Multi-purpose View the repo
36 stars · 7 forksGitHub repo · as of 2026-11-11 18:07 UTC
Unverified esp-atlas asserts this board↔firmware link at the shown trust tier — it does not guarantee your specific unit or the current firmware version. Flashing can erase keys/config and can brick the device. At your own risk.
README
Offensive security firmware for the LilyGo T-Deck — a pentesting terminal in your pocket.
📖 Documentation
⚠️ Legal For authorized security testing, CTF competitions, and education only. Using these tools against networks or devices you do not own or have written permission to test is illegal. You are responsible for how you use it.
Al-Anqa turns the LilyGo T-Deck (ESP32-S3) into a self-contained offensive-security terminal: a blinking cursor, a physical keyboard, and 60+ WiFi / Bluetooth / network / radio tools — no PC, no app, no GUI. Everything runs on-device and logs to the SD card.
Two boards are supported: T-Deck and T-Deck Plus (adds GPS and a speaker for wardriving and audio tools). The project is under active development.
.cap crackerwguard), WiFi-CSI motion detectionnetspy) and active isolation audit (isoscan) — implements the AirSnitch technique to reach and enumerate "isolated" clients on your own network[b] audit — link posture: encrypted? Just Works vs MITM? bonded? counts of chars readable/writable without pairing, plus a secret-value leak scan (keys/PINs)[g] abuse — access-control read-hammer: reads every characteristic ignoring its Read flag; a char that leaks data it marked non-readable = broken server-side access control[f] fuzz — writable-char fuzzer: sequential / random / boundary bytes, plus oversized (past-MTU long writes → input-length validation) and flood (unthrottled writes → DoS / rate-limit resistance)ux ble) — clone/spoof a bonded device, live-scanning target picker with in-place GATT inspectionwpa_supplicant.conf syncls / cd / cat / edit (nano-style) / rmgm) — play legal/homebrew .nes ROMs (mappers 0–4+069) with a retro library picker, save states, and trackball/keyboard controls| Component | Details | |-----------|---------| | Devices | LilyGo T-Deck · LilyGo T-Deck Plus | | MCU | ESP32-S3 · 16 MB flash · 8 MB PSRAM | | Display | 320×240 ST7789 TFT (GT911 capacitive touch) | | Input | Physical QWERTY keyboard (I2C) + trackball | | Radio | WiFi 2.4 GHz · Bluetooth LE (NimBLE) · LoRa SX1262 | | GPS | L76K / u-blox M10Q — T-Deck Plus only | | Audio | ES7210 mic + I2S speaker — T-Deck Plus |
Requirements: VS Code + the PlatformIO extension.
git clone https://github.com/abdallahnatsheh/AL-ANQA-FIRMWARE
# Open in VS Code → pick env:T-Deck or env:T-Deck-Plus → Upload
Can't upload? Hold the trackball button, plug in USB, then release — this forces the ESP32-S3 into download mode.
Run help for the list on-device, or man <cmd> for a full manual page.
| Command | Short | Args | Description |
|---------|-------|------|-------------|
| help | hlp | [cmd] | List commands, or detail one |
| man | mn | <cmd> | On-device manual page |
| info | inf | — | Device info (chip, MACs, battery, SD) + project GitHub QR |
| show | sh | <wifi\|ble\|hosts> | Re-display the last scan |
| clear | clr | — | Clear screen |
| pwrsave | psv | [status\|on\|off\|set ...] | Power-save config (dim / screen-off on idle) |
| sleep | slp | — | Deep sleep (~240 µA); click trackball to wake |
| lock | lk | [new\|update\|clean\|timeout <s>\|status] | Screen lock — optional SHA-256 PIN |
| volume | vol | [0-100\|up\|down\|off] | Master audio volume |
| notif | nf | [on\|off\|vol <n>\|test\|<lvl> ...] | Notification manager (per-level, custom WAV) |
| tz | tz | [+HH:MM\|<posix>\|status] | Device timezone (persisted) |
| weather | wx | [loc <lat> <lon>\|units ...\|now] | Live weather (Open-Meteo, no API key) |
| home | hm | [EXP] | Home-launcher cover UI (standalone) |
| undercover | uc | [set\|clear\|status\|boot ...\|panic ...] | [EXP] Silent disguise — passphrase exit, panic key |
| game | gm | [<rom.nes>] | [EXP] NES emulator — Anemoia core (mappers 0–4+069), ROM library, save states |
| WiFi | | | |
| scanwifi | sw | [on\|off] | WiFi manager — scan / connect / forget / radio power |
| connectwifi | cw | <index\|ssid> | Connect by scan index or SSID |
| wifipass | wp | [export\|clear] | Saved WiFi creds — view / export / erase |
| wifimon | wm | [ch] | Monitor mode — APs + clients, [d] deauth, [s] PCAP, probe log |
| | | | Deauthentication attack |
| | | — | Evil Twin AP + captive portal |
| | | | Reveal a hidden SSID |
| | | | Spoof the STA MAC |
| | | | Capture + crack a WPA2 handshake |
| | | | PMKID capture + crack — passive, no client |
| | | | WPA3 transition-mode downgrade → crackable |
| | | | Rogue-AP suite — harvest, PNL fingerprint, half-handshake, portal |
| | | | Offline WPA/WPA2 crack (handshake or PMKID) |
| | | | Passive WiFi IDS; / |
| | | | Beacon flood — fake AP injection |
| | | | All-in-one WPS: IE decode + device leak + PIN calc + live EAP-WSC handshake sniff (→ pixiewps) + push-button |
| | | — | Wardriving → WiGLE 1.4 CSV () |
| | | | Passive ESP-NOW sniffer — CSV + PCAP |
| | | | ESP-NOW TX/RX diagnostic |
| | | | Off-grid ESP-NOW chat (AES-128 private mode) |
| | | | ESP-NOW walkie-talkie — G.722 HD voice |
| | | | |
| | | — | ARP scan of the local /24 |
| | | | Passive client-isolation device recon (AirSnitch) |
| | | · | Active isolation audit — ; recommends an attack |
| | | | ARP poisoning + logs what the victim reaches (dst IP/DNS/HTTP → SD); heals on exit |
| | | | LLMNR/NBT/mDNS poisoner + NetNTLMv2/v1 + Basic capture (HTTP & SMB); = listen-only → per-session SD folder |
| | | · | TCP port scan ( = 26 common ports) |
| | | | Continuous ICMP ping with RTT stats |
| | | | Interactive SSH client (libssh) + saved profiles |
| | | | |
| | | — | BLE device scan |
| | | | GATT enum — read/write/fuzz(seq/rand/boundary/oversized/flood)/sniff/pair + audit + abuse read-hammer |
| | | | Anti-tracking detector |
| | | | Fast Pair — scan / flood / GATT hijack |
| | | | BLE notification spam |
| | | — | Passive BLE advertisement sniffer (iBeacon/Eddystone, PCAP) |
| | | | WiFi+BLE MAC watchlist → proximity alerts |
| | | | Claude Desktop remote — approve prompts, ASCII pet |
| | | — | T-Deck as a BLE keyboard + mouse (MITM-bonded) |
| | | | |
| | | — | SD card info |
| | | | List directory (paginated) |
| | | | Change working directory |
| | | | Scrollable file viewer |
| | | | nano-style text editor |
| | | | Delete file; recurses |
| | | | Format SD to FAT32 |
| | | | |
| | | — | Expose the SD card as USB mass storage |
| | | — | T-Deck as a USB keyboard + mouse |
| | | | Mouse jiggler (USB or BLE) |
| | | | BadUSB DuckyScript over USB or BLE (); OS-detect, SoftAP web trigger |
| | | | |
| | | | GPS control + coordinate test (Plus) |
| | | | Hardware self-tests |
| | | | Interactive I2C bus scanner |
| | | | WiFi-CSI motion detector (energy only, no direction) |
| | | — | Matrix rain animation |
Tip: run
nd(orns) first, then use the host index inps/pginstead of typing the IP.
All scan tables share l / a (next / previous page), u (rescan), q (quit).
| Trackball (command line) | Action | |--------------------------|--------| | Left / Right | Move cursor within the command | | Up / Down | Command history (16 entries) | | Click | Execute | | Double-click | Screen off / on | | Hold 3 s | Lock screen (from anywhere) |
' (Sym+K): completes command names at the start, file/dir paths after file commands, and valid sub-arguments (shown in yellow).See the keyboard reference for the full mapping.
/wpa_supplicant.conf saved WiFi credentials (Linux-compatible)
/config/ device-wide settings (pwrsave, lock, notif, weather, undercover…)
/config/notification/ per-level alert WAVs (16-bit PCM, 22050 Hz, mono)
/apps/<tool>/ one self-contained folder per command — logs, captures, wordlists, config
/apps/notes/ undercover Notes cover files
/apps/nes/roms/ NES ROMs (.nes) for the `gm` emulator
/apps/nes/states/ NES save states (one per ROM, keyed by CRC32)
Each tool writes under its own /apps/<tool>/ folder (e.g. wpasniff/, eviltwin/,
karma/, wardrive/, bleinfo/, badusb/scripts/). See the SD Card guide
for the complete file reference.
Installed automatically via PlatformIO lib_deps:
LovyanGFX (display) · NimBLE-Arduino (BLE) · RadioLib (LoRa) · LibSSH-ESP32 (SSH) · SensorLib (GT911 touch) · ESP32Ping · AceButton · ArduinoJson · TinyGPSPlus · TP_Arduino_DigitalRain_Anim · 18650CL (battery)
Vendored under lib/: libg722 (voice codec) · ES7210 (mic driver).
Full docs — every command, workflows, keyboard reference, troubleshooting, and the
wguard / trackme algorithm write-ups — are published at
abdallahnatsheh.github.io/AL-ANQA-FIRMWARE
(source in docs/).
| Main Screen | WiFi Scanner | Network Scan | |-------------|--------------|--------------| | | | |
Issues and PRs are welcome. To add a command or module:
.cpp/.h; register the command in setupCommands()).CI compiles both T-Deck and T-Deck-Plus on every push.
Released under the GNU AGPL-3.0. If you run a modified version as a network service, you must make your source available under the same license.
Built for the LilyGo T-Deck · ESP32-S3 · AGPL-3.0
Read the full README on GitHub
source github.com/abdallahnatsheh/AL-ANQA-FIRMWARE
[p]deauthda<bssid\|#> [ch] [client]eviltwinethiddenssidhs<idx\|bssid> [ch] [silent]macchangermcon\|off\|random\|set <mac>wpasniffws<idx\|bssid> [ch]pmkidpm<idx\|bssid> [ch]wpa3downw3d[idx].capkarmakm[auto\|hs\|portal <ssid>]crackcc[cap] [wordlist\|dir]wguardwg<idx\|bssid> [ch] [bg]wg stopwg viewbeaconfloodbf[list\|rickroll\|seq <base>\|file\|clone]wpswps[<idx>][p]wardrivewdespsniffes[ch]esptestest[ch]espchatec[pub\|prv\|bg\|stop] [ch]espvoiceev[ch]netdiscoverndnetspyns[gtk\|dump]isoscanis[ns#] <attack>cctestautoarpspoofas<victim> [gw]responderrsp[passive]passiveportscanps<ip\|#\|ns#> <start> <end>top ...toppingpg<ip\|host\|#\|ns#>sshsc<ip\|name> [user]scanbluesblbleinfobi<index\|mac\|all>[f][b][g]trackmetm[silent]fastpairfp[scan\|spam\|h <idx>\|h all]blespambs[apple\|android\|ms\|samsung\|all]bmonbmmacwatchmw[bg]buddybd[name]btkbdbksdinfosdisdlsls[path]cdcd<dir\|..>catcat<path>edited<path>rmrm<path>rm -d <dir>sdformatsdf[init]usbmscumusbkbdukjigglejg[ble]usbexecux[auto\|remote\|ble [clone <mac\|#>]] demo\|<path>ux bleux autoux remotegpsgpson\|off\|testtesttst<spk\|mic\|lora\|touch>i2cscanisc[r\|raw\|w\|d ...]csidetectcsi[auto]MATRIXmatrix