Bruce Firmware: Turn Any ESP32 into a Flipper Zero Alternative for RF, Wi-Fi, and BLE Auditing

TL;DR: Bruce is an open-source, multi-protocol offensive security and wireless auditing firmware for ESP32 microcontrollers. It transforms affordable pocket devices like the M5Stack Cardputer, LilyGO T-Deck, and custom RF Reaper devkits into versatile Swiss Army knives capable of Sub-GHz RF replay, 802.11 Wi-Fi auditing, BLE advertising spam, 125kHz/13.56MHz RFID cloning, infrared control, and wireless BadBLE keystroke injection without requiring expensive proprietary hardware.

For years, field technicians, radio amateurs, and penetration testers relied on dedicated, single-purpose gadgets for wireless assessments: a handheld scanner for Sub-GHz remotes, a dedicated Linux laptop with an Alfa Wi-Fi dongle for 802.11 auditing, a Proxmark for RFID tags, and a physical Rubber Ducky for USB HID keystroke injection. While devices like the Flipper Zero popularized pocket multi-tools, their proprietary architectures, supply shortages, and high price tags created demand for an open-source, hardware-agnostic alternative.

The ESP32 microcontroller family, with its dual-core processing power, integrated 2.4 GHz Wi-Fi and Bluetooth, rich peripheral buses, and low price point, is the ideal platform for field security tooling. The Bruce Firmware project (hosted at bruce.computer and developed on GitHub) has emerged as the premier open-source multi-tool operating environment for ESP32 hardware.

Named after the predatory mechanical shark from classic cinema, Bruce consolidates Wi-Fi penetration testing, Bluetooth Low Energy manipulation, Sub-GHz RF transceiver operations, NFC/RFID tag cloning, infrared emulation, and DuckyScript automation into a polished, themeable graphical user interface with an integrated WebUI and browser-based flasher.

Last updated: August 2026.

What is Bruce Firmware?

Bruce Firmware is an open-source, AGPL-3.0 licensed wireless security and penetration testing firmware engineered for the ESP32 platform that unifies Sub-GHz radio, Wi-Fi, BLE, RFID/NFC, infrared, and BadUSB tooling into a modular graphical handheld environment.

+-------------------------------------------------------------------------+
|                       Bruce Firmware Core Ecosystem                     |
|  [On-Screen GUI]   [WebUI: http://bruce.local]   [Bruce App Store / OTA] |
+------------------------------------+------------------------------------+
                                     |
+------------------------------------v------------------------------------+
|                         Protocol & Attack Engines                       |
|  +----------------+----------------+----------------+----------------+  |
|  |  802.11 Wi-Fi  | Bluetooth / BLE| Sub-GHz CC1101 | RFID / NFC     |  |
|  |  - Raw Sniffer | - BadBLE HID   | - 300-928 MHz  | - 125 kHz EM   |  |
|  |  - Deauth/AP   | - BLE Spam     | - Spectrum     | - 13.56M NDEF  |  |
|  |  - Wardriving  | - Scanner      | - Replay/Jam   | - Chameleon    |  |
|  +----------------+----------------+----------------+----------------+  |
|  |  Infrared (IR) | 2.4GHz NRF24L01| USB / HID      | JavaScript VM  |  |
|  |  - TV-B-Gone   | - Mousejack    | - DuckyScript  | - Custom Apps  |  |
|  |  - Multi-Proto | - 2.4G Sniffer | - BadUSB       | - Live Scripts |  |
|  +----------------+----------------+----------------+----------------+  |
+------------------------------------+------------------------------------+
                                     |
+------------------------------------v------------------------------------+
|                       Supported Hardware Platforms                      |
|  [M5Stack Cardputer]   [LilyGO T-Deck]   [CYD Display]   [RF Reaper PCB]|
|  [M5StickC Plus 2]     [LilyGO T-Embed]  [Elecrow TFT]   [Generic ESP32]|
+-------------------------------------------------------------------------+

Unlike basic firmware forks that focus solely on Wi-Fi deauthentication, Bruce is designed as a complete hardware abstraction layer. It supports dozens of commercial ESP32 boards featuring colour screens, keyboards, rotary encoders, and expansion ports.

Operators can navigate tools directly using on-device physical keyboards or directional buttons, or connect over local Wi-Fi to the device’s embedded web interface (http://bruce.local/) for remote file management, live packet capture downloads, script execution, and real-time antenna tuning.

Core Protocol Modules and Capabilities

Bruce bundles comprehensive protocol toolkits across the radio frequency spectrum:

+-------------------------------------------------------------------------+
|                       Bruce Multi-Protocol Matrix                       |
+-------------------+--------------------+-------------------+------------+
|  802.11 Wi-Fi     |  Bluetooth / BLE   |  Sub-GHz RF       | RFID / NFC |
|  - Deauth Flood   |  - BadBLE Keyboard |  - 315 / 433 MHz  | - 125 kHz  |
|  - Evil Portal    |  - iOS/Android Spam|  - 868 / 915 MHz  | - Mifare   |
|  - Wardriving GPS |  - Tracker Sniff   |  - Signal Replay  | - NDEF     |
|  - Brucegotchi    |  - GATT Explorer   |  - RF Spectrum    | - Amiibo   |
+-------------------+--------------------+-------------------+------------+

1. 802.11 Wi-Fi Auditing and Defense Testing

• Packet Sniffing and Handshake Capture: Promiscuous mode raw frame sniffer, EAPOL 4-way WPA/WPA2 handshake logging, and PMKID extraction saved directly to micro-SD in PCAP format.
• Deauthentication Testing: Selective single-target deauth, multi-target flood, and broadcast disconnect testing to validate 802.11w Protected Management Frames (PMF).
• Rogue AP & Evil Portal: Captive portal deployment with built-in phishing templates and credential harvesting for authorized red team social engineering.
• GPS Wardriving: Integrates with external NMEA GPS modules over serial UART to record wireless access points with latitude, longitude, and RSSI into WiGLE-compatible CSV files.
• Brucegotchi: An integrated Pwnagotchi client and companion engine capable of interacting with nearby Pwnagotchi units, swapping grid faces, and broadcasting peer telemetry.
• Network Administration: Built-in TCP port scanner, ARP poisoner, Telnet client, SSH terminal, and WireGuard VPN tunnel client.

2. Bluetooth Low Energy (BLE) & BadBLE

• BadBLE Wireless Keystroke Injection: Executes Hak5 DuckyScript payloads wirelessly over Bluetooth HID. When paired with a target computer or smartphone, the ESP32 acts as an authorized Bluetooth keyboard, typing administrative commands at high speed.
• BLE Advertising Flood: Broadcasts rapid device pairing spoofing packets targeting Apple iOS (AirDrop/AirPods prompts), Google Android Fast Pair, Samsung Galaxy, and Windows SwiftPair systems to audit device alert handling.
• BLE Reconnaissance: Discovers hidden BLE beacons, AirTags, smart watches, and exposed GATT services.

3. Sub-GHz RF Transceiver (CC1101 / RF433)

When connected to a Texas Instruments CC1101 SPI module or standard 433 MHz transceiver, Bruce operates across the 300 MHz to 928 MHz unlicensed ISM bands:

• Signal Sniffing and Demodulation: Captures ASK/OOK and 2-FSK transmissions from garage door openers, weather stations, smart meters, and remote gate controllers.
• Signal Replay: Records raw RF pulse trains into flash storage and replays them on demand.
• Live RF Spectrum Visualiser: Displays a real-time waterfall and signal strength bar graph across selected center frequencies to locate nearby transmitters.
• Sub-GHz Jammer Testing: Evaluates RF receiver resilience against continuous carrier wave or pulsed PWM jamming across test frequencies.

4. RFID and NFC (125 kHz & 13.56 MHz)

Pairing Bruce with a PN532 or PN532Killer module enables dual-frequency RFID auditing:

• Low-Frequency (125 kHz): Reads and clones standard EM4100 / TK4100 proximity cards onto rewritable T5577 transponders.
• High-Frequency (13.56 MHz): Reads ISO/IEC 14443 Type A NFC cards, Mifare Classic (1K/4K), and Mifare Ultralight tokens.
• NDEF Records & Emulation: Reads, writes, and modifies standard NDEF URLs and text records. Features Chameleon tag emulation and Amiibolink support for gaming NFC devices.

5. Infrared (IR) & BadUSB Automation

• TV-B-Gone: Built-in power-code database that cycles through hundreds of global television and display brand turn-off commands via onboard IR LEDs.
• Custom IR Capture & Replay: Decodes and replays signals using NEC, Sony SIRC, Philips RC5/RC6, and Samsung32 protocols.
• Hardware BadUSB: Direct USB-C DuckyScript keystroke injection for devices with native USB (ESP32-S2 / ESP32-S3).

Supported Hardware Ecosystem

Bruce runs across an extensive roster of off-the-shelf development kits and custom open-source hardware.

+-----------------------------------------------------------------------+
|                    Popular Bruce Hardware Targets                     |
+--------------------+---------------------+----------------------------+
| M5Stack Cardputer  | LilyGO T-Deck       | Bruce RF REAPER            |
| (ESP32-S3)         | (ESP32-S3)          | (Official Custom DevKit)   |
| - 56-Key Keyboard  | - Full Trackball KB | - CC1101 + PN532 Integrated|
| - 1.14" Color TFT  | - 2.8" IPS Display  | - 16MB Flash / 8MB PSRAM   |
| - Built-in Battery | - LoRa + Micro-SD   | - Flipper Zero / iButton   |
+--------------------+---------------------+----------------------------+

1. M5Stack Series

• M5Stack Cardputer: The most popular platform for Bruce. Features a full 56-key micro-keyboard, 1.14-inch colour display, internal speaker, digital microphone, infrared transmitter, micro-SD slot, and internal battery in a pocket form factor.
• M5StickC / StickC Plus / StickC Plus 2: Compact wrist/lanyard form factor with built-in display and 8-pin expansion socket for attaching CC1101 or RFID hats.
• M5Core / Core2 / CoreS3: Large touch-screen desktop and field enclosures.

2. LilyGO Series

• LilyGO T-Deck: Standalone blackberry-style communicator with a 2.8-inch IPS colour screen, trackball, full tactile keyboard, and built-in SX1262 LoRa module.
• LilyGO T-Embed & T-Watch: Rotary-encoder and smartwatch enclosures for covert field use.
• LilyGO T-Display S3: Ultra-bright dual-core display board.

3. The Official Bruce RF REAPER Board

For power users wanting an all-in-one hardware package without loose jumper wires, the Bruce project designed the RF REAPER devkit:

• Processor: ESP32-S3 with 16MB Flash and 8MB PSRAM.
• Integrated Transceivers: Onboard CC1101 Sub-GHz radio, PN532 NFC/RFID controller, 2.4 GHz NRF24L01 header, and high-power IR emitters.
• Expansion: AW9523 GPIO expander, Flipper Zero compatible GPIO pin headers, and an iButton 1-Wire probe port.

4. ESP32 Cheap Yellow Display (CYD) & 3D-Printed Enclosures

The $10-$15 ESP32-2432S028R Cheap Yellow Display (CYD) is fully supported by Bruce, providing a touch-driven 2.8-inch screen for bench or portable wardriving operations. To make the bare board field-ready, several 3D-printable cases are available on Printables:

• Tactical Handheld Case: ESP32 CYD Case for Bruce & Marauder on Printables provides a rugged snap-fit shell with cutouts for all buttons, SD card, and USB ports designed specifically for mobile auditing.
• Desktop Enclosure with Stylus Holder: aamott’s CYD Enclosure on Printables adds an angled desk stand and a dedicated holder for the resistive touch stylus.

Comparison: Bruce Firmware vs Alternatives

Installation and Quick Start Guide

Installing Bruce requires no local toolchain installation thanks to the browser Web Flasher.

+-------------------------------------------------------------------------+
|                       Three Installation Methods                        |
+------------------------------------+------------------------------------+
| Method 1: Web Flasher (Easiest)    | Method 2: M5Burner / M5Launcher    |
| - Visit https://bruce.computer     | - Open M5Burner desktop app        |
| - Select board from dropdown       | - Search "Bruce", select build     |
| - Click Flash over Web Serial      | - Click "Burn" directly to M5      |
+------------------------------------+------------------------------------+
| Method 3: esptool CLI (Advanced)   | esptool.py --port /dev/ttyACM0     |
|                                    | write_flash 0x00000 Bruce.bin      |
+------------------------------------+------------------------------------+

Method 1: Installing via Browser Web Flasher

1. Connect your ESP32 board (Cardputer, T-Deck, StickC, etc.) to your computer with a reliable USB data cable.
2. Open Google Chrome, Microsoft Edge, or Brave and browse to https://bruce.computer/flasher.
3. Select your specific board model from the hardware list.
4. Click Connect & Install, pick your device’s COM / serial port, and confirm.
5. The web installer writes the partition table and firmware binary in under 60 seconds.

First Boot and Configuration

1. Turn on the device. Bruce displays its startup logo and boots into the main icon carousel.
2. Connect to the device’s local configuration portal by navigating to the Wi-Fi -> Connect menu, or connect your phone to the Bruce-AP hotspot.
3. Open http://bruce.local or http://192.168.4.1 in your browser to upload custom DuckyScript payloads, install community applications from the Bruce App Store, or customize the UI theme.

Field Applications and Responsible Use

+-------------------------------------------------------------------------+
|                     Practical Field Deployment Cases                    |
+-------------------+--------------------+-------------------+------------+
| Red Team Physical | Sub-GHz Facility   | Emergency Comms   | Wi-Fi WPA3 |
| - BadBLE inject   | - Gate remotes     | - Spectrum check  | - PMF test |
| - Badge cloning   | - Sensor telemetry | - NRF24 link test | - Rogue AP |
| - TV-B-Gone kiosk | - Replay audit     | - Field wardrive  |   audit    |
+-------------------+--------------------+-------------------+------------+

1. Authorized Red Team and Physical Security Audits

Bruce allows security auditors to consolidate physical and wireless tools into a single pocket device:

• Test workstation screen-lock compliance using wireless BadBLE DuckyScript triggers.
• Audit corporate guest Wi-Fi networks for client isolation bypasses and rogue portal detection.
• Validate RFID door badges against legacy 125 kHz cloning attacks.

2. Radio Amateur and Maker Experimentation

For radio amateurs and IoT experimenters:

• Identify 433 MHz and 868 MHz ISM telemetry from remote weather stations, water meters, and energy sensors.
• Trace local 2.4 GHz RF interference sources using the built-in NRF24 and Wi-Fi spectrum analysers.
• Verify infrared command sequences for shack equipment and remote relay controllers.

Responsible Security Note: Bruce is a powerful wireless auditing toolkit intended strictly for educational purposes, personal laboratory testing, and authorized security assessments. Operating deauthentication floods, signal jammers, or unauthorized wireless interception on networks or spectrum you do not own is illegal under telecommunications and cybercrime statutes worldwide.

Frequently Asked Questions (FAQ)

What is Bruce Firmware?

Bruce is an open-source offensive security firmware for ESP32 microcontrollers. It provides tools for Sub-GHz RF, Wi-Fi auditing, Bluetooth Low Energy, RFID/NFC, infrared, and BadUSB automation in a unified handheld interface.

Which devices work best with Bruce Firmware?

The M5Stack Cardputer is the most popular device due to its built-in 56-key keyboard, display, and speaker. The LilyGO T-Deck, M5StickC Plus 2, and the custom Bruce RF REAPER PCB are also fully supported.

Can Bruce Firmware replace a Flipper Zero?

Yes. When paired with external CC1101 and PN532 modules (or running on the RF REAPER devkit), Bruce delivers equivalent Sub-GHz, RFID, NFC, and IR functions alongside more advanced Wi-Fi and BLE capabilities for a fraction of the cost.

How do I update Bruce Firmware?

You can update Bruce directly over the air (OTA) using M5Launcher, flash the latest release via the web installer at bruce.computer/flasher, or install community updates from the built-in Bruce App Store.

Is Bruce Firmware legal to use?

Yes. Bruce is a legitimate open-source security research tool. However, users must only operate its auditing, deauthentication, and RF transmitting features on hardware and wireless networks they own or have explicit written permission to test.

Summary: Why Bruce Firmware Matters for Makers and Security Pros

Bruce bridges the gap between low-cost open hardware and sophisticated wireless auditing tools. By leveraging the ubiquity of ESP32 boards like the M5Stack Cardputer and LilyGO T-Deck, it democratizes access to multi-protocol security research without the gatekeeping of proprietary hardware. Whether you are auditing enterprise Wi-Fi hygiene, exploring Sub-GHz IoT communications, or learning embedded radio security, Bruce transforms a $30 hobby board into a formidable tactical asset.

73 from 9M2PJU.

Sources and Further Reading

• Official Bruce Firmware Portal – Web flasher, theme builder, hardware guides, and community app store.
• BruceDevices GitHub Repository – Complete open-source codebase, releases, and hardware schematics.
• Official Bruce Wiki – Detailed module walkthroughs, pinouts, and DuckyScript references.
• Bruce Hardware DevKit Store – Official RF REAPER PCBs and pre-configured hardware.
• ESP32 CYD Case for Bruce & Marauder (Printables Model 1285303) – 3D printable handheld case for tactical field operations.
• ESP32 CYD Enclosure with Pen Holder (Printables Model 769863) – 3D printable desktop stand and enclosure by aamott.
• 9M2PJU ESP32 Fox Hunt Beacon – Open-source ESP32 radio direction finding firmware.
• 9M2PJU ESP32 DX Cluster Client – Standalone hardware DX spot terminal.