Flipper Zero — NFC

Specter

Sweep for the readers you can’t see.

An NFC reader has to radiate to work. A skimmer hidden inside a payment terminal, a rogue reader behind a door panel, a logger taped under a desk — all of them sit there pushing out a 13.56 MHz carrier, whether anyone is holding a card to them or not. Specter turns that giveaway into a meter you can walk around a room, using the Flipper’s own NFC chip. It never transmits.

Download specter.fap — official firmware Custom firmware specter-fw-dev.fap — Unleashed · RogueMaster · Momentum Source MIT licensed

13.56 MHz Listen-only · never transmits No extra hardware Target 7 · API 87.1 In the Flipper Apps Catalog

The instrument

A meter for something invisible

The Flipper’s NFC chip can be told to sit still and report one thing: whether another device’s field is washing over it. Specter samples that bit every two milliseconds and turns the result into a needle, a number, a cadence and a verdict.

Everything on this page is a real capture off a real device, taken over the Flipper’s own RPC session by tools_screenshot.py in the repository. There are no mock-ups here, and there is no mock-up renderer in the project — a drawing of a UI is a second implementation that can quietly disagree with the firmware, and once did.

Specter running on a Flipper Zero: the sweep meter finding a reader, the fingerprint classifier, a site survey verdict and watch mode — Captured over RPC · real device

2 ms

between field samples

bytes transmitted, ever

modes, one question each

527

host tests gating CI

Read this first

What Specter can and cannot sense

A counter-surveillance tool that overstates itself is worse than none at all, because you act on it. Specter senses powered, actively polling readers at 13.56 MHz. That is the whole claim.

Can it sense…	Verdict	Why
A live NFC reader — payment terminal, door pad, desk reader	Yes	It radiates a carrier continuously or in a polling rhythm, which is exactly what the chip’s field-detect bit reports.
A skimmer built into or over a reader	Yes, if powered	A skimmer that reads cards has to energise them. Specter sees the field; it cannot tell you the field is criminal.
A reader that is switched off or asleep	No	Nothing is radiating. Silence is not evidence of absence, and Site Survey refuses to call a room clean off a short walk for exactly this reason.
A card, tag or passport sitting in a wallet	No	Those are passive. They have no power of their own and emit nothing until a reader energises them.
125 kHz low-frequency badges and readers	No	The LF path has no external-field-detect bit to read. This is a hardware limit, not a setting.
Whether a reader you found is malicious	No	It tells you something is there, how it polls, and how strong it is. Deciding what it is for is your job.

Specter is receive-only by construction. It calls furi_hal_nfc_field_detect_start() and reads one bit; there is no code path in the app that transmits, so it cannot wake a tag, clone anything, or announce your presence to the reader you are standing in front of.

Five questions

One screen each

Each mode answers a different question, and none of them asks you to interpret a raw number to get the answer.

Sweep — where is it?

An analog-style EMF gauge whose needle rides the field in real time, with a peak-hold marker and a mark drawn at the exact point where reader begins at your current sensitivity — so the dial answers “what counts as a hit?” instead of leaving you to guess. Geiger clicks speed up as you close in, and the Flipper buzzes once when the meter pegs, so you can home in without watching the screen.

UPDOWN sensitivity, mid-hunt · LEFT learn the room’s noise floor · hold OK save the finding

Sweep screen with a reader found: needle at 27%, peak 37%, inverted ACTIVE READER strip reading NEAR — Sweep — locked on

Fingerprint — what kind of thing is it?

Readers poll on a rhythm, and the rhythm is characteristic. Specter measures period, burst length, jitter and duty, classifies the emitter as CONTINUOUS, POLLING or INTERMITTENT, and draws the raw carrier underneath as a logic-analyser trace — so the verdict is never asked to be believed on its own.

OK save to the logbook · hold OK restart the measurement

Fingerprint screen classifying a reader as POLLING with 100% confidence, period 40ms, burst 11ms, jitter 2ms, and a square-wave carrier trace — Fingerprint — a fixed poll

Site Survey — is this room clean?

Start it, walk the space, and get one verdict instead of watching a needle for two minutes: CLEAN, TRACE or ACTIVE, with the peak, average and time-in-field behind it. The grading is deliberately asymmetric — a one-second walk that finds something is a real finding, but a one-second walk that finds nothing reports TOO SHORT rather than clearing the room.

OK finish early and grade what you have · OK again on the card re-runs it

Site Survey verdict card: 14 seconds, ACTIVE READER, advice to fingerprint it, peak 100%, average 41%, 3 hits — Site Survey — the verdict

Watch — tell me if one appears

Leave it standing guard on a desk, in a hotel room, beside a rental car. A big clock counts the quiet; when a carrier appears the screen wakes itself, the band inverts, and the contact is written to the logbook with a timestamp. Presence is latched to the reader’s own measured poll period, so an alarm does not flicker in and out between polls.

OK re-arm · wakes the backlight on a contact, even in stealth

Watch mode with an active reader: inverted ACTIVE READER band, 1 hit, peak 100%, now 100% — Watch — a contact

Logbook — what did I find?

Every saved finding lands on the SD card twice: a grouped, readable logbook.txt you can scroll on the device, and a flat logbook.csv you can open later. Entries are RTC-stamped, tagged by mode, and filterable on-device, so a sweep ends with something you can hand to somebody.

Files live in apps_data/specter/

Logbook screen showing timestamped WATCH contacts with field and peak percentages — Logbook — on the device

Every screen

Captured from the device

Taken over the RPC session at 4×, in the panel’s own two colours. Nothing here was drawn. These are the screens the five modes above do not already show — the quiet states, the ones you only meet when there is nothing to find, and the key map.

Specter's boot intro: a flat trace writes across the screen, a reader's poll cuts in, the screen inverts, and the SPECTER nameplate engraves itself — Boot intro — a carrier arrives

Sweep screen listening, with the discoverability hint on the bottom strip — Sweep — listening

Fingerprint screen with no carrier present: NO FIELD, no confidence bar — Fingerprint — nothing there

Site Survey running, with progress bar and live waveform — Site Survey — walking

Watch mode quiet, counting up since the last contact — Watch — standing guard

Settings list: sensitivity, survey time, sound, vibrate — Settings

Install

Which build do I download?

Your firmware	File	Why
Official Flipper firmware	`specter.fap`	Built against the release SDK, API 87.1. Also installable straight from the Flipper mobile app — Specter is in the official Apps Catalog under NFC.
Unleashed · RogueMaster · Momentum	`specter-fw-dev.fap`	Built against the dev SDK. Custom firmware runs a newer API than the release SDK targets, and the official build refuses to load with `APP:87 < FW:88`.

Copy the .fap to /ext/apps/NFC/ with qFlipper, or build it yourself:

ufbt in the repository root produces dist/specter.fap.

Colophon

How it is put together

Specter’s print identity and this page are one system, called BACKLIGHT. The Flipper’s backlight orange and the house gold sit about fifteen degrees apart on the same hue wheel, so they are treated as one ramp read from opposite ends: more ink is more signal on paper, more light is more signal on black.

Type

Bodoni Moda Identity and figures. Instrument nameplates — galvanometers, theodolites — were engraved in Didone, and the printed banner is set in Didot.

Inter Everything you actually have to read. Neutral on purpose: the display face is elegant at 100px and tiring at 17.

JetBrains Mono Anything the device measured, and anything you would type.

Colour

Paper, ink, and two golds — a deep brass that stays readable as small text, and a brighter one for marks that carry no words. One gold cannot do both jobs.

Dark mode is true black, the colour Specter’s own stealth mode leaves you with. Never navy.

Two rules

The orange quarantine. #FE8A2C is the colour the device emits, and nothing here paints it. Every orange pixel on this page and on the banner is inside a real screen capture — sampled, never chosen.

The accent means one thing. Gold marks measurement and nothing else: not a link, not a button, not a border, not a heading. There is exactly one gold object on the banner, and it is 128 columns of recorded carrier.

The banner’s waveform is not a graphic. It is the 13.56 MHz carrier of a real polling reader, read back column by column out of the Fingerprint capture beside it. Its duty measures 26% where the device’s own counter printed 28%, and both numbers are printed on the banner. The renderer asserts they agree and refuses to build if they drift.

Please read

Limits, honestly

It finds fields, not crimes. A live reader in a shop is a shop’s reader. Specter tells you one is radiating and how it behaves; the judgement is yours.
Silence proves nothing. A reader that is off, asleep, or out of range reads as nothing at all. This is why Site Survey will not certify a room off a short walk.
High frequency only. 13.56 MHz. 125 kHz LF badge readers are invisible to this hardware path.
Range is short. You are sensing a near-field coupling meant to work across a few centimetres. Specter extends that usefully, not dramatically — it is a bug-sweep, not a room scanner.
Use it where you are allowed to. Passive listening is far less fraught than transmitting, but “less fraught” is not “anywhere”.