Flipper Zero Unleashed Guide: 093c Uses and Setup

Unleashed changes the software on a Flipper Zero: its interface, protocol support, bundled resources and choice of applications. This guide explains how to use Unleashed 093c, what its package name means, and how to explore its useful features without confusing a menu option with a successful security bypass.

Version scope: Unleashed 093c. Sources checked 21 September 2026. The reference firmware screen reports unlshd-093c, commit prefix 603f90d0 and API 88.9; these match the upstream release dated 12 September 2026. This identifies the reported build; it does not independently authenticate every installed file. THL has not hardware-tested these exercises. Expected observations below are teaching outcomes, not measured results.

This is a companion to our 12-part Flipper Zero series. It concentrates on the installed firmware and practical differences. No additional hardware purchase is needed for the initial setup; reuse your own remote, inactive test tag and computer for the relevant optional exercises.

What the 093c name means

unlshd identifies Unleashed; 093 is the release. The suffix selects optional app packs:

Version label	Application package
unlshd-093c	Neither pack.
unlshd-093	Base Apps pack.
unlshd-093e	Base Apps and Extra Apps packs.

Core firmware and resources remain in c. Release and package definitions

The package label describes what was supplied, not everything currently stored on the device. Check the actual microSD contents too, including files retained from earlier installations.

A practical consequence: when a video shows an app absent from your device, check the app package and compatibility before assuming the installation failed. Do not change firmware merely to make your screen resemble somebody else’s.

What Unleashed changes—and what stays the same

Unleashed is an independently maintained fork of Flipper’s firmware. Its documented additions include interface customisation, additional protocol support, expanded infrared resources and community applications. Its own project page is the starting point for downloads and documentation. Unleashed project

Area	Useful benefit	Boundary to keep in mind
Interface	Adjust the menu and frequently used controls to suit a task.	Appearance does not change the radio or card reader.
Infrared	Keep a working command as a named remote button.	The appliance must understand the command and receive the light.
Sub-GHz	Recognise and investigate more supported message formats.	Decoding a message does not establish that a receiver will accept a replay.
NFC	Interpret supported card data and manage permitted test material.	Readable identifiers and records are not equivalent to secret keys.
Applications	Add utilities appropriate to a particular experiment.	Files must suit the firmware API, resources and any external hardware.

Some functions discussed in custom-firmware videos also exist in official firmware. For example, current official documentation describes both USB and Bluetooth keyboard modes for BadUSB. Treat “custom firmware can do this” and “only custom firmware can do this” as different claims. Official BadUSB documentation

The physical limits remain. Installing Unleashed does not add a Wi-Fi radio to the base Flipper or convert every NFC card into a clonable credential. Keep four items separate in your notes: Flipper hardware, Flipper firmware, app version and any external board’s firmware.

Start with a recoverable baseline

Before changing packages, preserve a setup you can describe and recover.

1. Record the complete firmware label, date and API number from the version screen. Keep this with your lab notes.
2. Copy the microSD card’s files to a dated folder on your computer. Include the app-data folders and your own saved remotes or test files. If removing the card physically, use Settings → Storage → Unmount SD Card first and wait for confirmation. Check that a few copied files open successfully; a folder named “backup” is not evidence of a complete copy.
3. Make an internal-storage backup using the supported qFlipper backup workflow. Keep it alongside the SD copy, clearly labelled with the firmware version. These are different storage areas; an internal backup is not a substitute for copying the card.
4. Record settings you would want to restore, such as the display layout and favourites. An older settings file is not necessarily compatible with a newer firmware’s data format.
5. Check that the device, card and data-capable USB connection work before beginning an update. Close other programs that are simultaneously trying to control the Flipper.

Flipper internal-storage backup documentation, microSD handling, Unleashed installation guide for release 093

Store backups privately: saved credentials, personal identifiers and authentication material may be sensitive. This guide does not require using a production door card, payment card or your only account-security key.

Exercise 1: make the interface easier to use

Purpose: learn the controls and establish a layout you can return to while following other guides.

In 093, open Settings → Desktop → Menu Style. For quick brightness, volume and vibration controls, press Up on the desktop, then Left or Right. Alternative styles require their plugins. 093 controls

Try this short comparison:

1. Note the current style and where you find Infrared, NFC and BadUSB.
2. Select one other available style. Return to the desktop and locate the same three functions by name.
3. Open the quick menu and change only brightness, keeping the old setting in your notes.
4. Restore your preferred style and brightness. Record any loading error for the troubleshooting checks below.

Why it helps: the experiment separates navigation from functionality. A familiar screen reduces mistakes when a later exercise asks you to save a file or select a transport. A cosmetic change is not evidence that a radio feature improved.

Record: which layout made the three functions easiest to locate, and whether all expected styles were actually available on your device.

Exercise 2: keep one useful infrared command

Purpose: create a small, reliable remote for an appliance you own, such as a television’s volume control. Begin with a harmless command rather than an unattended heater, motor or shared display.

If the original remote is available:

1. Open Infrared → Learn New Remote.
2. Point the original remote towards Flipper’s infrared receiver and press one chosen button briefly.
3. Save the captured command with a descriptive appliance name and button label, such as Desk_TV and Volume_Down.
4. Open the saved remote, aim at that appliance and send the command once. Note whether the appliance responded.
5. Move off-axis and repeat once, then restore the appliance’s starting state.

Infrared control represents commands as timed light pulses. The receiver checks for a format it recognises. Direction, distance, batteries and interference can affect the result; recognising a capture on the Flipper does not prove the target received it. Official infrared documentation

If your own appliance’s remote is missing, the Universal Remote can try a library of commands. In 093, pause when your appliance responds and press Down to save the working signal. 093 infrared change

Re-test that saved button separately; a response during a sequence is only a candidate match until it is repeatable.

How the same feature is misused: conventional infrared receivers often accept a recognised command without authenticating its sender. Someone within optical reach can therefore operate a shared screen. Physical control of the receiver’s surroundings and restricting exposed control paths address that mechanism; a stronger account password does not protect a basic IR command channel.

Record: the appliance, command, capture type if displayed, orientation and actual response. Keep the successful named command rather than repeatedly scanning the whole library. See our infrared chapter for the underlying protocol lesson.

Exercise 3: inspect an inactive NFC test tag

Purpose: distinguish a tag’s identity, its readable contents and authentication. Use a simple, unprotected inactive test tag you own that is not associated with entry, payment, transport or another live service. Confirm its type and protection status before the exercise; some card types can initiate dictionary work during a read without a separate prompt.

1. Open NFC → Read and position the tag at Flipper’s NFC antenna.
2. Note the detected technology and the information the result actually exposes. Do not assume every tag will have a URL or the same memory layout.
3. Save the result under a neutral lab name. Reopen it and compare the displayed fields with your notes.
4. Remove the tag and write down what remains unknown: protected pages, application permissions or whether a particular reader would accept an emulated representation.

This is a read-and-inspect exercise. If the workflow proposes key recovery, writing, unlocking or emulation against a live reader, leave that workflow and use a simpler inactive tag.

Why it works: an NFC reader can retrieve information that the tag makes available under the current conditions. Different technologies expose different information and protect different operations. A readable UID is an identifier; it is not, by itself, proof that the reader possesses a secret. Official NFC documentation

Useful outcome: a clear inventory of your test tags and an evidence-based explanation of what a read established. Misuse mechanism: a poorly designed access system may trust a repeated static identifier. A system that verifies a fresh cryptographic response has a different security boundary. Additional parsers or dictionaries do not erase that distinction. Our NFC chapter

Do not publish raw dumps or identifiers merely to demonstrate that the exercise worked. A redacted field list is enough for the teaching record.

Exercise 4: understand keyboard automation with one sentence

Purpose: see why computers treat an accepted input device as capable of typing. Use your own computer with a blank text editor focused. This exercise contains no shell commands, downloads or account changes.

Create a plain-text file named THL_Keyboard_Demo.txt containing exactly:

REM THL owned-computer typing demonstration
DELAY 3000
STRING THL lab: this sentence was typed by an authorised keyboard demo.

Place it in SD Card/badusb/ using the file manager, then close qFlipper. Open BadUSB, select the file and use USB mode for this exercise. Connect to your computer with the editor ready, confirm the selected keyboard layout and start the script. The expected observation is that the single sentence appears after the delay. Stop and disconnect if the wrong application has focus. Official BadUSB workflow, script syntax

How it works: the computer accepts keyboard input reports. The delay gives you time to place focus; STRING supplies text. It does not grant administrator rights or defeat the lock screen. If characters are wrong, investigate keyboard-layout mapping and focus before assuming the firmware is broken.

Why this matters: authorised automation can remove repetitive typing. Malicious automation can enter unwanted commands if a computer accepts the device and the session permits them. Device-control policy, controlled pairing and locked unattended sessions reduce that exposure. A file’s friendly name does not describe what its contents will type, so inspect scripts before running them.

If you later evaluate Bluetooth mode, record it as a separate test with explicit pairing to your own host. Do not assume the USB result proves a wireless result. See our keyboard-trust chapter.

Exercise 5: observe Sub-GHz without claiming a bypass

Purpose: investigate an ordinary, non-security remote you own, such as a documented compatible test transmitter. Keep the Flipper receive-only for this exercise; the original transmitter performs its normal operation.

1. Record the transmitter’s model and stated operating frequency from its documentation or label. Choose a benign device whose normal operation you can observe safely.
2. Open the Flipper’s Sub-GHz receiving tools and select the documented supported receive configuration. If a Frequency Analyzer or related plugin is missing, resolve its matching resource package first.
3. Operate the original transmitter normally. Record whether the Flipper reports activity, recognises a protocol, or saves a decoded record.
4. Compare two observations, without retransmitting them. Note repeated and changing fields where they are shown. Redact identifiers from any shared notes.

Three separate questions govern the interpretation: Was a signal detected? Was it decoded correctly? Would a receiver accept a command? This exercise addresses the first two. Changes in a captured value can have several explanations; two captures alone are insufficient to classify a security design.

The additional protocol support is useful for interoperability research and troubleshooting. A rolling-code receiver may reject previously used values; transmitter and receiver state also matter. A menu labelled Save or Send does not prove those checks have been defeated. Replaying security remotes can disturb their synchronisation. Our Sub-GHz chapter, Flipper Sub-GHz documentation

Unleashed documents removal of some software transmission restrictions. That changes a software check, not the radio’s physical capabilities or the applicable conditions for transmission. This receiving exercise does not require changing transmission restrictions or extending frequency ranges. Unleashed feature overview

Why an app or Wi-Fi feature may be missing

Use this sequence instead of installing unrelated bundles until something launches:

Symptom	Check first	Reason
A video shows an app absent from your menu	Package comparison and actual SD-card inventory.	A screenshot from another installation is not an inventory of yours.
An app reports an API or load error	Its supported firmware/API and any required assets.	A plugin is executable software with interface dependencies, not just a menu icon.
A menu style or radio tool cannot load	Matching firmware resources and card accessibility.	Some firmware components themselves load plugins from storage.
A Wi-Fi app opens but sees no board	Required board model, connection and board firmware.	The handheld app and the external radio are separate components.
Only a charge indication appears over USB	Data cable, connector and which program owns the connection.	Power can work without a usable data connection.

For 093c, keep API 88.9 in your notes. Obtain applications and instructions from the release’s linked project sources, and check their compatibility. A newer application build may require a newer API. Do not force an incompatible binary to run by suppressing its checks. 093 installation documentation, Flipper application development documentation

Installing Unleashed on the handheld does not install Marauder on a Wi-Fi board. The official Wi-Fi Developer Board is a separate ESP32-S2 device; its stock purpose is firmware debugging over USB or Wi-Fi. Its radio is 2.4 GHz. Other board models and software have their own capabilities. Official board documentation, ESP32-S2 hardware overview

The useful question is: “Which component performs this operation?” For a wireless experiment, write down the handheld firmware, handheld app, board model and board firmware before predicting any result. Our Wi-Fi Developer Board guide explains the distinction and a stock-board logging exercise.

Misuse: explain the mechanism and the evidence

These are risk scenarios, not claims that a particular Unleashed user committed an offence. The firmware label alone does not establish which app ran or what happened.

Scenario	How harm can occur	Why a defence helps
Shared equipment disruption	An unauthenticated control channel accepts a recognised command from someone nearby.	Restricting physical access and exposed control paths reduces opportunities to send accepted commands.
Credential impersonation	A system relies on a repeatable identifier rather than a fresh proof of a secret.	Cryptographic authentication and prompt credential revocation address that trust failure.
Unwanted keyboard input	A host accepts an input device and acts on its keystrokes in the current session.	Device restrictions, controlled pairing and session locking constrain input and available privileges.
Wireless disruption or deception	A suitable radio and software target protocol behaviour or mislead a user into trusting the wrong network.	Protected management exchanges, sound network authentication and user verification address different parts of the mechanism.

For documented historical incidents and their limits, use the case files, Bluetooth-spam analysis and car-theft claims chapter. None of the exercises here establishes that an unrelated target is vulnerable.

Updating, returning to official firmware and recovery

You can use this guide with 093c already installed. Updating is a separate decision: first identify a specific fix or feature you need and read the destination release’s notes. Keep firmware packages, application packs and the SDK distinct; the SDK is for building software, not the ordinary self-update package.

For a planned change, finish the backups above, choose the intended stable release and package from the upstream project, and follow that release’s installation instructions. After reboot, re-check the version and repeat one harmless baseline exercise before restoring a large collection of apps. Keep the old backups unchanged so that a failed migration does not overwrite your only good copy. Pinned installation guide

If you want to return to official firmware, follow Flipper’s current update or recovery procedure through qFlipper. Recovery is not the same as restoring personal data, and a custom-firmware backup is not a promise that every setting will work on a different build. If the device will not start normally, use the manufacturer’s recovery instructions rather than improvising resets or formatting storage. Official firmware recovery

A desktop PIN and a convenient backup are also different controls. Do not assume a screen lock encrypts removable-card files. Keep genuinely sensitive authentication material out of a shared experiment kit.

A record that makes the exercise useful

Copy this template for each session, or use the series lab worksheet:

Firmware and API:
Application version and source, if separate:
External board model and firmware, if used:
Owned test device and permitted operation:
Backup location and date:
Expected observation:
Actual observation:
What this result establishes:
What remains unknown:
Settings restored and files removed, if appropriate:

For a first session, complete the version record, interface comparison and one infrared command. The next session can cover the inactive NFC tag or text-only keyboard exercise. A small repeatable result gives you a firmer foundation than a long list of installed tools.

Questions owners commonly ask

Does the c suffix mean my installation is broken?

No. Start with the package comparison, then investigate the particular missing feature using the troubleshooting table. Reinstalling before identifying the mismatch can obscure the cause.

Does the e package make the radio more powerful?

No. A package name establishes no improvement in range. Compare the actual radio, antenna, operating conditions and measured result before making a performance claim.

Is Bluetooth keyboard mode unique to Unleashed?

No. Current official Flipper documentation also describes it. Compare the precise feature, version and workflow instead of treating every capability shown in a custom-firmware video as exclusive.

Can I follow this guide without a Wi-Fi board?

Yes. The interface, infrared, NFC and USB keyboard exercises use the base device and appropriate existing test equipment. A separate board is relevant only to functions that depend on that board.

Has this guide proved my device or network is secure?

No. It teaches specific mechanisms and observations. The exercises have not been performed on THL hardware, and a successful or unsuccessful demonstration cannot establish the security of a different system.