Open-Source NFC Reader Bug Sweep for Flipper Zero
▼ Summary
– Specter is a Flipper Zero app that detects powered NFC readers operating at 13.56 MHz by using the device’s ST25R3916 chip to sense the radio field.
– The app measures the duty cycle of the carrier signal, displaying it as FIELD %, and offers a proximity scale from FAINT to STRONG, with a magenta LED and vibration on contact.
– Specter cannot detect 125 kHz systems like older HID Prox and EM4100 door panels, and may miss sleeping or shielded skimmers, as noted by creator Kailash Parshad.
– The tool reports reader presence and approximate distance, but FIELD % is uncalibrated; it also requires closing other NFC apps during a sweep.
– Specter is free on GitHub, with installation via qFlipper or ufbt, and future plans include a detection logbook, screen-off buzzer mode, and low-frequency sensing experiments.
The ST25R3916 chip at the heart of the Flipper Zero contains a hardware external-field detector, the same circuit that enables card emulation and detects when a reader initiates communication. Specter reads this single bit hundreds of times per second while keeping its own transmitter off, effectively turning the device into a passive NFC reader sniffer.
The key metric is duty cycle. Over a short time window, Specter calculates what fraction of the period a carrier signal is present, smooths the result, and displays it as FIELD % . A reader pressed directly against the case saturates the meter. A slow-polling reader across the room barely registers.
A sensitivity control lets the user adjust the noise floor, making it possible to hunt for faint distant fields or only flag strong signals underfoot. When contact is made, a magenta LED flashes and the device vibrates, allowing the Flipper to ride unnoticed in a pocket during a sweep. The proximity scale moves from FAINT to NEAR to CLOSE to STRONG.
What Specter cannot detect
The first limitation is the frequency band. Specter only hears the 13.56 MHz NFC range used by contactless payment skimmers, modern access readers, transit gates, and hotel locks. The 125 kHz world of older HID Prox and EM4100 door panels remains silent, as the Flipper’s low-frequency path lacks an equivalent field-detect bit.
Some skimmers sleep until a real card wakes them. Others sit behind shielding. “Absence of a reading isn’t a guarantee of absence,” said Kailash Parshad, the creator of Specter.
The tool confirms that a reader is live and gives a rough proximity estimate. FIELD % acts as a warmer-colder guide across a surface, calibrated against nothing. Specter also captures the NFC radio for the duration of a sweep, meaning any other NFC app must be closed first.
Installation and future plans
qFlipper drags the app into apps/NFC on the SD card. Building from source requires ufbt and a USB cable.
The roadmap includes a timestamped detection logbook written to the SD card, a screen-off buzzer-only sweep mode, and an experiment with coil-based low-frequency sensing.
Specter is available for free on GitHub.
(Source: Help Net Security)