# XFW - Xtreme Firmware

> Custom firmware and penetration testing toolkit for the Flipper Zero.

Xtreme Firmware was a feature-packed custom firmware for the Flipper Zero multi-tool that included interface customization, protocol expansions, and offensive security tools like BLE Spam and Bad-Keyboard. The project is now archived and no longer under active development, directing users toward Unleashed Firmware.

Website: https://github.com/flipper-xfw/xtreme-firmware

## What it is for

- Test device vulnerability to Bluetooth Low Energy advertisement packet flooding
- Simulate Bluetooth and USB keyboard injection attacks via Bad-KB
- Customize Flipper Zero UI themes, animations, and desktop asset packs
- Wardrive and map GPS coordinates alongside Sub-GHz radio captures

## Features

- BLE Spam app for broadcasting continuous spoofed advertising packets
- Bad-KB supporting both USB and Bluetooth HID injection with MAC spoofing
- Asset pack engine for custom animations, icons, and fonts
- Expanded Sub-GHz protocols and duplicate signal filtering
- Xtreme Settings app for managing system appearance and GPIO mapping
- On-device file manager with cut, copy, paste, and SD search

## Pricing

Open source

## Details

- Type: other
- Category: [Development](https://xiry.app/topics/development.md)
- Open source: yes
- Platforms: other
- For: Flipper Zero owners, security researchers, and hardware tinkerers.
- Alternative to: Flipper Zero Official Firmware, Unleashed Firmware, RogueMaster
- Tags: flipper zero, firmware, ble, bluetooth, pentesting, security

## Why it was saved

- [@0day, 8 October 2023](https://www.instagram.com/reel/CyI9L4-Okla/): Demonstrates a severe denial-of-service vulnerability affecting iOS devices via background BLE advertising packets using hardware that costs under $10.

## Related

- [AIMap](https://xiry.app/resources/aimap): Discovery and security testing platform for exposed internet-facing AI endpoints. (Web app, Open source)
- [BabelStrike](https://xiry.app/resources/babelstrike): Transliterate non-Latin names and generate username wordlists for security assessments (GitHub repo, Open source)
- [Better Auth](https://xiry.app/resources/better-auth): Open-source TypeScript authentication framework for modern web applications. (GitHub repo, Open source)
- [Browser Use Agent Sandbox Architecture](https://xiry.app/resources/browser-use-agent-sandbox-architecture): Architecture pattern for securely running code-executing agents inside isolated micro-VMs (Framework, Free)
- [Check SSH Brute-Force Login Attempts](https://xiry.app/resources/check-ssh-brute-force-login-attempts): Terminal commands to count and monitor failed SSH logins on Linux (Tip, Free)
- [CrowdSec](https://xiry.app/resources/crowdsec): Open-source collaborative security engine and intrusion prevention system using crowdsourced threat data. (GitHub repo, Open source)

Updated 3 October 2026. Page: https://xiry.app/resources/xfw-xtreme-firmware

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.