Setting up Clion for Flipper Zero development

Flipper Zero is an open source swiss knife for geeks and pentesters.
As soon as I received this device, I immediately began to learn how to develop fap extensions that would help me in my daily life and work.

In this article, I’ll show you how to set up Clion to build firmware, applications, and debug via WiFi Debugger Module.

As it turned out, the guys from Flipper Inc have developed their own tool for standardizing assembly and debugging on different platforms so that any enthusiast can quickly install the necessary tools and perform the operations necessary for development in a couple of clicks.

For VSCode, there is even a ready-made environment with various macros in the form of shell scripts.

I’ll make a reservation right away that I emphasized a lot from Savely Krasovsky’s personal blog: https://krasovs.ky/2022/11/01/flipper-zero-clion.htmlbut supplemented the instruction so that it was possible to debug fap applications.

Let’s start setting up

First you need to clone the git repository with the flipper firmware, for example, to the folder with Clion projects:

git clone --recursive https://github.com/flipperdevices/flipperzero-firmware.git

The repository contains the necessary scripts to install the build and debug tools.

Next, install the necessary utilities by executing the command in the project folder:

For macOS:

brew bundle --verbose

Or via pip (For Windows or Unix)

pip3 install -r scripts/requirements.txt

After installation, check that the Flipper Build Tool is working, for this we run the command:

./fbt

Python scripts must download the necessary utilities (GDB, GCC, and so on) and build the firmware.

Setting up the main functionality

Code completion and syntax highlighting

After installing fbt, you can open the project in Clion and proceed with the basic setup.

First, let’s create a CDB (Compilation Database) and import it into Clion.
This is needed for code completion.

Let’s execute 3 commands:

./fbt
./fbt faps
./fbt firmware_cdb

Then go to the folder build -> lastes and copy the file compile_commands.json to the root of the project. Then you need to right-click on the file and select Load Compilation Database Project. Ready! You can delete a file from the project root.

I have not yet found how to automatically pull the updated database from this file, if anyone knows – welcome to the comments 🙂

It remains to add the Toolchain, for this we go to File -> Settings -> Build, Execution, Deployment -> Toolchains and create the following configuration:

C Compiler: toolchain/{Ваша ОС}/bin/arm-none-eabi-gcc
C++ Compiler: toolchain/{Ваша ОС}/bin/arm-none-eabi-g++
debugger: toolchain/{Ваша ОС}/bin/arm-none-eabi-gdb-py

On a Mac with M1, the Cmake check fails for me, but this is not important, since we will collect the firmware and applications through fbt.

Adding convenient macros like in VSCode

As I said earlier, for VSCode there is a ready-made, easily importable environment with many tasks that can be launched in one click from the IDE. We will try to do something similar

We will add all tasks as follows:

Click at the top of the project Edit Configurations
Press + and select Shell Script
Select Script Text and add Working Directory (Папка с проектом)

For work, we need the following tasks:

./fbt

./fbt FORCE=1 flash_blackmagic

To download firmware via Wi-fi Dev Board

./fbt fap_dist

./fbt launch_app APPSRC={Папка с вашим приложением}

To build and upload your application to the flipper via USB

You can expand or change this list by contacting documentation. This is enough to get started.

Setting up a remote debugger

Debugging will be done through a remote GDB server.

Again we go to Edit Configurations at the top of the project and create a configuration Remote Debug:

Debugger – select the one that was added to the Toolchain earlier.
'target remote' args fill with command output ./fbt get_blackmagic (Wi-Fi debugger must be connected). It is advisable to set up a static ip on the Wi-Fi router for this device so as not to change the configuration.
symbol file: build/latest/firmware.elf – Path to the compiled elf flipper firmware file.
sysroot: build/latest The path to the folder with the assembled firmware

Before launching the debugger, you need to execute some commands on the GDB server.
For this we will create Before launch block External toolby clicking on +:

The block will look like this:

Tool Settings

Program: Select the same debugger as in the Toolchain: toolchain/{Ваша ОС}/bin/arm-none-eabi-gdb-py
Arguments:
-q -ex "target remote {заполняем выводом команды ./fbt get_blackmagic}" -ex "monitor swdp_scan" -ex "attach 1" -ex "set confirm off" -ex "set mem inaccessible-by-default off" -ex "source debug/flipperapps.py" -ex "fap-set-debug-elf-root {Тут нужен полный путь к папке .extraps в папке с собраной прошивкой, например /Users/user/CLionProjects/flipperzero-firmware/build/latest/.extapps}" -ex "quit" build/latest/firmware.elf
Working Detictory: Path to the project folder

Now we need to create a file .gdbinit in the root folder of the project.
Fill the file with the following content:

set confirm off
set trace-commands on

define target remote
target extended-remote $arg0
set mem inaccessible-by-default off
source debug/flipperapps.py
fap-set-debug-elf-root {Тут нужен полный путь к папке .extraps в папке с собраной прошивкой, например /Users/user/CLionProjects/flipperzero-firmware/build/latest/.extapps}
end

Ready! We save.

Now let’s check the debugging:

For debugging to work, you need to load the assembled firmware into the flipper. Before downloading the firmware, I recommend making a backup in the qFlipper application to save all the settings. To download the firmware, use the tasks created earlier: ./fbt and ./fbt FORCE=1 flash_blackmagic
You need to put a breakpoint in the file firmware/targets/f7/furi_hal/furi_hal_os.c, on line 154:

Start debugging

As a result, debug information should appear:

Ready! We’ve set up a remote debugger!

How to debug applications

Applications in Flipper Zero are stored on the SD card and only get into RAM when we launch them. Therefore, in order for the debugger to find the desired sector, you should put a breakpoint after loading the application into memory so that the debugger has time to subtract the area into which the application was loaded.

To do this, first put a breakpoint in the fap extension loader function:
applications/main/fap_loader/fap_loader_app.con line 107.

After that, you can put breakpoints in your application files and start debugging:

Start debugging.
On the flipper, run your application.
After you have launched the application – we will have to stop at the point that we previously put in fap_loader_app.c
Click Resume Programm, after which the breakpoints set in the application code will be launched: