---

3.1 About this Volume

Vol 2 showed that almost every off-the-shelf board Bruce runs on is missing the RF radios — CC1101 sub-GHz, NRF24 2.4 GHz, and an NFC front-end are rarely on the PCB, so Bruce makes up the gap with externally wired modules. This volume is about the hardware Bruce’s own team designed so that nothing has to be wired: a small family of first-party boards that put every radio, bus and expansion header Bruce supports onto a single PCB.

There are four of them, and they fall into two groups:

• Integrated devkits — complete boards built around an ESP32-S3 with the radios on-board: the RF REAPER (§3–§5) and the Bruce PCB V2 / “Smoochiee” (§6).
• M5Stick add-ons — expander PCBs that bolt onto an existing M5Stick to give it the RF radios it lacks: Ultramarines and Pirata (§7).

All four are open hardware under CERN-OHL-P-2.0 (Vol 1 §4), manufactured through Elecrow and sold through shop.bruce.computer, with Gerbers, BOMs and 3D-printable cases published (§8). The PCB design credit is Smoochiee for the integrated boards and TH3_KR4K3N for the M5StickC Plus extender.

This volume is the one place in the series where the firmware project becomes a hardware project, and it is worth holding onto why that is unusual. Most open firmwares are hardware-agnostic — they target whatever boards the community can make them run on, and the project ships bits, not boards. Bruce does both: it is firmware first (Vols 4–9) but it also publishes a small, deliberate hardware line whose only purpose is to be the ideal thing to run that firmware on. The boards below are best read as the firmware’s opinion, expressed in copper — the radios Bruce most wants to drive, laid out the way its author would wire them.

Source and verification. Hardware detail here is drawn from the official board pages at bruce.computer/boards. The module part numbers (E07-433M20S, E01-2G4M27SX, ST25R3916, ATGM336H, AW9523) are listed there. Where a figure is not printed on the official page it is marked.# 2. Why Bruce ships its own hardware

A firmware project does not usually design hardware. Bruce does, for a reason that falls directly out of the Vol 2 matrix: Bruce’s feature breadth is bottlenecked by the host board’s radios. The firmware can drive a CC1101, an NRF24, a PN532 and a GPS — but only three boards in the whole matrix (the two T-Embed CC1101 variants, for sub-GHz only, and Bruce’s own PCBs) have any of those on-board. On everything else, a user who wants the full breadth has to solder or jumper modules onto a board that was not designed for them.

Bruce’s own hardware removes that friction in two ways:

 The gap Bruce's PCBs fill

 Off-the-shelf board Bruce's own board
 ┌──────────────┐ ┌──────────────────────────────┐
 │ ESP32 + screen│ │ ESP32-S3 + screen │
 │ │ wire in │ + CC1101 (on-board) │
 │ (no RF) │ ───────► │ + nRF24 (on-board) │
 │ │ CC1101 │ + NFC (on-board) │
 │ │ nRF24 │ + GPS, IR, iButton, SD │
 │ │ PN532 … │ + Flipper-compatible header │
 └──────────────┘ └──────────────────────────────┘
 fragile jumpers, one board, designed for Bruce,
 breadboard reliability case + BOM published

• Integration — the radios are laid out, impedance-matched and powered on the PCB, so they work reliably instead of depending on breadboard jumpers.
• A reference target — because the board is designed for Bruce, its pin map is the canonical one; the firmware’s board config for it is authoritative rather than a user’s guess (Vol 4).

This is also why the hardware is permissively licensed (CERN-OHL-P) while the firmware is copyleft (AGPL): the project wants the boards manufactured and sold widely — including by Elecrow — without the firmware ceasing to be free.

3.2 RF REAPER — the flagship devkit

The RF REAPER is Bruce’s flagship board and the richest integrated platform in the whole matrix. It is built around an ESP32-S3 N16R8 — the 16 MB flash / 8 MB PSRAM variant — which is the largest memory budget of any Bruce target and the reason it can hold the full firmware with room to spare.

Onto that SoC the board integrates, on-PCB, essentially every radio and bus Bruce supports:

 RF REAPER — block diagram
 ┌──────────────────────────────────────────────────────────────┐
 │ ESP32-S3 N16R8 │
 │ (16 MB flash / 8 MB PSRAM) │
 └───┬───────┬────────┬────────┬────────┬────────┬────────┬──────┘
 │ SPI │ SPI │ SPI/I2C│ UART │ │ 1-Wire │
 ▼ ▼ ▼ ▼ ▼ ▼ ▼
 ┌───────┐┌───────┐┌────────┐┌────────┐┌──────┐┌────────┐┌───────┐
 │CC1101 ││ nRF24 ││ST25R391││ATGM336H││ IR ││iButton ││microSD│
 │E07- ││E01-2G ││6 NFC ││ GPS ││TX/RX ││ ││ │
 │433M20S││4M27SX ││reader ││ ││ ││ ││ │
 └───────┘└───────┘└────────┘└────────┘└──────┘└────────┘└───────┘
 sub-GHz 2.4GHz HF NFC location consumer 1-Wire storage
 (433 MHz)(PA) fixing IR
 ┌──────────────────────────────────────────────────────────────┐
 │ AW9523 I/O expander · 6-way button matrix · buzzer + vibration │
 │ status LEDs · multiple UART/I2C breakouts │
 │ ╔══════════════════════════════════════════════════════════╗ │
 │ ║ Flipper-Zero-compatible header (GPIO pinout) ║ │
 │ ╚══════════════════════════════════════════════════════════╝ │
 └──────────────────────────────────────────────────────────────┘

Read against the Vol 2 matrix, the RF REAPER is the one board where every radio column is native (●) rather than external (○): CC1101 sub-GHz, nRF24 2.4 GHz, and NFC are all on-board, and it adds GPS, IR, iButton and storage that most boards lack entirely. It is, in effect, the hardware Bruce was always driving over jumper wires, finally laid out as one board.

3.2.1 Why the N16R8 memory budget matters

The choice of the N16R8 variant — 16 MB flash, 8 MB PSRAM — is not incidental, and it connects this hardware directly to the LITE-build story of Vol 5. Bruce’s full feature set is large: the Wi-Fi/BLE stacks, the sub-GHz and NFC drivers, the JavaScript interpreter, the connectivity stack (Telnet/SSH/WireGuard/TCP), the WebUI assets and the file managers all have to fit in flash, and several of them want PSRAM at runtime. On a small-flash classic-ESP32 CYD, they do not all fit, which is why that board ships LITE (Vol 2 §7, Vol 5).

 Memory budget vs. what fits

 small-flash classic ESP32 (CYD, Elecrow 24B)
 flash ▓▓▓▓░░░░░░░░░░░░ → LITE: drops SSH/Telnet/WireGuard/
 Brucegotchi/RawSniffer/interpreter …

 ESP32-S3 N16R8 (RF REAPER, PCB V2)
 flash ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ → full build, room for OTA slots + SD
 PSRAM ▓▓▓▓▓▓▓▓ → large captures, WebUI, interpreter heap

The RF REAPER is therefore not only the board with the most radios — it is the board with the most headroom. It holds the full firmware with space for an OTA partition scheme and runtime buffers, which is part of why it is the project’s reference target: features are developed and validated where there is room for them before being squeezed (or dropped) for constrained boards.

Two design choices distinguish it technically:

• The NFC front-end is an ST25R3916, not a PN532. Most Bruce boards that do NFC use an external PN532 (or a PN532Killer); the RF REAPER integrates the ST ST25R3916 HF reader instead. The capability — HF read/clone/NDEF — is the same class (Vol 9), but the silicon is a different, higher-end reader. The matrix in Vol 2 footnotes this.
• The nRF24 module is a +27 dBm PA/LNA part (E01-2G4M27SX). This is a high-output 2.4 GHz front-end, which matters for the NRF24 subsystem’s range (Vol 7) and is a reason the board is bench/lab hardware rather than a casual gadget.

3.3 RF REAPER — the module-by-module BOM

The headline components, with the role each plays in a Bruce subsystem:

Table 1 — The headline components, with the role each plays in a Bruce subsystem

Component	Part	Bus	Bruce subsystem (volume)
SoC	ESP32-S3 N16R8 (16 MB / 8 MB PSRAM)	—	the whole firmware; holds the full build
Sub-GHz transceiver	CC1101 on an E07-433M20S module	SPI	RF / sub-GHz (Vol 8)
2.4 GHz transceiver	nRF24L01+ on an E01-2G4M27SX (+27 dBm PA/LNA)	SPI	NRF24 (Vol 7)
NFC front-end	ST25R3916 HF reader	SPI	RFID/NFC (Vol 9)
GNSS	ATGM336H GPS	UART	wardriving / GPS tagging (Vol 6)
IR	IR TX + RX	GPIO	IR (Vol 8)
1-Wire	iButton interface	1-Wire	Others / iButton (Vol 9)
Storage	microSD slot	SPI	scripts, captures, bruce.conf (Vol 4/9)
I/O expansion	AW9523 I/O expander	I2C	button matrix, LEDs
HMI	6-way button matrix, status LEDs, buzzer + vibration motor	GPIO/expander	UI / notifications
Expansion	Flipper-Zero-compatible header, multiple UART & I2C breakouts	—	external modules (§5)

[FIGURE SLOT — Vol 3 §4] — an annotated top-down photo of the RF REAPER PCB with the CC1101, nRF24, ST25R3916, GPS and Flipper header called out, if an official labelled image is available beyond the board hero already shown.

The practical reading: the RF REAPER is a bench/field RF workstation, not a keychain gadget. The +27 dBm 2.4 GHz front-end and the integrated sub-GHz, NFC and GPS put it in the same tier of capability as a purpose-built RF handheld, and the legal envelope from Vol 1 §10 applies with full force — in particular the jammer and sub-GHz TX rules (Vol 8), which are easy to trip precisely because the hardware makes them one menu away.

The RF REAPER against a purpose-built RF handheld

It is natural to compare the RF REAPER to a commercial RF multi-tool, because the on-board radio set overlaps heavily with that category. The comparison is instructive but has to be kept at the level of what class of hardware each is, not a benchmark:

Table 2 — It is natural to compare the RF REAPER to a commercial RF multi-tool, because the on-board radio set overlaps heavily with that category. The comparison is instructive but has to be kept at the level of what class of hardware each is, not a benchmark

Dimension	RF REAPER	A purpose-built commercial RF multi-tool
Nature	Open devkit (CERN-OHL-P hardware, AGPL firmware)	Closed product, closed or partly-closed firmware
SoC	ESP32-S3 N16R8 (general-purpose, user-flashable)	Vendor-specified, often locked bootloader
Radios	CC1101 (433 MHz module), nRF24 +27 dBm, ST25R3916 NFC, GPS, IR	Vendor-chosen, frequently a single integrated sub-GHz + NFC + IR set
Expansion	Flipper-compatible header + UART/I2C breakouts	Vendor header, if any
Firmware	Bruce (one of many; swappable)	Vendor firmware (sometimes with a jailbreak scene)
Who sets the pin map	Published, part of the Bruce board config	Closed

The RF REAPER’s distinguishing proposition is openness end to end: open hardware licence, open firmware, published pinout, and a header that accepts an existing accessory ecosystem. It is not a polished consumer appliance and does not try to be — it is a hacker’s reference board. The counterpart trade is that it demands more of the user (flashing, wiring discipline, understanding the legal envelope) than a sealed product does. The Flipper Zero itself is a separate tool in this hub and is the obvious point of reference for the header compatibility; the RF REAPER is best understood as “an open ESP32-S3 board that speaks that ecosystem’s GPIO, with Bruce’s whole radio stack already on it.”

3.4 The Flipper-compatible header and the external-module philosophy

The RF REAPER’s Flipper-Zero-compatible header is worth a section because it ties this volume back to the architecture. Bruce’s whole hardware model is external modules over a documented pinout (Vol 4 “External Modules” and “Wiring Diagrams”): the firmware knows how to talk to a CC1101, an nRF24, a PN532, a CH9329 USB-HID bridge, a GPS, a W5500 Ethernet controller and an SD card over defined pins, and a board’s job is to route those pins somewhere useful.

The Flipper-compatible header is the most convenient expression of that: it exposes GPIO on the same physical pinout the Flipper Zero uses for its GPIO modules, so a large existing ecosystem of Flipper add-on boards can be mechanically and electrically attached to the RF REAPER.

 External-module model (Vol 4) as the RF REAPER realises it

 Bruce firmware ──knows pinouts for──► CC1101 · nRF24 · PN532 ·
 CH9329 · GPS · W5500 · SD
 │
 ▼
 RF REAPER routes those pins to:
 • on-board modules (CC1101, nRF24, ST25R3916, GPS, …)
 • the Flipper-compatible header (third-party GPIO add-ons)
 • breakout UART/I2C pads (anything else)

The point for a reader deciding what to buy: the RF REAPER is not a closed appliance. It is an open expansion platform whose on-board radios cover the common cases and whose header and breakouts cover everything else. That is a different proposition from a sealed commercial multi-tool, and it is the reason the board is attractive to people who already own Flipper-ecosystem hardware. (The Flipper Zero itself is a separate tool in this hub; the header is a mechanical/electrical compatibility, not a software bridge.)

[FIGURE SLOT — Vol 3 §5] — the RF REAPER with a Flipper-format GPIO add-on seated on the compatible header, if an official image exists.

3.5 Bruce PCB V2 (Smoochiee)

The Bruce PCB V2 — sold through Elecrow as “Bruce PCB V2 Smoochiee” after its designer — is the second integrated board. It is a leaner, more focused design than the RF REAPER: the RF radios without the GPS/iButton/Flipper-header breadth.

Table 3 — 6. Bruce PCB V2 (Smoochiee)

Component	Part / spec
SoC	ESP32-S3-WROOM-1 (NF variant on the board page)
Memory	16 MB flash / 8 MB Octal PSRAM
Sub-GHz	CC1101 (E07-433M20S)
2.4 GHz	nRF24 (E01-2G4M27SX)
I/O expansion	AW9523BTQR GPIO expander (Adafruit part)
Power	USB-C input with on-board 3.3 V regulation
Published	Gerber / BOM, manual build files, 3D case model

Where the RF REAPER is a full RF workstation, the PCB V2 is the “CC1101 + nRF24 on an S3 with a big memory budget” board — the two radios most central to Bruce’s RF and NRF24 subsystems, on silicon that comfortably holds the full firmware, with a clean USB-C power path. It is the design most likely to be bought as a bare Bruce board by someone who wants sub-GHz and 2.4 GHz but does not need GPS, NFC or the Flipper header.

Both integrated boards are credited to Smoochiee, who is Bruce’s PCB designer (Vol 1 §3). The “Smoochiee” name on the Elecrow listing is the designer’s handle, not a separate product line — it is the same Bruce PCB V2.

3.6 The M5Stick add-ons — Ultramarines and Pirata

The other two first-party boards are not standalone computers; they are expander PCBs that give an existing M5Stick the RF radios it lacks. This is the cheapest route to RF-capable Bruce for anyone who already owns an M5Stick (including the M5Stick S3, a hub tool).

• Bruce Ultramarines — a compact add-on PCB for M5Sticks. The official page gives no further hardware breakdown beyond its M5Stick compatibility;it is the general-purpose Bruce expander for the Stick form factor.
• Pirata PCB — an add-on for the M5StickC Plus specifically, providing NRF24 + CC1101 with switch support (a hardware switch to select between the two radios on the shared bus). The M5StickC Plus extender PCB design is credited to TH3_KR4K3N (Vol 1 §3).

 The two integration strategies

 Integrated devkit Stick + add-on
 ┌─────────────────┐ ┌──────────┐ ┌──────────────┐
 │ RF REAPER / │ │ M5Stick │ + │ Ultramarines │
 │ PCB V2 │ │ (own it) │ │ or Pirata │
 │ (buy one board) │ └──────────┘ └──────────────┘
 │ everything on it│ reuse owned adds CC1101 /
 └─────────────────┘ hardware nRF24 to it
 best if starting fresh best if a Stick is already on the bench

The Pirata’s switch detail is a small but telling piece of engineering: the CC1101 and the nRF24 both want an SPI bus, and on the pin-constrained M5StickC Plus there is not room to run both independently, so the board switches between them rather than wiring both live. It is the kind of constraint that disappears on the RF REAPER, where the pin budget is large enough to run everything at once.

The trade across the two strategies is straightforward. An add-on reuses hardware already owned and is the cheapest route, but it inherits the host Stick’s limits — small screen, small flash (the M5StickC PLUS ships a LITE build, Vol 2), pin-sharing constraints like the Pirata’s switch. An integrated devkit costs more and is one more board to own, but it has no such compromises: full build, independent radios, large memory budget. Neither is “better” in the abstract; the add-ons serve the “already have a Stick” case and the devkits serve the “want the best Bruce platform” case.

3.6.1 Why these boards are the firmware’s reference targets

There is a second, less obvious reason Bruce designs hardware: a board designed for the firmware gives the project an authoritative pin map. For every third-party board, Bruce’s board config (Vol 4) encodes someone’s reading of that board’s schematic — which GPIO the SD is on, which pins the screen and buttons use, where a wired CC1101 should go. Mistakes there show up as “feature X does not work on board Y,” and much of the per-board maintenance in releases (the CoreS3 SD-conflict fix, the T-LoRa Pager encoder fix in v1.16.1, Vol 1 §3) is exactly this kind of config correction.

On Bruce’s own boards there is no such ambiguity: the designer and the firmware author are the same project, so the pin map in the board config is the board. That makes the RF REAPER and PCB V2 the natural reference targets — the boards where a new feature is first brought up because the hardware is known-correct, before it is ported outward to the wider matrix. It is the hardware counterpart to the “new core” HAL (Vol 4): the HAL makes porting cheap, and a known-good reference board makes it reliable.

 Development flow: reference board outward

 new feature ──developed/validated on──► RF REAPER / PCB V2
 (known-correct pin map,
 full memory headroom)
 │
 ▼ ported via the HAL (add board config + pin map, Vol 4)
 ┌──────────────────────────────────────────────────────────┐
 │ Cardputer · T-Embed · CYD · Elecrow · bare ESP32 · … │
 │ (per-board quirks surface here → fixed in later releases) │
 └──────────────────────────────────────────────────────────┘

3.7 Manufacture, licensing, availability and the 3D case

All four boards share the same production and licensing story:

• Licence: CERN-OHL-P-2.0 (Vol 1 §4) — permissive open hardware. This is what allows Elecrow (and anyone else) to manufacture and sell the designs, and it is why the Gerbers and BOMs are published rather than held closed.
• Manufacture: Elecrow. The integrated boards are produced through Elecrow; the Bruce PCB V2 is listed there as “Bruce PCB V2 Smoochiee.” Elecrow is also a supported host vendor in its own right (Vol 2 §8), so the relationship runs both ways.
• Sale: shop.bruce.computer is the first-party storefront; PCBWay and Elecrow links for the bare boards are on the official board pages.
• 3D-printable cases. Each integrated board has a published 3D case model, so a bare PCB can be housed into a usable handheld. The case files sit alongside the Gerbers in the published hardware bundle. A housed board matters for more than looks: the RF REAPER carries a GPS antenna, an IR window and the Flipper header, and the published case is designed around those apertures, so a printed enclosure keeps the board field-usable rather than a bare PCB that snags on everything.

The practical sourcing picture, then, has three independent axes a builder can mix: where the PCB is fabricated (Bruce shop pre-assembled, Elecrow, or any fab from the Gerbers), where the modules come from (populated by the fab, or hand-soldered from the BOM), and how it is housed (the published case on any printer, or bare). None of the three is locked by the others, which is the direct consequence of the permissive hardware licence.

[FIGURE SLOT — Vol 3 §8] — a printed-and-assembled RF REAPER in its 3D case, to show the finished handheld form, if an official image is available.

Because the hardware is CERN-OHL-P and the files are public, a reader is not locked to buying from shop.bruce.computer: the Gerbers can be sent to any fab and the case printed on any printer. Buying the assembled board is a convenience, not a requirement — the same openness the AGPL gives the firmware, the CERN-OHL-P gives the boards.

Credits. The integrated boards (RF REAPER, Bruce PCB V2) are designed by Smoochiee; the M5StickC Plus extender is designed by TH3_KR4K3N (Vol 1 §3). The hardware designs are open under CERN-OHL-P-2.0; the module part numbers and availability links are published on the official board pages at bruce.computer/boards.

3.8 Choosing among the four boards

Table 4 — 9. Choosing among the four boards

Board	SoC / memory	On-board radios	Best for	Form
RF REAPER	ESP32-S3 N16R8 (16/8 MB)	CC1101, nRF24 (+27 dBm), ST25R3916 NFC, GPS, IR, iButton	The full Bruce RF workstation; Flipper-ecosystem expansion	Integrated devkit
Bruce PCB V2	ESP32-S3-WROOM-1 (16/8 MB)	CC1101, nRF24	Sub-GHz + 2.4 GHz on a clean S3 board, no extras	Integrated PCB
Ultramarines	(host M5Stick)	per the host + add-on	Giving an owned M5Stick RF capability, general	M5Stick add-on
Pirata	(host M5StickC Plus)	CC1101 + nRF24 (switched)	Giving an owned M5StickC Plus switchable sub-GHz/2.4 GHz	M5Stick add-on

The decision in three lines:

• Starting fresh and want everything → RF REAPER. It is the only board where every RF column in the Vol 2 matrix is native, plus GPS, NFC, IR and a Flipper header.
• Starting fresh and only want the two RF radios → Bruce PCB V2. Same big memory budget, half the bill of materials, clean USB-C.
• Already own an M5Stick → Ultramarines (general) or Pirata (M5StickC Plus, switched radios). Cheapest path to RF-capable Bruce on hardware already on the bench.

A fourth option sits implicitly in the table and is worth naming because it is often the right answer for someone who already has an off-the-shelf board: buy nothing from the project, wire the modules. Vol 2 §4 showed that a bare ESP32-S3 with a screen reaches most of the RF REAPER’s capability once a CC1101, nRF24 and PN532 are jumpered on. What the RF REAPER buys over that is reliability and tidiness — impedance-matched layout, no loose jumpers, a case with the right apertures, GPS and the Flipper header — not a capability otherwise unreachable. So the real choice is less “which Bruce board” than “how much do integration and field-ruggedness matter versus minimum spend,” and that is a judgement about the intended use, not about Bruce. For bench learning, wired modules on an owned board are fine; for anything carried and used in the field, the integrated board earns its cost.

A final framing for where this hardware sits in the dive. Vol 2’s matrix answered what can I flash Bruce on across the whole ecosystem; this volume answered what did Bruce build so nothing has to be wired. The two integrated devkits are the top of that matrix — every RF column native, the largest memory budget, the reference pin maps — and the two add-ons are the cheapest way to lift an owned M5Stick’s row without buying a new computer. For a reader deciding how to get the fullest Bruce experience, the honest one-liner is: the RF REAPER is the best Bruce platform money can buy from the project; a wired-up S3 board or a Stick-plus-add-on is the best Bruce platform if the money is already spent.

How these boards’ pin maps become Bruce builds — the per-board PlatformIO environment, the capability flags, the external-module wiring the Flipper header exposes — is the architecture, and it is Vol 4, next. How to get the firmware onto any of them is Vol 5.