CapibaraZero: A cheap alternative to FlipperZero based on ESP32-S3
capibarazero.github.io409 points by andreock 8 months ago
409 points by andreock 8 months ago
A good PCB design + a few STL files and this would truly be marvelous. I do own a flipper zero(I was one of the first backers so I've had it for a while). Admittedly it's a bit over-hyped and I never saw it as an rf swiss army knife because of it's limitations and shortcomings.
The two shortcomings I saw were the price and the lack of WiFi built in. In reality, if this project gets paired with a single board computer, this would truly be a match made in heaven. An 18650 lipo battery to power them on, a cheap stl file for a 3d printed case and you have a disposable one-off hacking device(as in drop it somewhere for a one time task and do everything remotely over ssh and a proxy like ngrok or bore).
Admittedly I started working on something of the sorts a while back though I never really got anywhere due to the lack of time. I actually wanted to include LoRa to the equation to make it truly off the grid. I got as far as writing some boilerplate code for the project and it's been collecting dust ever since... "Someday" as we all like to say...
There are many ESP32 boards with a SubGHz radio. But they are either ESP32 with a SX127x or ESP32S3 with a SX126x. A lot of them come with built in battery support.
The next problem with this project is the used radio: The SX12xx series from Semtech is good but lacks a lot of features like the CC1101 as used in the Flipper Zero.
I really like the idea of using an ESP32 but the choice of the used radio is a bit akward.
why do you say this? I find SX1276 a perfect replacement for CC1101( that have problems with shared SPI bus). Also SX1276 support LoRa and have a wider frequency range than CC1101.
The SX127x doesn’t have the same features and CC1101 has way more options to fine tune any aspect of the radio.
I see several boards with ESP32 + SX1276 built in for a couple tenners so they might do. I have to check still which ones work.
Edit: They are not ESP32S3 as other commenters have mentioned :'(
There are PCB designs linked (maybe not good?) and an STL for a case. Just didn't know if you had missed those.
I was not able to find a photo of the finished device.
Push it!
I can happily pick up the torch on everything except the PCB design.
Well the PCB design isn't my strong side either - I am completely self-taught in that regard and I'm sure people who have studied that will tare me apart for any decisions I've made(also valid for all of my projects involving PCB's in the past, even more so considering I make the PCB's at home with a diode laser). Likewise, software is my domain.
> For the moment the only option is to make capibaraZero with a breadboard but we are working on a PCB to make device more portable.
Radically low-cost, can't disagree :)
PCB files are actually available: https://github.com/CapibaraZero/resources/tree/main/PCB/
OTOH it's nice to be able to literally see every part, and how they are connected.
PCB is ready, it's a typo in docs, I will update ASAP
What part was a typo?
> For the moment the only option is to make capibaraZero with a breadboard but we are working on a PCB to make device more portable.
That’s awesome! I love the idea of starting with a breadboard—it makes everything more hands-on and helps visualize the connections better. Having PCB files available is a great touch for when things need to go portable! Are there any music-related (https://sites.google.com/site/legitticketsites/vivid-seats-r...) projects or builds you’ve seen with CapibaraZero so far?
Remember hardware != software. These PCBs may still be WIP.
Yes, updating a PCB means building a device anew, and to build it you can't just type "make" and go grab a tea.
This us why the idea to go for the breadboard first and thus always have a working prototype is so obviously right.
M5stack.com makes a whole bunch of ESP32 modules with display, enclosures, batteries, etc already integrated, and they're cheap and robust. You can get one with a built-in keyboard for $30.
Espressif(the ESP* company) bought M5Stack earlier this year. So M5 products are basically official ESP* reference platform.
Oh wow, had no idea. I like their products, have a bunch of sensors and liking the ease of use. Most recently got the SCD41 co2 sensors to migrate away from all the crappy cloud-based sensors, and works great!
For the more budget concious - you can get ESP32 modules with USB C, Wifi/BT and a few IO pins from AliExpress for $4. These things are amazingly cheap.
Agree, but M5stack devices also start at $5 and come with a case. Add $10 or 15 and you can get a device with a screen, accelerometer, buttons, microphone, and more. No soldering required.
Which of theirs is the most comparible to the flipper zero? Besides the cool looking Cardputer it is quite hard to make sense of their product lineup and compare features.
Care to recommend one? Appreciate it.
It depends what you want to do with it and how many modules you want to hang off it (or not). The 'entry level ' one is the M5stickC, which is about the size of your thumb, has a couple of buttons, a screen, a grove connector (to attach peripherals), an accelerometer, a real time clock chip, and a battery for around $20.
All their stuff is programmable in C or in MicroPython, and they have a Scratch-type building-block interface called UIflow which lets you prototype in MP very fast, and is extensible with your own modules. You kind of need it even if you're competent in Python because the documentation tends to be barebones and focus on the electronic schematics, so the UIflow software components are the API documentation.
Expressif's own documentation is very good so this may be changing since they acquired M5stack, but I still find UIflow the fastest way to get hands-on with a new module.
The big advantage of the FlipperZero is the community developing software. This seems to be a based on a different chip. Does the Flipper software run natively on this, or do we need to port everything?
I find my FlipperZero is a super fun tool for exploring stuff I'm even vaguely curious about, which I can then use to design/build things I want.
Both my motorcycles now have about $8 worth of AliExpress parts including a CC1101 rf module hooked top to the high beam globe, so I can just flash my hi beams at the garage door and it opens via 433MHz magic. It was super easy to know how to build that when I'd experimented with "listening" to the keychain garage door opener with the FZ, and playing back the signal at the garage door. To get from there to a first prototype with a CC1101 module and an Arduino, then a second prototype with a CC1101 and an AT-Tiny installed on a bike was so obviously just going to work that it was a heap of fun. Without the "instant gratification" of being able to record the garage door opener key fob with the FZ and play it back to open the door, and the knowledge that the FZ did that just by using a inexpensive microcontroller driving a CC1101 module itself, I'd probably never even done more than wonder about how to do it.
> “listening" to the keychain garage door opener with the FZ, and playing back the signal
That would only work with older garage doors that don’t use rolling codes, wouldn’t it?
Yep. Non rolling code garage doors seem to be ubiquitous in rental properties here (Sydney Australia).
Rolling codes are better. But if you haven't seen it, Samy Kamkar has a device called Roll Jam, take a look at the last ~5 mins of this Defcon23 talk: https://www.youtube.com/watch?v=UNgvShN4USU
(The TL;DR of the trick there is: Jam the radio signal a key fob sends so a car/garage fairly wide band receiver can't hear it. At the same time listen with a better tuned receiver. Wait for someone to press their key fob and record the code, then wait for them to press it again and record the second code - then stop jamming and replay the 1st code you captured. Door opens and person goes through. But you now have a valid second rolling code that will work. You can do this with a Teensy3 and two CC1101 modules, about $40 worth of hardware.)
> But you now have a valid second rolling code that will work.
Once. Note also that the same technique will work on other OTP schemes that are not time-based.
With a basic rolling code that works and maybe still used in garage doors, but afaik current decent car alarms exchange encrypted keys several times between car and keyfob that you can't just replay. Even simply generating totp based keys and invalidating them in a few minutes is enough to make that kinda useless in practice.
How old that door can be? 30 years old? Even in the EU we installed rolling codes 30 years ago
Yep! That’s an unfortunately (or fortunately, for the hacker unconcerned with garage theft) the vast bulk of installed garage doors.
Good to see some competition, the FlipperZero is very pricey for what it is. Then again, I guess you're paying for the software.
Side note that I learned the hard way; once you buy a Flipper Zero and get bored with it, they are very, very hard to sell. Both eBay and Facebook Marketplace seem to not allow them to be sold, and simply asking around doesn't do much.
I got mine awhile ago, played with it, did what I wanted to do and lost interest as I moved on to other things. So now I have a costly device knocking around in a drawer.
How do people end up selling it? If you are anywhere near NYC I could be interested in yours.
I honestly don't know. I also advertised on a few less regulated forums, but no bites. Not in NYC, but if it makes a difference, I am in the US and shipping is always an option. If we can establish contact outside of HN, I'm willing to work something out.
You might update your profile to include contact info?
Or email me if you don't hear back from the first person. :) dga@cs.cmu.edu
You are paying for a complete package that you can fit in your pocket.
This is still at breadboard stage. If you want to put something together for yourself at sub $35 you can. It's just not going to be portable, pretty, or probably even usable. I carry my flipper zero everywhere for a variety of tasks.
The flipper zero isn't doing anything special that you we haven't been able to do for decades with a variety of parts.
* SubGHZ, you need an RF module.
* Bluetooth? yep
* IR, you need IR,
* network, hey WiFi.
* SD card for any kind of storage? yep, another module
* USB anything but charging? Yep, more wires and modules.
But hey, most devices want at least 4 wires (VCC/GND/A FEW SIGNALs), and other devices want more, to handle clocks and timing. And that's only if your thing supports IC2 and you have enough GPIO. Otherwise you need multiplexers.
Any one of these things can be done with less than a dollar in parts. But have fun combining them all into something workable AND can do them all.
But hey, you are paying for the software right?? Come on.
The complete package is far more valuable because of the software that drives it. More valuable than not needing to solder the wires is not needing to figure out how to make the IR blaster do useful work by editing code. Because if it was just the hardware, the moat discouraging a non-open source competitor wouldn't exist and there would be competition already.
What you are saying doesn't even make sense.
They are discouraging open source hardware therefore that's what makes the software more valuable?
I invite you to hit up ChatGPT or something and shit out a flipper app. It's fun, and straightforward and most people could pull it off with a bit of time and slogging through it.
I would LOVE to see your Gerber design that fits in a case that's around 100x40x25mm and only weighs 104 grams. OH. And because of the parts involved, I'd love to see it because you'd need VERY advanced soldering skills to put it together.
I'll write the OS/SDK. But it has to be the same size or smaller and have:
1. A screen
2. NFC
3. 125 kHz RFID
4. IR Blaster and Receiver
5. Bluetooth
6. USB controller that can be tons of things
7. HID Controllers for lots of things
8. Still lots of exposed GPIO pins for external stuff.
9. SD Card
Any single one of these requires a sub $1 microcontroller/arduino/ESP + soldering ability + 10 lines of boilerplate code.
Yeah. tell me again the hardware isn't anything special.
> You are paying for a complete package that you can fit in your pocket.
Yeah. I've got raspberry pis, and some USB Wi-Fi adaptors specifically bought for having monitor mode, and a few different RTL-SDRs, and a HackRF One, and an Ubertooth One.
But I'm _way_ more likely to have my FlipperZero with me when my curiosity is piqued while out somewhere. I'll often have it in my pocket to use as the world's most expensive tv-b-gone.
I wish this functionality was in Watchy v3 (https://watchy.sqfmi.com/), which is also based on EPS32-S3
Those esp32-s3’s are super hot right now. Lots of improvements over the older esp32’s like the ability to assign any set of pins to your SPI bus. Previously there were a fixed set of pins you could use.
Back on the 8266 it was even worse as there were a lot of gpio pins you couldn’t use at all!
The S3 also has a built in hardware debugger accessible with its new built in USB pins. Previously you had to attach an external jtag debugger.
The one thing I’ve noticed is the S3 is a bit of a “breaking” hardware revision and things like the arduino pin library haven’t quite caught up yet to some of the new features. Things like WLED or FastLED haven’t caught up quite yet either.
Thank you, we really need a good alternative to FZ.
I haven't looked closely at the files, but I wonder if there is anything stopping us from using the new C3 riscv version instead if S3.
C3 seems to be cheaper and more stable, but maybe the performance is a bit lower?
I have a bunch of esp32-c3 and build system of capibaraZero make it easy to integrate it(like other device of esp32 family). The only problem with esp32-c3 is the absence of USB OTG feature.
Is OTG a requirement? Or just good to have?
I have a bunch of C3-mini boards and it would be great to finally use them for something more interesting than a temperature sensor.
Not really a requirement, you won't see USB section on the GUI. The capibaraZero is designed to support almost every device that support Arduino Wiring framework, so if a device doesn't support a feature, it will be hidden in GUI
Much more usable if this will target directly the LILYGO T3 and T3/S3. One would optionally add more hardware if needed to support the IR blaster, NFC and so forth, but the LoRa chip is already included.
I saw the board, interesting, a really compact board with almost all module already soldered on it. The project structure and build system makes it easy to integrate new board, I consider it a valid option to reduce space and avoid issues of soldering all components. Thank you for the advice!
Or the LilyGO T-Embed CC1101.
CC1101 boards(at least the cheapest ones) have problems with shared SPI bus(SD card and Subghz module)
Cute, but I'll wait for the ESP32-P4 version (RISC-V successor to the now deprecated S line).
Not really a successor, they’re different chip lines (more I/O, video engine, more hardware crypto stuff but no wireless capabilities we all know and love from Espressif)
Hmm, I had missed that. Perhaps the C line (e.g. C6) would be more suited.
Espressif CEO expressed commitment to RISC-V (now already years ago) and they've stopped releasing new chips with tensilica ISA.
As the ecosystem, toolchains and such aren't comparable to that of RISC-V and this gap will only widen, they really shouldn't be selected for new designs.
C line isn’t also very comparable: single (C-series) vs dual core (S3), and S3 has USB-OTG capabilities whereas C6 only has USB-JTAG.
Tensilica ESPs aren’t formally in NRND stage as of right now, for some usages they’re still the only choice, even if RISC-V is clearly the path forward.
Nice! The FlipperZero is too expensive for me so this would be a great option.
So I forgot what a FlipperZero is, and this website doesn't say squat about what this this actually is or is used for other than claiming it's a FlipperZero clone of some sort.
How about saying what the thing is all on your own rather than ONLY making sense as an alternative?
No pic of the assembled hardware or mostly software?
Does anyone know what the legality of these are? Can you get in trouble just for purchasing things like flipper zero? Or just for using them in some way?
Depends on your country. Usually it's the action of using it for specific things that are illegal, not just purchasing/owning it. But if you're caught breaking into an office with it, I'm sure many countries' courts would see that as additional tooling for the break in, for example.
Flipper Zero was banned in at least one country: Brazil.
https://www.eff.org/deeplinks/2023/03/flipper-zero-devices-b...
https://www.bleepingcomputer.com/news/security/brazil-seizin...
Transmissions are pretty tightly regulated in most countries. Receiving less so but those laws can be pretty catch-all. Unless you enjoy static noise you're probably intercepting something and thus potentially running afoul of lawful interception rules.
Exactly laws & whether anyone cares are ofc dependent on your country
Your country may be of relevance to the question, but in most countries owning or using a flipper or similar, provided you do not interfere with devices you do not own, will not cause issues.
Canada was going to ban Flipper Zero but rolled it back earlier this year. https://www.pcmag.com/news/canada-walks-back-ban-of-flipper-...
HN discussion at the time: https://news.ycombinator.com/item?id=39778185
It depends on usage, if you make an ARP poison attack on your home network, for example, it's not a big problem, if you make it on someone else network, can be a problem :). Also pay attention on SubGHZ frequency, country restrict free frequency range
It's probably not illegal to own in most countries, but nevertheless won't be the smartest move to actively getting involved with it, the idea around it is just too malicious.
What are you even on about, mate? A hacker's multi tool with infinite potential for exploration is an idea "too malicious" to consider?
Thank you