Which firmware should I flash?
Short answer: your board usually decides for you, and where there is a real choice it comes down to scope.
- One board, many tools (Wi-Fi and Sub-GHz and NFC and BadUSB) → Bruce. RF features need an add-on CC1101 / nRF24 module; the firmware alone does not add radios.
- Wi-Fi and Bluetooth, done thoroughly → ESP32 Marauder. Narrower on purpose, and the most-starred of the four on GitHub.
- Dual-band 2.4 + 5 GHz Wi-Fi → 5Ghost on a BW16 (RTL8720DN). A plain ESP32 has no 5 GHz radio, so no firmware can give it one.
- Flipper Zero itself → Momentum, Unleashed or RogueMaster. Different question, covered below.
This page compares the projects, not a feature checklist — feature lists go stale within weeks of being written, and every claim below is one you can re-check at its source. If a term here is unfamiliar, the flashing glossary defines them.
Which firmware runs on which board
This is what the flasher on this site actually supports, generated from its own device manifests:
| Board | Bruce | Marauder | 5Ghost | Flipper CFW |
|---|---|---|---|---|
| M5Stack Cardputer / ADV · Bruce | ✅ | — | — | — |
| M5StickC Plus2 · Bruce + Marauder | ✅ | ✅ | — | — |
| M5Stack StickS3 · Bruce | ✅ | — | — | — |
| Cheap Yellow Display (CYD) · ESP32 | ✅ | ✅ | — | — |
| ESP32-C5-WROOM · Marauder | — | ✅ | — | — |
| PINGEQUA Scout Lite · Marauder | — | ✅ | — | — |
| Flipper WiFi Devboard · Marauder | — | ✅ | — | — |
| PINGEQUA BW16 · 5Ghost | — | — | ✅ | — |
| Flipper Zero · Custom Firmware | — | — | — | ✅ |
| Lilygo T-Deck · Bruce | ✅ | — | — | — |
| Lilygo T-Display-S3 · Bruce | ✅ | — | — | — |
| M5Stack Core2 · Bruce | ✅ | — | — | — |
| M5Stack CoreS3 · Bruce | ✅ | — | — | — |
| Lilygo T-Embed · Bruce | ✅ | — | — | — |
| Boards covered | 9 | 5 | 1 | 1 |
Generated from this site's own device manifests at build time — it is exactly what the flasher supports, not a hand-maintained list.
Boards that run more than one firmware (the CYD and the StickC Plus2) show a firmware selector on their device page. Everything else has one firmware because the board only has the radios for one.
Versions and licences
| Firmware | Version here | Released | Licence |
|---|---|---|---|
| Bruce | 1.16.1 | 2026-08-11 | AGPL-3.0 |
| ESP32 Marauder | v1.14.1 | 2026-08-01 | MIT |
| Momentum | mntm-012 | 2025-12-31 | GPL-3.0 |
| Unleashed | unlshd-090 | 2026-07-30 | GPL-3.0 |
| RogueMaster | RM0722-1811-ff9f4feb | 2026-07-22 | GPL-3.0 |
Read from this site's upstream release snapshots, refreshed on every build. Snapshot taken 2026-08-14. Every version links to the upstream release notes.
The licence column matters more than it looks if you are building a product on top of one of these: Marauder is MIT (do what you like, including closed-source and commercial), GhostESP is GPL-3.0, and Bruce is AGPL-3.0 — the strictest of the three, because it extends copyleft to software offered over a network, not just software you distribute.
The four ESP32 projects
Bruce — breadth, if you add the radios
Bruce calls itself "The powerful open-source ESP32 firmware designed for offensive security and Red Team operations", and it is the broadest of the four: Wi-Fi, Sub-GHz and RFID, BadUSB, NFC, and audio.
The catch that surprises people: Bruce does not give a board radios it does not have. Its own compatibility table marks Sub-GHz and 2.4 GHz transceiver features as device-dependent — built in on some boards, needing an external CC1101 or nRF24 module on others, unavailable on the rest. If you flash Bruce on a bare Cardputer and the Sub-GHz menu does nothing, that is the expected behaviour, not a bad flash.
Runs on the most boards here: see the matrix above.
ESP32 Marauder — Wi-Fi and Bluetooth, deeply
Marauder describes itself as "A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32". It deliberately does not chase Sub-GHz, NFC or IR — it does Wi-Fi and BLE scanning, sniffing and attack tooling. It is also the most-starred of the four on GitHub by a clear margin (roughly 11.7k, against 6.2k for Bruce and 0.8k for the GhostESP revival, checked 2026-07-25).
It is also the firmware with an official hardware line behind it (the various Marauder boards and the Flipper Wi-Fi dev board), which is why it tends to be the best-tested option on any board it supports.
GhostESP — broad, but this site cannot flash it
GhostESP describes itself as "The open-source wireless research platform for ESP32", built on ESP-IDF, with a graphical UI, an SD-loaded app ecosystem, and coverage spanning Wi-Fi, BLE, NFC and IR, Sub-GHz, network recon and BadUSB.
Two things worth knowing before you go looking for it:
- The original repository is archived.
Spooks4576/Ghost_ESPhas been archived since 2025 and no longer receives commits. Active development moved to GhostESP-Revival/GhostESP, which is where releases now come from. If you land on the archived repo from an old link or an AI answer, you are looking at a dead tree. - We do not flash it here, and this is why: GhostESP ships one
.zipper board (10–15 MB each) rather than directly flashable.binimages. A browser flasher would have to unpack the archive client-side and know each board's partition layout, and guessing flash offsets is how boards get bricked. Use the project's own installer instead.
5Ghost — the one that is actually dual-band
5Ghost is our own firmware and it exists for one reason: the ESP32 has no 5 GHz radio. No amount of firmware changes that. 5Ghost runs on the BW16 (Realtek RTL8720DN), which does have a dual-band radio, so it can work on 2.4 GHz and 5 GHz networks.
If your goal involves 5 GHz Wi-Fi, the board matters and the firmware follows. If it does not, one of the ESP32 firmwares above is the simpler answer.
Flash it at PINGEQUA BW16 · 5Ghost. Unlike the other three, 5Ghost is closed-source.
Flipper Zero custom firmware
Different question entirely: these replace the firmware on the Flipper itself, and all three are GPL-3.0 forks of the official firmware. All three are flashable from the Flipper firmware page.
- Momentum — based on the official firmware, including most of Unleashed's features, and by its own README "a direct continuation of the Xtreme firmware, built by the same (and only) developers who made that project special." Broad app set, heavy customisation, good external-module support.
- Unleashed — the popular stable base: region locks removed, extra Sub-GHz support, the smallest departure from stock behaviour. Most-starred of the three by a wide margin (~21.9k, against ~8.9k for Momentum and ~6.3k for RogueMaster, checked 2026-07-25).
- RogueMaster — by its own README "a fork of all Flipper Zero community projects", pulling updates from across the ecosystem (its changelog cites Unleashed pull requests directly). The largest app and animation pack of the three, and correspondingly the heaviest install.
One caveat you will not see on vendor pages: release cadence differs sharply. Unleashed and RogueMaster tag releases regularly; Momentum's last tagged release is older, though its repository is still actively committed to. A stale release tag is not an abandoned project — but if you want the newest tagged build, check the dates in the table above before assuming.
How to choose
- Start from the board, not the firmware. Check the matrix above. Most boards here run exactly one, and that settles it.
- If the board runs two (CYD, StickC Plus2): pick Marauder for Wi-Fi/BLE work, Bruce if you want the wider toolbox and will add an RF module.
- If you need 5 GHz: you need different hardware, not different firmware — a BW16 running 5Ghost.
- If you are building a product on it: read the licence column first. AGPL-3.0 (Bruce) has real consequences for network-delivered software that MIT (Marauder) does not.
- If a firmware menu appears but does nothing: that feature needs a radio your board does not have — an external CC1101 or nRF24 module, typically. A menu entry is compiled into the firmware for every board; the radio behind it is not. This is a hardware gap, not a flashing failure, so re-flashing will not change it. For genuine flashing failures see firmware flashing errors & fixes.
Sources
Project facts were checked against the upstream repositories and official sites on 2026-07-25; versions and dates in the table above come from this site's own build-time snapshots and refresh themselves.
- Bruce — bruce.computer (self-description, per-device compatibility table) and BruceDevices/firmware (AGPL-3.0).
- ESP32 Marauder — justcallmekoko/ESP32Marauder (repository description;
LICENSEis the MIT licence) and its wiki. - GhostESP — ghostesp.net and GhostESP-Revival/GhostESP (GPL-3.0; release assets are per-board
.zip). Archived predecessor: Spooks4576/Ghost_ESP. - Flipper firmware — Momentum, Unleashed, RogueMaster, all GPL-3.0.
For educational and lawful testing only. Comply with the laws that apply where you are.