Willy_Firmware_V3_T-Embed_CC1101

KO | EN

gitlite — search

#open-source #ai #java #rag #pytorch #nextjs #html #anthropic #bash #gpt

Willy_Firmware_V3_T-Embed_CC1101

(★ 9)

Willy Firmware is an alternative to Flipper Zero. | Board: Lilygo T-Embed CC1101

File Explorer

ZIP Download

- About.png
- Bad_USB.png
- BLE_Scan.png
- BLE_Scan_Signal.png
- BLE_Scan_Signal_List.png
- BLE_Spam.png
- BLE_Spam_Settings.png
- Bluetooth.png
- Brightness.png
- Bruteforce.png
- Bruteforce_Settings.png
- Color.png
- DeBruijn.png
- EvilPortal.png
- EvilPortal_Result.png
- EvilPortal_Result_List.png
- EvilPortal_Settings.png
- Home.png
- IMG_20260814_215202.jpg
- Infrared.png
- Infrared_SD_Card.png
- Infrared_SD_Card_Send.png
- Jammer.png
- Jammer_Config.png
- Jammer_Roll.png
- Jammer_Roll_Start.png
- Jammer_Settings.png
- Jukebox.png
- Learn.png
- Learn_Settings.png
- Learn_Signal.png
- Learn_Signal_List.png
- NRF24.png
- NRF24_Analyzer.png
- NRF24_BLE_Jam.png
- NRF24_BLE_Jam_Config.png
- NRF24_Drone_Jam.png
- NRF24_Drone_Jam_Config.png
- NRF24_WiFi_Jam.png
- NRF24_WiFi_Jam_Config.png
- PIN_Code.png
- PIN_Code_Edit.png
- PIN_Code_Locked.png
- Pocsag.png
- Pocsag_Read.png
- Pocsag_Read_Signal.png
- Pocsag_Read_Signal_List.png
- Pocsag_Send.png
- Pocsag_Settings.png
- Read.png
- Read_RAW.png
- Read_RAW_Settings.png
- Read_RAW_Signal.png
- Read_Settings.png
- Read_Signal.png
- Read_Signal2.png
- Read_Signal_Generator.png
- Read_Signal_Generator2.png
- Read_Signal_List.png
- Read_Signal_List2.png
- Remote.png
- Remote2.png
- Remote_Digital_Sign.png
- Remote_LED.png
- Remote_Projector.png
- Remote_TV.png
- Rollback.png
- Rollback_Send_Sequence.png
- Rollback_Settings.png
- Rollback_Signal_List.png
- Rolljam.png
- Rolljam_Settings.png
- Rolljam_Signal_List.png
- Scanner.png
- Scanner_Result.png
- Scanner_Settings.png
- Settings.png
- Sniffer.png
- Sniffer_Deauth.png
- Sniffer_Result.png
- Sniffer_Result_List.png
- Sniffer_Settings.png
- SSID_Spam.png
- SSID_Spam_Settings.png
- SubGhz1.png
- SubGhz2.png
- SubGhz_SD_Card.png
- SubGhz_SD_Card_Send.png
- Tesla.png
- Transmit.png
- Transmit_Keyboard.png
- Transmit_Signal.png
- Transmit_Signal_Editor.png
- TV_B_Gone.png
- USB_Mode.png
- WiFi.png
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<h1 align="center"> <code>Willy Firmware V3</code> - Flipper Zero alternative for LILYGO T-Embed CC1101</h1><a id="introduction"></a>

<h2 align="center">
 <a href="#introduction">Introduction</a> | <a href="#features">Features</a> | <a href="#fromwilly">V2 → V3</a> | <a href="#contact">Contact</a> | <a href="#disclaimer">Disclaimer</a>
</h2>

**Willy Firmware V3** is a feature-rich firmware developed specifically for the **LILYGO T-Embed CC1101** and **T-Embed CC1101 Plus**.

Inspired by the Flipper Zero ecosystem, Willy Firmware brings **Sub-GHz, Infrared, NFC, Wi-Fi, Bluetooth/BLE and nRF24** functionality together in a single ESP32-S3 device.

V3 has been redesigned around the T-Embed platform with a focus on **stability, usability, hardware integration and standalone operation**.

<h4 align="center">Website: https://willy-firmware.com/</h4>

-----

<h1 align="center">What makes Willy Firmware special?</h1>

Willy Firmware V3 was rebuilt specifically for the LILYGO T-Embed CC1101 platform, taking advantage of its integrated hardware while keeping the philosophy of the previous Willy Firmware generations.

- **All-in-one:** Sub-GHz, Infrared, NFC, Wi-Fi, Bluetooth/BLE and nRF24 functionality.
- **T-Embed optimized:** Designed specifically around the ESP32-S3 based T-Embed CC1101.
- **T-Embed CC1101 Plus support:** Supports the additional nRF24 2.4 GHz radio available on the Plus model.
- **Flipper Zero file compatibility:** Uses Flipper Zero-compatible Sub-GHz and Infrared file formats, allowing compatible files to be saved, loaded, exchanged and reused between devices.
- **SD Card support:** Captured signals and compatible files can be stored and accessed directly from the device.
- **Actively developed:** New applications, protocols, improvements and fixes are regularly added.

---

| Device | Support | CC1101 | nRF24 |
| --- | :---: | :---: | :---: |
| LILYGO T-Embed CC1101 | ✅ | ✅ | — |
| LILYGO T-Embed CC1101 Plus | ✅ | ✅ | ✅ |

Both versions use the integrated CC1101 for Sub-GHz functionality.

The **T-Embed CC1101 Plus** additionally includes an nRF24 2.4 GHz radio, which is supported by Willy Firmware V3.

Willy Firmware V3 is designed specifically for the LILYGO T-Embed CC1101 and T-Embed CC1101 Plus. It is not intended as a direct replacement firmware for other ESP32 boards.

---

-----

<h1 align="center">Features</h1><a id="features"></a>

### 📡 Sub-GHz<a id="subghz"></a>

<a href="#read-raw">Read RAW</a> •
 <a href="#read">Read</a> •
 <a href="#transmit">Transmit</a> •
 <a href="#tesla">Tesla</a> •
 <a href="#scanner">Scanner</a> •
 <a href="#bruteforce">Bruteforce</a> •
 <a href="#debruijn">DeBruijn</a> •
 <a href="#jukebox">Jukebox</a> •
 <a href="#jammer">Jammer</a> •
 <a href="#rolljam">Rolljam</a> •
 <a href="#rollback">Rollback</a> •
 <a href="#jam_mode">Rolljam/back Jammer</a> •
 <a href="#pocsag_read">Pocsag Read</a> •
 <a href="#pocsag_send">Pocsag Send</a> •
 <a href="#subghz_sd">SD</a>

Willy Firmware uses the integrated **CC1101** for Sub-GHz reception, decoding, transmission and signal analysis.

The firmware supports both known protocols and RAW signals, allowing signals to be received, analyzed, saved and reused directly from the device.

-----

## Read RAW<a id="read-raw"></a>

**Read RAW** captures Sub-GHz signals directly as RAW pulse data.

This allows signals using unknown or unsupported protocols to be captured without requiring a decoder.

Captured signals can be inspected, retransmitted or saved to the SD card for later use.

-----

## Read<a id="read"></a>

**Read** receives and decodes Sub-GHz signals using known protocols.

When a compatible signal is received, Willy Firmware decodes its information and stores it temporarily in memory.

Up to **50 signals** can be kept in memory. From there, signals can be inspected, retransmitted or saved to the SD card for later use.

### Supported decoders

<details>
<summary>Show supported Sub-GHz decoders</summary>

- Allstar Firefly
- Alutech AT-4N
- Ansonic
- BETT
- Beninca ARC
- CAME
- CAME Atomo
- CAME TWEE
- Cham_Code
- Clemsa
- Ditec GOL4
- Doitrand
- Dooya
- Elplast
- Faac SLH
- Feron
- GangQi
- GateTX
- Hay21
- Hollarm
- Holtek
- Holtek_HT12X
- Honeywell
- Honeywell Sec
- Hormann HSM
- Intertechno_V3
- Jarolift
- KeeLoq
- KeyFinder
- KingGates Stylo4k
- Legrand
- Linear
- LinearDelta3
- Magellan
- Marantec
- Marantec24
- Mastercode
- MegaCode
- Nero Radio
- Nero Sketch
- Nice FLO
- Nice FloR-S
- Nord ICE
- Phoenix_V2
- Power Smart
- Princeton
- Revers_RB2
- Roger
- SMC5326
- Security+ 1.0
- Security+ 2.0
- Somfy Keytis
- Somfy Telis
- Star Line
- Treadmill37

</details>

### Supported vehicle decoders

<details>
<summary>Show supported vehicle decoders</summary>

- Chrysler
- Fiat SPA
- Ford V0
- Ford V1
- Ford V2
- Kia/HYU V0
- Kia/HYU V1
- Kia/HYU V2
- Kia/HYU V3
- Kia/HYU V4
- Kia/HYU V5
- Kia/HYU V6
- Kia V7
- Land Rover V0
- Mazda V0
- MazdaSiemens
- Mitsubishi V0
- PSA
- Porsche AG
- Renault V0
- Subaru
- Suzuki
- Star Line
- VAG

</details>

-----

## Transmit<a id="transmit"></a>

**Transmit** generates Sub-GHz signals using supported protocols and user-defined values.

Signals can be configured directly from the device, transmitted immediately or saved to the SD card for later use.

### Supported protocols

<details>
<summary>Show supported transmission protocols</summary>

</details>

-----

## Tesla<a id="tesla"></a>

**Tesla** generates and transmits the known signal used to open the charging port door on compatible Tesla vehicles.

The appropriate frequency can be selected directly from the interface depending on the target region.

### Supported regions

- **EU** - 433.92 MHz
- **US** - 315.00 MHz

-----

## Scanner<a id="scanner"></a>

**Scanner** analyzes signal strength (RSSI) across the frequencies available in the Sub-GHz frequency configuration.

When a signal exceeds the configured RSSI threshold, Willy Firmware identifies and displays the frequency with the strongest detected signal.

The detected frequency can then be applied directly to the general Sub-GHz settings.

-----

## Bruteforce<a id="bruteforce"></a>

**Bruteforce** generates Sub-GHz signals using supported fixed-code protocols while automatically iterating through possible code values.

A single signal can be transmitted using the currently selected value, or the complete sequence can be started to automatically increment the value after each transmission.

The current signal can also be saved to the SD card for later use.

Several parameters can be configured directly from the interface, including:

- Delay between transmissions
- Increment step
- Current code value

The increment step can be adjusted to move through the code range at different intervals, such as **1, 5, 10 or 30 values per step**.

### Supported protocols

<details>
<summary>Show supported bruteforce protocols</summary>

- Ansonic 12bit - 433.07 MHz
- Ansonic 12bit - 433.92 MHz
- Ansonic 12bit - 434.07 MHz
- CAME 12bit - 303.87 MHz
- CAME 12bit - 307.80 MHz
- CAME 12bit - 315.00 MHz
- CAME 12bit - 330.00 MHz
- CAME 12bit - 433.92 MHz
- CAME 12bit - 868.35 MHz
- Chamberlain 7bit - 300.00 MHz
- Chamberlain 7bit - 315.00 MHz
- Chamberlain 7bit - 390.00 MHz
- Chamberlain 8bit - 300.00 MHz
- Chamberlain 8bit - 315.00 MHz
- Chamberlain 8bit - 390.00 MHz
- Chamberlain 9bit - 300.00 MHz
- Chamberlain 9bit - 315.00 MHz
- Chamberlain 9bit - 318.00 MHz
- Chamberlain 9bit - 390.00 MHz
- Chamberlain 9bit - 433.92 MHz
- HT12X AM 12bit - 315.00 MHz
- HT12X AM 12bit - 433.92 MHz
- HT12X AM 12bit - 868.35 MHz
- HT12X AM 12bit - 915.00 MHz
- HT12X FM 12bit - 433.92 MHz
- Linear 10bit - 300.00 MHz
- Linear 10bit - 310.00 MHz
- LinearDelta3 8bit - 310.00 MHz
- Nice FLO 12bit - 433.92 MHz
- Nice FLO 12bit - 868.35 MHz
- PT2260 24bit - 315.00 MHz
- PT2260 24bit - 330.00 MHz
- PT2260 24bit - 390.00 MHz
- PT2260 24bit - 433.92 MHz
- PT2262 24bit - 315.00 MHz
- PT2262 24bit - 418.00 MHz
- PT2262 24bit - 430.00 MHz
- PT2262 24bit - 430.50 MHz
- PT2262 24bit - 433.92 MHz
- SMC5326 25bit - 330.00 MHz
- SMC5326 25bit - 433.92 MHz
- UNILARM 25bit - 330.00 MHz
- UNILARM 25bit - 433.92 MHz

</details>

-----

## DeBruijn<a id="debruijn"></a>

**DeBruijn** generates and transmits De Bruijn sequences based on supported fixed-code Sub-GHz protocols.

Instead of transmitting individual values one by one, the generated sequence combines possible code combinations into a compact transmission sequence for the selected protocol.

The protocol and operating frequency can be selected directly from the interface.

### Supported protocols

<details>
<summary>Show supported DeBruijn protocols</summary>

</details>

-----

## Jukebox<a id="jukebox"></a>

**Jukebox** provides a collection of known Sub-GHz remote-control commands used by compatible jukebox systems.

A command can be selected directly from the interface and transmitted using its predefined signal.

Available commands include playback controls, volume controls, queue management and other supported remote functions.

### Supported commands

<details>
<summary>Show supported Jukebox commands</summary>

</details>

-----

## Jammer<a id="jammer"></a>

**Jammer** is an experimental Sub-GHz interference-testing feature intended for controlled and authorized RF testing environments.

The interface provides different transmission modes, including **Carrier** and **Frame**, allowing the RF output behavior to be selected directly from the settings.

> [!CAUTION]
> Radio-frequency interference may disrupt nearby wireless devices and communications. Use this feature only in controlled environments where you are authorized to perform RF testing, and always comply with applicable local regulations.

-----

## Rolljam<a id="rolljam"></a>

**Rolljam** is an experimental proof-of-concept designed to demonstrate rolling-code capture and synchronization behavior in a controlled testing environment.

The application can collect between **2 and 5 received signals** during a test session and can communicate with a second Willy Firmware device over Wi-Fi to coordinate the testing workflow.

Once the capture session is complete, the collected signals are displayed in a dedicated signal list where they can be inspected and saved to the SD card for later analysis.

> [!CAUTION]
> This feature is intended exclusively for controlled research and authorized testing of systems you own or have permission to evaluate. Radio-frequency interference and unauthorized use of captured signals may be illegal and may disrupt nearby devices.

-----

## Rollback<a id="rollback"></a>

**Rollback** is an experimental proof-of-concept for studying rolling-code behavior and signal sequences in controlled environments.

The application can capture and store between **2 and 5 signals** during a test session. It can also communicate with a second Willy Firmware device over Wi-Fi to coordinate the testing workflow.

After capture, the collected signals are displayed in a dedicated list where individual signals can be inspected and saved to the SD card for later analysis.

A **Sequence** mode is also available to replay a set of captured signals consecutively. The delay between sequence entries can be configured directly from the interface.

> [!CAUTION]
> This feature is intended exclusively for controlled research and authorized testing of systems you own or have permission to evaluate. Unauthorized replay of captured radio signals may be illegal or interfere with nearby systems.

-----

## Rolljam/Rollback Jammer<a id="jam_mode"></a>

**Rolljam/Rollback Jammer** is a companion mode designed to work with the experimental **Rolljam** and **Rollback** proof-of-concept applications.

It allows two Willy Firmware devices to communicate over Wi-Fi so that the secondary device can participate in a coordinated RF test session.

The mode can be controlled remotely by the primary Willy device, allowing the companion device to start and stop its configured test state as the Rolljam or Rollback workflow progresses.

> [!CAUTION]
> Jam Mode is intended exclusively for controlled RF research and authorized testing environments. Radio-frequency interference may disrupt nearby wireless devices and communications and may be restricted or prohibited by local regulations.

-----

## POCSAG Read<a id="pocsag_read"></a>

**POCSAG Read** is a dedicated receiver for capturing and decoding POCSAG pager messages transmitted over Sub-GHz frequencies.

The receiver can monitor POCSAG transmissions independently of the destination **RIC** and automatically decode supported baud rates.

Received messages are stored temporarily in a signal list, allowing each transmission to be inspected individually along with its decoded information and message content.

-----

## POCSAG Send<a id="pocsag_send"></a>

**POCSAG Send** generates and transmits configurable POCSAG pager messages for compatible receivers.

The destination **RIC**, message content and baud rate can be configured directly from the device using the integrated keyboard and settings interface.

This allows custom POCSAG messages to be created and transmitted without requiring an external computer.

> [!CAUTION]
> Transmitting paging signals may be regulated and could interfere with active paging systems. Use this feature only with equipment and frequencies you are authorized to test, and always comply with applicable local regulations.

-----

## Sub-GHz SD<a id="subghz_sd"></a>

**Sub-GHz SD** provides direct access to compatible `.sub` files stored on the SD card.

Files can be browsed directly from the device, opened and transmitted without requiring an external computer.

Both **decoded Sub-GHz protocols and RAW signals** are supported, allowing signals previously captured, generated or copied to the SD card to be reused directly from Willy Firmware.

Willy Firmware uses **Flipper Zero-compatible `.sub` files**, allowing compatible Sub-GHz files to be exchanged and reused between Willy Firmware and Flipper Zero.

-----

### 💡 Infrared<a id="infrared"></a>

<a href="#infrared_learn">Learn</a> •
 <a href="#infrared_remote">Remote</a> •
 <a href="#infrared_tv_b_gone">TV-B-Gone</a> •
 <a href="#infrared_sd">SD</a>

Willy Firmware provides a complete set of **Infrared** tools for receiving, decoding, transmitting and managing IR signals directly from the device.

Infrared signals can be captured from existing remote controls, decoded using supported protocols or stored as RAW timing data when the protocol is unknown.

Captured signals can then be inspected, retransmitted or saved to the SD card for later use.

The Infrared section also includes additional tools such as universal remote-control functions for compatible devices.

-----

## Infrared Learn<a id="infrared_learn"></a>

**Infrared Learn** receives and analyzes infrared signals from compatible remote controls and devices.

When a supported protocol is detected, Willy Firmware automatically decodes the signal and displays its protocol information and associated values.

Signals using an unknown or unsupported protocol can still be captured and stored as **RAW infrared timing data**, allowing them to be reproduced without requiring a dedicated decoder.

Received signals are temporarily stored in a signal list where they can be individually inspected, retransmitted or saved to the SD card for later use.

Signals saved from **Infrared Learn** use the same Flipper Zero-compatible `.ir` file format, allowing compatible infrared files to be exchanged and reused between Willy Firmware and Flipper Zero.

### Supported protocols

<details>
<summary>Show supported Infrared protocols</summary>

- RAW
- NEC
- NECext
- NEC42
- NEC42ext
- Samsung32
- RC6
- RC5
- RC5X
- SIRC
- SIRC15
- SIRC20
- Kaseikyo
- RCA

</details>

-----

## Infrared Remote<a id="infrared_remote"></a>

**Infrared Remote** provides a collection of customizable infrared remote controls loaded directly from the SD card.

Remote controls are organized into different device categories.

Each remote is based on a **Flipper Zero-compatible `.ir` file** stored on the SD card, containing a collection of named infrared commands and their associated signal data.

When a remote is opened, its available commands can be selected and transmitted directly from the device.

Because the remote database is stored on the SD card, additional compatible `.ir` files and commands can be added without modifying or rebuilding the firmware.

<img src="https://raw.githubusercontent.com/h-RAT/Willy_Firmware_V3_T-Embed_CC1101/refs/heads/main/Image/Remote_TV.png" width="49%">
 <img src="https://raw.githubusercontent.com/h-RAT/Willy_Firmware_V3_T-Embed_CC1101/refs/heads/main/Image/Remote_Digital_Sign.png" width="49%">
 <img src="https://raw.githubusercontent.com/h-RAT/Willy_Firmware_V3_T-Embed_CC1101/refs/heads/main/Image/Remote_Projector.png" width="49%">
 <img src="https://raw.githubusercontent.com/h-RAT/Willy_Firmware_V3_T-Embed_CC1101/refs/heads/main/Image/Remote_LED.png" width="49%">
 
 ...

-----

## Infrared TV-B-Gone<a id="infrared_tv_b_gone"></a>

**Infrared TV-B-Gone** is a universal TV power-control feature based on a built-in database of known infrared power signals.

Unlike **Infrared Remote**, the signal database is embedded directly into Willy Firmware and does not require an SD card.

Two regional code databases are available directly from the interface:

- **Region NA** - North America
- **Region EU** - Europe

The application automatically transmits the supported power codes for the selected region, allowing compatible televisions to be controlled without selecting a specific manufacturer or remote profile.

-----

## Infrared SD<a id="infrared_sd"></a>

**Infrared SD** provides direct access to compatible `.ir` files stored on the SD card.

Infrared files can be browsed directly from the device, opened and transmitted without requiring an external computer.

Both **decoded Infrared protocols and RAW signals** are supported, allowing previously captured or imported infrared signals to be reused directly from Willy Firmware.

Willy Firmware uses **Flipper Zero-compatible `.ir` files**, allowing compatible Infrared files to be exchanged and reused between Willy Firmware and Flipper Zero.

-----

### 🟦 Bluetooth / BLE<a id="bluetooth"></a>

Willy Firmware provides a set of **Bluetooth Low Energy (BLE)** tools for device discovery, advertisement analysis and BLE payload testing.

Nearby BLE devices can be scanned and inspected directly from the device, while dedicated testing tools can generate configurable BLE advertisement payloads.

-----

## BLE Spam<a id="bluetooth_spam"></a>

**BLE Spam** is an experimental BLE advertisement testing tool capable of transmitting different types of predefined advertising payloads.

A payload type can be selected directly from the interface, while the delay between transmissions can be adjusted from the settings.

### Supported payload types

- Apple Device Popup
- Apple Action Modal
- Apple NotYourDevice
- Google Fast Pair
- Microsoft Swift Pair
- Samsung Buds
- Samsung Watch
- Xiaomi QuickConnect
- Pair Spam
- Rickroll Pair Spam

> [!CAUTION]
> This feature generates BLE advertisements that may trigger notifications or pairing prompts on nearby compatible devices. Use it only in controlled and authorized testing environments.

-----

## BLE Scan<a id="bluetooth_scan"></a>

**BLE Scan** discovers nearby Bluetooth Low Energy devices and collects information from their advertisements.

Detected devices are temporarily stored in a dedicated list where each result can be selected and inspected individually.

The detailed result view provides available information about the detected device, including:

- Device name
- Detected device or advertisement type
- MAC address
- RSSI and estimated distance
- Bluetooth address type
- Advertisement event type
- Manufacturer information
- Recognized manufacturer-specific data

This provides a convenient way to discover and inspect nearby BLE advertisements directly from Willy Firmware.

-----

### 📶 Wi-Fi<a id="wifi"></a>

<a href="#wifi_ssid_spam">SSID Spam</a> •
 <a href="#wifi_evil_portal">Evil Portal</a> •
 <a href="#wifi_sniffer">Sniffer</a>

Willy Firmware provides a collection of **Wi-Fi tools** for wireless network discovery, packet analysis and controlled network testing.

The Wi-Fi section includes tools for generating test access-point advertisements, hosting a local interactive portal and discovering nearby access points and stations.

-----

## SSID Spam<a id="wifi_ssid_spam"></a>

**SSID Spam** is an experimental Wi-Fi testing tool that generates multiple advertised network names (SSIDs).

Several name-generation modes are available directly from the interface:

- **Random** - Generates randomized SSID names.
- **Rickroll** - Uses a predefined Rickroll-themed SSID sequence.
- **Default** - Uses the built-in default SSID list.

This provides a simple way to test Wi-Fi scanning and network-list behavior with multiple simulated network names.

> [!CAUTION]
> Use this feature only in controlled and authorized testing environments.

-----

## Evil Portal<a id="wifi_evil_portal"></a>

**Evil Portal** creates a local Wi-Fi access point and hosts an interactive HTML page directly from the device.

A default HTML page is included, allowing the feature to be used without requiring additional files or configuration.

Responses submitted through the hosted page are received by Willy Firmware and displayed directly in the device logs, making it possible to observe and compare submitted test data in real time.

This feature is intended for controlled captive-portal development, interface testing and authorized Wi-Fi research.

> [!CAUTION]
> Do not use this feature to impersonate legitimate services or collect information from users without their knowledge and authorization.

-----

## Sniffer<a id="wifi_sniffer"></a>

**Sniffer** discovers and analyzes nearby Wi-Fi devices and traffic directly from Willy Firmware.

The scanner can operate in different discovery modes:

- **Access Point** - Focuses on nearby Wi-Fi access points.
- **Station** - Focuses on client stations observed on Wi-Fi networks.

Scanning can be performed across **all available channels** or restricted to a specific Wi-Fi channel.

Detected devices are stored in a dedicated result list where each entry can be opened and inspected individually to display the available network and device information.

The result interface also includes an experimental **Deauthentication test** option for authorized wireless-network testing.

> [!CAUTION]
> Deauthentication frames can disconnect devices from a Wi-Fi network. Use this functionality only on networks and devices you own or have explicit authorization to test.

-----

### 📱 NFC<a id="nfc"></a>

🚧 Documentation and firmware in progress.

-----

### ⌨️ Bad USB<a id="bad_usb"></a>

**Bad USB** allows Willy Firmware to emulate a USB keyboard and execute scripted keyboard commands on a connected device.

Payloads are stored as `.txt` files on the SD card and can be selected directly from the device before execution. The selected script is then interpreted and its keyboard commands are sent to the connected computer through USB.

The keyboard **layout** can also be configured directly from the interface allowing the same payload to be adapted to different keyboard configurations.

Willy Firmware uses a **DuckyScript-compatible** payload format, making it possible to reuse compatible Bad USB scripts and payloads from other supported devices.

> [!CAUTION]
> Bad USB scripts can perform actions on the connected device as if they were entered through a physical keyboard. Only execute payloads on device you own or have explicit authorization to test.

-----

### 🛰️ nRF24<a id="nrf24"></a>

<a href="#nrf24_analyzer">Analyzer</a> •
 <a href="#nrf24_wifi_jam">WiFi Jammer</a> •
 <a href="#nrf24_ble_jam">BLE Jammer</a> •
 <a href="#nrf24_drone_jam">Drone Jammer</a> •

The nRF24 is a 2.4 GHz transceiver used by the T-Embed CC1101 Plus to provide additional wireless functionality beyond the integrated WiFi/BLE.

Willy Firmware uses the nRF24 for 2.4 GHz spectrum analysis and experimental wireless testing features, with dedicated applications for Wi-Fi, Bluetooth/BLE and other 2.4 GHz technologies.

> [!NOTE]
> nRF24 functionality requires the LILYGO T-Embed CC1101 Plus. The standard T-Embed CC1101 does not include the additional nRF24 radio.

-----

## Analyzer<a id="nrf24_analyzer"></a>

**Analyzer** is a 2.4 GHz activity analyzer based on the nRF24 radio.

The analyzer monitors the nRF24 channel range and displays the detected RF activity directly on a real-time bar chart. Each bar represents one of the monitored nRF24 channels, allowing activity across the 2.4 GHz range to be visualized at a glance.

The chart is continuously updated while the analyzer is running, providing a live representation of detected wireless activity.

-----

## WiFi Jammer<a id="nrf24_wifi_jam"></a>

**WiFi Jammer** is an experimental 2.4 GHz RF interference-testing feature using the nRF24.

The target can be configured to cover the Wi-Fi 2.4 GHz channel range or to focus on the channels associated with a previously scanned Wi-Fi network.

The transmission behavior can be customized through several settings:

### Target:
- Wi-Fi 2.4 GHz channels
- Previously scanned SSID channels

### Mode:
- **Const Carrier** - Continuous carrier transmission mode.
- **Data Flooding** - Repeated data transmission mode.
- **Turbo Flood** - High-speed data transmission mode.
- **AFH Exhaust** - Designed to continuously cover channels used by adaptive-frequency systems.

### Settings:
- **Data Rate** - Selects the nRF24 transmission data rate.
- **Packet Delay** - Configures the delay between transmissions.
- **Packets** - Selects the number of packets handled per transmission cycle, from 1 to 20.

This provides several configurable RF transmission patterns for controlled 2.4 GHz wireless testing.

> [!CAUTION]
> 2.4 GHz interference may disrupt nearby wireless devices and communications. Use this feature only in controlled environments where you are authorized to perform RF testing, and always comply with applicable local regulations.

-----

## BLE Jammer<a id="nrf24_ble_jam"></a>

**BLE Jammer** is an experimental 2.4 GHz RF interference-testing feature focused on Bluetooth and Bluetooth Low Energy environments.

The transmission target can be selected according to the type of Bluetooth traffic being tested:

### Target:
- **BLE Data** - Targets channels used for BLE data communication.
- **BLE Advertising** - Targets the advertising channels used by Bluetooth Low Energy.
- **Classic** - Targets the channel range used by Bluetooth Classic.

The transmission behavior can be customized through several settings:

This provides several configurable RF transmission patterns for controlled 2.4 GHz wireless testing.

> [!CAUTION]
> 2.4 GHz interference may disrupt nearby Bluetooth and BLE devices and communications. Use this feature only in controlled environments where you are authorized to perform RF testing, and always comply with applicable local regulations.

-----

## Drone Jammer<a id="nrf24_drone_jam"></a>

**Drone Jammer** is an experimental 2.4 GHz RF interference-testing feature designed to explore different types of wireless systems commonly operating in the 2.4 GHz band.

The target can be selected according to the type of wireless system being tested:

### Target:
- **Drone FHSS** - Targets frequency-hopping systems used by compatible drone communication links.
- **RC Controller** - Targets the 2.4 GHz channel range commonly used by remote-control systems.
- **Video / FPV** - Targets 2.4 GHz wireless video and FPV communication systems.
- **Zigbee** - Targets channels used by Zigbee networks in the 2.4 GHz band.

The transmission behavior can be customized through several settings:

This provides several configurable RF transmission patterns for controlled 2.4 GHz wireless testing.

> [!CAUTION]
> 2.4 GHz interference may disrupt nearby drones, remote-control systems, video links, Zigbee networks and other wireless devices. Use this feature only in controlled environments where you are authorized to perform RF testing, and always comply with applicable local regulations.

-----

### ⚙️ Settings<a id="settings"></a>

<a href="#about">About</a> •
 <a href="#brightness">Brightness</a> •
 <a href="#color">Color</a> •
 <a href="#pin_code">PIN Code</a> •
 <a href="#usb_mode">USB Mode</a> •
 <a href="#shutdown">Shutdown</a> •
 <a href="#reboot">Reboot</a>

The **Settings** section provides access to device information, interface customization, security options and system controls.

Most configurable preferences are stored directly on the device and automatically restored after reboot.

-----

## About<a id="about"></a>

**About** provides an overview of the device's current hardware and system status.

It displays useful real-time information including **RAM usage, SD card capacity, battery level, battery voltage (mV), current consumption (mA) and device uptime**.

This screen provides a quick way to monitor the device's resources, power status and operating time directly from Willy Firmware.

-----

## Brightness<a id="brightness"></a>

**Brightness** allows the display backlight intensity to be adjusted directly from the device.

The selected brightness level is saved in the device settings and automatically restored after reboot.

-----

## Color<a id="color"></a>

**Color** allows the main interface color to be customized directly from the device.

A color can be selected using the integrated color picker, allowing the appearance of Willy Firmware to be personalized according to the user's preference.

The selected color is saved in the device settings and automatically restored after reboot.

-----

## PIN Code<a id="pin_code"></a>

**PIN Code** provides an optional security lock for Willy Firmware.

When enabled, a custom PIN code can be configured and stored in the device settings. The PIN will then be required to unlock the device after startup.

The integrated on-screen keyboard is used to enter and manage the PIN directly from the device.

-----

## USB Mode<a id="usb_mode"></a>

**USB Mode** turns the device into a USB mass storage device, allowing the inserted SD card to be accessed directly from a connected computer.

Once enabled, the SD card appears on the computer as a removable USB drive, making it easy to browse, copy, add or manage files without removing the SD card from the device.

-----

## Shutdown<a id="shutdown"></a>

**Shutdown** safely powers off the device directly from Willy Firmware.

Once the device is powered off, it can be turned back on by pressing 3x the **OK button**

-----

## Reboot<a id="reboot"></a>

**Reboot** restarts the device and reloads Willy Firmware.

This can be used to quickly restart the system after changing settings or whenever a fresh firmware initialization is required.

-----

# Development Status

**Willy Firmware V3 is currently under active development.**

Most core functionality is already implemented and functional, but applications, protocols and documentation may continue to evolve as development progresses.

More screenshots and detailed feature documentation will be added as additional sections of the firmware are finalized.

<h1 align="center">From Willy Firmware V2 to V3</h1><a id="fromwilly"></a>

**Willy Firmware V3 is the successor to Willy Firmware V2.**

V2 was developed around the **ESP32 T-Display-S3** with external hardware such as the CC1101.

V3 has been redesigned specifically around the **LILYGO T-Embed CC1101 platform**, providing much tighter integration between the firmware and the hardware.

Compared with V2, V3 introduces or improves:

- Native LILYGO T-Embed CC1101 support
- T-Embed CC1101 Plus support
- Integrated NFC support
- nRF24 support on compatible hardware
- Improved graphical interface
- Rotary encoder navigation
- Improved SD card integration
- Expanded Sub-GHz protocol support
- Persistent device and interface settings
- Improved hardware and shared SPI management
- A firmware architecture designed specifically around the T-Embed platform

The previous generation of Willy Firmware remains available here:

**[Willy Firmware V2 – ESP32 Flipper Zero Alternative](https://github.com/h-RAT/Willy_Firmware_V2_ESP32_Flipper_Zero_Alternative)**

-----

<h1 align="center">Contact</h1><a id="contact"></a>

<h4 align="center">Website: https://willy-firmware.com/</h4>

-----

<h1 align="center">Disclaimer</h1><a id="disclaimer"></a>

Willy Firmware is intended for **educational, research and authorized security-testing purposes**.

Some features interact with radio-frequency, infrared, NFC, Bluetooth and Wi-Fi systems. Users are responsible for ensuring that their use of the firmware complies with applicable laws and regulations.

Do not use Willy Firmware to interfere with, access, test or control systems without authorization.

The developer assumes no responsibility for misuse of the firmware or for damages resulting from its use.

Willy_Firmware_V3_T-Embed_CC1101

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Willy_Firmware_V3_T-Embed_CC1101

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README