Flipper Zero

Runs a real FreeRTOS firmware on an in-browser STMicro STM32WB55 (ARM Cortex-M4F), the exact chip inside the Flipper Zero. The firmware is built from source with the open GCC ARM toolchain: the real FreeRTOS 11 kernel (MIT) boots on the emulated silicon, its SysTick drives the RTOS tick and PendSV/SVC do the context switches, and two tasks (a GPIO input poller and a GUI task) talk over a FreeRTOS queue. It drives the real 128x64 ST7565R LCD over SPI2 with the authentic Flipper display-init sequence and page-addressed framebuffer, reads the 5-way navigation + Back buttons from their real STM32WB GPIO pins, and beeps the piezo speaker through a TIM16 PWM tone. It boots to the Flipper dolphin desktop; press OK (or Up/Down) to open the main menu (Sub-GHz, 125 kHz RFID, NFC, Infrared, GPIO, iButton, Bad USB, U2F, Applications, Settings), Up/Down to move the selection, OK to open an item, Back to go back — every key press changes the LCD and clicks the speaker. Keyboard: arrows = 5-way, Enter/Space = OK, Backspace/Esc = Back (click the screen first so it captures the keyboard); the same controls live in the shared debugger's Controller panel. Open the debugger, or add ?debug, to single-STEP real Thumb instructions (through exception entry/return, SVC and PendSV context switches too), set PC breakpoints and write watchpoints, and read the ARM registers (r0-r15, xPSR, N/Z/C/V, the VFP s0-s31) and the real STM32WB memory map live. It also models the STM32WB's SECOND CORE: on boot it High-Level-Emulates the Cortex-M0+ wireless co-processor (CPU2) plus the IPCC mailbox and the SHCI/HCI transport layer, so the firmware's real dual-core BLE bring-up completes over the actual inter-core channel registers and a real shared-memory packet mailbox — CPU2 posts its SHCI "ready" event (WIRELESS_FW_RUNNING), CPU1 sends SHCI_C2_BLE_Init and HCI_Reset and gets success, then reports the radio stack running (the desktop shows a "BT" mark + "BLE 1.20.0", and a Bluetooth screen reports Radio: running / Stack v1.20.0). A larger HAL runs too: the clock tree (HSE+LSE+HSI48+PLL), the RTC, and an ADC battery read. Open Sub-GHz from the menu to run a real CC1101 Frequency Analyzer: the firmware brings up the TI CC1101 sub-GHz transceiver over the SPI_R bus (SPI1, chip-select PD0), reads its VERSION register (0x14) to confirm the part, then sweeps the 433 MHz ISM band — programming the PLL (FREQ2/1/0), calibrating, entering RX and reading the RSSI status register at each step — and renders a live spectrum that locks onto 433.92 MHz with a dBm readout. Every SPI transaction, the chip-ID handshake, the PLL programming and the RSSI decode are the real furi_hal_subghz code path; there is NO real radio, so the RSSI comes from a synthetic on-board emitter (loopback) rather than photons. This is an HONEST PARTIAL: it is not the full official flipperzero-firmware binary (that needs Flipper's whole build tree, its pinned toolchain and a real CPU2 wireless binary), but it now boots the real dual-core BLE handshake the official firmware blocks on, on top of a real FreeRTOS build, and drives a real CC1101 over SPI. Open NFC from the menu to run a real ST25R3916 reader: the firmware brings up the ST25R3916 NFC frontend over the same SPI_R bus (chip-select PE4), reads its IC-identity register to confirm the part (ic_type 5), then runs a real ISO14443A poll — REQA → ATQA, anticollision (0x93 0x20) → 4-byte UID + BCC (checked), SELECT (0x93 0x70) → SAK — driving the frontend through its direct commands (Set Default, Transmit REQA, Transmit with/without CRC), the FIFO load/read and the IRQ status register, and shows the detected card (Mifare Classic 1K, UID 04 A1 B2 C3, ATQA 0004, SAK 08). Same honesty as Sub-GHz: the ST25R3916 SPI framing, IC-identity read, direct commands, FIFO and the anticollision sequence are the real code path, but there is NO 13.56 MHz field — the card is a synthetic on-board tag (loopback). Open Infrared from the menu to run a real NEC learn/send: Learn arms TIM2_CH1 input capture on the IR receiver pin (PA0) and captures the mark/space timing of an incoming NEC frame from a synthetic on-board emitter, decodes it (checking the header + the address/command inverse bytes) and shows the decoded NEC address/command plus a live capture waveform; press OK to Send, which builds the NEC mark/space pattern and gates the TIM1 38 kHz carrier (IR LED pin PB9) for each mark/space — the board times the carrier gating and decodes it back, so the sent frame round-trips. There is NO real IR light: the received frame is a loopback emitter and the transmitted carrier is decoded internally, but the timing capture, NEC decode/encode and carrier gating are the real furi_hal_infrared code path. CPU2 is emulated only at the mailbox layer: it answers the bring-up and reports a stack version, but there is no real 2.4 GHz radio — advertising / connections / GATT do not exist. The Sub-GHz, NFC and Infrared paths are all real firmware code over real STM32WB peripherals (SPI buses / TIM capture+carrier) but their RF/IR is loopback (no photons); iButton and USB are still stubbed.