Flipper Zero

Embedding

Two instances of a real ARM CPU core underneath, and a from-scratch STM32WB55 + Flipper Zero board on top. CPU1 loads a Cortex-M4F flash image and CPU2 a Cortex-M0+ image; both run on the modelled peripherals. CPU1 runs the real FreeRTOS 11 kernel plus a Flipper-style desktop and apps, built from source with the open arm-none-eabi-gcc toolchain. The RTOS runs on the emulated hardware; it is not a shim.

• The CPU. cortex-m7.js executes Thumb-2. The real chip is a Cortex-M4F (ARMv7E-M + single-precision FPU); this core is ARMv7-M with an FPv5 single-precision VFP, a compatible superset, so it runs the M4 image unchanged. It implements the full exception model — NVIC, the 24-bit SysTick, SVC, PendSV, real exception entry/return — which is exactly what FreeRTOS needs to tick and context-switch. CPU2's image only uses the ARMv6-M subset.
• Real reset. The image is a real STM32 flash image with the ARM vector table at 0x08000000: on reset the board loads SP from word 0 and PC from word 1, exactly like the silicon.
• One clock. One executed CPU1 instruction counts as one 64 MHz cycle, the same convention SysTick uses here. Timers, radios and pins are scheduled against that count, so a pulse lasts as long as its cycles say.
• Real FreeRTOS. The firmware is the unmodified FreeRTOS-Kernel (V11.1.0) with the GCC ARM_CM4F port. vTaskStartScheduler arms SysTick, an SVC starts the first task, and every vTaskDelay/queue block triggers a PendSV context switch — all visible in the debugger.
• The board, in JavaScript. flipper-board.js maps the peripherals at their real STM32WB addresses and raises real NVIC interrupts: TIM2, DMA1, EXTI and the two IPCC lines are all interrupt-driven in this firmware.

Debugger integration

flipper-zero-debug.js reads window.EMU_BOOT and hands the shared debugger a genuine ARM Cortex-M4 machine — the same core the firmware runs on, exposed instruction-accurately.

• Registers. registers() reads r0-r12, SP, LR, PC, xPSR, the APSR flags N/Z/C/V, and the VFP s0-s31 live each refresh; each has a set() that writes straight back into the core's register file.
• Disassembly. FLASH is decoded with the shared cortex-m7 Thumb-2 disassembler, so the code window shows real ARM mnemonics at the real reset address 0x08000000.
• Single-step. Step calls transport.stepInsn, advancing the core one Thumb instruction. You can watch a real exception entry on a SysTick tick (PC jumps to the handler, xPSR/IPSR changes, the frame is stacked) and the matching PendSV context switch (the scheduler saves one task's registers and restores another's), then the EXC_RETURN unstack.
• Breakpoints & watchpoints. Execution breakpoints are a PC set the run-loop checks before each instruction; write watchpoints wrap the board's memory-write path and pause when a watched address is written. Both are real.
• Memory map. Three chips read the real address space side-effect-free: FLASH (program, disassembled, 0x08000000), SRAM (0x20000000), and the GPIO block (0x48000000 — watch the button IDR and the display-control ODR change as you press keys and the GUI redraws).
• Peripherals. The Devices window shows the CC1101 (state, MARCSTATE, tuned frequency, FIFO levels, GDO0), the ST25R3916, TIM1 + TIM2, the 1-Wire bus, the IPCC registers, and CPU2's own registers, instruction count and sleep state. The debugger steps and breaks CPU1; CPU2 runs alongside it and is shown, not stepped.

Architecture

The Flipper Zero is a portable multi-tool built on an STMicro STM32WB55 — a dual-core wireless SoC whose application core is a 64 MHz ARM Cortex-M4F with 1 MB flash and 256 KB RAM, beside a 32 MHz Cortex-M0+ that runs the radio stack. On board: a 128x64 monochrome ST7565R LCD, a 5-way navigation button + a Back button, a piezo speaker, a CC1101 sub-GHz radio, an ST25R3916 NFC frontend, an IR LED + receiver, and a 1-Wire pad.

• Display — ST7565R over SPI2. 128x64, organised as 8 pages of 128 columns, each byte a vertical 8-pixel slice (LSB = top). The board decodes the real Flipper display-init sequence (0xE2 reset, 0xA2 bias, 0xA0/0xC8 SEG/COM direction, 0x24 ratio, 0x81+contrast, 0x2F power, 0xAF on) and the per-page 0xB0|page / 0x10|col≫4 / 0x00|col&0xF addressing, then streams the framebuffer. SPI pins: SCK PD1, MOSI PB15, CS PC11, DC PB1, RST PB0 — the real f7 wiring.
• Buttons. Up PB10, Down PC6, Right PB12, Left PB11, Back PC13 are active-low with pull-ups; OK PH3 is active-high with a pull-down — exactly as in furi_hal_resources.c. The firmware's input task polls these from the GPIO IDR.
• Speaker. A piezo on PB8 driven by TIM16 channel 1 PWM; the board reads the timer's prescaler/auto-reload/enable and synthesises the tone (freq = 64 MHz / ((PSC+1)(ARR+1))) through the shared audio sink.
• FreeRTOS on real interrupts. The core's 24-bit SysTick drives the 1 kHz kernel tick; SVC starts the scheduler; PendSV performs every context switch; the NVIC priority masking (BASEPRI) protects critical sections.
• Second core — CPU2 really executes. A second instance of the ARM core stays in reset until CPU1 sets PWR_CR4.C2BOOT, then runs its own Thumb image from the secure top of flash at half CPU1's clock, sleeping in WFI until an interrupt. The two cores talk the way the silicon does: both sides of the IPCC (0x58000C00) with its set/clear/status registers and per-CPU interrupts, ST's published reference table at the base of SRAM2A, doubly linked event queues, an event-buffer pool handed back over the memory-manager channel. CPU2 finds the tables through FLASH_IPCCBR, fills the device-info table, posts the SHCI READY event (0x9200, WIRELESS_FW_RUNNING), and answers SHCI, HCI and ACI commands, including building a real GATT database and serving ATT requests from it.
  The image is not ST's. ST's Bluetooth stack is closed and is neither shipped nor run. This is an independently written replacement for the published mailbox interface, and firmware cannot tell it apart at that interface: the stock open-source Flipper firmware's unmodified ST transport code brings it up and reaches "Radio stack started" against it. It reports version 1.20.0 because that is the interface revision it speaks. It is not a Bluetooth controller: no link layer, no pairing, no encryption, no L2CAP beyond ATT. ST does not document the WB radio block, so it reaches the simulated air through an emulator-only port that does not exist on real hardware.
• Sub-GHz — CC1101 over SPI, with real timing. SPI_R bus (SPI1, SCK PA5, MISO PB4, MOSI PB5, chip-select PD0, GDO0 PA1 — the real f7 wiring). The model has the datasheet's reset values, the header byte, every strobe, the status byte with its FIFO count, 64-byte TX and RX FIFOs, PATABLE, the FSM with its real calibrate + settle times, MARCSTATE, RSSI, programmable GDO outputs, and the modem parameters (frequency, bandwidth, data rate, modulation) worked out from the registers the firmware wrote. Capture is the real furi_hal_subghz arrangement: async OOK on GDO0 into TIM2_CH2, with reset slave mode restarting the count on each rising edge, interrupt driven into a 24-bit decoder that has to cope with the slicer's noise between key presses. Transmit is too: DMA1 channel 1 feeds TIM2.ARR on the update request, refilled from its half + complete interrupts, while TIM2_CH2 toggles GDO0 into the CC1101's modulator. Packet mode runs through the FIFOs with preamble, sync, length, CRC and appended status, with GDO0 framing each packet.
  There is no RF. The other ends are simulated: a key fob keying OOK at 433.92 MHz, a garage receiver that decodes the firmware's transmission and opens only for the right code, a sensor node that answers packets on the right channel, data rate and sync word. Propagation, interference, range and antennas are not modelled.
• NFC — ST25R3916 over SPI. Same bus, chip-select PE4, IRQ PA2 on EXTI line 2 — the real f7 wiring. The model has the operation-mode byte, the register map, the masked IRQ registers driving the pin, the FIFO, NUM_TX_BYTES, CRC_A generation and checking, partial-byte frames, the no-response timer, and passive-target memory. The firmware runs an ISO14443-3A reader with cascade levels, reads and writes a Type 2 Tag, and emulates a card: the chip's automatic anticollision answers from PT memory, and the firmware answers READ frames itself.
  There is no field. The tags and the reader are simulated, and the air exchange is modelled per frame, not per load-modulated bit. Mifare Classic's Crypto-1 is not modelled, so that card is detected but not read.
• Infrared — real capture + carrier. Learn mirrors furi_hal_infrared: TIM2_CH1 on PA0 with reset slave mode, CH1 catching rising edges, CH2 falling, CH3 compare timing out the frame, all from the timer interrupt. Send drives TIM1_CH3N on PB9: PWM for a mark, forced-inactive for a space. A virtual TV measures the LED's real on/off times and carrier frequency, and rejects a carrier a TSOP would not pass.
  There is no light. The remote and the TV are simulated, and only NEC is implemented in this firmware.
• iButton — 1-Wire. The firmware bit-bangs the standard slot timings on open-drain PB14; a simulated DS1990A answers with a presence pulse and its ROM, acting on the measured length of each pulse. The firmware checks the ROM's CRC8.
• Larger HAL. On boot the firmware brings up the clock tree (HSE + LSE + HSI48 + PLL, flash latency, SYSCLK switch), initialises the RTC, and reads the battery through the ADC (VBAT). The RTC is a running calendar in emulated time. The power-management chips on I2C1 are modelled too, the gauge as a behavioural stand-in for a healthy pack.
• Firmware. A purpose-built image: the real FreeRTOS-Kernel sources plus original drivers and apps written against the real Flipper pin map and chip datasheets. It is not the official flipperzero-firmware, whose dolphin artwork and apps it does not include.
• How close the board is. As a test, the stock open-source Flipper firmware (release 1.5.1, not shipped on this page) was run unmodified on this board. It boots through every furi_hal init, starts its services, brings up CPU2 through ST's own transport code, and reaches its real desktop and main menu. It shows its own "No Factory Keys Found" warning, because real factory keys are per-device secrets inside ST's closed firmware, and it cannot open its radio apps, because those load from an SD card and no SD card is modelled.
• Not modelled. Real RF and light. The Bluetooth link layer, pairing and encryption. USB. An SD card. The 125 kHz RFID front end: the 125 kHz RFID, GPIO, Bad USB, U2F, Applications and Settings menu items are placeholder screens.

Sound

Pattern S (authored chip). The Flipper's only audio hardware is a piezo speaker on PB8 driven by a TIM16 PWM square wave. There is no PCM path — tone is pure frequency — so the board synthesises it directly from the timer registers. Each video frame genAudio() reads TIM16's CR1.CEN/CCER.CC1E enable, PSC and ARR, computes the output frequency as 64 MHz / ((PSC+1)(ARR+1)), and fills exactly round(EmuAudio.sampleRate/60) interleaved-stereo Int16 samples with a phase-continuous square wave (silence when the timer is off).

The GUI beeps on every key (a short ~70 ms tone at menu-click pitches), so navigating the menu is audible. Mute is the standard contract — transport.setMute/isMuted delegate to EmuAudio, and it starts muted until the on-page Sound button is clicked (browsers block audio before a gesture).