🥇[Flipper Zero] we abandon Raspberry Pi and create our own board from scratch. Finding the right WiFi chip

Flipper Zero — a project for a pocket multitool for hackers in the form factor of a Tamagotchi that I am developing with friends. Previous post. [1].

A lot has happened since the first post about Flipper. We've been working hard all this time, and the project has undergone radical changes. The main news is that we've decided to completely abandon the Raspberry Pi Zero and create our own board from scratch based on the i.MX6 chip. This significantly complicates development and completely changes the overall concept, but I'm sure it's worth it.

Also, we still haven't found the right WiFi chipset that supports all the necessary functions for WiFi attacks, while also supporting the 5GHz band and isn't outdated by 15 years. Therefore, I invite everyone to participate in our research.

In this article, I will explain why we made this decision, the current stage of the project, current tasks, and how to participate.

What's wrong with Raspberry Pi Zero.

I personally love Raspberry Pi, but during the development process, it turned out that it has many drawbacks. The most simple one is that you simply can't buy it. Even large distributors have no more than a few hundred rpi0 in stock, while stores like Adafruit and Sparkfun sell no more than 1 unit per person. Yes, there are a few factories that produce rpi0 under license from the Raspberry Pi Foundation, but they cannot ship batches of 3-5 thousand units either. It seems that rpi0 is sold at near-cost prices and is more aimed at promoting the platform.

Here are the main reasons for abandoning rpi0.

It cannot be purchased in large quantities. Factories like Farnell offer to buy the Compute Module. The Chinese on Alibaba lie about having large quantities; when it comes to a real batch, they back out. For anyone who will say that we didn't search properly, try to negotiate with someone to purchase 5 thousand units, so that they send you an invoice.
Few interfaces.
Old BCM2835 processor that was used in the first version of rpi. Hot and not very energy-efficient.
No power management, the board can't be put to sleep.
Outdated built-in WiFi.
and many other reasons.

The Raspberry Pi Foundation recommends using the RPi Compute Module for such tasks. This is a board in the SO-DIMM form factor (like the RAM in laptops), which inserts into a motherboard. This option doesn't suit us as it significantly increases the size of the device.

The Raspberry Pi Compute Module is a board in the SO-DIMM form factor designed for installation in your device.

We then began looking at various SoMs (System on Module), with the i.MX6-based modules being the most appealing. Our entire search is documented in a forum thread. Raspberry Pi Zero Alternatives. However, it should be noted that not all companies will be willing to work with you on volumes of even 3-5 thousand pieces per year. For instance, the Israeli company Variscite simply stopped responding to us when they learned of our planned purchase volumes. Apparently, they are only interested in selling SoMs along with additional services such as support and integration. I also want to mention a Russian developer, Starterkit.ru, who makes very interesting devices, like SK-iMX6ULL-NANO. They are almost impossible to find online, and I wouldn't have known about their existence if not for recommendations from acquaintances.

After comparing all the options and assessing the economics, we made the difficult decision to create our own SoM from scratch specifically for Flipper based on the chip i.MX6 ULZ. This is a single-core Cortex-A7 running at 900 MHz, with performance nearly comparable to the rpi0, yet it runs almost cool under load, whereas the rpi0 becomes like a furnace.
By designing our board from scratch, we gained complete freedom in component placement on the board, which we expect will result in a more compact device. The i.MX6 ULZ is a stripped-down version of the i.MX6 ULL without some interfaces and a video core, so for development, we use the MCIMX6ULL-EVK development board with the i.MX6 ULL chip, simply not utilizing some of the interfaces. This board, by the way, is supported by the mainline Linux kernel, allowing Kali Linux with the kernel from packages to boot on it.

Here's how the flipper looks without its casing at the moment:

The Right WiFi

Hacking WiFi is one of the main features of Flipper, so it's crucial to choose the right WiFi chipset that will support all the necessary functions: packet injection and monitor mode. It should also operate in the 5GHz range and support modern standards like 802.11ac. Unfortunately, we couldn't find such chipsets readily available.

The Chinese SiP (system in package) module Apmak AP6255 based on the BCM43456.

We are currently considering several candidates, but all of them require further refinement, and it’s still unclear which one is the best choice. Therefore, I kindly ask everyone who understands WiFi hacking to join our search here: Wi-Fi chip with SPI/SDIO interface that supports monitoring and packet injection

Main candidates:

Broadcom/Cypress BCM43455 or BCM4345 with patched firmware. Discussion in the nexmon repository.
Mediatek MT7668 — not yet tested, but theoretically could be suitable.

Please, before suggesting anything, carefully read the requirements on the forum, including the connection interface. Remember, I have been studying this topic for several months and have sifted through everything I can find.

What is already ready

The part controlled by the STM32 is already working: 433MHz, iButton, reading-emulation 125kHz.
The mechanical part, buttons, case, connectors, and layout are currently in active development; the case in the videos and photos below is outdated; in the new versions, the joystick will be larger.

The video shows a simple demonstration of opening a barrier using a replay of a remote control signal.

FAQ

How to buy?

We are planning to launch a crowdfunding campaign on Kickstarter in April-May this year. We hope to send out finished devices six months after the campaign ends. If you are interested in the device, I ask you to leave your email below the website, and we will send offers to subscribers when the prototypes and early samples for sale are ready.

Is this legal?

This is a research tool. All of its components can be purchased separately in a store. If you embed a WiFi adapter and a 433MHz transmitter in a small case and add a screen, it won't make it any less legal. The device does not fall under the definition of special means or equipment for covert information gathering. Illegal use can only occur with the intent to cause harm or for illegal activities. In other words, I can make knives of any shape and from any metal; the responsibility for using my knives lies with you.

How to donate?

Right now you can support me personally with small donations for food through Patreon. Regular donations of $1 are much better than a large sum at once because they allow for forecasting ahead.