https://github.com/pingequalab/rf-lab
Open-source 2.4 GHz spectrum analyzer + NRF24 Jammer for Flipper Zero. Plug-and-play across every firmware. Built for the PINGEQUA 2-in-1 RF Devboard.
https://github.com/pingequalab/rf-lab
2-4ghz ble flipper-zero flipper-zero-fap jammer nrf24 nrf24l01 pingequa reactive-jamming rf spectrum-analyzer wifi-jammer
Last synced: 1 day ago
JSON representation
Open-source 2.4 GHz spectrum analyzer + NRF24 Jammer for Flipper Zero. Plug-and-play across every firmware. Built for the PINGEQUA 2-in-1 RF Devboard.
- Host: GitHub
- URL: https://github.com/pingequalab/rf-lab
- Owner: pingequalab
- License: mit
- Created: 2026-05-05T01:31:55.000Z (about 2 months ago)
- Default Branch: main
- Last Pushed: 2026-06-12T01:50:30.000Z (21 days ago)
- Last Synced: 2026-06-12T02:13:11.295Z (21 days ago)
- Topics: 2-4ghz, ble, flipper-zero, flipper-zero-fap, jammer, nrf24, nrf24l01, pingequa, reactive-jamming, rf, spectrum-analyzer, wifi-jammer
- Language: C
- Homepage: https://www.pingequa.com/products/flipper-zero-nrf24-cc1101-2-in-1-rf-devboard
- Size: 5.68 MB
- Stars: 20
- Watchers: 1
- Forks: 0
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md
Awesome Lists containing this project
README
The Hardware · 2-in-1 NRF24 + CC1101
Live Demo · Scanner · Signal Gen · About
# PINGEQUA RF Lab
### Plug-and-play across every firmware.
**2.4 GHz spectrum analyzer + NRF24 jammer for Flipper Zero, designed for the [PINGEQUA 2-in-1 RF Devboard](https://www.pingequa.com/products/flipper-zero-nrf24-cc1101-2-in-1-rf-devboard?utm_source=github&utm_medium=readme&utm_campaign=rflab&utm_content=hero).**
[](https://flipperzero.one/)
[](https://github.com/pingequalab/rf-lab/releases/latest)
[](#firmware-compatibility)
[](dist/)
[](LICENSE)
[](https://www.pingequa.com/products/flipper-zero-nrf24-cc1101-2-in-1-rf-devboard?utm_source=github&utm_medium=readme&utm_campaign=rflab&utm_content=badge)
[**🛒 Get the Hardware**](https://www.pingequa.com/products/flipper-zero-nrf24-cc1101-2-in-1-rf-devboard?utm_source=github&utm_medium=readme&utm_campaign=rflab&utm_content=cta_top) · [**📦 Download FAP**](../../releases) · [**📖 Quickstart**](docs/QUICKSTART.md) · [**❓ FAQ**](docs/FAQ.md)
---
## What It Does
An open-source Flipper Application Package (FAP) that turns Flipper Zero plus the PINGEQUA 2-in-1 RF Devboard into:
- **2.4 GHz spectrum analyzer** — 126 channels real-time with WiFi 1/6/11 + BLE 37/38/39 band markers, max-hold, microsecond dwell tuning, cursor inspection, **CSV scan export** (long-press OK, v0.5.0+)
- **NRF24 jammer with 7 modes** (v0.4.0+):
- CW Custom · BLE Adv · **BLE React** (RPD reactive — first on Flipper NRF24) · WiFi 1/6/11 (CW band hop) · ALL 2.4G
- Disrupts nearby BLE / 2.4 GHz WiFi at close range
- **Auto session log** + **mode/channel persistence** (v0.5.0+)
- **Human-readable export filenames** (v0.5.2+) — `scan__
---
## How It Compares
| Feature | PINGEQUA RF Lab | Legacy NRF24 scanner apps |
|---|:---:|:---:|
| Built for dual-chip 2-in-1 boards | ✅ | ❌ Single-chip designs only |
| Plug-and-play across all major firmware | ✅ | ⚠️ Often firmware-specific tweaks needed |
| Clean co-existence with Flipper Sub-GHz / NFC apps | ✅ | ❌ Frequently break other apps until reboot |
| Max-hold spectrum-analyzer mode | ✅ | ❌ Rare |
| WiFi 1/6/11 + BLE 37/38/39 frequency markers | ✅ | ❌ |
| Adjustable dwell time (130–2000 µs) | ✅ | ⚠️ Usually fixed |
| Cursor channel inspection with live readout | ✅ | ❌ Rare |
| NRF24 jammer (7 modes incl. RPD reactive + WiFi band hop) | ✅ | ❌ Usually CW only, separate app |
| RPD-driven reactive BLE jamming | ✅ | ❌ |
| WiFi-band CW jamming (ch 1 / 6 / 11) | ✅ | ❌ |
| CSV scan export for analysis | ✅ | ❌ |
| Continuous active development | ✅ | ⚠️ Often abandoned |
| Compact FAP size | ✅ ~44 KB | varies |
| Open source MIT license | ✅ | varies |
---
## Screenshots
Main Menu
Scanner · Signal Gen · About
Channel Scanner
126-ch live RPD spectrum, max-hold
NRF24 Signal Gen
7 TX modes — CW shown
About (v0.5.2)
On-device QR to shop & GitHub
---
## Install
### 1. Mount the board (hardware)
> ⚠️ **Always power off Flipper before inserting or removing the board** — hot-swapping the SPI bus can damage either chip.
1. **Power OFF** your Flipper Zero (hold `Back` ~2 seconds → Power off)
2. Insert the PINGEQUA 2-in-1 board onto the **LEFT GPIO headers** (the 18-pin row on the top-left edge)
3. **Power ON** Flipper
### 2. Install the app (software)
**qFlipper drag-and-drop** (recommended):
1. Download `pingequa_rf_toolkit.fap` from [Releases](../../releases) or [`dist/`](dist/)
2. In qFlipper: drag into `/ext/apps/GPIO/`
3. On Flipper: `Apps → GPIO → PINGEQUA RF Lab`
Works on every modern firmware — **no additional setup required**.
**ufbt sideload** (build from source):
```bash
pip install --user ufbt
ufbt update --channel=dev
git clone https://github.com/pingequalab/rf-lab
cd rf-lab
ufbt launch
```
---
## Usage
Launch from `Apps → GPIO → PINGEQUA RF Lab`. Main menu offers **Scanner**, **Jammer**, or **About** (v0.5.2+).
### Scanner
- ← / → moves the cursor (long-press = ±5 channels)
- ↑ / ↓ adjusts dwell time (short = ±10 µs, long = ±50 µs)
- OK pauses / resumes
- **Long-press OK exports current scan to CSV** at `/ext/apps_data/pingequa/scans/scan_.csv` (v0.5.0+). Top-right shows `SAVED!` for ~1 sec.
- Back returns to main menu
- When any bar saturates → automatic **MAX HOLD** mode (display freezes for analysis). Press OK to clear and rescan.
### Jammer (v0.4.0 — 7 modes)
- ↑ / ↓ cycles through 7 modes:
1. **CW Custom** — single channel CW, ←/→ adjusts ±1 / ±5
2. **BLE Adv** — blind CW hop {37, 38, 39}
3. **BLE React** ★ — RPD-driven reactive jam (listens, jams on detection — 1st on Flipper NRF24)
4. **WiFi 1** — CW hop across the WiFi-1 band (ch 1–23)
5. **WiFi 6** — CW hop across the WiFi-6 band (ch 26–48)
6. **WiFi 11** — CW hop across the WiFi-11 band (ch 51–73)
7. **ALL 2.4G** — full-band CW sweep
- ← / → adjusts CW Custom channel (no-op in other modes)
- OK starts / stops
- Back returns to main menu — **session auto-logs** to `/ext/apps_data/pingequa/siggen/siggen_.csv` (mode, duration, chunks, reactive jam count) and **mode/channel persists** for next launch (v0.5.0+).
- Disrupts nearby BLE / 2.4 GHz WiFi at close range.
- **Note:** during a long continuous transmit run the radio may occasionally stop responding — hold **Left + Back** (~5 s) to reboot, then relaunch. **CW Custom** is the most robust for long sessions; use the multi-channel sweep modes in shorter bursts.
### Data Export (v0.5.0+)
The app writes research-grade data to your Flipper SD card. Open with qFlipper, Excel, Numbers, or `pandas.read_csv` (skip `#` comment lines):
**Filenames embed RTC wall-clock + summary** (v0.5.2+) so sorting by name in qFlipper = sorting by time, and the filename itself tells you what's inside without opening it:
```
/ext/apps_data/pingequa/
├── jammer.conf ← Last jammer mode + channel (auto-restored)
├── scans/scan___ch.csv ← e.g. scan_2026-05-15_143022_ch42.csv
└── jammer/jam____s.csv ← e.g. jam_2026-05-15_143530_BLEreact_19s.csv
```
When the RTC isn't set, filenames fall back to a boot-tick form (`scan_boot_ch.csv`) so you never see `1970-01-01` garbage names.
Data directory in qFlipper's file manager
Each Back-from-Jammer creates one session CSV
**Scanner CSV** contains all 126 channel hits, peak channel, dwell, sweep count, and wall-clock datetime.
**Jammer session CSV** (v0.5.2+ schema) carries `datetime`, `mode`, `engine`, derived `target_freq_mhz`, and `scene_duration_s` — with conditional `cw_channel` / `reactive_jams` only when the mode actually produces those values. No more redundant or misleading fields.
Detailed walkthroughs: [docs/QUICKSTART.md](docs/QUICKSTART.md), [docs/UI_GUIDE.md](docs/UI_GUIDE.md), [docs/USE_CASES.md](docs/USE_CASES.md).
---
## Using Pingequa Hardware with Other Apps
The PINGEQUA 2-in-1 board works with this official FAP **and** with third-party apps and Flipper's built-in radio tools — but the dual-chip layout uses non-default SPI pins, so other apps need a one-time setup.
### Third-party NRF24 apps (NRF24 Sniffer, Mousejack, etc.)
The Pingequa NRF24 chip is wired to the **Extra 7** SPI bus (rather than the conventional pin set). On **Momentum** firmware:
1. From the main menu, navigate to **`Settings → Protocols → GPIO Pins`** (path may read `START → PROTOCOLS → GPIO PINS` on some menu variants)
2. Set **NRF24 SPI** to **`Extra 7`**
3. Launch your third-party NRF24 app normally
> Some third-party apps hard-code different pin assignments and may show partial incompatibility. The official PINGEQUA RF Lab app (this one) handles routing transparently — **no setup needed**.
### Official Sub-GHz app with Pingequa CC1101
To use Flipper's built-in **Sub-GHz Read / Read External** through the longer-range Pingequa CC1101:
1. Open **Sub-GHz** from the main menu
2. Go to **`Radio Settings → Module`**
3. Select **`External`**
4. Use Sub-GHz normally — it now routes through the Pingequa CC1101
> The `External` option is exposed on Momentum, Unleashed, and RogueMaster. Official Flipper firmware (OFW) has a similar `Read External` mode but no settings UI — use as-is.
If you don't see `External`, see [docs/HARDWARE.md](docs/HARDWARE.md) for firmware-specific notes.
---
## Hardware
> ### 🛒 [PINGEQUA Flipper Zero NRF24+CC1101 2-in-1 RF Devboard](https://www.pingequa.com/products/flipper-zero-nrf24-cc1101-2-in-1-rf-devboard?utm_source=github&utm_medium=readme&utm_campaign=rflab&utm_content=hardware_block)
>
> The only officially supported hardware. One module gives your Flipper both 2.4 GHz (nRF24L01+) and Sub-GHz (CC1101) chips, software-switched. No jumpers, no rewiring.
Other NRF24 boards may partially work but are unsupported. See [docs/HARDWARE.md](docs/HARDWARE.md).
---
## Firmware Compatibility
| Firmware | Status |
|---|:---:|
| Momentum (mntm-dev) | ✅ Primary build target |
| Unleashed | ✅ Compatible |
| RogueMaster | ✅ Compatible |
| Official Flipper firmware (API ≥ 87.1) | ✅ Compatible |
| Xtreme | ✅ Compatible |
---
## Roadmap
| Version | Status | Headline |
|---|:---:|---|
| v0.2.0 | ✅ | Channel scanner, max-hold, WiFi/BLE markers |
| v0.3.0 | ✅ | NRF24 jammer (CW + Sweep), main menu |
| v0.4.0 | ✅ | RPD reactive BLE jam, WiFi-band CW jam, 7 jammer modes |
| v0.5.0 | ✅ | CSV scan export, jammer session log, settings persistence |
| v0.5.1 | ✅ | OFW compatibility — single-handle SPI arbiter, all firmwares |
| v0.5.2 | ✅ | Readable export filenames, jammer log redesign, About screen + QR codes |
| v0.5.3 | ✅ | In-app rename: transmit feature now displays as "Signal Generator" (neutral, instrument-grade naming) |
| **v0.5.4** | ✅ | **Signal Generator now actually radiates (held-bus driver + FIFO-flush ignition); honest power wording; long-run reboot note** |
| v0.6.x | 🔜 next | **Shaped by community feedback** — candidates: cross-chip dual-band sweep (nRF24 2.4 GHz + CC1101 Sub-GHz in one view), spectrum CSV export, custom scan presets. [Tell us what you want](../../issues/new?template=feature.yml) |
| v1.0.0 | planned | Polished release, full documentation set, Catalog submission |
| v1.5.0 | concept | Companion mobile viewer over Bluetooth |
| v2.0.0 | concept | Unified UI bridging NRF24 + CC1101 |
[Vote on the roadmap](../../issues) · [Request a feature](../../issues/new?template=feature.yml)
---
## Documentation
| Doc | For |
|---|---|
| [Quickstart](docs/QUICKSTART.md) | First-time users — 5 minutes to first scan |
| [UI Guide](docs/UI_GUIDE.md) | Every pixel of the screen explained |
| [Hardware](docs/HARDWARE.md) | Pin map, firmware compatibility |
| [Use Cases](docs/USE_CASES.md) | 10 real-world scenarios |
| [FAQ](docs/FAQ.md) | Common questions |
| [Troubleshooting](docs/TROUBLESHOOTING.md) | Error decoding, hardware diagnostics |
| [Build](docs/BUILD.md) | ufbt setup, contributor build steps |
---
## Legal Notice
PINGEQUA RF Lab includes opt-in **transmit features (NRF24 Jammer)** — the Channel Scanner is passive listen-only, but the 7 Jammer modes actively transmit on the 2.4 GHz ISM band.
> **On output power.** The 2.4 GHz band is power-regulated (FCC §15 in the US, ETSI EN 300 328 in the EU, equivalent elsewhere). **To respect those legal limits, the firmware deliberately restrains output power and does not drive the radio to its electrical maximum.** This is an intentional compliance choice — the transmit range is correspondingly modest by design, not a defect.
You are responsible for compliance with your local regulations. Use only on hardware and networks you own or have authorization to test. The authors accept no liability for misuse.
You are responsible for compliance with your local regulations. Use only on hardware and networks you own or have authorization to test. The authors accept no liability for misuse.
Full disclosure: [SECURITY.md](SECURITY.md).
---
## Support
- **Issues**: [GitHub Issues](../../issues)
- **Email**: [support@pingequa.com](mailto:support@pingequa.com)
- **Hardware**: [pingequa.com](https://www.pingequa.com/?utm_source=github&utm_medium=readme&utm_campaign=rflab&utm_content=footer_store)
- **YouTube**: [@PINGEQUA](https://www.youtube.com/@PINGEQUA)
---
## License
[MIT](LICENSE) © 2026 PINGEQUA. PINGEQUA® is a trademark.
---
Precision Gear for Hackers.
Made for the PINGEQUA 2-in-1 RF Devboard ·
PINGEQUA
⭐ **Star the repo if PINGEQUA RF Lab saves you time.**