Noureddine RAMDI / TagTinker: pushing custom images to electronic shelf labels via zero-allocation IR streaming on Flipper Zero

Created Sat, 23 May 2026 20:41:14 +0000 Modified Sat, 23 May 2026 20:41:27 +0000
974 Words
github-stars flipper-zero embedded-c infrared reverse-engineering electronic-shelf-labels rle

i12bp8/TagTinker

TagTinker tackles a niche but technically intriguing problem: sending custom images and text to electronic shelf labels (ESLs) using infrared signals from the Flipper Zero, a versatile multi-tool device popular among hardware hackers. What stands out is its zero-allocation run-length encoding (RLE) streaming IR engine, designed to squeeze signal transmission into the constrained microcontroller environment while exploiting poorly documented IR protocols of e-ink ESLs.

What TagTinker is and how it works

At its core, TagTinker is a C application built specifically for the Flipper Zero platform. It reverse engineers obscure infrared protocols used by certain electronic shelf labels—those small e-ink displays you sometimes see on retail shelves displaying prices and product info. These ESLs typically communicate via proprietary IR signals, and TagTinker’s purpose is to decode and then send custom images and text to these tags.

The project relies on a zero-allocation run-length encoding streaming IR engine. Zero-allocation means it avoids dynamic memory allocation at runtime, a crucial constraint when working with microcontrollers with limited RAM like the Flipper Zero’s ARM Cortex-M4. RLE compression helps reduce the amount of IR data transmitted by encoding consecutive pixels or bits as a run-length, rather than raw pixel-by-pixel data.

To prepare images for transmission, TagTinker pairs with a browser-based web tool available at i12bp8.github.io/TagTinker. This tool preprocesses images through dithering, Oklab 3-color quantization, and tone/contrast/sharpening adjustments. It outputs Flipper-ready BMP files formatted to match the ESL display capabilities.

Additional features extend TagTinker beyond IR transmission. It integrates NFC tag identification to discover compatible ESL targets and supports an optional WiFi plugin system powered by an ESP32-S2. This plugin enables live network-rendered content to be pushed to tags, expanding the project’s flexibility.

Under the hood, TagTinker builds on public research by furrtek into ESL protocols but adds valuable features and tooling around it. The codebase is “source-first,” compiled with ufbt, a Flipper-specific build tool, and carries strong ethical disclaimers emphasizing use only on legally owned hardware and strictly for educational purposes.

Technical strengths and design tradeoffs

The standout technical feat is the zero-allocation RLE streaming IR engine. Embedded development on constrained devices demands careful management of RAM, CPU cycles, and power. By avoiding heap allocations entirely, TagTinker sidesteps fragmentation and runtime overhead, improving reliability and predictability.

RLE streaming reduces IR transmission time by compressing runs of identical pixels, which is well suited to e-ink displays that often show large uniform areas. However, RLE encoding plus zero allocations implies the code must be carefully designed for streaming: it can’t buffer large chunks but must process data on-the-fly, increasing complexity.

The image preprocessing pipeline is another highlight. Using Oklab color quantization (a perceptually uniform color space) for three-color dithering fits the limited color depth of ESL displays better than simpler methods like RGB565. The web-based tool offloads heavy image manipulation from the Flipper Zero, which lacks the power for complex image processing.

TagTinker’s use of NFC for tag identification is pragmatic, speeding up target discovery and avoiding blind attempts. The optional WiFi plugin adds a modern networked dimension, though it requires extra hardware (ESP32-S2) and is naturally less portable.

The codebase is pragmatic and lean, reflecting embedded constraints. It’s tightly coupled to Flipper Zero’s environment and ufbt build system, so portability is limited. The ethical disclaimers are a responsible touch, acknowledging the potential risks of misuse in wireless hacking and reverse engineering.

Quick start

  1. Build the Flipper app from this repository and install it via ufbt. The first launch creates apps_data/tagtinker/dropped/ on your SD card.

  2. Open i12bp8.github.io/TagTinker in any browser, pick your tag profile, drop an image, tweak, and download the BMP.

  3. Copy the BMP into apps_data/tagtinker/dropped/ on the SD card (over qFlipper, USB MTP, or whatever you use).

  4. On the Flipper, open Targeted Payloads → → Set Image, pick the BMP, choose a page, send.

This process is straightforward if you’re familiar with Flipper Zero app installation and SD card management. The web tool simplifies image preparation significantly.

Verdict

TagTinker is a technically focused project for practitioners interested in the intersection of embedded systems, reverse engineering, and wireless hacking. Its zero-allocation RLE streaming IR engine is an elegant solution to the challenge of transmitting images to ESLs from a constrained device.

It’s not a turnkey consumer product; it demands some familiarity with Flipper Zero development, IR protocols, and image preprocessing workflows. The browser-based tool and NFC integration improve the developer experience, but the project remains niche.

Limitations include dependence on specific ESL protocols, the need for hardware ownership to stay ethical, and the complexity of the image encoding pipeline. The WiFi plugin adds versatility but at the cost of additional hardware complexity.

For anyone exploring the capabilities of Flipper Zero beyond common RF hacking, or working on embedded IR transmission with tight resource constraints, TagTinker offers a compelling codebase and workflow. It’s a deep dive into a specialized but fascinating corner of hardware hacking with a clean, pragmatic approach.

→ GitHub Repo: i12bp8/TagTinker ⭐ 1,551 · C