R4TKN — Turning a Flipper Zero into a Dual-Band Wi-Fi Research Tool with BW16

The Flipper Zero is one of the most popular portable security research tools in the community. Out of the box it handles a lot — RFID, NFC, IR, sub-GHz, iButton. But its built-in Wi-Fi capabilities are limited. R4TKN fixes that by pairing it with a Realtek BW16 module to add real dual-band Wi-Fi research functionality.

What is R4TKN?

R4TKN is an open-source Wi-Fi research toolkit built around the combination of a Flipper Zero and a BW16 (RTL8720DN) module. The BW16 handles all the radio work — its dual-band chipset supports both 2.4GHz and 5GHz Wi-Fi — while the Flipper Zero provides the interface, control, and power.

The result is a compact, portable, battery-powered device that fits in a pocket and requires no laptop or phone to operate.

The project is open source and available on GitHub: github.com/rusyln/flipper-zero-bw16-r4tkn

For authorized research and educational use only.

Why BW16?

The BW16 is based on the Realtek RTL8720DN chip — a dual-band Wi-Fi and Bluetooth module that operates on both 2.4GHz and 5GHz. This is the same chipset used in SigBin Labs' standalone research hardware.

Most Flipper Zero Wi-Fi addons use ESP32-based boards, which are 2.4GHz only. The BW16 gives R4TKN access to the 5GHz band — meaning it can work with modern dual-band infrastructure that ESP32 addons simply cannot see.

Current features

Deauth ALL

Sends 802.11 deauthentication frames to all visible clients on a target network, forcing disconnections. Used in authorized environments to test network reconnection behavior and resilience.

Targeted deauth

Per-station and per-client targeting — instead of hitting all clients on a network, you can target a specific device. Useful for more controlled authorized testing scenarios.

Features in development

• Random SSID generation — generate and broadcast arbitrary network names
• Beacon flood + deauth combination — simultaneous beacon injection and deauth
• Handshake capture — capture WPA2 4-way handshakes during reconnection events in authorized environments

Hardware wiring

Connecting the BW16 to the Flipper Zero uses the GPIO pins on the Flipper's header. The pin mapping is straightforward:

| BW16 | Flipper Zero |

|---|---|

| 5V | Pin 1 |

| GND | Pin 8 |

| RX1 | Pin 13 (TX) |

| TX1 | Pin 14 (RX) |

The Flipper powers the BW16 over its 5V pin and communicates via UART on pins 13 and 14. No external power supply needed — the Flipper's battery runs both devices.

Note: Some third-party BW16 boards use different pin mappings. If you're using a non-standard BW16 board, verify the pinout against your board's datasheet before connecting.

Setup — BW16 firmware

1. Download the BW16 flasher from the R4TKN GitHub releases

2. Run the flasher as administrator

3. Select the correct COM port for your BW16 board

4. Enter boot mode: hold the BOOT button, press and release RESET, then release BOOT

5. Execute the upload and wait for completion

Setup — Flipper Zero

1. Install qFlipper from the official Flipper Zero website

2. Connect your Flipper Zero via USB

3. In qFlipper, navigate to the apps folder on the Flipper's SD card (create it if it doesn't exist)

4. Drag the R4TKN .fap file into the apps directory

5. On the Flipper, go to Applications → FAP Loader and launch R4TKN

Known limitations

The project notes that it "may not function properly on modern 5GHz routers" in some configurations. This is due to how band steering and management frame protection (PMF/802.11w) behave on newer hardware. WPA3-only deployments with enforced PMF will reject unauthenticated management frames regardless of the radio's band capability.

WPA2 and WPA2/WPA3 transition mode networks — the majority of current deployments — are the primary target environment for this toolkit.

Where to get hardware

The BW16 module is available through Elecrow, with local stock in the Philippines, Singapore, and Malaysia — making it accessible for the Southeast Asian research community without long international shipping times.

The Flipper Zero is available through the official Flipper Zero store and authorized resellers.

Responsible use

R4TKN is provided for educational research and authorized testing only. The deauthentication and network analysis features must only be used on networks you own or have explicit written permission to test. Unauthorized use against third-party networks is illegal in virtually every jurisdiction.

The project is released as-is with no warranty, and the developers accept no liability for misuse.

Source code

The full source — firmware for the BW16 and the Flipper Zero FAP — is available at:

github.com/rusyln/flipper-zero-bw16-r4tkn

Contributions, bug reports, and feature requests are welcome via GitHub Issues.