"$15 headless starter"
budgetClassic ESP32 (CH340) + a data USB-C cable + a laptop running Headless Marauder. Learn Marauder with zero screen.
Build-hub · ESP32 · Cyberdecks
Build the gear. The right way.
One honest place to build these security-hardware projects: figure out what to buy, what firmware runs on it, how to flash it, and where every tool and guide lives.
01Pick your path
New to this? Start with what you're actually trying to do.
Build a cyberdeck
What boards, screens, antennas and power to buy, and how it all comes together.
Just flash a board
Got an ESP32 or Flipper? Find the right firmware and the tool that flashes it.
Explore the tools
The controllers, flashers and utilities that run the whole kit from one place.
Build a cyberdeck
Boards, screens & input, antennas, power, enclosures and example builds.
A cyberdeck is just a board + a way to see it + a way to power it + a way to carry it. Start with the board — everything else follows from it. Prices below are rough street-price tiers (2026), not quotes ; buy from wherever you trust.
| Board family | Good for | Notes / gotchas | Rough tier |
|---|---|---|---|
| Classic ESP32 (WROOM, CH340) — "Gold"/generic dev boards | Cheapest way in; headless Marauder / Bruce / GhostESP | It is not an S3; needs the CH340 driver on Windows | ~$5–12 · budget |
| ESP32-S3 dev board | Native USB, more RAM; some builds require it (ESP32-DIV, some Meshtastic) | Pick one with PSRAM for display builds | ~$8–18 · budget |
| ESP32-C-series (C3 / C5 / C6) | Cheap single-core; C5/C6 add newer radios; C5 = dual-band 2.4/5 GHz | C5 bootloader offset 0x2000, not 0x0 — a classic brick; let the tool handle it |
~$6–15 · budget |
| CYD — "Cheap Yellow Display" (ESP32-2432S028, 2.8") | Screened builds — HaleHound, GhostESP, Bruce; touchscreen out of the box | The 2.4" (2432S024) variant is NOT supported by GhostESP — get the 2.8"; newer NM-CYD-C5 adds 5 GHz | ~$10–18 · budget |
| Flipper Zero + WiFi Dev Board / Dev Board Pro | Flipper users; Marauder over the ESP32 module (PMKID / deauth-test / pcap to SD) | Dev Board Pro has onboard SD, no soldering; the Flipper itself is SubGHz / NFC / IR / BadUSB | Flipper ~$170; board ~$30–45 · mid |
| LilyGO T-Deck / T-Deck Plus (ESP32-S3) | All-in-one handheld: 2.8" touch LCD + BlackBerry keyboard + trackball; GhostESP / Bruce / Meshtastic | Plus adds GPS + 2000 mAh battery + LoRa — a near-complete deck in one unit | ~$43–50 · mid |
| LilyGO T-Embed CC1101 | SubGHz + IR + NFC in a screened body; GhostESP-supported | More specialized / pricier | ~$45–70 · mid |
| M5Stack / M5StickC / Cardputer | Compact screened kits; Bruce runs great on Sticks / Cores / Cardputer | Cardputer = keyboard form factor + IR + SD | ~$15–40 · mid |
| Heltec WiFi LoRa 32 V3/V4, LilyGO T-Beam | Meshtastic / LoRa mesh comms (not attack tooling) | V4 adds GNSS + solar + 28 dBm; T-Beam has GPS onboard | ~$15–25 bare · budget |
| BW16 / RTL8720DN (Realtek AmebaD) | Dual-band 2.4/5 GHz recon on a Realtek chip | Flashed over its own AT-command CLI / ImageTool, not esptool | ~$8–15 · budget |
| "Ghost" / premium fusion boards (Banshee, Ultimate Marauder, Poltergeist 5 GHz, GhostBoard) | Purpose-built decks: dual-ESP32, dual-band, SD, Ethernet, GPS, dual displays | Vendor boards (Wired Hatters / Rabbit-Labs); premium price | ~$40–120+ · premium |
If you only want to try things: a classic ESP32 or a 2.8" CYD is the cheapest honest start. If you want
one thing that already feels like a deck: a T-Deck. If you're a Flipper owner: the WiFi Dev Board Pro.
How you see and drive the board. You don't need a screen to start — bare boards run headless.
- Bare ESP32 / S3 = headless. Drive it from a laptop via Cyber Controller or Headless Marauder over serial. No screen needed to start.
- CYD = integrated resistive touch 2.8" — the simplest screened path.
- T-Deck / Cardputer / M5 = integrated LCD + physical keyboard/trackball — best for untethered use.
- Add-on displays: SSD1306 / SH1106 OLED (0.96"/1.3", I²C) for headless status; ST7789 TFT for color. Match the firmware build to the panel — a wrong display driver means a blank screen.
- Input: trackball (T-Deck), keyboard (Cardputer / T-Deck), or none (drive it from the desktop app).
What the board can see and transmit — and the range you'll actually get.
- External antenna (IPEX / u.FL) on a board wired for it noticeably improves range — but only if the board has the connector; many WROOM boards are PCB-antenna only.
- 2.4 GHz vs dual-band: classic ESP32 is 2.4 GHz only; ESP32-C5 and BW16 / RTL8720DN reach 5 GHz — needed to see 5 GHz networks at all.
- SubGHz (CC1101) / IR / NFC: on Flipper, T-Embed CC1101 and premium fusion boards — for 300–928 MHz remotes, IR and NFC work (authorized use only).
- LoRa (SX1262): Heltec V3/V4, T-Beam, T-Deck + LoRa — for Meshtastic long-range mesh text, not attack tooling.
- GPS (NEO-6M/8M, or onboard on T-Beam / T-Deck Plus): required for wardriving to WiGLE CSV.
Keeping the deck alive — and the one cable mistake behind most "it won't flash" reports.
- 18650 Li-ion is the cyberdeck standard (many boards have a holder + charge circuit). Use protected cells; mind polarity. Battery/charging is where cheap boards cut corners — verify the charge IC before trusting it.
- LiPo packs (JST-PH) for slim builds — the T-Deck ships a 2000 mAh pack; add a fuel gauge if the board supports it.
- USB-C power bank = the no-solder option: run the deck off a bank, done.
- Cable warning: use a data USB-C cable, not charge-only. A charge-only cable powers the board but it never enumerates as a serial port → "it won't flash."
A way to carry it. Print one, buy one, or box it — just don't shield your antennas.
- 3D-printed cases — Flipper WiFi-module cases, CYD cases, T-Deck shells; plenty of community STLs (the firmware and board repos link them).
- Off-the-shelf project boxes + a panel-mount antenna for a rugged deck.
- Vendor shells — Heltec / Meshtastic sell finished shells (~$46–59 ) if you don't print.
- Keep antennas external to the case where possible; shield nothing you need to transmit through.
Three concrete starting points at three budgets. Totals are rough tiers, not quotes.
"~$25 screened solo deck"
mid2.8" CYD + an 18650 + a case. Runs HaleHound / GhostESP / Bruce with no laptop.
"~$110 do-everything handheld"
premiumT-Deck Plus (GPS + LoRa + battery) + an external 2.4/5 GHz consideration + a printed shell. Runs GhostESP / Bruce / Meshtastic.
Each links the relevant Hardware Guides PDF — buy → build → flash → run.
Just flash a board
Pick the firmware, pick the tool, flash it, and get past the usual snags.
Pick by what you actually want to do. Each is upstream, open-source firmware — full credit to its authors.
ESP32 Marauder
The classic WiFi/BLE recon + testing suite (scan, PMKID, deauth-test, pcap, wardrive). Runs on the widest range of ESP32 boards.
GhostESP (Revival)
Broad modern platform, 45+ board targets — Wi-Fi/BLE/NFC/IR/SubGHz/GPS/Zigbee. Strong on screened boards (CYD 2.8", T-Deck, Cardputer).
Bruce
A "predatory" multi-tool firmware; excellent on M5 Sticks/Cores, Cardputer, T-Deck, T-Embed; added NM-CYD-C5 dual-band.
HaleHound
A CYD-focused build for the Cheap Yellow Display.
esp8266_deauther (v3)
The original learning/testing tool. ESP8266 / ESP8285 only — NOT ESP32.
Meshtastic
Encrypted long-range LoRa mesh text (comms, not attack). ESP32-S3 / Heltec / T-Beam / T-Deck.
Flipper Zero CFWs
Momentum (feature-rich, continuation of Xtreme), Unleashed (removes region locks, stable), RogueMaster (kitchen-sink). Flipper firmware, flashed via qFlipper.
BW16 / RTL8720DN
Realtek dual-band recon, flashed over its AT CLI / ImageTool.
Which LxveAce tool flashes what — plus the generic 3-step.
Cyber Controller
all-in-one50 firmware profiles across 5 backends; auto-detects the chip (runs
chip_id first, so it won't brick a C5 at the wrong offset). Use it when you want one
app for everything + serial monitor + multi-radio broadcast.
Universal Flasher
flasher onlyStandalone, device-agnostic flasher; also writes Kali / Tails / Arch to USB, integrity-checked. Use it when you just want to flash and nothing else.
Headless Marauder
one-clickOne-click standalone exe (no Python, no browser); Marauder controller + multi-firmware flasher. Great for headless "Gold" boards.
The generic 3 steps. 1) Plug in with a data cable. 2) Let the tool
auto-detect / pick the board profile. 3) Flash and watch the serial monitor. Hold BOOT
on boards that need manual download mode.
Backends under the hood (for
transparency): esptool (ESP32 family), qFlipper (Flipper),
rtl8720 (BW16 / AmebaD), SD image (Raspberry Pi). Each release ships a
SHA256SUMS + a VirusTotal link.
The snags that bite everyone, and how to clear them.
- Port never appears (Windows): install the CH340 (or CP210x) driver; try another USB port; confirm it's a data cable.
- "Failed to connect / no serial data": hold BOOT/IO0 while starting the flash (manual download mode); lower the baud; unplug other serial devices.
- Wrong chip / brick after flash: you assumed the chip — let the tool auto-detect.
An ESP32-C5 flashed at
0x0instead of0x2000bricks — reflash at the correct offset with a tool that knows it (Cyber Controller does). - Blank screen after flashing a screened board: wrong display driver/variant in the build — match the exact board (CYD 2.8" ≠ 2.4"; NM-CYD-C5 ≠ classic CYD).
- Flipper won't take CFW: use qFlipper / the web updater, correct region, fully charged.
- SmartScreen / AV warning on the Windows app: expected for an unsigned PyInstaller
build — verify via the VirusTotal link +
SHA256SUMSin the release, or build from source. See Downloads & trust.
Each firmware → the LxveAce tool that flashes it → the backend under the hood.
| Firmware | Chips / boards | Flashed by (LxveAce tool) | Backend | Upstream |
|---|---|---|---|---|
| ESP32 Marauder | ESP32 / S2 / S3 / C-series (+ Flipper WiFi Dev Board) | Cyber Controller · Headless Marauder · Universal Flasher | esptool | justcallmekoko |
| GhostESP (Revival) | ESP32 / S2 / S3 / C3 / C5 / C6, CYD 2.8", T-Deck, Cardputer, T-Embed, premium fusion boards | Cyber Controller · Universal Flasher | esptool | GhostESP-Revival |
| Bruce | ESP32 / S3 / C-series, M5 Sticks/Cores/Cardputer, T-Deck, T-Embed, NM-CYD-C5 | Cyber Controller · Universal Flasher | esptool | BruceDevices |
| HaleHound | ESP32 (CYD 2.8") | Cyber Controller · Universal Flasher | esptool | JesseCHale |
| esp8266_deauther (v3) | ESP8266 / ESP8285 only (NodeMCU, Wemos, Feather HUZZAH) | Universal Flasher | esptool (8266) | SpacehuhnTech |
| Meshtastic | ESP32-S3, Heltec V3/V4, T-Beam, T-Deck | Cyber Controller · Universal Flasher | esptool | meshtastic |
| Flipper CFW (Momentum / Unleashed / RogueMaster) | Flipper Zero | qFlipper flow | qFlipper | respective CFW teams |
| BW16 / RTL8720DN | Realtek AmebaD (2.4/5 GHz) | Cyber Controller (rtl8720) | rtl8720 / ImageTool | AmebaD |
| Pi images (Kali / RaspyJack / Pwnagotchi) | Raspberry Pi (ARM) | Universal Flasher (SD image) | SD image | respective projects |
The full 50-profile list lives in Cyber Controller; this is the curated public view.
Explore the tools
The LxveAce toolkit, grouped by the job you're actually doing.
One window to flash a board and then drive every radio on it.
Just want to write firmware or an OS image and get out.
Universal Flasher
v1.4.0The standalone, device-agnostic flasher — firmware plus writing Kali/Tails/Arch to USB, each integrity-checked before it writes. Purely a flasher; no controller or logger.
Headless Marauder
v1.3.4An all-in-one ESP32 Marauder controller and multi-firmware flasher. One-click standalone exe — no Python, no browser. Great for headless "Gold"-style boards.
Universal Flasher & UI
v0.1.0 alphaA light standalone Qt flasher + serial controller with a cross-device event bus. An early prototype of the unified idea that became Cyber Controller; kept as a working snapshot.
Run the board, watch the traffic, log a wardrive.
Headless Marauder
v1.3.4Drives ESP32 Marauder for scanning, logging and recon — including the wardrive flow that exports to WiGLE CSV (add a GPS module). Doubles as the flasher for the same boards.
Hardware Guides
docsPer-firmware, per-device recon walkthroughs — what each board can see, how to capture it, and how to fold it into Cyber Controller. Each with a downloadable PDF.
The rest of the kit.
Dead Man's Switch
v1.0.0An owner-only anti-forensic "dead-man gate" for ESP32 security firmware. Runs early in boot and, only when armed, triggers a forensic self-destruct. Defensive use on hardware you own.
Tag Studio
v0.3.1An industrial label & tag design studio that prints to laser engravers, thermal printers and vinyl cutters. Off-topic from the security gear, but part of the toolkit — currently free.
Hardware Guides
docsThe buy → build → flash → integrate PDFs behind every device on this hub.
02The projects
The LxveAce security-hardware toolkit. Each is open source unless noted, and every release links a VirusTotal scan + checksums so you can verify what you download.
Cyber Controller
v1.8.0The flagship. One window to flash and run every piece of security hardware on a cyberdeck. It ships 50 firmware profiles across 5 backends, a serial monitor for 14 firmwares, and a broadcast that hits every connected radio at once.
Universal Flasher
v1.4.0The standalone, device-agnostic flasher — firmware plus writing Kali/Tails/Arch to USB, each integrity-checked before it writes. Purely a flasher; no controller or logger.
Headless Marauder
v1.3.4An all-in-one ESP32 Marauder controller and multi-firmware flasher. One-click standalone exe — no Python, no browser. Works with headless "Gold"-style boards and screened devices alike.
Dead Man's Switch
v1.0.0An owner-only anti-forensic "dead-man gate" for ESP32 security firmware. Runs early in boot and, only when armed, triggers a forensic self-destruct. Defensive use on hardware you own.
Universal Flasher & UI
v0.1.0 alphaA light standalone Qt flasher + serial controller with a cross-device event bus. An early prototype of the unified idea that became Cyber Controller; kept as a working snapshot.
Hardware Guides
docsPer-firmware, per-device walkthroughs: what to buy, how to build it, how to flash and run it, and how to fold it into Cyber Controller — each with a downloadable PDF.
Tag Studio
v0.3.1An industrial label & tag design studio that prints to laser engravers, thermal printers and vinyl cutters. Off-topic from the security gear, but part of the toolkit — currently free.
03Firmware & what flashes it
50 firmware profiles ship in Cyber Controller across 5 flash backends. A sample of the most-used below — the Hardware Guides cover the full set with buy → build → flash walkthroughs.
| Firmware | Chips | Backend | Upstream |
|---|---|---|---|
| ESP32 Marauder | ESP32 / S2 / S3 / C5 | esptool | justcallmekoko |
| Bruce | ESP32 / S3 / C-series | esptool | BruceDevices |
| GhostESP | ESP32 / S2 / S3 / C | esptool | GhostESP-Revival |
| HaleHound | ESP32 (CYD) | esptool | JesseCHale |
| Meshtastic | ESP32-S3 / Heltec | esptool | meshtastic |
| Flipper Zero | Flipper (Unleashed / Momentum) | qFlipper | flipperzero.one |
| BW16 / RTL8720DN | Realtek AmebaD (2.4/5 GHz) | rtl8720 | AmebaD ImageTool |
| Raspberry Pi images | Pi (ARM) | SD image | Kali / RaspyJack / Pwnagotchi |
Not sure which tool? Cyber Controller flashes all of these from one app and auto-detects the chip; Universal Flasher and Headless Marauder are the lighter standalone options.
04Hardware notes
What to buy, and the gotchas that bite people. Source from wherever you like — these are just known-good notes, not affiliate links.
Boards
- Classic ESP32 (WROOM, CH340 USB-serial) — the "Gold" and most headless dev boards. Cheapest way in; runs Marauder/Bruce/GhostESP. Note it's not an S3.
- ESP32-S3 — native USB, more RAM; needed by some firmware builds (ESP32-DIV v2, some Meshtastic).
- ESP32 C-series — cheap single-core; watch the
C5bootloader offset (0x2000, not0x0— a common brick). - CYD (Cheap Yellow Display) — ESP32 + touchscreen; great for HaleHound and screened builds.
- BW16 / RTL8720DN — dual-band 2.4/5 GHz, flashed over its AT-command CLI.
- Flipper devboards / T-Deck / M5Stack — screened, more capable, more expensive.
Antennas, screens & extras
- External antenna (IPEX/u.FL) on a board that has the connector improves range noticeably.
- GPS module (NEO-6M/8M) if you want wardriving to WiGLE CSV.
- A quality USB-C cable that carries data (not charge-only) — a surprising number of "it won't flash" issues.
- SD/USB storage for logging and for the OS-to-USB flashing.
Common flashing gotchas
- Wrong chip assumed → let the tool auto-detect (Cyber Controller runs
chip_idfirst). - ESP32-C5 flashed at
0x0instead of0x2000→ brick. Use a tool that knows the offset. - CH340 driver missing on Windows → the port never appears.
- Charge-only cable → device powers up but won't enumerate as serial.
05Downloads & trust
Grab releases from each project's own page — they carry the platform binaries,
a SHA256SUMS.txt, and a VirusTotal link.
Heads-up on Windows warnings. The desktop apps aren't code-signed yet, so SmartScreen may
warn and a few heuristic AV engines flag the Windows build — the normal false-positive pattern for an
unsigned PyInstaller app (Linux/macOS scan clean). That's why every release links its VirusTotal report +
checksums, and it's open source so you can build it yourself. Nothing here is hidden.
06About & community
These are self-taught hobby projects, hardened and tested as they grow. This hub exists to help people actually build them — and to credit the upstream firmware authors the tools rely on.
Authorized, lawful use only. Some of this gear can transmit on regulated bands and run
offensive actions. Use it only on hardware and networks you own or are explicitly allowed to test. You're
responsible for following the laws where you are. Each project's repo has its own disclaimer — read it.
Our sites
07Resources & learn
New here? These are the genuinely useful, newcomer-friendly places to learn this — the upstream firmware projects, docs, communities and vendors we build on. Real links over self-promotion.
These aren't ours — full credit to their authors. We don't control these sites; follow their
licenses and their disclaimers. Everything here is for learning and for authorized, lawful security research
and education — on hardware and networks you own or have written permission to test.
Learn the basics
Start here if this is all new. Cheap screened board, first flash, first mesh node.
Cheap Yellow Display (CYD)
The best cheap-screened-board starting point — setup, examples, cases and troubleshooting for the ESP32-2432S0xx boards. Community-maintained.
esptool — flashing basics
Espressif's official flasher and its docs — what "flashing" actually is, offsets, chip detection. The backend most of these tools drive under the hood.
ESP-IDF — get started
Espressif's official "Get Started" for absolute ESP32 basics — toolchain, first build, what the chip is doing.
Meshtastic — getting started
A model beginner walkthrough: cable check, drivers, flashing, config — and the "never power on without an antenna" warning. Off-grid mesh text, not an attack tool.
Spacehuhn Deauther — DIY
Install-from-.bin and Arduino-IDE guides plus supported devices. Educational; ESP8266/ESP8285 only, not ESP32.
Official firmware docs
The authoritative source for each firmware — the wikis and repos to read before you flash.
ESP32 Marauder
The upstream wiki — Arduino setup, OTA and from-source flashing, board variants and feature guides. The classic WiFi/BLE recon suite.
GhostESP (Revival)
Broad modern platform — 40+ board targets across WiFi/BLE/NFC/IR/SubGHz/GPS. Site, tested-boards list and source.
Bruce
A multi-tool firmware that runs great on M5 Sticks/Cores, Cardputer, T-Deck and T-Embed; added the NM-CYD-C5 dual-band board.
esp8266_deauther (v3)
The original learning/testing tool. ESP8266/ESP8285 only — not ESP32. Repo plus the docs.
Flipper Zero firmware
Compare the custom firmwares (Official vs Unleashed vs Momentum vs RogueMaster), then go to the one you want. Flipper's own firmware, flashed via qFlipper.
Meshtastic
The docs hub and the supported-hardware list — encrypted long-range LoRa mesh text (comms, not attack tooling).
Communities
Where people ask, answer and share builds. We don't run these — link plainly.
Subreddits
r/flipperzero, r/esp32, r/meshtastic, r/cyberDeck and r/hacking — active help and build threads.
Project Discords
Each firmware's Discord is linked from its own site or repo (GhostESP, Bruce, Meshtastic, the Flipper CFWs) — follow the official invite there, since hand-typed invite codes expire.
Board pinouts & specs
espboards.dev — a one-stop reference for ESP32 board pinouts, specs, reviews and troubleshooting.
LxveAce community
Our Discord and GitHub, plus the Hardware Guides repo — questions on the tools on this hub land here.
Wardriving & WiGLE
Logging the location of visible wireless networks while moving (needs GPS).
WiGLE
The community wireless-network database and CSV format — plus the Android app and API (running since 2001). The common wardrive export target. Honestly: mapping and observing visible networks is generally lawful; connecting to them without authorization is not.
How to log a wardrive
Pair a GPS module (NEO-6M/8M, or onboard on a T-Beam/T-Deck Plus) with Marauder or GhostESP's wardrive mode, then export to WiGLE CSV. See the firmware docs above and the GPS note in Hardware.
Buy sources
Where people buy the boards. Not affiliate links, and no price promises — prices move batch to batch, so we link the vendor, not a number.
Vendor stores
Official stores for the purpose-built boards: LilyGO (T-Deck/T-Beam), Heltec (LoRa/Meshtastic), M5Stack (Sticks/Cardputer), Flipper, and JustCallMeKoko (Marauder dev boards).
Generics
AliExpress or Amazon for classic ESP32 / CYD / NodeMCU. Cheap generic boards vary batch to batch — the radio and the charge circuit are where corners get cut. Buy from a seller you can return to, and verify the chip with the tool before trusting it.
08Glossary & compatibility
Plain-language definitions for the jargon this gear throws at you, plus an honest map of which firmware runs on which board. Both are here so you understand what the tools do and can use them responsibly.
These terms and this table are for learning and for authorized, lawful security research and education —
on hardware and networks you own or have written permission to test. Wherever a term
describes something disruptive or transmitting, that framing is the rule, not a footnote.
Glossary
Newcomer-first, defensively framed. If a word on this site tripped you up, it's probably here.
- AP (access point)
- A Wi-Fi base station — your router — that devices connect to.
- Station / client
- Any device connected to (or hunting for) an AP: a phone, a laptop, a TV. "Station" and "client" mean the same thing.
- SSID
- The human-readable network name an AP broadcasts, e.g. "HomeWiFi". Several APs can share one SSID.
- BSSID
- The AP's MAC address — the unique hardware ID of that one radio, which (unlike the SSID) is specific to it.
- MAC address
- A 48-bit hardware address identifying a network interface. Modern phones randomize it for privacy.
- Channel
- The specific frequency slice a network sits on within a band; scanners hop channels to see everything.
- 2.4 vs 5 GHz
- The two common Wi-Fi bands. 2.4 GHz reaches further through walls; 5 GHz is faster but shorter-range. Classic ESP32 sees only 2.4 GHz; C5 and BW16 add 5 GHz.
- RSSI
- Received signal strength, in dBm (negative — closer to 0 is stronger). How loud a network looks to your radio.
- Beacon
- The frame an AP broadcasts to announce itself. "Beacon spam" floods fake names — a disruptive nuisance test, and regulated.
- Probe request
- A frame a client sends looking for known networks; it can leak the names a device has joined before.
- Deauthentication (deauth)
- A management frame that knocks a client off an AP. Used to measure how a network you own handles disruption — illegal against networks you don't own or aren't authorized to test.
- Handshake (4-way / WPA)
- The key exchange between a client and an AP; captured to audit your own passphrase's strength offline.
- PMKID
- A value in the first handshake frame that lets you audit your own WPA2 passphrase strength offline, with no client connected.
- Evil portal / captive portal
- A fake login page — used only in authorized, written-consent social-engineering tests of user awareness.
- BLE (Bluetooth Low Energy)
- Low-power Bluetooth these tools can scan and advertise. Spamming BLE adverts is a disruptive nuisance, and regulated.
- SubGHz
- Sub-1 GHz RF (300–928 MHz): garage doors, remotes, sensors. Capture/replay only on devices you own; transmitting is heavily regulated.
- NFC / RFID
- Short-range tag tech; read or emulate your own access cards for testing only.
- Wardriving
- Logging the location of visible wireless networks while moving (needs GPS). Observing/mapping is generally lawful; connecting without authorization is not.
- WiGLE
- A community database and CSV format for logged wireless networks — the usual wardrive export target.
- BadUSB
- A device that emulates a keyboard to type pre-scripted input — for authorized physical-access testing only.
- Meshtastic
- Open, encrypted, long-range LoRa mesh messaging — off-grid text and location, not an attack tool.
- LoRa
- Low-power long-range radio (SX127x / SX126x) that Meshtastic runs on.
- ESP32 vs ESP8266
- ESP8266 is the older, cheaper, Wi-Fi-only chip (it runs esp8266_deauther). ESP32 is the newer dual-core Wi-Fi + Bluetooth chip that runs almost everything else here.
- ESP32-S3 / -C5
- ESP32 variants: S3 adds native USB and more RAM (some builds need it); C5 adds dual-band 2.4/5 GHz. The C5 flashes at offset
0x2000, not0x0. - Firmware vs flasher
- Firmware is the program that runs on the board (Marauder, GhostESP…). A flasher is the desktop tool that writes it onto the board (Cyber Controller, Universal Flasher).
- CFW (custom firmware)
- Community firmware replacing a device's stock software — e.g. the Flipper Zero CFWs (Momentum, Unleashed, RogueMaster).
- CYD (Cheap Yellow Display)
- A low-cost ESP32 board with an integrated touchscreen — the ESP32-2432S0xx family.
- Headless
- A board with no screen, driven from a computer over a serial (USB) connection.
- Bootloader offset
- The flash address firmware is written to; the wrong offset (e.g. a C5 at
0x0instead of0x2000) bricks the board. - esptool / qFlipper / ImageTool
- The flashing backends for ESP32 / Flipper / Realtek boards respectively.
- CH340 / CP210x
- Common USB-to-serial chips; their driver must be installed for the board's COM port to appear.
Firmware ↔ hardware compatibility
What actually runs where. Rows are firmware families; columns are common boards/chips. This is not the firmware → flasher-tool matrix in "Just flash a board" — this one answers "will this firmware run on my board?"
- ✓ supported
- ~ partial / unverified — check upstream
- ✗ not supported / not applicable
| Firmware | Classic ESP32 | ESP32-S3 | ESP32-C5 | CYD 2.8" | ESP8266 | T-Deck / T-Embed | M5 / Cardputer | Heltec / T-Beam | BW16 | Flipper |
|---|---|---|---|---|---|---|---|---|---|---|
| ESP32 Marauder | ✓ | ✓ | ✓ | ~ | ✗ | ~ | ✓ | ✓ | ✗ | ✓ |
| GhostESP (Revival) | ✓ | ✓ | ✓ | ~ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ |
| Bruce | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ |
| esp8266_deauther (v3) | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Meshtastic | ~ | ✓ | ✗ | ✗ | ✗ | ✓ | ~ | ✓ | ✗ | ✗ |
| ESP32-DIV | ✗ | ✓ | ✗ | ~ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Flipper CFWs Momentum / Unleashed / RogueMaster |
✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ |
How to read it: a ✓ means the firmware has a build for that board family; ~ means partial, variant-specific, or not confirmed upstream this pass (check the project's own supported-boards page); ✗ means it doesn't apply (wrong chip, or a different tool's job). Marauder's Flipper support is via the ESP32 WiFi Dev Board, not the Flipper MCU itself. Board support changes fast — the upstream firmware docs are the last word.