# Evil Crow RF V2

> Open-source RF security research tool with ESP32, dual CC1101 sub-GHz transceivers (300-928MHz), and NRF24L01 2.4GHz module for penetration testing, signal analysis, and replay attacks.

## Quick Facts

- **Brand:** Evil Crow
- **Board Type:** security-tool
- **Price:** ~$41.39
- **Product Readiness:** consumer
- **CPU:** Xtensa LX6 dual-core @ 240MHz, FPU, hardware crypto (AES/SHA/RSA)
- **CPU Architecture:** Xtensa LX6
- **CPU Cores:** 2
- **RAM:** 520KB SRAM
- **Flash:** 4MB
- **USB:** Micro-USB
- **Power:** 5V via Micro-USB
- **Operating Voltage:** 3.3V
- **Operating Temp:** -40°C to +85°C
- **Antenna:** Built-in PCB antenna
- **SD Card:** microSD (FAT32)

## Connectivity

- **Wifi:** 802.11 b/g/n
- **Bluetooth:** BLE 4.2
- **Lora:** CC1101 sub-GHz (300-348MHz, 387-464MHz, 779-928MHz) + nRF24L01 2.4GHz

## Open Source

- **Firmware:** Yes
- **Schematics:** Yes
- **PCB Layout:** No

## Compatible Firmware

arduino, platformio, esp-idf

## Use Cases

- rf-security-testing
- penetration-testing
- sub-ghz-research
- wireless-security-research
- rf-signal-analysis
- rf-experimentation

## Components

- **ESP32-D0WDQ6** (mcu): Espressif ESP32-D0WDQ6 Xtensa LX6 dual-core SoC running at 240MHz with 520KB SRAM, WiFi 802.11 b/g/n, Bluetooth 4.2/BLE, hardware crypto acceleration (AES/SHA/RSA), and ULP co-processor. — [Datasheet](https://openhardware.directory/r?to=https%3A%2F%2Fwww.espressif.com%2Fsites%2Fdefault%2Ffiles%2Fdocumentation%2Fesp32-wroom-32_datasheet_en.pdf&ref=openhardware.directory&product=evil-crow-rf-v2&source=md-export)
- **CC1101** (sub-ghz-radio): Texas Instruments CC1101 low-power sub-1GHz RF transceiver covering 300-348MHz, 387-464MHz, and 779-928MHz bands with configurable modulation (OOK, 2-FSK, 4-FSK, GFSK, MSK) and data rates up to 600kbps. — [Datasheet](https://openhardware.directory/r?to=https%3A%2F%2Fwww.ti.com%2Flit%2Fds%2Fsymlink%2Fcc1101.pdf&ref=openhardware.directory&product=evil-crow-rf-v2&source=md-export)
- **CC1101** (sub-ghz-radio): Second CC1101 module enabling simultaneous transmit and receive on different sub-GHz frequencies for real-time signal capture and replay. — [Datasheet](https://openhardware.directory/r?to=https%3A%2F%2Fwww.ti.com%2Flit%2Fds%2Fsymlink%2Fcc1101.pdf&ref=openhardware.directory&product=evil-crow-rf-v2&source=md-export)
- **nRF24L01** (radio): Nordic Semiconductor nRF24L01 2.4GHz ISM-band transceiver enabling mousejacking attacks and 2.4GHz wireless communication at up to 2Mbps. — [Datasheet](https://openhardware.directory/r?to=https%3A%2F%2Fwww.nordicsemi.com%2FProducts%2FnRF24-series&ref=openhardware.directory&product=evil-crow-rf-v2&source=md-export)
- **CP2102N** (usb-uart): Silicon Labs CP2102N USB-to-UART bridge IC providing serial communication for firmware flashing and debug output via Micro-USB. — [Datasheet](https://openhardware.directory/r?to=https%3A%2F%2Fwww.silabs.com%2Fdocuments%2Fpublic%2Fdata-sheets%2Fcp2102n-datasheet.pdf&ref=openhardware.directory&product=evil-crow-rf-v2&source=md-export)
- **AP2114H** (voltage-regulator): Diodes Incorporated AP2114H 1A low-dropout regulator converting 5V USB input to stable 3.3V for the ESP32 and RF modules. — [Datasheet](https://openhardware.directory/r?to=https%3A%2F%2Fwww.diodes.com%2Fassets%2FDatasheets%2FAP2114.pdf&ref=openhardware.directory&product=evil-crow-rf-v2&source=md-export)

## Protocols

- **SPI** (HSPI): SCK: GPIO14, MISO: GPIO12, MOSI: GPIO13, CS1: GPIO5, CS2: GPIO27
- **SPI** (VSPI (SD Card)): SCK: GPIO18, MISO: GPIO19, MOSI: GPIO23, CS: GPIO22
- **UART** (USB Serial): TX: GPIO1, RX: GPIO3

## GPIO Map

| Pin | Name | Type | Functions |
|-----|------|------|-----------|
| GPIO1 | UART TX (USB) | UART | digital-output |
| GPIO2 | CC1101 #1 TX (GDO0) | SPI | digital-input, digital-output, adc, pwm |
| GPIO3 | UART RX (USB) | UART | digital-input |
| GPIO4 | CC1101 #1 RX (GDO2) | SPI | digital-input, digital-output, adc, touch, pwm |
| GPIO5 | CC1101 #1 CS | SPI | digital-input, digital-output, pwm |
| GPIO12 | SPI MISO (HSPI) | SPI | digital-input, digital-output, adc, touch, pwm |
| GPIO13 | SPI MOSI (HSPI) | SPI | digital-input, digital-output, adc, touch, pwm |
| GPIO14 | SPI SCK (HSPI) | SPI | digital-input, digital-output, adc, touch, pwm |
| GPIO18 | SD Card SCK (VSPI) | SPI | digital-input, digital-output, pwm |
| GPIO19 | SD Card MISO (VSPI) | SPI | digital-input, digital-output, pwm |
| GPIO22 | SD Card CS | SPI | digital-input, digital-output, pwm |
| GPIO23 | SD Card MOSI (VSPI) | SPI | digital-input, digital-output, pwm |
| GPIO25 | CC1101 #2 TX (GDO0) | SPI | digital-input, digital-output, adc, dac, pwm |
| GPIO26 | CC1101 #2 RX (GDO2) | SPI | digital-input, digital-output, adc, dac, pwm |
| GPIO27 | CC1101 #2 CS | SPI | digital-input, digital-output, adc, touch, pwm |

## Accessories

- aluminum-case

## Description

## Overview

The Evil Crow RF V2 is an open-source radiofrequency security research platform designed for penetration testers, red team operators, and cybersecurity enthusiasts. Built around the ESP32 microcontroller, it combines dual CC1101 sub-GHz transceivers with an NRF24L01 2.4GHz module to cover a wide range of RF attack and analysis scenarios.

The two CC1101 modules can be independently configured to transmit or receive on different frequencies simultaneously, enabling real-time signal capture and replay across the 300-348MHz, 387-464MHz, and 779-928MHz bands. The NRF24L01 module extends capabilities into the 2.4GHz range, supporting mousejacking and other wireless keyboard/mouse attacks. The device ships with a web-based control interface accessible over WiFi, allowing configuration of RX/TX parameters, signal logging, and jammer operation from any browser.

Evil Crow RF V2 stores captured signals on a microSD card and serves a responsive web panel at evilcrow-rf.local for real-time control. The firmware is fully open source and written in Arduino/C++, with an active community producing alternative ROMs that add features like BLE mobile app control, RF spectrum visualization, and Flipper Zero .sub file compatibility. The aluminum case variant provides durability and RF shielding for field use.

## Where to Buy

- [Tindie](https://openhardware.directory/r?to=https%3A%2F%2Fwww.tindie.com%2Fproducts%2Fryanyu%2Fevil-crow-rf-v2-transceiver-with-aluminu-case%2F&ref=openhardware.directory&product=evil-crow-rf-v2&source=md-export) — $41.39
- [KSEC Worldwide](https://openhardware.directory/r?to=https%3A%2F%2Flabs.ksec.co.uk%2Fproduct%2Fevil-crow-rf-v2%2F&ref=openhardware.directory&product=evil-crow-rf-v2&source=md-export) — $59.99
- [Hacker Warehouse](https://openhardware.directory/r?to=https%3A%2F%2Fhackerwarehouse.com%2Fproduct%2Fevil-crow-rf-v2%2F&ref=openhardware.directory&product=evil-crow-rf-v2&source=md-export) — $69.99

## Resources

- [product](https://openhardware.directory/r?to=https%3A%2F%2Fwww.tindie.com%2Fproducts%2Fryanyu%2Fevil-crow-rf-v2-transceiver-with-aluminu-case%2F&ref=openhardware.directory&product=evil-crow-rf-v2&source=md-export)
- [github](https://openhardware.directory/r?to=https%3A%2F%2Fgithub.com%2Fjoelsernamoreno%2FEvilCrowRF-V2&ref=openhardware.directory&product=evil-crow-rf-v2&source=md-export)

## Tags

`rf-security`, `penetration-testing`, `sub-ghz`, `esp32`, `cc1101`, `nrf24l01`, `open-source`, `replay-attack`, `mousejacking`, `signal-analysis`

## Images

![Evil Crow RF V2](https://nbg1.your-objectstorage.com/openhardware-directory/entities/evil-crow-rf-v2/cde9ebc26a75.jpg)
![Evil Crow RF V2](https://nbg1.your-objectstorage.com/openhardware-directory/entities/evil-crow-rf-v2/58fe4dd48ec8.jpg)
![Evil Crow RF V2](https://nbg1.your-objectstorage.com/openhardware-directory/entities/evil-crow-rf-v2/cdef1ccf9597.jpg)
![Evil Crow RF V2](https://nbg1.your-objectstorage.com/openhardware-directory/entities/evil-crow-rf-v2/7b3032ced959.jpg)
![Evil Crow RF V2](https://nbg1.your-objectstorage.com/openhardware-directory/entities/evil-crow-rf-v2/770713ecb1ac.jpg)
![Evil Crow RF V2](https://nbg1.your-objectstorage.com/openhardware-directory/entities/evil-crow-rf-v2/a5035b5889b3.jpg)
![Evil Crow RF V2](https://nbg1.your-objectstorage.com/openhardware-directory/entities/evil-crow-rf-v2/7ff14797c358.jpg)
![Evil Crow RF V2](https://nbg1.your-objectstorage.com/openhardware-directory/entities/evil-crow-rf-v2/00402bde169a.jpg)
![Evil Crow RF V2](https://nbg1.your-objectstorage.com/openhardware-directory/entities/evil-crow-rf-v2/a5b99437dd55.jpg)

---
[View full device page](https://openhardware.directory/devices/evil-crow-rf-v2)