First! Wow, I'm so lonely in here. A little something while we all wait for next year's Hacker Summer Camp.

At DEF CON 33, I bought a FreeWili embedded device as an alternative to a Flipper Zero, thinking that I'd be going all sorts of cool things with it. A year later, it mostly sat on a shelf, and at DC34, the makers of the FreeWili (Intrepid Control Systems) made a new version that largely ignored the original — but were willing enough to release some updated tools for firmware flashing and a board support package (BSP) intended to help humans and AI agents alike to build "apps" for the pretty nifty device.

Having followed the latest AI craze for some time, I decided to adopt a full AI dev workflow with human product owners to build a slate of hacker focused apps that run on the FreeWili "OG" — that is what I have in this repo. It includes the built UF2, helper python apps, descriptions of the tools, and additional readmes and addendums to the BSP that should give an AI agent a small step up — I say small because my total resource investment in this was less than $40, maybe 30 hours of my own time, and a couple of weeks working a few hours in the evening. What I ended up with is a physical test bench that can see the OG screen to verify landing screens, a separate locally run uncensored model to guide/force the questionable pentest bits, and a better understanding of how a human can improve an AI workflow (and might even be necessary), the OG hardware itself, and some practices to do more of this AI workflow in my professional and personal life. And all the source is there as well as links to the libraries and resources I borrowed from, so go to town. Note that all this is provided as-is with rights to the original developers and that it is intended for "research" and "academic use" as the end user deems appropriate.

First I want to document my human thoughts on what I learned categorized by workflow and the OG hardware.

# Hardware

[](https://github.com/nullswitch23/fwog_defcon#hardware)

1. Communicating across the UART is a PITA. We computer users/homelabbers just assume that data can flow easily between embedded systems but there is a lot of constraints that must be dealt with like not overloading the bandwidth of the channel, not capturing or sending at an acceptable rate, garbled or misdirected signals, and overall inability to leverage the OG processing when you have an orca like bottlenose (Wifi + BLE) attached.
2. Speaking of the bottlenose, the boot and reset buttons are a PITA especially if you are developing. Because I wanted to be able to load bottlenose firmware from the OG UF2, it had to be sent over UART, and this was a fairly inconvenient button press sequence. I tried to AI build a 3D printed case with better buttons, but that was not achievable by the agents — I will probably do a photogrammetry scan and then edit it in tinkercad so the bottlenose is protected when I bring it to DC35.
3. The USB-C is largely a serial comm. Ok for one way and flashing but it'd be awesome if it could also double as a usb mass storage interface. This is actually possible via the UART but requires some hardware and shorting a few pins; the plan is documented and might be something I do. However, the OG has a fatfs storage of around 8 MBs which I used to store clips, persistent settings, etc. and then made a separate app and desktop helper app that dumps the data.
4. I think I understand this correctly, but the FPGA is largely used to adjust the GPIO header and is not really good for any quick processing "chip" — I was half thinking I could make a hardware decoder/encoder but after looking at it briefly, it just isn't meant for that type of work.
5. I'd have to go back and check, but even though the C1101 radios support 433 Mhz near the Meshtastic/Reticulum bands, there is some extra magic that makes them non-starters.
6. I have some real concerns about the 6 buttons with how much I push them, but with 6 I can do almost any interface imaginable. I think the only think I might want is a D-pad on the back which would then leave the front facing buttons for specific actions instead of navigation. I liked thinking of some throwback technology like T-9 keyboards, so as a product owner, it was fun to think about how to achieve functionality with the limited hardware.
7. I wish there was NFC, something that could emulate MIFARE/HID cards. I have an m5 atom s3 with RFID2 which can read some mifare, but ultimately I want to pen test things and that means doing emulation...

# Workflow

[](https://github.com/nullswitch23/fwog_defcon#workflow)

1. Which leads me to my eventual setup and why I think I need to run an uncensored setup somewhere. Grok and cursor tend to have very few guardrails but it does stop when asking it to do something illegal. I had bought a panther lake 32 GB unified memory laptop with an arc B390 thinking I'd poke around some inference, and I ended up needing to set up llama.cpp with an abliterated qwen3.8 model to take care of the illegal bits. What's neat is that I had the agents design its own interface so my laptop could take a look at the desktop local repos, task an agent worker, and basically orchestrate what was going on — all at 2-5 tokens/sec. I think my final setup would be a main cursor grok 4.6 orchestrator, composer 2.5 or cheap sub agents, and then an uncensored "consultant" that would monitor what items were blocked by policy or guardrails and then it would find a way around that block or end up doing itself (at very slow rate).
2. The whole intent was to create these iteratively, so instead of just fire and forget, there was a lot of taking a look at the flashed "chrome" and then giving adjustments. Sometimes, I felt like a meat puppet. Sometimes, I felt that there was no way the agents would figure it out without me. What I do know is that agents tend to solve with more — more code, more workaround, more documentation, more everything. In my work setups, I find that the agents tend to find the problem faster than me, but then fail to see a simple, elegant solution right in front of it. There was a lot of back and forth, and I read the thoughts to understand what was going on and to help figure out my next orders; sometimes a solution broke things and the human was necessary to provide that feedback.
3. Cursor is pretty slick and easily spins up subagents — my Claude at work is similar. I think it defaults and gravitates to "software engineer" speak, which I told it to take more tokens to explain, but I started using terms like blocked, chrome, smoke test, etc. after a few hours of interaction. I write software at work but am not a dev myself (more like prototyping tools). Hermes on the laptop is neat because you don't need to steer, it just adapts to the next prompt you give. Cursor does take a steer, but I found myself just queuing next tasks in a logical manner while having it keep track of all the outstanding tasks. When I tried to use different chats to parallel path work, it was a little ugly with commits. Thus, I ended up specifying that the main chat should task subagents and only sequence retests (due to the flash to hardware bottleneck) when the main chat and I were ready.
4. Many tools and skills and markdowns were made to help the agents not start from zero — while this worked well for my multiple sessions spread across weeks, I wonder how well a new human/AI team might benefit. Regardless, all this could be recreated with decent prompting and a couple hundred million tokens later (lolz — luckily, Cursor does accounting a little differently than ChatGPT and Claude but this is still a lot I think).

So is it AI slop? Sure. But it is also human slop. And more importantly, where before there was no functionality beyond that the original FreeWili team provided, there is a whole product slate of things that can be used now. And where I was largely ignorant about the OG hardware/software before, I at least know what is possible and approaches to design apps. If I was doing this full time, I probably could have made something in 3-9 months. The whole product slate? Probably not. And if I wanted to make something completely different, I'm probably an hour or two of background research away before I can almost one-shot a functional firmware build. Plus, all this automation gives me more time to chat on Discord and read Phrack, so winning all around? Until next time! (and if the FreeWili team wanted to send a FW2 my way, I would not reject it!)



Vibe Coded Hacker Apps for OG