Bruce Firmware for T-Embed CC1101
An offensive security and red-team firmware for the LILYGO T-Embed CC1101, providing sub-GHz RF scanning, signal replay, WiFi attacks, BLE exploitation, NFC cloning, IR control, and BadUSB — with 5.1k GitHub stars.
Overview
Bruce is a feature-rich ESP32 security research firmware with first-class support for the LILYGO T-Embed CC1101. It turns the device's built-in CC1101 transceiver, WiFi, BLE, NFC, and infrared hardware into a comprehensive wireless testing toolkit, conceptually similar to the Flipper Zero but running on accessible ESP32 hardware.
Features
Sub-GHz operations use the onboard CC1101 for frequency scanning across the 300–928 MHz bands, raw signal capture, replay, and jamming. WiFi tools include beacon spam, deauthentication attacks, evil portal, and ARP spoofing. BLE scanning and exploitation utilities are included alongside RFID/NFC reading, cloning, and emulation. The infrared module handles capture and replay of TV remote codes, and a BadUSB/HID keyboard injection mode works via the USB interface. An onboard JavaScript interpreter lets users run custom attack scripts stored on the SD card.
Build Details
Written in C++ using PlatformIO, licensed under AGPL. The project has 5.1k stars and 1.7k forks with active development. Pre-compiled firmware binaries are available for direct flashing through the BruceDevices web flasher, requiring no build toolchain. The T-Embed CC1101 is listed as an official supported target in the repository's platformio.ini.
