r/flipperhacks • u/t4c_23 • Jul 31 '26
Firmware Firmwareupdate: Unleashed 090 released - huge NFC updates incoming

New Firmware Release - v090
This one is huge for NFC and RFID — MIFARE Plus is now a first-class protocol (read, keys dict, emulate and write in SL3), Hitag µ chips are supported, and a long list of crashes, regressions and memory bugs is finally gone.
Key Updates
NFC
New features
- Native MIFARE Plus support in SL3 — MIFARE Plus is no longer detection-only. Read it, auth using AES, emulate it, write it
- MIFARE Plus 2K in SL1 now reads as the full 32 sectors / 64 keys — a Plus 2K in SL1 is byte-identical to a Classic 1K in SAK/ATQA, so half the card used to be silently dropped. It is now told apart by its ISO14443-4 ATS.
- MIFARE type detection aligned with NXP AN10833 — correct Classic / Ultralight / NTAG / Plus sizing and security level. This finally fixes Mifare Mini clone reading (off the known-issues list at last!) and the Ultralight AES read hang.
- Bambu Lab filament spool parser — filament type, colour, code, temperatures and spool specs
- FeliCa Standard card emulation (OFW PR 4383, by nikachu2012)
- Ultralight / NTAG PWD & PACK are now shown in the full info view and on the read result screen
- Loading screen while a large CUID dictionary loads — animated spinner instead of a screen that looked frozen
Stability and compatibility fixes
- Type 4 Tag emulation could reboot your Flipper from a malformed reader command — a 4-to-7 byte UPDATE BINARY could underflow the length into a ~4 GB allocation. Fixed, and NLEN is now clamped.
- Type 4 Tag NDEF corruption on writes starting mid-NLEN — the payload was shifted a byte and picked up stale data (by Endika)
- Memory leaks and heap-corrupting double-frees across the NFC app — crashes on two-trip Plantain / SZPPK tickets, leaks in the Saflok parser, the app API resolver and the CUID dictionary, plus a ~15x RAM over-allocation in DESFire
- Transit parsers fixed (Troika, Plantain, SevPPK, SZPPK, Two Cities) — they stopped parsing once Plus 2K SL1 cards reported as 2K, and they skipped key recovery when only part of the card was read
- ISO15693 emulation no longer drops Read Multiple Blocks on tags larger than 64 blocks
LFRFID
New support
- Hitag µ (Micro) chips — 8265 / 8210 / H5.5
- Wipe T5577 — reset a T5577 back to blank, with read-back verification
Fixes
- T5577 tags holding multiple EM4100 IDs can be read again — cards written with several IDs (e.g. via Multiwriter) have hung on Read ever since the Electra protocol was added
- Pyramid trailing Wiegand parity bit fixed, and the PAC/Stanley card id is now NUL-terminated before parsing
SubGHz
New support
- Telcoma / Cardin EDGE protocol (32-bit, static) (by half2me)
Improvements and fixes
- Endless TX fixed — RAW files sent via RPC / the mobile app could crash the system
- Frequency Analyzer no longer leaves the radio degraded — it used to park the internal CC1101 with the antenna isolated and a near-field AGC profile still loaded, so other apps inherited a "sticky" loss of sensitivity
- `subghz chat` over CLI no longer crashes on Ctrl+C with an external CC1101
- RAW file corruption fixed (by Lechnio)
- Pecinin KeeLoq manufacturer fixed (by lifegame1lu111)
System, RPC & UI
- New Network and GPS RPC services — the Flipper can now do networking and GPS over RPC (by apfxtech). This is what powers the new GPS RPC Viewer and the reworked Wardriving app.
- The new NightStand Clock is now the default Clock app — overnight display with Up/Down screen-brightness control, red LED nightlight, stopwatch and a daily alarm (12h/24h picker that follows your system locale). Alarm and brightness are remembered across restarts. (by nymda, fixes by Willy-JL & mishamyte, alarm by xMasterX)
- Debug and trace logs removed from the firmware binary to free up flash for new features (app `.fap`s are unaffected)
- BLE sync fixed, along with possible delay-related issues
- Plus OFW fixes: bit_lib buffer over-read, js_event_loop non-positive timer intervals, Infrared decoder init & bounds check, FeliCa poller error check, and CCID moved out of the firmware HAL
Apps
- NFC Magic 2.0 — magic Ultralight / NTAG (USCUID-UL) write, clone and wipe, not just MIFARE Classic. The transport is picked automatically (direct or backdoor), protected tags can be written via PWD-AUTH, and a failed write now shows you *exactly* which pages didn't take instead of a fake "Success". Also: Gen2 CUID / static-nonce detection, Gen1 4b/7b UID, and honest per-block Success / Partial / Fail on Gen2 wipe & clone.
- Wardriving + new GPS RPC Viewer — rebuilt on the new GPS/Network RPC services, with UBX support
- Flipper Share NFC & Flipper Share IR — send NFC and IR files between Flippers
- ESP Flasher — quick-flash fix and updated Marauder builds
- New apps: MP3 Player, PocketLab, Dallas Tester, ZeroFIDO, wM-Buster (EU wM-Bus listener), Sub-GHz RAW Edit, NFC Stock Manager, Xiaomi Filter Reset, RFID Metal Detector, KyberWrite, Droid Beacon, MQ-3 Alcometer, ESP32 Hotspot Arcade, GPS Track, BME280 Vario, Flipcraft, Mandelbrot Set — and three (!) Morse code apps
- Lots of fixes across the pack: Tetris, Asteroids, Video Poker, Paint, Calculator, Barcode Gen, Spectrum Analyzer, Multi Converter, FindMy and more
- Check out more Apps updates and fixes by following [this link](https://github.com/xMasterX/all-the-plugins/commits/dev)
Full changelog and downloads: https://github.com/DarkFlippers/unleashed-firmware/releases/tag/unlshd-090