Main changes

• Current API: 88.19
• iButton: Choose which blanks a write may target - new Settings -> Write Blanks list in the iButton app, where RW1990.1, RW1990.2, TM2004 and TM01x can each be switched on or off; a write then only tries the enabled ones instead of every blank type in turn, and the write screen names the type it is currently attempting rather than showing an unlabelled "Writing ID" throughout. Each attempt that is not the blank in front of you costs real time (RW1990.1/.2 about 900 ms each, TM01x about 335 ms), so narrowing the list is the difference between a write that lands right away and one that walks the whole sequence first. Writing with nothing enabled, or with nothing enabled that the loaded key can actually be written to, says so instead of blinking forever. The choice is saved and is honoured by the ibutton CLI as well (by @mishamyte | PR #1153 | Closes #1152)
• RFID: Add Manually by facility code and card number - picking a format under Add Manually now asks whether to enter the card as FC/ID or as hex. FC/ID takes the numbers printed on the card, one number input per field, and builds the data itself: EM4100 (all clocks), HID H10301 and the HID formats below, ioProx XSF (with its version), AWID and Pyramid 26-bit, and Gallagher (with region code and issue level). Formats without such a layout go straight to hex as before (by @matthewb-worthe | PR #1149)
• RFID: HID H10302, H10304, H10306, AMAG S10401 and Corporate 1000 35-bit now read - a Generic HIDProx card of one of these lengths whose parity checks out shows its FC and card number on the read and saved-card screens, one line per format the frame fits (a 37-bit card can fit more than one). The formats are listed under Add Manually too, entered by FC/ID and saved as HIDProx. The "Data:" line of HIDProx cards is gone: it repeated the hex shown above it and lost bits after the first digit on 37-, 35- and 26-bit frames (by @matthewb-worthe | PR #1149)
• RFID: Casi-Rusco C10106 badges now read - the badges are EM4100 frames, so an EM4100 read whose 40 bits fit the badge layout gets an "or C10106: credential card" line under the EM4100 text, the twelve-digit badge id split as the access system prints it. There is no parity to check, so it is one possible reading; it is only shown for credentials beginning with 15, as the badges are numbered, which keeps it off almost all other EM4100 cards. Add Manually gets a Casi-Rusco C10106 entry that takes the two numbers and saves an EM4100 card at RF/32, the clock the badges use (by @matthewb-worthe | PR #1149)
• GUI: Number input starts on a value it accepts - a number input whose range excludes 0, such as 1-26, opened on an empty field that the Save key refused, so there was no way to confirm anything until a digit was typed. It now starts on the nearest value the range allows, and an empty field reads as 0 and is accepted or refused like any other value. Applies to every app using the widget, including JS apps (by @matthewb-worthe | PR #1149)
• RFID: Choose which chips a write may target - new Settings -> Write Chips list in the 125 kHz RFID app, where T5577, EM4305 and each Hitag micro / ID82xx variant (8265, 8210, H5.5) can be switched on or off; a write then only tries the enabled ones instead of every chip in turn, which cuts the wait when the blank in front of you is not the first one on the list (each attempt that is not the chip present costs a verify read of up to 2 s). Writing with nothing enabled, or with nothing enabled that the protocol can actually be written to, says so instead of retrying forever. The choice is saved and is honoured by the rfid CLI as well (by @mishamyte | PR #1146 | Closes #1145)
• RFID: Write an EM4100 id onto a Hitag S / ID8268 clone - the ID82xx "china clone" Hitag S chips (F8268, 8211 and relatives) join T5577, EM4305 and the Hitag micro variants as a write target, so a saved EM4100 key can be cloned onto one from the 125 kHz RFID app and the rfid CLI. This chip is switched OFF by default - turn "8268" on in Settings -> Write Chips to use it. That is deliberate: pages 4 and 5 hold application data on a genuine Hitag S, nothing the Flipper can read tells a genuine tag from a clone, and unlike the blind writers this one selects whatever tag answers - so cloning a key with a real Hitag S in range must not silently overwrite it. It is also the only target that checks before it writes: SELECT needs the tag's own UID, so the Flipper reads and confirms that first, and skips the attempt when no such chip is in range instead of waiting out a verify read. EM4100 at RF/64 only, the rate the chip's factory config emits (by @mishamyte | PR #1148 | Closes #1147)
• SubGHz: Genius remotes now work - Genius uses the same frame as Faac SLH but its own key, so a Genius remote used to show the wrong counter and could not be resent. Add a Manufacture: Genius line to the .sub file next to its Seed: and it reads and sends properly, with the signal screen saying Genius instead of Faac SLH. Genius 433MHz and Genius 868MHz are new in Add Manually
• SubGHz: Monarch and KEY remotes are read and resent properly now - both used to come up as Unknown. Monarch covers the Dorcas 22366CLN, and KEY is new in Add Manually as KL: KEY 433MHz. Monarch remotes differ from each other in one value, so Advanced Add Manually asks for it (Enter DISC.) and a received signal keeps whatever its remote used
• SubGHz: New protocol KeyFinder2 - the colour-button key finder fobs the existing KeyFinder decoder could not read. Shows the button colour next to the code, unverified: the colour names come from a single four button fob, so another fob may name them differently
• SubGHz: Nord ICE remotes send the full pair, and their other buttons - a press puts two frames on air that differ in one bit, and only one of them was ever resent; both are rebuilt from a single key, so files saved by an earlier build transmit the pair unchanged, and the bit and gap timings now match the remote. The arrows on the send screen reach the remote's other three buttons, the button editor works, and saving keeps whichever button was sent. Nord ICE 433MHz is in Add Manually too, generated on button 4
• SubGHz: HomeGate remotes now work - new KeeLoq manufacturer key, so these remotes read and send properly. HomeGate 433MHz is in Add Manually too
• SubGHz: Prastel 433MHz is new in Add Manually, generated on button 1. The arrows on the send screen now reach the remote's other three buttons and the button editor works - the button map is unverified, it follows the other four button remotes
• SubGHz: Nice O-Code 433MHz is new in Add Manually - Advanced asks for the installer code (Enter IC) so a remote can be made for a gate you already have. The Nice O-Code app, which recovers that code from a remote, now has New next to Save: it writes a second remote with the same code and button but its own serial and a fresh counter, so it works alongside your original instead of fighting it
• SubGHz: New app - Seed Capturer - collects the Fix + Hop pairs an offline seed recovery needs from a FAAC SLH, Genius or Erreka remote, under Apps -> Sub-GHz. Pick the manufacturer and 433.92 or 868.35 MHz AM650, then press the remote's button over and over: it locks onto the first Fix it hears and keeps every distinct Hop under it, up to 10. Two hops are enough to save, more narrow the search. Captures go to /ext/apps_data/subghz_seed_captures for the qUnleashed app to recover the seed from
• Main menu: Two new menu styles - Macintosh and 3D - pick them in Settings -> Desktop -> Menu Style. Macintosh is a classic Mac OS desktop - title bar with the Flipper's name, icon grid, paged with arrows; 3D is a carousel that flies the icons along a path with the selected one zoomed in front. Both are reimplementations of MIT-licensed Arduboy/Arduino originals: Ardutosh by @jhhoward and the 3D OLED menu by @upiir (by @apfxtech | PR #1155)
• SubGHz: New protocol Doorbell32 - unbranded 433MHz doorbells. KeyFinder, KeyFinder2 and Doorbell32 are all in the Sensors ignore group
• SubGHz: KeeLoq Erreka programming mode - the 0xF button now sends the seed in the clear like the original remote, same as BFT, and the seed is saved with the signal so the hops can be rebuilt. Erreka 868MHz joins Erreka 433MHz in Add Manually, for the IRIS IR02/868 and IR04/868 remotes
• NFC: Texkom (Техком) keys now read and emulate - the 13.56 MHz intercom fobs, in TK13, TK15, TK17 and MMBIT flavours. Read one and you get its UID, which variant it is and whether its checksum is valid; save it and it emulates. TK13, TK17 and MMBIT can also be made up in Add Manually. Writing to a blank is not supported (by @mishamyte)
• SubGHz: Longer 112bit Nice O-Code frames are read by the Nice O-Code app now. O-Code is shown in Read as a raw key with a note to use that app, instead of a Nice One with a random serial, and Save and Send are hidden for it since without the installer code there is nothing to rebuild it from
• SubGHz: Nice Flor-S, Nice One, Came Atomo and Beninca ARC remotes show one entry per press in Read instead of one per frame, and Nice O-Code is told apart from Flor-S and Nice One properly now
• SubGHz: The Nice O-Code and Security+ PIN apps support external radio modules now
• Apps: Build tag (14oct2026) - Check out more Apps updates and fixes by following this link

Other changes

• OFW: NFC: FeliCa emulation and reading are more robust - an emulated card no longer goes quiet for the rest of a reader's session after it turns one command down, a Standard card answers Polling only for the System Codes its own dump holds and can switch System by IDm, a bad read or write gets the proper error status instead of no answer, writes refuse read-only services and either land in full or not at all, blocks above 255 are addressed properly, and reader timeouts follow what the card declares in its PMm (OFW PR 4465 | by @kormax)
• OFW: NFC: A FeliCa Standard card's system key version is the system's own now, not the root area's - it was filled in from area 0000, a different node with a different key, so the Key version shown for a system was wrong on every card where the two differ. The system node 0xFFFF is queried directly, in the same Request Service batch as the areas and services, and an emulated card answers that node from the stored system key version. The FeliCa file format is at version 4 because of it: a file saved by an earlier build holds the root area's key version on its system line, so that value is no longer read back as the system's and the field shows as unknown until the card is read again (OFW PR 4462 | by @kormax)
• NFC: The nfc CLI no longer reboots the Flipper on an EMV card - the CLI keeps its own table of protocol names and EMV was never added to it, so scanning, dumping or emulating one printed a null string and hard-faulted. A protocol missing from that table now fails loudly where it is looked up instead of taking the device down (by @mishamyte)
• NFC: Add Manually no longer reboots the Flipper on a card that is not NFC-A - the generated-card screen assumed every generator produced an ISO14443-3A descendant and read that data unconditionally; the check that was meant to catch otherwise is compiled out of a release build. It reads the UID through the generic accessor now (by @mishamyte)
• RPC: Storage read can ask for a range - a read request takes an offset and size, so a companion app can fetch part of a file instead of all of it (by @apfxtech | PR #1174)
• Docs: SubGHzRemoteProg.md rewritten - 27 systems in alphabetical order with a jump table, 17 of them new, a table of which key sends each protocol's programming button, and how to use the Seed Capturer app with FAAC SLH, Genius or Erreka and recover the seed in qUnleashed afterwards
• Build: An app that embeds plugins builds a second time instead of failing - the plugin staging dir is a VariantDir of the app's source dir, so globbing it named source paths that never exist; each plugin's staged .fal is a direct dependency now (original implementation by @RogueMaster)
• Build: Adding or removing a file asset rebuilds the .fap that embeds it - assets are enumerated the way they are bundled, so the dependencies match what ends up in the binary (original implementation by @RogueMaster)
• Build: A recursive source glob walks each app tree once instead of once per source pattern (original implementation by @RogueMaster)
• Build: macOS leaves .DS_Store and ._* sidecars in any folder it touches, and they are skipped now instead of being embedded in a .fap, listed in the resources Manifest, packed into the update tarball or compiled in as an icon - an ._*.png next to a real icon used to fail the build outright
• NFC: MIFARE DESFire Light is recognised instead of coming up as ISO14443-4A (Unknown) - the card takes only ISO 7816-wrapped commands and answers a plain native frame with SW 6700 ("wrong length"), so every DESFire command the firmware sent was refused and nothing in the ISO14443-4A family claimed the card. DESFire now settles on whichever command mode the card answers, keeping the plain frames the EV series expects and falling back to wrapping only when the card refuses the frame itself. Its own hardware type (0x08) is accepted too, so it reads as Mifare DESFire Light. Light has no PICC-level free memory, key settings or key versions - it answers 0x1C to all three - so the read now carries on without the fields a card refuses rather than failing, and the info screen says the card has a single fixed application instead of blaming authentication. A status code the firmware does not model is reported as a refusal by the card rather than as a broken exchange, so a card leaving the field mid-read can no longer be saved as a thin successful one. Detection relies on GetVersion alone, whose 28-byte layout and hardware type already tell DESFire apart from MIFARE Plus and NTAG 4xx. Reading the Light's file contents is not part of this (by @mishamyte)
• GUI: Loading screen can show a label next to the spinner (by @mishamyte | PR #1169 | Closes #1168)
• NFC: Show progress while a large per-UID (CUID) dictionary loads on Read (by @mishamyte | PR #1167 | Closes #1166)
• LF RFID: A Write Chips settings file saved by a newer firmware no longer confuses the write screen - a build that knows fewer chips still accepts the file, and used to keep the bits for chips it does not have; they are dropped as the file is read now. With every chip this build knows switched off but a newer-only one still set, a write said "No enabled chip can write this protocol" instead of "No write chips enabled. Enable one in Settings". Apps reading the setting through the API now only see chips their firmware has (by @mishamyte | PR #1164 | Fixes #1154)
• NFC: What a reader writes to an emulated FeliCa card is kept again - the check that decides whether emulation changed the card passed an element count where a byte count was wanted, so only the first byte of the system list was ever compared; blocks a reader wrote into an emulated FeliCa Standard card read back as unchanged and were dropped instead of being kept in the shadow file. That length is element-aware now, and the FeliCa system and DESFire application lists - whose entries own nested arrays, so comparing their bytes only compares pointers - are compared entry by entry (by @MNeroba | PR #1107)
• NFC: The MIFARE Classic dictionary attack ends as soon as the card is fully read - a card that reuses the same keys across its sectors is often solved by the key reuse pass while the attack is still on sector 0, but it used to walk every remaining sector with the counters already full, and then start the next dictionary phase on a card with nothing left to find, which looked stuck. With a per-UID dictionary those leftover sectors also cost a scan of that dictionary for every key index (by @mishamyte | PR #1151 | Fixes #1150)
• SubGHz: Better checks on ext module init in CLI
• SubGHz: Sending a receive-only signal from the mobile app or qFlipper no longer crashes the Flipper - the Send button on the device is hidden for a protocol the firmware can decode but not encode, while the RPC path has no such check, so asking the Flipper to transmit a saved iDo 117/111 file reached the transmit path, found no encoder to allocate, and then handed that NULL to a free that requires a real instance. It is reported as an error now, and the transmitter pointer is cleared after every teardown instead of being left dangling (by @MNeroba | PR #1104)
• SubGHz: An unknown radio preset is an error instead of a crash now - the preset lookup in lib/subghz reports a miss rather than taking the device down, and loading a key or starting TX/RX fails with the unknown-preset error those paths already had; Add Manually -> Security+ 2.0 also stopped leaking a transmitter on every generated key (Closes #1159 | Closes #1161)
• LF RFID: Keri tags now read correctly - the PSK slicer reports one level ~135us long on a frame as unbalanced as Keri's, so every run of ones decoded a bit too long and no genuine Keri card read at all, not even one the Flipper had just written; the skew is corrected both ways round now, and the two frames in the register must agree before a read is accepted, since Keri carries no parity or checksum (OFW PR 4449 | by @mfcarroll)
• LF RFID: Capture durations are now exact - the counter had no hardware zero, so the origin was written by software inside the capture ISR, one interrupt latency after the edge the hardware had already latched, and every duration handed to a decoder read ~1.7us short; the counter free-runs now and consecutive captures are differenced. Every decoder quantises each duration and rounded the bias away, so no read changes - it is margin for anything measuring absolute time (OFW PR 4442 | by @mfcarroll)
• NFC: Emulating a card straight from Favorites awards Dolphin XP, like emulating it from NFC -> Saved already did (OFW PR 4448 | by @peakji)
• HID: Mouse Jiggler and Mouse Jiggler (Stealth) stop when you press Stop - the timer was left firing into an empty callback until you closed the screen. Leaving the screen now clears the running state too, so re-opening it no longer shows a highlighted "Stop" for a jiggler that is not running, where the first press only put the label back. Over Bluetooth the jiggler waits for the link instead of sending into nothing, and a connection completing while the app is still starting is no longer missed; Stealth movement is never zero on an axis, so a scheduled jiggle always moves (by @MNeroba | PR #1112)
• OFW: RPC: An app can no longer be handed a forged RPC context - an app started in RPC mode is given its session as an address inside the launch argument string, so a crafted RPC <hex> argument could hand an app any pointer and have it write through it. Live sessions are tracked now, an argument that looks like a context but names no live session is refused, and the callback setter checks the session under the same lock that stops it being freed mid-call
• OFW: NFC: An NDEF SmartPoster that nests itself no longer overflows the stack - a SmartPoster holds a nested NDEF message, parsed by recursing into it, and nothing stopped a card from nesting them as deep as it liked. The depth is capped at 8 now, and a record below that says "Nesting too deep" instead of taking the parser down with it
• OFW: NFC: A saved DESFire file whose access rights are longer than the field that holds them is refused instead of being read past the end of it
• OFW: iButton: A saved key naming a protocol this build does not have is refused on load, instead of being looked up by an invalid protocol id
• OFW: Storage: A read error part way through unpacking a .tar is treated as a failure - the negative error code the read returns was handed to the write as a length
• LF RFID: LFRFIDProtocolIndala224 moved to the end of the protocol enum - it had been inserted after Indala26, which shifted the id of every protocol after it, so an app built against a different SDK version acted on the wrong protocol. Saved cards are unaffected: the files name their protocol, they do not store its id
• API: mf_desfire_send_chunks is an exported function again - the deprecated name became a macro alias when the poller function was renamed, which took it out of the API table and left apps calling it unable to link. It is a wrapper around mf_desfire_poller_send_chunks now, so both names work
• OFW: Build: fap_dist no longer races the dist commands - a dist command wipes dist/<flavor> when it starts, so installing the faps is ordered after the dist commands the build is running
  
  
  

-> How to install firmware

-> Unleashed FW Web Installer

Please support development of the project

Service	Remark	QR Code	Link/Wallet
Patreon			patreon.com/mmxdev
Boosty	patreon alternative		boosty.to/mmxdev
CloudTips	only RU payments accepted		pay.cloudtips.ru/p/7b3e9d65
YooMoney	only RU payments accepted		yoomoney.ru/fundraise/XA49mgQLPA0.221209
USDT	TRC20		TSXcitMSnWXUFqiUfEXrTVpVewXy2cYhrs
ETH	BSC/ERC20-Tokens		0xFebF1bBc8229418FF2408C07AF6Afa49152fEc6a
BTC			bc1q0np836jk9jwr4dd7p6qv66d04vamtqkxrecck9
SOL	Solana/Tokens		DSgwouAEgu8iP5yr7EHHDqMNYWZxAqXWsTEeqCAXGLj8
DOGE			D6R6gYgBn5LwTNmPyvAQR6bZ9EtGgFCpvv
LTC			ltc1q3ex4ejkl0xpx3znwrmth4lyuadr5qgv8tmq8z9
BCH			qquxfyzntuqufy2dx0hrfr4sndp0tucvky4sw8qyu3
XMR	Monero		41xUz92suUu1u5Mu4qkrcs52gtfpu9rnZRdBpCJ244KRHf6xXSvVFevdf2cnjS7RAeYr5hn9MsEfxKoFDRSctFjG5fv1Mhn
TON			UQCOqcnYkvzOZUV_9bPE_8oTbOrOF03MnF-VcJyjisTZmsxa

Thanks to our sponsors who supported project in the past and special thanks to sponsors who supports us on regular basis

@mishamyte, ClaraCrazy, Pathfinder [Count Zero cDc], callmezimbra, Quen0n, MERRON, grvpvl (lvpvrg), art_col, ThurstonWaffles, Moneron, UterGrooll, LUCFER, Northpirate, zloepuzo, T.Rat, Alexey B., ionelife, ...
and all other great people who supported our project and me (xMasterX), thanks to you all!

Recommended update option - Web Updater

What e, , c means? What I need to download if I don't want to use Web updater?

What build I should download and what this name means - flipper-z-f7-update-unlshd-094(e / c).tgz ?

flipper-z = for Flipper Zero device

f7 = Hardware version - same for all flipper zero devices

update = Update package, contains updater, all assets (plugins, IR libs, etc.), and firmware itself

unlshd-094 = Firmware version

To enable RGB Backlight support go into LCD & Notifications settings

⚠️RGB backlight hardware mod, works only on modded flippers! do not enable on non modded device!

Firmware Self-update package (update from microSD) - flipper-z-f7-update-unlshd-094.tgz for mobile app / qFlipper / web

Archive of scripts folder (contains scripts for FW/plugins development) - flipper-z-any-scripts-unlshd-094.tgz

SDK files for plugins development and uFBT - flipper-z-f7-sdk-unlshd-094.zip

Install FW via Web Updater:

Default >

Extra apps > e

No apps > c