flood, a joke SSID list, malformed-frame bursts, spoofed channel-switch/power-save frames, and a plain TCP port scanner.
• MAC address tools — randomize, clone a specific address, clone the selected AP's address, or reset to the factory MAC. Software-only, no extra hardware.
• Bluetooth LE tools — a general BLE bridge (built for a Chameleon Ultra but usable for general scan/connect/notify work), a gated multi-vendor pairing-popup spam tool, and non-gated item-tracker detection (Apple Find My, Samsung SmartTag, Tile).
• FoxChat — post messages to a Discord channel and read the most recent ones back, straight from your Flipper's screen, with basic outgoing content filtering.
• FoxPortal — stand up an open WiFi network with a custom enquiry-form landing page, auto-detect whatever fields the form submits, log them to a per-session text file, and hand out a join QR code — fully reconfigurable copy/HTML without a reflash.
• FoxScript — a small embedded scripting language (14 native modules covering WiFi, HTTP, BLE, GPIO, storage, and more) for automating multi-step actions without a computer involved.
• A real FlipperHTTP-compatible internet bridge — GET/POST/PUT/PATCH/DELETE (including binary-safe base64 variants), a WebSocket client, and simple JSON field extraction — usable directly from Terminal, or by other Flipper apps built on the real jblanked/FlipperHTTP client library (verified against its actual source, and against a bundled app's own request/response parsing, not just its documentation). See HTTP & internet bridge for exactly what's covered and the couple of things that deliberately aren't.
• Optional hardware add-ons — RFID (PN532), Sub-GHz (CC1101), IR, and GPS support, each gated behind a build-time flag for boards that have the extra breakout wired up.

Web Installer

The ESP32 side of this project is flashed from your browser — no Arduino IDE, no esptool command line, nothing to install. You only need a USB cable and a Chrome- or Edge-based desktop browser (Web Serial support is required; Safari and Firefox cannot do this).

Choosing your board

You don't have to. The Model dropdown starts on Auto-detect on connect: when you click Connect, the flasher asks the chip what it is and loads the matching Fox firmware for you. Leave it on auto unless you have a reason not to.

Every board flashes the same four files — Bootloader, Partitions, Boot App0, and Firmware — at the same addresses except for the bootloader itself, whose address differs by chip family. The flasher fills these in for you.

Step by step

1. Open the Web Flasher link above in Chrome or Edge on desktop.
2. Plug your ESP32 into your computer with a USB data cable. Flipper Wi-Fi Dev Board: hold BOOT, tap RESET, release BOOT.
3. Click Connect and pick your device from the browser's own serial port picker.
4. The flasher identifies the chip, selects the matching board and downloads the Fox firmware for it. The hint under the Connect button tells you when it's ready.
5. Click Program. A progress bar tracks each of the four files as they're written, and each one is read back and verified.
6. When it finishes, the board restarts into the new firmware and the flasher disconnects. If the board doesn't come up, press RESET once or unplug and replug it.

To flash your own build instead, switch to the Select Custom Firmware Files tab and choose each of the four files (the ones Arduino IDE's Sketch → Export Compiled Binary produces, see Hardware Setup).

Wrong-board protection

The chip that answers on the port always decides which firmware is used. If you picked a model by hand and it doesn't match the connected chip, the flasher switches to the right one and says so in the console; while a board is connected it won't let you switch to another chip's firmware. Custom files are checked too: an image built for a different chip is refused before anything is written, because it would leave the board unable to start.

Erasing the flash

The Erase button wipes the entire flash chip. You'll get a confirmation prompt first. This is useful if a previous flash left the board in a bad state, or before switching a board between firmware projects.

Statistics

At the bottom of the Web Flasher there is a Statistics bar. Click it to see how many installs have finished, by month, day, country, chip, firmware version, connection type, operating system and browser, and where failed attempts stopped. Use < and > to move between months. The same panel is on the FoxFW Web Installer and the FAP Compiler, where it also lists the most compiled and most recently compiled apps.

The numbers are public and anonymous: each install adds one to a counter. No IP addresses, cookies, device IDs or personal details are stored.

Flashing via Flipper Zero (no PC required)

If you already have FoxFW installed on your Flipper, you can flash the ESP32 directly from the device — no browser, no USB cable to a computer, no files to download. The firmware for every supported board is bundled into FoxFW and deployed to your SD card automatically during the standard qFlipper install.

1. Connect your ESP32 to the Flipper Zero GPIO header: TX (GPIO1) → Pin 14, RX (GPIO3) → Pin 13, GND → GND, 3.3V → 3.3V.
2. On your Flipper go to Apps → Fox → Fox ESP32 Flasher.
3. The app detects your connected ESP32 automatically. If nothing is found, check your wiring and try again.
4. Select Flash Firmware, then choose your board type from the list.
5. Confirm the firmware files shown and press Flash. The app writes the bootloader, partition table, and firmware in a single pass and shows a progress bar.
6. Press Done when complete — the ESP32 resets automatically.

Hardware Setup

Wiring the UART link

The Flipper and the ESP32 talk over a plain 4-wire UART connection — no special adapter needed, just jumper wires from the Flipper's GPIO header to the ESP32's RX/TX/GND/5V (or 3V3) pins. Every Flipper-side app in this project (Detector, FoxHub, Fox Chat, Fox Portal) probes the same two standard pin pairs automatically at boot, so as long as you wire into one of these two pairs, every app will find your ESP32 without any manual configuration:

All communication runs at a fixed 115200 baud.

Board differences

Fox ESP32 Firmware supports the classic ESP32 and its variants, with real differences in what each one can do:

Optional add-on hardware

Four extra hardware peripherals can be wired to the ESP32 for expanded functionality. Each one is a separate breakout board you add yourself — none of them ship as part of the base kit — and each is controlled by its own build-time flag in the firmware, off by default. If you want one of these, you (or whoever builds your firmware image) needs to turn the flag on and recompile; it can't be toggled at runtime like the Attacks setting can.

With a peripheral's flag left off, every command for that hardware replies with a specific error (ERROR:NORFID, ERROR:NOSUBGHZ, ERROR:NOIR, ERROR:NOGPS) rather than doing nothing silently, so it's always clear whether a missing feature is "not wired up" versus "not working."

Fox ESP32 Detector

A single-purpose diagnostic app: it tells you whether anything is actually talking on your Flipper's GPIO header, and if so, which pins, which baud rate, and — where it can tell — which firmware. There's no menu, no configuration, and nothing is saved. Point it at a freshly wired board when you're not sure the wiring is right, or when Fox ESP32 FoxHub reports "not detected" and you want to know why.

How it works

Press Scan and watch a live progress bar work through every combination of the two Flipper pin pairs and nine common baud rates — 18 combinations total. For each one, it tries up to four detection tiers in order, stopping at the first one that answers:

Baud rates tested: 9600, 19200, 38400, 57600, 74880, 115200, 230400, 460800, 921600. A full scan of a board with nothing connected takes roughly 30 seconds, since every combination has to time out before moving on.

FoxHub

The main control app for the firmware — WiFi, Bluetooth, item-tracker detection, automation scripts, the safety toggle, and a raw Terminal, all in one menu tree. This is the app you'll spend the most time in.

First run & detection

Opening the app always follows the same sequence:

If nothing answers on either pin pair, you'll see a short message — "Fox ESP32 Firmware required on ESP32 connected via GPIO." — with two options: Retry (probes both pin pairs again, useful if you just plugged something in) and Settings (opens Connect Settings, below).

Main menu:

WiFi menu

Connect / Connection

The network list merges a live scan with your saved networks (saved ones shown first), as rounded Fox-styled rows showing SSID, signal strength, security type, and whether it's saved. Selecting a saved network reconnects immediately. Selecting a new one prompts for a password (leave blank for open networks) and saves it for next time. Once connected, the same menu item relabels itself Connection and opens a submenu instead: Disconnect, Status (current SSID + IP), Connect to Network (switch to a different saved/new network), and Forget Network (removes the saved password and disconnects).

My IP & HTTP Request

My IP fetches your ESP32's public internet-facing IP address and prints it to Terminal. HTTP Request gives you a quick GET (just a URL prompt) or POST (URL, then a body prompt) without needing to type bracket-command syntax yourself — the raw response is shown in Terminal either way. This is deliberately just GET/POST with no custom headers or other verbs; Terminal is there for anything more advanced (see the full HTTP command reference).

Recon

Scan APs and Scan Stations populate the network/station lists used elsewhere in this menu. Signal Monitor and Packet Count are quick, bounded checks (10 and 5 seconds respectively) that stream straight to Terminal. Wardrive and Packet Capture are the two data-logging tools:

Attacks Gated

Every item in this submenu requires Attacks to be turned on in Settings — with it off, every action here replies with a plain "disabled" message instead of doing anything. All attack primitives run for a fixed 5-second burst and then stop on their own; no separate stop button exists because none is needed.

• Deauth (Broadcast) — deauthenticates every client of the currently selected AP.
• Deauth (Targeted) — deauthenticates one specific station (pick it via Select Station first).
• Beacon Spam (Random) — floods the air with 8 randomly-named fake networks.
• Beacon Spam (Custom) — same idea, but you type a comma-separated list of SSIDs to cycle through.
• Probe Flood — sends a burst of probe requests.

Bluetooth menu

This menu is BLE spam only — five gated items, each cycling a proximity-pairing-shaped advertisement for 8 seconds to trigger the matching OS's pairing popup nearby.

Tag Detection menu

Each item runs a bounded 8-second BLE scan for that tracker family's broadcast signature and prints any matches straight to Terminal — mac address, signal strength, and (for Find My only) a decoded battery hint. This is not gated by the Attacks toggle — detecting nearby trackers is passive listening, not an attack.

Scripts menu

Lists every script currently saved on the ESP32, plus a trailing New Script item. Selecting an existing script opens Run / Show / Delete (deliberately not run-on-select, so Delete is never one accidental press away). New Script prompts for a name, then the script's source code, and saves it.

Settings & Terminal

Fox Chat

Post to and read from a Discord text channel, straight from your Flipper's screen, using your ESP32's internet connection. You'll need an active WiFi connection (set up via FoxHub's WiFi menu) — nothing else to configure.

Content moderation — what's protected and what isn't

• Every outgoing message is checked against a built-in word/phrase filter before sending (toggle in FoxHub's Settings — on by default). It's plain word-matching, not spacing- or leetspeak-aware, so it can occasionally false-positive on an innocent word that contains a blocked substring.
• Mentions are always sent inert — @everyone, @here, and role pings render as plain text and can't actually ping anyone, regardless of what you type.
• A short minimum gap is enforced between posts to prevent accidental flooding.
• Discord's own AutoMod does not see bot-posted messages — AutoMod only scans human-account messages, so whatever protections your server has configured there won't apply here. The built-in filter above is the only thing standing between what you type and the channel.
• Anything genuinely abusive or illegal posted through the bot is still a Discord Terms of Service violation on the bot account (and, by extension, whoever's Discord developer account created it).

Fox AI Chat

Chat with Google Gemini directly from your Flipper's screen, using your ESP32's WiFi connection. You'll need an active WiFi connection (set up via FoxHub's WiFi menu) — nothing else to configure, no API key to enter.

Fox Portal

Stands up an open WiFi network with a small enquiry-form landing page — anyone who joins sees your page, fills it in, and gets a confirmation screen, with every submission logged to a text file. Unlike a typical "evil portal," this one is built for consent-based lead capture: the visitor is knowingly opting in and the confirmation page shows them exactly what was recorded, not a credential phishing trap.

Customizing the pages — start.html, finish.html, portal.cfg

These three plain files live on your Flipper's own SD card and are the real source of truth for what visitors see — nothing here is compiled into the ESP32 firmware, so editing them never requires a reflash.

Open and edit these directly — via qFlipper's file browser, the Flipper Mobile App, or by pulling the SD card into a computer. Add or rename fields in start.html by editing its <input name="<fieldname>"> tags directly — whatever names actually get submitted are auto-detected and logged, so there's no separate field list to keep in sync. In finish.html, use {{FIELD:<fieldname>}} anywhere you want to echo back what the visitor submitted for that field.

Each HTML file has a 1024-byte size limit once flattened to a single line (a transfer-safety limit, not an HTML restriction) — the included starter templates use under 1000 bytes each, leaving room to adjust copy or light styling.

Submission logging

Every submission is appended as its own self-describing line — SSID=...;fieldname=value;fieldname=value... — to a text file on the ESP32 named for that portal session's start time, so each time you run Start gets a fresh file. Whatever fields a visitor's page actually submits are the fields that get logged for that line; there's no fixed column list, so different sessions can collect different fields without anything lining up wrong.

Those session log files only ever live on the ESP32 temporarily. Loading the Fox Portal app immediately triggers a transfer of anything waiting there into portal.txt on your Flipper's SD card (/ext/apps_data/fox_portal/portal.txt), clearing it from the ESP32 to free that flash up for new submissions. From then on, while you stay on Fox Portal's menu, it automatically checks again every 5 seconds and pulls over anything new — you don't need to back out and re-open the app, or select View Saved Results, for a submission to make it across; leave the menu open and it shows up within a few seconds. Nothing queued just means a quiet no-op. Use View Saved Results to read back what's accumulated in portal.txt so far.

Fox Update Downloader

Checks GitHub for newer releases of both FoxFW and Fox ESP32 Firmware, downloads whichever one you pick, and hands off straight to install — no PC, no browser, no manual file copying. Because the Flipper itself has no internet connection of its own, this app reaches GitHub over your already-wired ESP32 the same way FoxHub does — it needs the same UART wiring and a WiFi network for the ESP32 to join.

Checking for an update

Pick a row and the app connects to your ESP32, asks it to fetch the latest release from GitHub, and shows a progress screen while it compares versions. You'll land on one of three outcomes:

Selecting your ESP32 board

Choosing Fox ESP32 Firmware adds one extra screen before the check begins: Select Board. Use Left/Right to cycle through the six supported targets — ESP32 Classic, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C5, ESP32-C6 — then Down and OK on Continue. This tells the app which three files to fetch (bootloader, partition table, and firmware image are downloaded separately for this flow) and which board profile to hand to the flasher afterwards.

Downloading

A progress screen shows the file currently being fetched by name, a percentage, and a running KB / KB total — for the ESP32 flow this cycles through all three files in turn (bootloader → partition table → firmware) under one combined progress bar. Press Back at any point to cancel; anything already written to your SD card is cleaned up automatically rather than left as a partial, unusable file.

Installing

Once the download finishes you'll see Downloaded with two options: Install hands off immediately, or Later keeps the file on your SD card and returns you to the menu without installing. Choosing Later shows a Not Installed screen with Menu (just go back) and Restart (install the already-downloaded copy right now) — so you never have to download the same release twice just because you weren't ready to install the first time.

Fox File Downloader

Downloads files onto your SD card over the ESP32's internet connection — a direct URL, a browsable App Catalog, or a .fap straight off a GitHub repo — plus its own WiFi menu for connecting, scanning, and (if Attacks is on) the same recon/attack tools as FoxHub.

File Download (URL)

Prompts for a single URL — there's no separate filename prompt. The filename is worked out automatically from the last segment of the URL; if a file with that name already exists it's saved as name (2).ext, name (3).ext, and so on rather than overwriting anything. Files land at /ext/downloads/. The field remembers the last URL you entered (pre-filled next time), or starts at http:// the very first time.

Opening this menu item doesn't necessarily show that keyboard right away — it checks two things first, in order:

Once a URL is confirmed, the flow is a single continuous connection:

Download.txt queue

A plain text file at /ext/download.txt (SD card root, not in apps_data) — created automatically the first time you open the app if it doesn't already exist, with a header comment explaining itself. One URL per line; blank lines and lines starting with # are ignored. Opening File Download (URL) checks this file for the first non-comment line and downloads it automatically, no keyboard shown — once it starts, that line gets a # inserted in front of it so it's not picked up again, but it stays in the file as a record rather than being deleted. Only one URL is taken per visit, so queue up as many as you like and reopen File Download (URL) to work through them one at a time.

App Catalog

Browses catalog.flipperzero.one by category — Bluetooth, Games, GPIO, Infrared, iButton, Media, NFC, RFID, Sub-GHz, Tools, USB — showing one app at a time with its description, version, and position in the list. Left/Right moves between apps (and pages, once you reach either end); OK installs the highlighted app straight to /ext/apps/<Category>/, matching the category folder Flipper itself expects.

GitHub Repos

Type a repo as owner/repo (not a full URL) — e.g. jblanked/FlipDownloader. The app fetches the repo's default branch and scans its entire file tree for anything ending in .fap, wherever it lives in the repo (this looks at the raw tree, not GitHub Releases or a build workflow — the app needs to already contain a built .fap file checked into the branch). Pick one from the list and it downloads straight from raw.githubusercontent.com to /ext/apps/GitHub/<filename>.

Manage Apps

Lists every .fap under /ext/apps (skipping any folder literally named assets, so bundled app resources aren't shown or touched) as a path relative to that folder, e.g. Tools/myapp.fap. Selecting one shows a confirm screen — OK deletes it, Back cancels — and the list refreshes afterward.

Download Settings

The main menu's Settings item goes straight here — this app doesn't have a separate Connect Settings screen reachable from the menu the way FoxHub does. Four rows, Left/Right to cycle, saved automatically on every change:

WiFi, Recon & Attacks

Same shared WiFi module as FoxHub — full network connect/manage plus Recon and (if enabled) Attacks, not a trimmed-down "just connect" menu. The main menu's WiFi item disappears once you're connected, replaced by nothing (there's no menu-level shortcut to the Connection submenu here the way FoxHub has one) — reopen WiFi from Terminal/Settings context if you need to check status without disconnecting.

FoxDeFlock

A Flock Safety / ALPR (automatic license plate reader) camera detector, using your ESP32 as the WiFi/BLE radio. Based on FlipDeFlock by ReconGrunt (GPL-3.0-or-later) — this port reuses FlipDeFlock's OUI/SSID confidence-scoring and BLE-advert decoding logic verbatim, rebuilt against Fox ESP32 Firmware's own command set instead of FlipDeFlock's Marauder-based backend.

Setup

Requires Fox ESP32 Firmware wired via UART at 115200 baud (standard Fox pinout). On launch the app checks for an ESP32; if it isn't found, you get an ESP32 not found screen with Settings (pick which UART pin pair to use — 13/14 or 15/16) and Retry buttons. Nothing destructive happens if no ESP32 is present — the app just never sees any hits.

Scanning

Once connected, FoxDeFlock rotates through three scan modes every ~8.5 seconds, shown in the top-right corner of the hit list:

Each hit is shown as a single row: source (WiFi/BLE), the last two MAC bytes, an SSID or BLE name if one was broadcast, and a confidence code (CONF/FP?/LIKE/POSS). Up and Down move the selection; OK on a hit opens its detail screen (full MAC, confidence, device class, source, SSID/BLE name, channel/RSSI for WiFi or RSSI for BLE, and a sightings count); hold OK from the hit list opens an About screen with attribution. Back returns to the previous screen from either.

Status Bar WiFi / CC1101 Icon

Your Flipper's own desktop status bar shows a small icon, immediately to the left of the battery indicator, that does double duty: it reflects your ESP32's WiFi connection state as last reported by Fox ESP32 FoxHub's WiFi menu, and — only when WiFi isn't connected — whether Sub-GHz Garage/Gate/Other has found an external CC1101 module attached. See the FoxFW2.0 guide for what the CC1101 module itself does.

The icon stays visible even when disconnected on purpose — if it vanished entirely, someone who hasn't discovered the Fox ESP32 apps yet would have no hint that this feature exists at all. You can hide it entirely from Settings → Desktop → WiFi/CC1101 Icon — that one toggle hides both halves together, not just WiFi.

Full Command Reference

Every command the firmware understands, sent over serial at 115200 baud. You'll rarely need to type these by hand — FoxHub, Fox Chat, and Fox Portal send them for you — but they're all reachable from FoxHub's Terminal screen if you want raw access, and knowing them helps make sense of what each menu action is actually doing.

WiFi reconnaissance

Sniff modes — WIFISNIFF:<mode> (all 8 seconds)

MAC address tools

Wardriving & packet capture

WiFi attacks gated

All attack commands below are blocked with ERROR:DISABLED unless SETTINGS:ATTACKS:ON is active. Every attack self-limits to a 5-second burst and ends on its own with ATTACKDONE — there's no separate stop command needed.

Bluetooth & Tag Detection

Not available on ESP32-S2 boards (no BLE radio) — every command below replies ERROR:Incompatible ESP32-S2 Module has no BLE on that chip.

BLE bridge (general BLE / Chameleon Ultra)

Incoming notifications arrive asynchronously as NOTIFY:<hex>.

BLE spam gated

Each runs an 8-second advertising burst, then ATTACKDONE.

Tag Detection — snapshot scans, not a stalking detector

Each ends with TAGSCANDONE:<count>. A match means a tag is broadcasting nearby right now — it is not a history of whether something has been following you.

HTTP & internet bridge

Bracket-style commands. The GET/POST/PUT/PATCH/DELETE, WiFi, PING, LIST, IP/ADDRESS, and PARSE commands below reproduce the real jblanked/FlipperHTTP wire protocol on purpose — verified against that project's own firmware source and against a bundled app's actual request/response parsing code, not just its documentation — so any Flipper app built on the standard flipper_http.c client should work against this board without modification. [GET]/ [GET/HTTP]/[POST/HTTP]/[PUT/HTTP]/ [DELETE/HTTP] all reply with the same shape a real FlipperHTTP board uses:

[GET/SUCCESS]{"Status-Code":200,"Content-Length":128}
<response body, raw - may span more than one physical line>

[GET/END]

— a status/length header line, the body (sent as-is; any real newlines it contains become extra physical lines, exactly like the official firmware), a blank line, then a method-specific terminator: [GET/END], [POST/END], [PUT/END], or [DELETE/END]. Keep reading until that line shows up rather than stopping after the first one. Note that [GET/HTTP] replies with [GET/SUCCESS] too (not [GET/HTTP/SUCCESS]) — the real protocol tags by HTTP method, not by which bracket command triggered the request, so a client can't tell the two apart and neither can this firmware. [PATCH/HTTP] is a Fox-only extension (real FlipperHTTP doesn't define PATCH) and uses its own [PATCH/SUCCESS] / [PATCH/END] pair.

Async WebSocket traffic arrives as [SOCKET/CONNECTED], [SOCKET/DISCONNECTED], [SOCKET/MSG]<text> (or [SOCKET/MSG/BIN]<base64>), and [SOCKET/ERROR]. Everything not covered above still follows Fox's own long-standing shape, [COMMAND/SUCCESS]<data> or [ERROR] <message>.

FoxScript

FoxScript is a small purpose-built scripting language (not JavaScript, though the syntax looks familiar) — variables, if/else, repeat(n) loops, numbers, strings, arithmetic/comparison/logical operators, and function calls including dotted native calls. No user-defined functions, arrays, objects, or while/for. Scripts run straight off the ESP32's own storage — no SD card, no reflash.

let name = "world";
print("hello " + name);

if (wifi.connect("MySSID", "MyPassword")) {
  let body = http.get("http://api.ipify.org");
  print("my IP is " + body);
} else {
  print("wifi connect failed");
}

repeat (3) {
  print("free heap: " + device.freeHeap());
  delay(1000);
}

repeat is capped at 1000 iterations, and a whole script run is capped at 200,000 evaluation steps as a safety net against a mistyped infinite loop.

Native functions

Fox Chat (Discord bridge)

Reads reply with one DISCORDMSG:<HH:MM>|<full date and time>|<content> line per message (oldest first), ending with DISCORDREADDONE.

Fox AI Chat (Gemini relay)

AIASK errors: ERROR:NOWIFI, ERROR:EMPTY, ERROR:RATELIMIT:<seconds> (still cooling down — the ESP32 enforces this itself before ever reaching the relay), ERROR:BLOCKED (Gemini's own safety filter), ERROR:NOREPLY, or ERROR:HTTP:<code>.

Fox Portal

These commands are gated behind SETTINGS:ATTACKS:ON. See Chapter 8 for the full behavior of each — the Fox Portal app is the intended way to drive all of this.

Optional hardware — RFID, Sub-GHz, IR, GPS

These only work if the corresponding hardware flag was enabled at compile time (FOX_HAS_RFID/FOX_HAS_SUBGHZ/FOX_HAS_IR/FOX_HAS_GPS, all off by default). With a flag off, its whole command family replies a fixed error instead — ERROR:NORFID, ERROR:NOSUBGHZ, ERROR:NOIR, or ERROR:NOGPS.

RFID (PN532 breakout, I2C)

Sub-GHz (CC1101 breakout, SPI)

Raw RX/TX only — no rolling-code or OOK protocol decoding.

Infrared

GPS (UART, NMEA 0183)

Safety, Legal & the Attacks Toggle

The Attacks toggle

All WiFi attacks, BLE spam, the TCP port scanner, and Fox Portal are gated behind one setting, checked with SETTINGS and changed with SETTINGS:ATTACKS:ON / SETTINGS:ATTACKS:OFF — reachable from FoxHub's Settings screen as a single "Attacks: ON/OFF" row that applies immediately.

While attacks are off, every gated command replies plainly with ERROR:DISABLED — nothing is hidden or silently ignored.

Built-in self-limits

Every attack primitive (deauth, beacon spam, probe flood, BLE spam, the novelty attacks, the port scanner) runs for a fixed, short burst — 5 seconds for WiFi/port-scan attacks, 8 seconds for BLE spam — and then stops on its own, replying ATTACKDONE. There's no "run forever" mode and no separate stop command to remember; re-run the command if you want another burst.

Content moderation in Fox Chat

Outgoing Discord messages are checked against a built-in word filter before sending (toggle: SETTINGS:PROFANITY:ON/OFF, on by default), and every post is sent with mentions disabled so @everyone/@here/role pings can never actually ping anyone. See Chapter 6 for the full detail, including what this protection does not cover (Discord's own AutoMod doesn't scan bot-posted messages).

Fox Portal is consent-based

Fox Portal is a lead-capture tool, not a credential-phishing "evil portal" — visitors knowingly join an open network and see exactly what they're submitting, with a confirmation page that echoes it back. Don't use it to impersonate another organization's network or to collect information from people who haven't knowingly agreed to give it.

Known Limitations

An honest list of rough edges, so nothing here catches you by surprise. None of these are dealbreakers for normal use — most are "this hasn't been battle-tested against every possible target/accessory yet," not "this is broken."

Firmware

• HTTPS requests don't validate the server's certificate — fine for casual API calls, not for anything sensitive.
• The JSON field extractor only understands flat objects plus one level of nested headers — not deeply nested or general array-valued JSON (beyond the dedicated [PARSE/ARRAY] command).
• FoxScript is a small custom language, not real JavaScript — no user-defined functions, arrays, objects, or while/for loops.
• WIFISNIFF:PMKID/SAE flag frame shapes (an EAPOL frame was seen; a SAE Commit frame was seen) rather than performing full protocol extraction.
• RFIDEMULATE is not implemented — everything else in the RFID/Sub-GHz/IR/GPS command families is real, working driver code.
• The BLE spam payloads match each vendor's proximity-pairing packet framing (AD structure, company ID, UUID) correctly, but the exact inner payload bytes beyond that framing are a best-effort approximation.

FoxHub

• The AP/station scan-result list re-scans every time you open it — there's no caching between visits.
• SSIDs, passwords, URLs, and script text sent to the firmware aren't JSON-escaped — a literal quote or backslash in one of these can break the request.
• Custom-SSID beacon spam and targeted deauth only check that the field isn't empty, not that it's well-formed.
• The Connect Settings baud-rate row only offers 115200 today (built to support more rates later).

Fox ESP32 Detector

• Scans the two standard pin pairs (13/14, 15/16) across 9 baud rates each — a full scan with nothing connected takes about 30 seconds.
• Only recognizes a small, growing list of non-AT firmware signatures by name (currently this firmware and Bruce) — anything else that responds is reported generically as "Unidentified" rather than misidentified.
• Doesn't detect raw unflashed ESP32 chips, I2C/SPI sensor modules, or Flipper's own built-in IR — by design, out of scope for this tool.

Tag Detection

• A snapshot tool, not a stalking/tracking detector — a positive result means a tag is broadcasting nearby right now, not that anything has been following you over time.
• Find My detection catches any Find My-network accessory (AirTag, Chipolo, Pebblebee, etc.), not AirTags specifically — the broadcast protocol itself doesn't distinguish between them.

General

• ESP32-S2 boards have no Bluetooth radio at all — Bluetooth menu, Tag Detection, and every BLE command are unavailable on that chip.
• The status bar WiFi icon reflects only the last action taken through FoxHub's WiFi menu — it does not live-poll the ESP32 and doesn't reflect WiFi state from Fox Chat or Fox Portal, since those apps never change the connection themselves.

Support & Troubleshooting

Nothing responds / apps say "not detected"

1. Run Fox ESP32 Detector first — it's built exactly for this. It'll tell you which pin pair and baud rate (if any) something is answering on.
2. Double-check wiring against Chapter 3 — pins 13/14 (USART) or 15/16 (LPUART), plus a shared ground.
3. Confirm the ESP32 is actually powered — a USB cable that only carries data and not power, or a loose connection, is a common culprit.
4. Make sure the firmware was actually flashed successfully — re-run the Web Installer's Erase, then Program again.
5. If one app detects it but another doesn't, try Connect Settings (reachable from that app's Retry screen) to manually pick the pin pair Detector identified.

qFlipper "Unknown Error" during firmware install

If qFlipper stops at around 23% with "Verifying existing files…" and then shows Unknown Error / "Operation timeout (generic)" on Storage Md5Sum resources.ths, the most common cause is a stale Update folder left on the SD card from a previous install attempt. The checksum qFlipper computed no longer matches what is on the card.

Fix: delete the /Update folder from the root of your SD card (accessible via qFlipper's file browser or the Flipper Mobile App), then try installing again. If you cannot easily locate the folder, formatting the SD card achieves the same result — your FoxFW apps and settings will be re-deployed on the next successful install.

Web Installer issues

Attacks say "ERROR:DISABLED"

This is the Attacks safety toggle, not a fault — turn it on from FoxHub's Settings screen (see Chapter 13).

Fox Chat issues

Fox Portal issues

General questions

This guide aims to cover everything end to end — install, hardware, every app and menu, and the full command set. If something's still unclear after reading the relevant chapter, that's useful feedback: check the project's GitHub Pages site (the same place hosting the Web Installer) for the latest release notes and any additional notes posted there.