// releases · changelogMIT-licensed · open source

Release notes

A chronological record of every firmware release. Follow along or jump to a version.

VERSIONv1.8.1· May 17, 2026
LATEST

A polish-and-prank cycle: four new WiFi mischief modules (Cast Bomb, Bonjour Spam, Printer Prank), a Nokia-style Music Composer, an inline Wardrive Map, plus CoreS3 power & audio fixes and broader I²C bus availability across the fleet.

ADDED5 entries
  • Music Composer — Nokia-style RTTTL editor under Games. Compose tunes and play them back on the device buzzer.
  • Cast Bomb — DIAL discovery on the local network with M-SEARCH retransmits to survive multicast loss, then launches a YouTube video on every discovered smart TV / Chromecast. Endpoint probing prevents bad POSTs against Chromecast GTV (no DIAL).
  • Bonjour Spam — mDNS phantom services — broadcasts fake AirPlay, Spotify, Cast, printer, and SMB targets to flood neighbours' "share" pickers.
  • Printer Prank — SSDP-discovers nearby IPP / JetDirect printers and ships raw text via TCP 9100. Free-form message popup.
  • Inline Wardrive Map — WiGLE / GPS now renders a live map view while scanning — ESRI satellite tiles cached on SD so the map keeps drawing offline.
CHANGED8 entries
  • CoreS3 power — defer DLDO1 enable and lower BLDO2 so the device boots reliably on battery cold-start
  • CoreS3 SPI — bumped to 40 MHz write / 20 MHz read (visible LCD speed-up)
  • CoreS3 audio — tone() rewritten with fixed-rate I2S + trapezoidal LUT + octave-down to fix harsh artefacts
  • Cardputer Adv — NRF24 module pin defs added, SD SPI uses the default constructor for shared-bus consistency
  • Navigation — 4-way / 2-way capability is now a runtime check (Nav->is4Way()) so screens can adapt per-device
  • Packet Monitor — new line-chart-with-glow rendering instead of the old bar histogram
  • Beacon Spam — load SSID dictionaries from SD via the file browser, rate-limit emissions to channels 1 / 6 / 11
  • I²C bus reliability — every board with an external I²C bus now begins it at boot, fixing legacy callers (GPS XL9555 etc.) on Cardputer / T-Display / StickC Plus. Pin retargeting via Settings → Pin still applies live in MFRC522, PN532-I²C, and I²C Detector
FIXED4 entries
  • Storage — fix stack overflow in file listing and recursive directory delete
  • EAPOL Brute Force — fix stack overflow plus add crash guards
  • HID — show a USB-busy error when WebAuthn has claimed USB before keyboard binds
  • Dino (Lua) — fix OOM crash and cap speed

Install in your browser at https://unigeek.xid.run — no tools required. Or download a .bin from https://github.com/lshaf/unigeek/releases and flash with esptool / PlatformIO.

Copy the sdcard/ folder to the SD card root, or use the built-in Download menu on the device to fetch sample files over WiFi.

Built for security research and education. Use responsibly.

VERSIONv1.8.0· May 8, 2026
ARCHIVED

1.8.0 ships three flagship additions: a full Lua 5.1 scripting runner, a WebAuthn / FIDO2 USB security key with BIP-39 backup, and a UART Log Mode that records or streams terminal traffic over WiFi. Plus a Fishing minigame, a Random Line Picker utility, and quality-of-life polish across input popups and main-menu touch.

ADDED5 entries
  • WebAuthn / FIDO2 USB Security Key — Full CTAP 2.1 stack — passkeys, ClientPIN proto v1 (with 10-minute auth-token idle timeout), hmac-secret / PRF, largeBlob (4 KB on-device), GetNextAssertion, CredentialManagement, AuthenticatorConfig (toggleAlwaysUv + setMinPINLength), and U2F backward-compat. Master key generation uses live WiFi + NTP entropy with on-device BIP-39 backup and restore. Windows compatibility via a stuck-mount watchdog that survives selective-suspend churn. Manage passkeys + master from Utility → Manage WebAuthn, daily use from HID → USB Web Authn. ESP32-S3 boards only.
  • Lua Runner — Run Lua 5.1 scripts from /unigeek/lua/ on a dedicated FreeRTOS task (32 KB stack, PSRAM source buffer for scripts ≥ 2 KB). Module ecosystem: uni.lcd (full draw primitives + off-screen sprites), uni.nav (buttons + raw touch coords), uni.sd (full CRUD), uni.input / uni.dialog / uni.notify (modal text/number/hex/IP prompts, confirm/select, toast), uni.json (cJSON encode/decode), uni.path, uni.time, uni.config. Ships with seven samples — base, sample, dino, btntest, inputs, savedata, clock.
  • UART Log Mode — The UART Terminal can now record traffic. Log Mode picks Off / File (/unigeek/utility/uart/<name>.log) / Stream AP (built-in SoftAP) / Stream Network (Telnet on TCP 23, up to 4 clients). Status bar surfaces the active mode at a glance.
  • Fishing minigame — Cast, time the bite, and reel in. New entry under the Games menu.
  • Random Line Picker — Select up to 30 text files from /unigeek/utility/random_line/, then shuffle and display a random line from the combined pool. Press OK to cycle.
CHANGED5 entries
  • Main menu touch — direct-tap on touch boards with finger-hover highlight; new Home tile when running from a sub-screen
  • Input grids (text / number / hex / IP / BIP-39) — 4-way navigation on boards that emit it; 2-button boards continue walking linearly
  • Input grids — BACK is now backspace — first BACK clears any in-progress multi-tap, then chips at the committed input one char at a time, only cancels when the field is empty
  • Web File Manager — moved to port 8000 with domain isolation; log lines show both unigeek.local and ip:8000
  • CYD — default GPS pins (TX=1, RX=3, baud=9600) so the GPS module works out-of-the-box
FIXED1 entry
  • Web File Manager — fixed crash when previewing a zero-byte file

Install in your browser at https://unigeek.xid.run — no tools required. Or download a .bin from https://github.com/lshaf/unigeek/releases and flash with esptool / PlatformIO.

Copy the sdcard/ folder to the SD card root, or use the built-in Download menu on the device to fetch sample files over WiFi.

Built for security research and education. Use responsibly.

VERSIONv1.7.2· May 1, 2026
ARCHIVED

A second HID feature pair — Password Manager and Mouse Jiggle — plus a quieter HID picker, a richer BLE Analyzer, and a smarter Karma stack. Bus-sharing fixes for M5Stick S3 and CYD let the Grove port host SD, CC1101, NRF24, and PN532 simultaneously. Achievement total 231 → 238.

ADDED2 entries
  • Password Manager — Deterministic HID vault — entries are generated on demand from SHA256(master + label + params) and never written back to flash. Master is stored as a 32-byte hash; per-entry preferences (length, uppercase / lowercase / digits / symbols) persist. One-press auto-type via USB or BLE HID.
  • Mouse Jiggle — Periodic mouse movement over USB or BLE HID to keep the host awake. Configurable interval and jiggle amplitude; works on every ESP32-S3 board with HID and on boards with the BLE backend.
CHANGED11 entries
  • HID menu — Keyboard menu renamed to HID, USB / BLE picker flattened into a single chooser; combined keyboard+mouse HID descriptor on both USB and BLE backends
  • BLE Analyzer — richer device info plus a scrollable detail view per advertisement
  • Karma support — simple pairing, MAC lock, and a 5 s heartbeat that auto-stops the attack on client silence
  • Karma EAPOL — same 5 s heartbeat with stop + reset on silence
  • Web File Manager — ports the net_gotchi improvements (saveCrack, password dictionary endpoints), embeds crack.wasm as PROGMEM and serves it from /crack.wasm
  • CYD — Grove port now shares a single VSPI bus across SD, CC1101, and NRF24
  • M5Stick S3 — Grove port shares one FSPI bus across SD, CC1101, NRF24, and PN532; Grove 5V exposed via IPower::setExtOutput and a GROVE_5V_OUTPUT pin entry
  • IR — Grove 5V routed through Uni.Power->setExtOutput, restored on exit
  • Pin Setting — Grove 5V unified under a single global pin-config key across all boards
  • ListScreen / AchievementScreen — scrollbar indicator using the active theme color across all list views
  • Achievements — 238 total entries (≈ +7 this cycle); per-domain cap raised 32 → 64 so every WiFi and Chameleon entry is reachable
FIXED5 entries
  • M5Stick S3 — PN532 UART default pins corrected to TX=1 / RX=0
  • Web File Manager — replaced deprecated send_P with send for arduino-esp32 v2 compatibility
  • IR — fixed Uni.Power-> → Uni.Power. (IPower is a reference, not a pointer)
  • Pin Setting (M5Stick S3) — onPinConfigApply now reads the unified grove_5v key
  • Web installer (M5StickC Plus 1.1) — pinned flash baud to 115200; the CP2104 bridge ACKs higher baud rates but times out mid-write

Install in your browser at https://unigeek.xid.run — no tools required. Or download a .bin from https://github.com/lshaf/unigeek/releases and flash with esptool / PlatformIO.

Copy the sdcard/ folder to the SD card root, or use the built-in Download menu on the device to fetch sample files over WiFi.

Built for security research and education. Use responsibly.

VERSIONv1.7.1· Apr 26, 2026
ARCHIVED

Two new NFC modules, a BLE companion for Claude Desktop, full MIFARE Classic nested-attack coverage on both Chameleon Ultra and MFRC522, and touch calibration for the CYD family.

ADDED6 entries
  • NFC (PN532 UART) — PN532 / PN532Killer over HSU. Scan ISO14443A, ISO15693, EM4100; authenticate, dump, and dictionary-attack MIFARE Classic; read/write Ultralight pages; detect Gen1a / Gen3 magic cards; emulate a fixed UID or a previously dumped MIFARE Classic / NTAG .bin. Pin-configurable from Modules > Pin Setting.
  • NFC (PN532 I2C) — Same feature set as PN532 UART with NTAG emulation. Auto-detects external I2C first, then falls back to internal. NTAG emulation marked unstable for this release.
  • Claude Buddy — BLE desk pet that pairs with the claude-desktop-buddy companion app on macOS / Windows over Nordic UART. Live session status, running tasks, and queued approval prompts; approve or deny tool calls directly from the device; animated buddy character reflects session state.
  • MIFARE Classic Static Nested + Nested Attack (Chameleon Ultra) — Recover keys from a single known key. Static-nested via firmware command 2003 for fixed-nonce cards; weak-PRNG nested via command 2006 with parity-disambiguated 65 535-distance enumeration and on-device verification. Per-target rendering: cyan header, silent enumeration, single green/red summary line.
  • MIFARE Classic Nested Attack (MFRC522) — Weak-PRNG nested attack: collects 3 nonce samples per target via the full CRYPTO1 reader handshake, enumerates PRNG distances with parity disambiguation, runs lfsr_recovery32, soft-checks each candidate, and verifies on the card. Same single-line summary format as the Chameleon path.
  • Touch Calibration (CYD) — Three-point calibration screen for CYD touch boards. Maps raw touch coordinates to display pixels and persists the result across reboots. Available from the Settings menu.
CHANGED3 entries
  • M5Stack CoreS3 — Grove 5V direction toggle in Pin Setting
  • About screen — added ChameleonUltraGUI and claude-desktop-buddy credits
  • Achievements — 14 new entries this cycle bringing the total to 231 (≈ 96 000 EXP pool); covers the new Chameleon nested attacks, MFRC522 weak-PRNG nested, and Claude Buddy approval flow
FIXED3 entries
  • CYD — SD card now uses HSPI / VSPI explicitly; resolves SD init failures from shared SPI bus contention
  • NRF24 — pin labels renamed to CS and GDO0 for clarity
  • M5Stack CoreS3 — pin-config apply moved into Device::onPinConfigApply, with weak defaults so other boards build cleanly

Install in your browser at https://unigeek.xid.run — no tools required. Or download a .bin from https://github.com/lshaf/unigeek/releases and flash with esptool / PlatformIO.

Copy the sdcard/ folder to the SD card root, or use the built-in Download menu on the device to fetch sample files over WiFi.

Built for security research and education. Use responsibly.

VERSIONv1.7.0· Apr 23, 2026
ARCHIVED

Five new screens, six more CYD board variants, and passive WiFi threat detection. Total supported boards: 18.

ADDED13 entries
  • CYD 2432S028 2USB — Dual USB-C variant.
  • CYD 2432W328R — Wider 328×240 display.
  • CYD 2432W328C — Capacitive touch.
  • CYD 2432W328C-2 — Second capacitive touch variant.
  • CYD 3248S035R — 3.5" resistive touch display.
  • CYD 3248S035C — 3.5" capacitive touch display.
  • WiFi Watchdog — Passive promiscuous monitor across five views — deauth flood detection, probe request leaks, beacon flood tracking, and evil twin detection. Touch boards get tap-to-drill navigation.
  • Karma Detector — Broadcasts fake probe requests across channels and listens for rogue APs responding to any SSID — surfaces karma and EAPOL attack surfaces.
  • TOTP Authenticator — Time-based OTP generator. Add accounts by Base32 secret, view live 6 or 8-digit codes with countdown, hold to reveal or delete.
  • UART Terminal — Serial terminal over configurable TX/RX GPIO pins. Send text or hex, receive in the background while you type, optional session log save to SD.
  • Pomodoro Timer — Focus/break timer with configurable work and break durations, progress bar, speaker notification, and session counter.
  • File Hex Viewer — Open any SD or LittleFS file as a scrollable hex dump with offset, hex columns, and ASCII panel.
  • Push/GoBack Navigation Stack — Screens push onto a history stack and restore the cursor position when going back — consistent across all boards.
CHANGED4 entries
  • Chameleon Ultra — MF Dump — reads sector keys from the Dict Attack result file (/unigeek/nfc/keys/<UID>.txt); run Dict Attack first
  • Beacon Attack — full rework with improved reliability
  • Scroll List View — rendering and performance improvements
  • Sound — updated Win, Lose, and Notification audio
FIXED1 entry
  • Flappy Bird: controls and scoring regression fixed

Copy the sdcard/ folder to the SD card root, or use the built-in Download menu on the device.

Built for security research and education. Use responsibly.

VERSIONv1.6.0· Apr 20, 2026
ARCHIVED

Six new boards land in a single release — total supported boards now 12. NRF24L01+ and ChameleonUltra BLE round out the radio toolkit.

ADDED11 entries
  • M5Stack CoreS3 — (M5Unified) Touch navigation, I2S speaker, full USB HID support.
  • M5Stick S3 — I2S speaker, USB HID, IR transmit.
  • LilyGO T-Display S3 — USB HID.
  • LilyGO T-Embed CC1101 — Rotary encoder, I2S speaker, CC1101 module.
  • DIY Smoochie — 5-button navigation, CC1101 module.
  • CYD (ESP32-2432S028R) — Budget-friendly board support.
  • NRF24L01+ Module — 2.4 GHz spectrum analyzer, multi-mode broadcaster (10 presets + single-channel + hopper), and wireless HID receiver scanner — requires an NRF24L01+ module.
  • Chameleon Ultra BLE Client — Full BLE client for ChameleonUltra and ChameleonLite: device info, 8-slot card manager, HF/LF scan and clone, MIFARE dictionary attack + dump + magic card detection, MFKey32 log recovery, T5577 write, password cleaner.
  • Hand Orientation Toggle — Flip the display and swap UP/DOWN navigation on M5StickC Plus 1.1, Plus 2, and StickC S3.
  • Speaker Test Screen — Play Win, Lose, Notification, and Beep sounds to verify speaker output.
  • Touch Navigation Overlay — Live edge indicators for touch areas — always visible during navigation on CoreS3 and CYD.
CHANGED5 entries
  • Sprite rendering — all screens migrated to per-region sprites; significantly lower peak RAM usage across every board
  • Ducky Script — expanded command support with more script commands recognized
  • GPS screen — default pin auto-configuration per board type
  • Navigation — back navigation now consistent on all boards; screen no longer wakes on nav press
  • Achievement system — reworked tracking and expanded achievement entries
FIXED2 entries
  • Input popups (text, number, select): back/cancel no longer saves changes
  • Web File Manager: storage file list and upload path corrections

Browser installer (no tools required): unigeek.xid.run.

Download firmware binaries: GitHub Releases. Copy the sdcard/ folder to the SD card root, or use the built-in Download menu on the device.

VERSIONv1.5.0· Apr 12, 2026
ARCHIVED

Achievements, ranks, and a character screen — plus BLE device spam and two new games.

ADDED7 entries
  • Achievement System — 60+ achievements across 10 domains (WiFi, BLE, Keyboard, NFC, IR, Sub-GHz, GPS, Utility, Games, Settings). Earn EXP, level up your rank, and unlock an Agent Title for your Character Screen.
  • Character Screen — Full-screen profile showing rank, EXP, HP, BRAIN, domain progress bars, and your Agent Title.
  • BLE Device Spam — New submenu under BLE — Android (Google Fast Pair popups, 31 model IDs, randomized MAC), iOS (Apple Continuity: SourApple action + AppleJuice AirPods/setup), Samsung (Galaxy Watch pairing, 26 watch models).
  • Memory Sequence — Simon Says-style memory game with 4 difficulty levels and high score tracking.
  • Number Guess — Higher/lower number guessing game with 4 difficulty levels (1–99 through 1–9999).
  • High Scores — Top 5 scores per difficulty tracked for Wordle, HEX Decoder, Number Guess, Memory Sequence, and Flappy Bird.
  • Karma Attack split — Karma EAPOL and Karma Captive are now separate modes. Karma Support adds a companion mode for a second device to host fake WPA2 APs via ESP-NOW.
CHANGED3 entries
  • Download menu now includes BadUSB scripts organized by OS and category
  • Better EAPOL offline brute-force
  • Simplified sprite rendering across screens
FIXED6 entries
  • PSRAM heap allocation
  • I2C detector and pin settings
  • Font position and dialog bubble rendering
  • WiFi connect stability
  • IP ping fix
  • IRAM usage reduction

Browser installer (no tools required): unigeek.xid.run.

Manual download: GitHub Releases. Copy the sdcard/ folder to the SD card root, or use the built-in Download menu.

VERSIONv1.4.0· Apr 6, 2026
ARCHIVED

Sub-GHz and IR radio join the toolkit, and WhisperPair tests Google Fast Pair devices for CVE-2025-36911.

ADDED6 entries
  • Sub-GHz (CC1101) — Capture, replay, and jam Sub-GHz RF signals via an external CC1101 module. Frequency scanner, configurable frequency (280–928 MHz), receive with RcSwitch decoding, send from .sub files, and jammer. Compatible with Flipper Zero and Bruce .sub formats.
  • IR Remote — Capture and replay infrared signals with automatic protocol detection (NEC, Samsung, Sony, RC5, RC6, Kaseikyo, Pioneer, RCA). Send from IR files, TV-B-Gone with 271 power-off codes, configurable TX/RX pins. Compatible with Flipper Zero and Bruce IR formats.
  • WhisperPair (CVE-2025-36911) — Tests Google Fast Pair devices for the KBP vulnerability. Performs an ECDH key exchange and forged KBP handshake to detect unauthorized pairing. Based on FrostedFastPair by PivotChip.
  • Pin Settings — Configure GPIO pins for every external module from the device — GPS TX/RX/baud, external I2C SDA/SCL, CC1101 CS/GDO0. Accessible from both Modules menu and Settings.
  • Frequency Scanner — Spectrum scanner across ~40 known Sub-GHz frequencies (300–928 MHz). Live bar chart showing RSSI per channel, highlighting the strongest signal.
  • External SPI for M5StickC — M5StickC Plus 1.1 and 2 now support external SPI for Sub-GHz CC1101 modules (GPIO 32/33), with proper bus handoff when GPS is also connected.
CHANGED3 entries
  • Packet Monitor UI refresh
  • EAPOL capture target count increased
  • Better ListScreen highlight reset behavior
FIXED3 entries
  • LoRa conflict on Cardputer ADV fixed
  • File manager re-render on navigation fixed
  • Screen highlight reset after back navigation fixed

Browser-based installer (no tools required): unigeek.xid.run.

Manual download: GitHub Releases. Copy the sdcard/ folder to your SD card root, or use the built-in Download menu in the firmware.

VERSIONv1.3.2· Mar 30, 2026
ARCHIVED

Stability pass: background processes survive screen-off, plus our first built-in game.

ADDED3 entries
  • Flappy Bird — Classic side-scroller with randomized pipes and scoring.
  • Configurable EAPOL Capture — Channel hopping support and configurable capture settings.
  • File Manager Sorting — Files and directories now sorted for easier navigation.
FIXED9 entries
  • Screen-off no longer stops background processes (EAPOL, GPS, Karma, etc.)
  • Cardputer sound output fixed
  • EAPOL password counter fixed for the built-in wordlist
  • SSID name capture fixed
  • Display flickering fixed on multiple screens
  • Power management rules corrected (PowerSave vs PowerOff)
  • LogView status bar positioning fixed
  • Large file handling fixed in the file viewer
  • Web File Manager power-off issue fixed

Download binaries from the GitHub Releases page. Copy the sdcard/ folder to your SD card root, or use the built-in Download menu in the firmware.

VERSIONv1.3.1· Mar 29, 2026
ARCHIVED

Wardriving gets scan-mode presets and a real file viewer.

ADDED3 entries
  • GPS Scan Mode — Pick what to scan during wardriving: WiFi + BLE (default), WiFi only, or BLE only. The status bar adapts to show only the relevant counts.
  • GPS Wardrive Mode — Two WiFi scanning methods. Driving (default) uses active scanning for better coverage at speed. Walking uses passive promiscuous sniffing with channel hopping.
  • File Viewer — Tap any file in File Manager to view its contents. Scrollable text display with scrollbar, page jump with LEFT/RIGHT, line scroll with UP/DOWN.
FIXED2 entries
  • Keyboard input — nav keys (; . , /) are no longer consumed during text input, fixing number-mode decimal entry and allowing every printable character
  • Wardrive upload — file list now sorted newest-first for quick access to recent logs

Pre-built binaries: GitHub Releases. Copy the sdcard/ folder to your SD card root, or use the built-in WiFi > Network > Download menu to fetch sample files directly on the device.

VERSIONv1.3.0· Mar 28, 2026
ARCHIVED

NFC key recovery, GPS wardriving, and Wigle uploads land in one release.

ADDED6 entries
  • NFC (MFRC522) — MIFARE Classic card reader and key recovery — scan UID, authenticate with common default keys, dump memory, and run dictionary, static-nested, and darkside attacks.
  • GPS & Wardriving — Live GPS view (coordinates, speed, altitude, satellite count, UTC) plus WiFi + BLE wardriving in Wigle-compatible CSV format. NimBLE scanning works on all boards (no PSRAM required); WiFi capture hops across all 13 channels. GPS time syncs to the device clock and RTC where available.
  • Wigle Integration — Upload wardrive logs to Wigle from the GPS module or Network menu. View profile stats (rank, WiFi/Cell/BT discovered, upload history) and manage the API token — shared between GPS and Network > Wigle. Uploaded files are renamed with an _uploaded suffix.
  • Barcode Generator — Code 128 barcode display from typed text or a file. Load content from /unigeek/barcode/. Toggle inverted colors with UP/DOWN.
  • BLE Detector — BitChat app user detection added to passive BLE scanning.
  • Pin Configuration — Configure external I2C SDA/SCL pins and GPS TX/RX/baud from Settings. T-Lora Pager ships with GPS pins pre-configured.
FIXED7 entries
  • Power saving now respects blocking action overlays — the screen won't turn off during popups or input dialogs
  • ScrollListView flicker eliminated
  • Partition size increased for more app storage
  • Cardputer keyboard logic error fixed
  • I2C detection fix for the MFRC522 module
  • T-Lora Pager hardware fixes
  • Web file manager fix

Download firmware binaries from the GitHub Releases page. For SD card samples, copy the sdcard/ folder contents to your SD card root, or use the built-in WiFi > Network > Download > Firmware Sample Files menu.

VERSIONv1.2.1· Mar 23, 2026
ARCHIVED

Maintenance release — hardware fix for T-Display 16MB battery readings.

FIXED1 entry
  • T-Display 16MB battery — fixed an incorrect battery ADC pin reference that could cause wrong battery readings

Download binaries from the GitHub Releases page. Copy the sdcard/ folder to your SD card root, or use the built-in Download menu in the firmware.

VERSIONv1.2.0· Mar 23, 2026
ARCHIVED

The Swiss Army Knife for ESP32 Security Research — one firmware, six devices, dozens of tools right in your pocket.

ADDED7 entries
  • M5StickC Plus 2 support — Full support for the refreshed M5StickC Plus 2 with rotary encoder navigation, PWM brightness control, and buzzer feedback. Same powerful toolkit, even more portable.
  • Karma Attack — Automatically answers WiFi probe requests from nearby devices. When a phone looks for a remembered network, UniGeek becomes that network instantly.
  • MITM Attack — Full man-in-the-middle on local networks. ARP spoofing redirects traffic through your device, letting you intercept packets in real time.
  • Rogue DHCP — Hands out custom gateway and DNS settings. Silently redirect traffic without touching ARP tables.
  • Deauth Burst — Concentrated deauth frames at high speed — faster and more effective than single-frame deauth.
  • CCTV Sniffer — Scan the local network for CCTV cameras and stream their feeds directly on device. Find unsecured cameras and test their accessibility.
  • Storage Checker & Device Status — Monitor storage health, firmware version, board info, and memory usage at a glance.

Download the .bin file for your device from the GitHub Releases page and flash using ESP Web Flasher or esptool.py.

For SD card content — DuckyScript, Evil Twin portals, passwords, QR codes — copy the sdcard/ folder to your SD card root, or use the built-in Download menu inside the firmware.

VERSIONv1.1.0· Mar 15, 2026
ARCHIVED

LilyGO T-Display joins the lineup, evil twin is live, and BLE detection gets a major expansion.

ADDED5 entries
  • LilyGO T-Display — 2-button navigation, double-click select, LittleFS storage.
  • Evil Twin — Clones a nearby AP and broadcasts a matching SSID to intercept connections. Includes a captive portal for credential harvesting.
  • BLE Detector — Passive BLE sniffing with device classification — detects phones, laptops, wearables, and IoT devices from advertisement data.
  • Download Menu — Built-in downloader for DuckyScript payloads, Evil Twin portals, and wordlists — pulls content directly over WiFi, no computer needed.
  • WPA2 Wordlist — Built-in wordlist bundled for offline EAPOL brute-force without an SD card.
CHANGED3 entries
  • EAPOL brute-force speed improved (~7.6 pass/sec)
  • Storage handling refactored for reliability across boards
  • Deauth warm-up phase added for more consistent attack results

Flash the .bin file for your device using ESP Web Flasher or esptool.py. Copy the sdcard/ folder to your SD card root, or use the built-in Download menu.

Built for security research and education. Use responsibly.

VERSIONv1.0.1· Mar 8, 2026
ARCHIVED

Stability patch for EAPOL capture and Cardputer power.

FIXED3 entries
  • EAPOL capture: deauth timing and reliability fixes
  • Cardputer: power management issue fixed
  • Press-hold detection improved

Flash the .bin file for your device using ESP Web Flasher or esptool.py.

Built for security research and education. Use responsibly.

VERSIONv1.0.0· Mar 8, 2026
ARCHIVED

First public release — multi-device firmware built from the ground up to support three ESP32 boards with a unified codebase.

Flash the .bin file for your device using ESP Web Flasher or esptool.py. Copy the sdcard/ folder to your SD card root for scripts, portals, and wordlists.

Built for security research and education. Use responsibly.