Flash 5Ghost firmware on the PINGEQUA BW16 (RTL8720DN)
Install the 5Ghost dual-band (2.4 / 5 GHz) WiFi research firmware on your PINGEQUA BW16 (RTL8720DN) board directly from this page. You need Chrome, Edge or Firefox 151+ on a desktop computer and a USB-C data cable.
Firmware is hosted and the browser flasher is live. (Most 5Ghost BW16 boards also ship preloaded and plug straight into the Flipper GPIO header — no flashing needed.)
How do I flash the BW16?
Connect the board over USB, click Connect, then Flash. The flasher first tries to enter download mode automatically (DTR/RTS). If that fails, hold the BOOT button, tap RESET, release BOOT, and click Connect again.
Which browsers can flash the BW16?
| Browser | Supported |
|---|---|
| Chrome / Edge (desktop) | ✅ Yes |
| Chrome (Android) | ✅ Yes |
| Firefox 151+ (desktop) | ✅ Yes — first use adds a permission add-on |
| Safari (macOS / iOS) | ❌ No |
| Firefox (Android) | ❌ No |
Browser flashing relies on the Web Serial API: Chrome and Edge on desktop, Chrome on Android, and — since Firefox 151 for desktop (May 2026) — Firefox. Safari and every browser on iOS are out; see Web Serial is not supported.
Troubleshooting
| Symptom | Fix |
|---|---|
| Stuck at "entering bootloader" | Follow the BW16 download-mode sequence, then click Connect again. |
Flashloader download fail | The Realtek ROM didn't accept the RAM flashloader — see BW16: Flashloader download fail. |
Tried esptool and it failed | The BW16 is a Realtek part, not an ESP32 — esptool can't flash it. |
| No port in the picker | Follow No serial port detected; the board uses a CH340 bridge, so install WCH's driver if the OS identifies one. |
| Flashing is slow | The BW16 flashes at 115200 baud, so a full image takes a few minutes. |
Firmware or the Flipper app — which do I need?
The 5Ghost system is two parts, and this page is one of them:
- This page re-flashes the 5Ghost firmware onto the BW16 board itself. PINGEQUA boards ship with it preloaded, so you mainly need this to recover a board whose module firmware was corrupted, or to move it to a newer build.
- The control UI is a Flipper Zero app — see Install 5Ghost WiFi Lab. The app drives the board over the Flipper's GPIO header; the board does the radio work.
If your board already works on the Flipper, you do not need to flash anything here.
What the BW16 board does
5Ghost turns the BW16 into a dual-band Wi-Fi and BLE research tool for the Flipper Zero. The capabilities below are documented in the public 5Ghost WiFi Lab repository:
- Dual-band scan — lists 2.4 and 5 GHz access points with signal, encryption, and precise PMF / WPA3 detection.
- Channel map — congestion across both bands, with the least-busy channel highlighted.
- Capture handshake — grabs a WPA/WPA2 4-way handshake to a standard PCAP on the SD card, routed over 5 GHz where the capture is reliable.
- BLE scan — a passive Bluetooth LE sweep that flags Find My / AirTag trackers and nearby Flipper Zeros, and names device vendors — something a bare Flipper's own firmware does not expose.
- PMF-aware deauth, Evil Portal (including your own HTML from the SD card), and soft-AP / beacon tools, all for authorized testing.
Why a BW16 and not an ESP32
The common ESP32 chips — the original ESP32, S2, S3, C3 and C6 — have no 5 GHz radio, so no firmware built for them (Marauder, Bruce or otherwise) can see or work on 5 GHz networks. (Espressif's newer ESP32-C5 does have a dual-band radio, and this site flashes C5 boards too — but that's a separate chip you'd buy on its own.) The BW16's RTL8720DN puts a genuine dual-band radio on this one module, which is why 5Ghost runs here. It is also not flashed with esptool — it is a Realtek part with its own bootloader, which is why the flow above is BW16-specific.
For how it compares to the ESP32 firmwares feature-by-feature, see which firmware should I flash?.
Honest limits
Straight talk matters more than a longer feature list, and these limits apply to every tool, not just this one:
- WPA3-SAE cannot be cracked offline — by any tool. SAE is designed so a captured handshake has no offline-crackable hash. 5Ghost detects WPA3 and tells you it is out of reach rather than pretending otherwise.
- PMF / WPA3 access points cannot be deauthenticated. That is 802.11w working as designed. The value 5Ghost adds is flagging those APs up front instead of failing silently against them.
- Handshake capture runs on 5 GHz, because on 2.4 GHz this chip often cannot hear the client's reply — which is exactly what dual-band hardware is for.
About 5Ghost
5Ghost is PINGEQUA's dual-band WiFi research firmware for the BW16 / RTL8720DN, intended for educational and authorized network-research use. The browser flashing protocol is PINGEQUA's own implementation of the public Realtek AmebaD ROM bootloader protocol. The firmware itself is closed-source; the Flipper companion app is MIT-licensed and public.
Frequently asked questions
What is the 5Ghost BW16 devboard?
A dual-band (2.4 GHz / 5 GHz) WiFi research devboard built on the Realtek RTL8720DN (BW16) that connects to the Flipper Zero GPIO header. It runs the 5Ghost firmware.
How does it enter download mode?
The flasher attempts to put the BW16 into download mode automatically. If it does not enter, replug the USB cable and retry; on a bare module, hold BOOT while connecting.
Which browsers can flash the BW16?
Chrome or Edge on desktop, Chrome on Android, or Firefox 151+ on desktop. Flashing uses the Web Serial API; in Firefox the first connection also adds a permission add-on. Safari and every browser on iOS cannot flash.
Do I need to flash the board? It already works on my Flipper.
No. PINGEQUA boards ship with 5Ghost preloaded, so if it already works over the Flipper you do not need to flash anything. This page is mainly for recovering a board whose firmware was corrupted, or moving to a newer build.
Why a BW16 instead of a cheaper ESP32?
Because the ESP32 has no 5 GHz radio — no ESP32 firmware can see or work on 5 GHz networks. The BW16 (RTL8720DN) has a genuine dual-band radio, which is why 5Ghost runs on it. It is also not an esptool part; it uses Realtek's own bootloader.
Can 5Ghost crack a WPA3 network?
No, and neither can any other tool: WPA3-SAE is designed so a captured handshake has no offline-crackable hash. 5Ghost detects WPA3 and tells you it is out of reach rather than pretending otherwise. WPA/WPA2 handshakes can be captured to a standard PCAP for offline analysis on hardware you are authorized to test.
WARNING
For educational and lawful network-research purposes only. Comply with all applicable laws in your jurisdiction.