The ESP-IDF-native wireless security platform for ESP32.
Deep Wi-Fi and BLE assessment, research-grade capture and export, and a real app ecosystem. Built directly on Espressif's ESP-IDF rather than through the Arduino core, so new silicon and radio features land first and there is no abstraction layer between GhostESP and the hardware.
⚠️ Only flash GhostESP with the official flasher or bins from our GitHub releases. We can't verify integrity or provide support for third-party flashers and mirrors.
⭐️ Enjoying GhostESP? Please give the repo a star. It helps a lot.
What's New
v2.2: LoRa goes dual-stack, captures get richer, and detection widens.
- LoRa: Meshtastic and MeshCore on SX1262, switchable at runtime, with the official apps over BLE. Ships on Heltec V3, T-Deck, CrowPanel Advance 2.4/2.8/4.3", and CrowPanel Advanced P4 7/9/10.1".
- Captures: per-frame signal, channel and rate in Wireshark; 802.1Q/QinQ VLAN tags; control frames (RTS/CTS/ACK) in EAPOL and Wireshark captures.
- Detection: a wider BLE device-detect list (Tile, SmartTag, Chipolo, AirPods, Apple Watch, FindMy, Fast Pair, hearing aids and more), plus
bledetect, mdnssniff, and dualwd BLE + Wi-Fi wardriving.
- Apps: Game Boy / Game Boy Color emulator, gallery folders (Tools, System, Games, Communication, Media, Sensors), and a richer plugin UI API.
- Quality of life: status-bar clock with analog and seven-segment faces, Country selector, Row Height setting, runtime IR TX/RX pin config, custom channel hopping, USB SD passthrough (S3), and T-Deck audio.
Earlier: v2.1 (Revival) added on-device OTA with rollback protection, the ST25R3916 NFC backend, the Cloud Store, and GhostScript (sandboxed Lua). v2.0 rebuilt the UI and introduced the native app ecosystem.
Full history in CHANGELOG.md.
Get Started
| Flash your device | Community and support | Learn more |
| --- | --- | --- |
| ghostesp.net/flasher | Discord | Documentation · Website |
Why GhostESP
GhostESP is a platform, not a bag of tools. Five things set it apart:
- Built on ESP-IDF, not Arduino. Unlike Marauder and Bruce, GhostESP works against Espressif's SDK directly. It gets new chips and radio features first (802.15.4, Zigbee, 5 GHz on the C5) and lower-level control of the radios, memory, and partitions. Arduino-based firmware can reach the same APIs, just not as directly.
- Live capture and on-device analysis. Stream traffic into Wireshark in real time over USB, and browse, inspect, and convert captures (PCAP, hc22000, WiGLE, 802.15.4) on the device itself.
- GhostLink. Pair two ESP32s so one runs the other's radio, keyboard, and display, with BLE bridging to the Android app, split-channel wardriving, and peer OTA.
- Native apps. SD apps with their own permissions and storage, built with
gbt and a plugin SDK, installed from the Cloud Store, plus a Lua runtime for scripts. Examples: Device Inspector, ESP32Finder, a Doom port, a QR generator.
- One command set, many front ends. Drive GhostESP from the on-device UI, serial CLI, WebUI, Flipper Zero app, Android app, or a GhostLink-connected device, all against the same commands.
Features
WiFi Features
- Evil Portal (with custom HTML from buffer via serial)
- Deauth / disassoc attacks
- Channel switch attack
- GTK abuse / client isolation testing
- EAPOL logoff attack
- Karma (with custom SSID lists and custom portal chaining)
- Beacon spam (single/list/random/Rickroll)
- AP scan / STA scan / scanall
- Multi-select APs and stations
- Probe request listening (with auto-spawned Evil Twin)
- Handshake + PMKID capture
- WiFi capture to SD (PCAP) with on-device PCAP browser + hc22000 export
- USB dongle mode for Wireshark (extcap stream)
- Per-frame signal, channel and rate in captures, plus 802.1Q/QinQ VLAN tag and control-frame (RTS/CTS/ACK) support
- DHCP starvation
- ARP / port / SSH / local IP scanners
- mDNS discovery / NetBIOS scan / HTTP banner scan / SNMP probe (with per-host and per-subnet variants)
- Passive local-name sniffer (
mdnssniff: mDNS/LLMNR/SSDP/NetBIOS) per ARP-discovered host
- WiFi OUI vendor lookup
- WPA3/SAE attacks (flood + compliance checker)
- Wardriving exports (WiFi/BLE/GPS) + sweep CSV (WiFi/BLE/GPS/802.15.4)
- Split-channel wardriving helper via GhostLink
- Dual-band
dualwd BLE + Wi-Fi coexistence wardriving (PSRAM boards)
- RSSI tracking (AP/station) with live RSSI meter view
- Drone detection / spoofing
- PineAP detection
- Flock / surveillance detector
- WPS detection
- Pwnagotchi-style automated capture mode (Capture PWN)
- Channel congestion analysis
- Custom channel-hopping plans for attacks, AP/station scans, Airspace Monitor and packet hopping
- WiFi Airspace Monitor (real-time packet/threat insights, fast channel hopping, suspect device cards, packets/sec sparkline)
- DNS Sinkhole (blocklist-based NXDOMAIN blocking with built-in blocklist downloads)
- Web UI + filesystem + remote command relay
BLE Features
- BLE scan modes (general, AirTag, Flipper, raw)
- BLE advertisement scan with OUI prefix/vendor filtering + RGB match pulses
- BLE spam modes (Apple, Microsoft, Samsung, Google, Random) with optional custom advertiser name (
blespam -name)
- AirTag scan / spoof / select
- BLE packet capture
- BLE stream to Wireshark
- Flipper finder + RSSI
- GATT/service scan + per-device enumeration + device tracking (live RSSI meter)
- BLE wardriving
- BLE skimmer detection
- BLE device detect scan (
bledetect) with list, track and AirTag-spoof actions: Tile, Samsung SmartTag, Chipolo, AirPods (per-model), Apple Watch, generic FindMy clones, Fast Pair / Find Hub, hearing aids, exposure beacons and Chameleon Ultra
- Drone / OpenDroneID scan / list / track / spoof
- Aerial (drone) detector with threat classification
- GhostLink BLE bridge to the Android companion app
USB Features
- USB keyboard host mode (ESP32-S3 builds)
- USB SD card passthrough (ESP32-S3 boards with an SD slot)
- Remote keyboard control over GhostLink
- BadUSB script runner
- BadUSB identity options (VID/PID/manufacturer/product/layout/randomize)
- BadUSB trackpad (touchpad-style cursor control)
- BadUSB mouse jiggler
- BadUSB
type_char CLI for typing individual ASCII characters
- USB HID keyboard output mode (forward on-device keystrokes over USB)
- Dedicated WebUI BadUSB page
IR Features
- IR TX/RX on supported boards
- IR learn mode
- Runtime IR TX/RX pin configuration (CLI or Settings)
- IR easy learn mode
- Flipper
.ir file support
- Universal library transmit
- IR CLI tools
- IR dazzler (38 kHz high duty)
NFC Features
- PN532 NTAG/MIFARE Classic support
- ST25R3916 NFC backend (EMV payment-card reads, DESFire application and file trees, PicoPass and iCLASS)
- Flipper
.nfc import/export
- MIFARE Classic dictionary attack (default + user dictionary + session key reuse / sector sweep)
- Full embedded MIFARE Classic dictionary
- MIFARE Classic hardnested recovery
- Flipper NFC parser set (transit, parking, access, amusement, loyalty): BIP, Clipper, CharlieCard, Troika, Plantain, Zolotaya Korona, WashCity, Social Moscow, Saflok, Gallagher, Disney Infinity, Skylanders, Aime, Hi, HWorld, Two Cities, Umarsh, Microel, MIZIP, MetroMoney, Kazan, SmartRider, and more
- MIFARE Desfire detection
- Chameleon Ultra support (CLI + UI + BLE control)
- Chameleon Ultra HF/LF RFID scan + reader controls
SubGHz Features
- Signal scanning across 64 channels
- Frequency analyzer with waterfall display
- Signal capture and decoding
- 20+ protocol decoders based on Flipper Unleashed/xMasterX
- Signal transmission and replay
- Saved signals as
.sub files
- Flipper SubGhz Key File format compatibility
- CC1101 hardware support
- Frequency bands: 315, 390, 433.92, 868.35, 915 MHz
- Full CLI support
- SubGHz remote radio support via GhostLink
Audio Features
- I2S DAC audio player (MP3 playback with headphone detection and volume control)
- Audio receiver (TLV320DAC I2S)
- T-Deck onboard MAX98357A speaker amp support
- Music visualizer (RGB LED audio visualization)
- Microphone spectrum / MIC visualizer (microphone-driven RGB LED effects with multiple modes, color modes, sensitivity, smoothing, and contrast)
Display & Sensor Features
- Full LVGL graphical UI with carousel, grid, and list layouts
- Custom asset packs loaded from SD (icons, colors, backgrounds, themes)
- 21 color themes
- On-screen splash/boot animation with progress bar
- Toast notification system
- Persistent status bar with level badge
- Touch drag scroll + tap-to-wake
- Configurable screen timeout, brightness, and orientation
- Country selector (Settings > Wi-Fi), Row Height setting for menus, and T-Embed rotary detent mode
- Idle animations (Game of Life, Ghost, Starfield, HUD, Matrix, Flying Ghosts, Spiral, Falling Leaves, Bouncing Text)
- On-screen Clock
- Status-bar clock (toggleable) with analog and seven-segment clock faces
- Compass screen (magnetometer)
- Accelerometer screen (G-force, tilt, orientation, shake, speed)
- ENV-III sensor screen (temperature, humidity, pressure, dew point, altitude)
- PIN Lock screen with auto-lock (overlay mode keeps captures running while locked)
- Trackpad / cursor control
- Setup wizard with Home WiFi configuration
- Accessibility settings (font size, high contrast, reduced motion, input repeat speed, epilepsy-safe mode)
- Terminal font size control
- Rave mode (display builds)
- DRV2605 haptic feedback (S3TWatch)
Apps & Extensibility
- Apps Gallery (central launcher for native SD apps, with folders for Tools, System, Games, Communication, Media, and Sensors)
- Native SD app system (load, list, inspect, launch, stop, reset apps with permissions and scoped storage)
- Ghost Build Tool (
gbt) for scaffolding, building, and packaging apps and firmware
- Plugin/app SDK and example apps (Device Inspector, ESP32Finder)
- Plugin UI API additions: embeddable options list, widget rects, design metrics, page stack, raw touch state, batched UI calls,
forward_back manifest option and GHOSTESP_API_HAS() feature gating
- Cloud Store (browse and install apps, scripts, and asset packs on-device)
- GhostScript (sandboxed Lua 5.4 scripting runtime for scripts from the SD card)
- Ghostchi virtual pet companion (50-level XP system, 27 XP sources, passive/aggressive modes, companion lockscreen, global mood, level-up toasts, status-bar badge)
- SD Browser (file/folder browsing, rename, delete, copy/move, text file preview)
- Game Boy / Game Boy Color emulator app with save states and battery saves
- On-device PCAP browser with hc22000 export
- On-device Info screen (device, runtime, build, credits)
- Reusable confirmation popups for dangerous UI actions
Additional Features
- GhostLink (dual-device command and display interface) with remote radio support and keyboard relay
glbench GhostLink throughput benchmark and link statistics- Setup wizard (display builds)
- Wired + web screen mirroring
- Ethernet mode (W5500) + full toolset: fingerprint scan, port scan, ping sweep, ARP scan, ARP poisoning, MITM, HTTP, DNS, NTP, trace route, MAC tools, statistics
- TLS SNI / HTTP / FTP credential capture over Ethernet
- DIAL / Chromecast V2 support
- GPS integration (
gpsinfo) with WiGLE manual upload, runtime baud config, and wdstream companion streaming
- Network printer output (
powerprinter, PJL)
- RGB LED modes (Normal, Rainbow, Stealth, Knight Rider, MIC Visualizer, custom colors) with neopixel brightness control
- Timezone configuration (
timezone) + NTP time set
- Camera motion detection with SD card snapshot capture and Discord webhook alerts (XIAO S3 Sense)
- Live MJPEG camera stream (
/camera)
- NRF24 spectrum analyzer with passive 2.4 GHz jamming detection
- Zigbee / 802.15.4 packet capture + sweep CSV (ESP32-C5/C6)
- 802.15.4 / Zigbee channel capture
- Battery monitoring / fuel gauge support
- Sensor / RTC hardware support (PCF8563)
- M5 Cardputer / Cardputer ADV keyboard support
- Android companion app
- On-device CH422G / ST7262 / AXS15231B / APX2102 display driver support
- CrowPanel 1.28-inch rotary display with USB audio volume/mute control
- Light-sleep idle + frequency scaling + Wi-Fi power saving
- Reduced-motion animations
- SD config backup / restore
- On-device OTA and SD firmware update with verification and rollback protection
LoRa Features
- Meshtastic-compatible LoRa (SX1262 / SX1276 / LLCC68) with stock air framing
- MeshCore companion stack on the same radio, switchable at runtime
- Official Meshtastic and MeshCore apps over BLE (PhoneAPI)
- On-screen LoRa view: node list, map, chat and packet log
lora and meshcore CLI commands- 24 region / band-plan presets plus a custom channel, with per-board TX power caps
- Encrypted LoRa chat and Ed25519 PKI direct messages
- Position, node info, routing and traceroute packets
- MeshCore adverts, group and direct text, contacts and channels
- Boot auto-start of the remembered protocol
- Enabled on Heltec V3, Elecrow CrowPanel Advance 2.4 / 2.8 / 4.3-inch, Elecrow CrowPanel Advanced P4 7/9/10.1-inch, and the LilyGo T-Deck
Supported ESP32 Variants
- ESP32-Wroom · ESP32-S2 · ESP32-C3 · ESP32-S3 · ESP32-C5 · ESP32-C6 · ESP32-P4
Note: Feature availability varies by chip. S2 lacks Bluetooth hardware. C5 has 5 GHz and 802.15.4 or Zigbee support. P4 uses an external ESP32-C6 for Wi-Fi and Bluetooth via ESP-Hosted.
Supported Boards
62 board targets build in CI (.github/workflows/compile_all.yml) from 61 configs in configs/. Awok V5 shares the generic ESP32-S2 config.
Board feature matrix (click to expand)
| Board | Bluetooth | NFC (PN532) | NFC (Chameleon) | IR TX | IR RX | GPS Default | Keyboard | Display | SD | OTA | Native SD Apps | LoRa |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ESP32-Wroom DevKitC | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| ESP32-S2 DevKitC | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| ESP32-S3 DevKitC | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| ESP32-C3 DevKitC | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| ESP32-C5 DevKitC | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| ESP32-C6 DevKitC | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Awok V5 | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| GhostBoard | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Marauder v4 | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | Full | ✓ | ✓ | ✗ | ✗ |
| Marauder v6 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✗ | ✗ | ✗ | ✗ |
| AWOK Mini | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | Full | ✗ | ✗ | ✓ | ✗ |
| Cardputer | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | Full | ✓ | ✓ | ✗ | ✗ |
| Heltec V3 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Status | ✓ | ✗ | ✗ | ✓ |
| CYD2 USB | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| CYD2 Micro USB | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| CYD2 Dual USB | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| CYD2 USB 2.4" | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| CYD2 USB 2.4" (C variant) | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| CYD 2432S028R | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| Waveshare 7" Touch | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| Crowtech 7" | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✓ | ✗ |
| CrowPanel Advance 7" (S3, TFCard mode) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| CrowPanel 4.2" E-paper (400×300) | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | E-paper | ✓ | ✗ | ✓ | ✗ |
| CrowPanel 5.79" E-paper (792×272) | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | E-paper | ✓ | ✗ | ✓ | ✗ |
| CrowPanel Advance 2.4" (S3, 320×240) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✓ |
| CrowPanel Advance 2.8" (S3, 320×240) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✓ |
| CrowPanel Advance 3.5" (S3, 480×320) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| CrowPanel Advance 4.3" (S3, 800×480) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✓ |
| CrowPanel Advance 5" (S3, 800×480) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| CrowPanel 1.28" Rotary (S3, 240×240) | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| CrowPanel Advanced P4 7/9/10.1" (v1.2+) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✓ |
| CrowPanel Advanced P4 7/9/10.1" (v1.1) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✓ |
| CrowPanel Advanced P4 5" RGB | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| Sunton 7" | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| JC3248W535EN | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| Flipper JCMK GPS | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| T-Deck | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | Full | ✓ | ✗ | ✓ | ✓ |
| T-Embed CC1101 | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| GhostLink P1 Core | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| GhostLink P1 Peer | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| T-Dongle-S3 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✗ | ✗ |
| T-Dongle-C5 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| S3TWatch | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | Full | has 4MB vfs partition | ✓ | ✗ | ✗ |
| T-Display S3 Touch | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| JCMK Devboard Pro | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Minion | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Lolin S3 Pro | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✓ | ✗ |
| Cardputer ADV | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | Full | ✓ | ✓ | ✗ | ✗ |
| Poltergeist | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗ | Status | ✓ | ✗ | ✗ | ✗ |
| Banshee (C5 display MCU) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | Full + Status | ✓ | ✗ | ✓ | ✗ |
| Banshee (S3 main) | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | - | ✗ | ✓ | ✗ | ✗ |
| Febris Pro | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | - | ✗ | ✗ | ✗ | ✗ |
| ACE C5 | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| NM-CYD-C5 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| ACE S3 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Seeed XIAO ESP32-S3 Sense | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✓ | ✗ | ✗ |
| Seeed XIAO ESP32-S3 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✓ | ✗ | ✗ |
| Seeed XIAO ESP32-C5 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Marauder v8 | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | Full | ✓ | ✗ | ✓ | ✗ |
| Pancake C5 | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | Full | ✓ | ✗ | ✓ | ✗ |
| M5Stack CoreS3-SE | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| M5Stack AtomS3R | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | Full | has 1MB vfs partition | ✗ | ✗ | ✗ |
*: the checked-in config for this board predates a Kconfig option (NFC_CHAMELEON) that defaults on for BLE-capable boards; no board-specific override is present, so this reflects the Kconfig default rather than an explicit setting in the file. Most unstarred BLE-capable boards set the symbol explicitly, but some generic configs may also rely on the Kconfig default.
M5Stack Grove ports: the M5Stack CoreS3-SE and AtomS3R configs expose their HY2.0-4P Grove connectors on I2C port 1 (PORT.A: SDA=G2, SCL=G1; the CoreS3-SE also has PORT.B G8/G9 and PORT.C G17/G18). Plug an ST25R3916 NFC module (I2C, 0x50) and/or an M5Stack ENV III unit (SHT30 0x44 + QMP6988 0x70) into Grove PORT.A and open the NFC or ENV III app; both devices share the same bus.
Display: Full = LVGL graphical UI. Status = secondary small status display only (shares the IO-expander I2C bus), no full UI. - = headless, no display.
SD: most boards use SPI-mode SD. JC3248W535EN and T-Dongle-S3 use SDMMC 1-bit mode instead; the SDMMC bus option exists in Kconfig for other boards.
NFC (Chameleon): Chameleon Ultra support rides over BLE, so it's on by default for any BLE-capable board and off where BLE is unavailable (ESP32-S2 boards) or explicitly disabled (Marauder v8, Pancake C5).
Native SD Apps: at compile time the feature depends only on CONFIG_SPIRAM (main/Kconfig.projbuild:1410). At runtime the app gallery checks MALLOC_CAP_SPIRAM and renders into the full LVGL screen, so a display is required for the UI to be usable. That leaves it enabled on: AWOK Mini, Waveshare/Crowtech/Sunton 7″, CrowPanel Advance 2.4/2.8/3.5/4.3/5″, CrowPanel Advanced P4 5″/7/9/10.1″ (v1.1/v1.2+), JC3248W535EN, CrowPanel 1.28″ Rotary, T-Deck, T-Embed CC1101, GhostLink P1 Core, T-Dongle-C5, NM-CYD-C5, M5Stack CoreS3-SE, Banshee (C5), and Marauder v8/Pancake C5. Boards with a screen but no PSRAM (Cardputer, Cardputer ADV, the CYD2 family, S3TWatch, T-Dongle-S3, M5Stack AtomS3R, etc.) don't get it.
Banshee ships as two configs: the S3 main board (headless) and the C5 module that drives its display and status LED, paired over GhostLink. Self-OTA is disabled on the C5 in v2.2; update it over GhostLink from the S3 or by USB.
ESP32 Firmware Comparison
Marauder is the focused, hardware-first Wi-Fi and BLE toolset that much of this space grew out of, and GhostESP credits it directly (see Credits). GhostESP covers the same Wi-Fi and BLE ground and adds the capture-to-analysis pipeline, multi-device control through GhostLink, and the native app ecosystem described above, on an ESP-IDF base rather than Arduino.
The table below compares GhostESP against other broad-scope firmware. It is based on GhostESP's feature set and the publicly available source for each listed project. It is not a complete feature list for every firmware. HaleHound and nyanBOX are compared against the latest public source available to us. If newer releases are closed source, this table cannot be independently verified against those builds.
View comparison table
| Feature | GhostESP | Bruce | HaleHound | nyanBOX |
| --- | --- | --- | --- | --- |
| Current source available for audit | [x] | [x] | Limited / older public source | Limited / older public source |
| ESP-IDF-native architecture | [x] | | | |
| Arduino / PlatformIO architecture | | [x] | [x] | [x] |
| Supported board targets | 62 CI targets | 48+ | 4 | 1 |
| Full LVGL graphical UI | [x] | | | |
| Web dashboard / REST control | [x] | [x] | | |
| Captive portal web server | [x] | [x] | [x] | [x] |
| AP / station WiFi scanning | [x] | [x] | [x] | [x] |
| Deauth / disassoc testing | [x] | [x] | [x] | [x] |
| Beacon spam | [x] | [x] | [x] | [x] |
| Karma / probe response attack | [x] | [x] | [x] | |
| Handshake / EAPOL capture | [x] | [x] | [x] | |
| On-device PCAP browser / hc22000 export | [x] | | [x] | |
| PMKID capture / export | [x] | | [x] | |
| Live Wireshark USB streaming | [x] | | | |
| SAE flood / WPA3-specific testing | [x] | | | |
| WPA3 compliance checker | [x] | | | |
| EAPOL logoff attack | [x] | | | |
| Channel switch attack | [x] | | | |
| GTK abuse / client isolation testing | [x] | | | |
| DHCP starvation | [x] | [x] | | |
| ARP / port / SSH scanners | [x] | [x] | [x] | |
| mDNS discovery | [x] | | | |
| NetBIOS scanner | [x] | | | |
| HTTP banner scanner | [x] | | [x] | |
| SNMP probe | [x] | | | |
| WiFi OUI vendor lookup | [x] | [x] | [x] | |
| PineAP / Evil Twin detection | [x] | | | [x] |
| WPS detection / reporting | [x] | [x] | | |
| Pwnagotchi-style automated capture mode | [x] | [x] | | |
| Pwnagotchi detector / spam | | [x] | | [x] |
| Channel congestion analysis | [x] | [x] | | [x] |
| Live WiFi packet monitor / visualizer | [x] | | [x] | [x] |
| WiFi Airspace Monitor | [x] | | | |
| DNS sinkhole / blocklist NXDOMAIN | [x] | | | |
| GPS WiFi wardriving | [x] | [x] | [x] | |
| BLE wardriving | [x] | [x] | [x] | |
| WiGLE upload integration | [x] | [x] | | |
| 802.15.4 capture and PCAP export | [x] | | | |
| GhostLink dual-ESP control | [x] | | | |
| GhostLink BLE bridge to Android | [x] | | | |
| Split-channel wardriving helper | [x] | | | |
| GhostLink remote radio support | [x] | | | |
| Drone / OpenDroneID detect | [x] | | | [x] |
| Drone / OpenDroneID spoof | [x] | | | [x] |
| BLE scanning | [x] | [x] | [x] | [x] |
| Raw BLE scanner | [x] | [x] | | [x] |
| BLE spam modes | [x] | [x] | [x] | [x] |
| AirTag scan / spoof | [x] | [x] | [x] | [x] |
| BLE tracker detection tools | [x] | | [x] | [x] |
| Flipper Zero finder | [x] | | | [x] |
| GATT / service enumeration | [x] | [x] | [x] | |
| BLE device tracking by RSSI | [x] | | | |
| BLE stream to Wireshark | [x] | | | |
| BLE skimmer detection | [x] | | | [x] |
| FastPair / pairing exploit research | | [x] | [x] | [x] |
| BLE HID injection / DuckyScript over BLE | | [x] | | |
| BLE keyboard mode | | [x] | | |
| BLE GATT honeypot / cloned peripheral | | | [x] | [x] |
| BLE vulnerability profiling | | [x] | | |
| Flock / surveillance detector | [x] | | [x] | [x] |
| PN532 NFC support | [x] | [x] | [x] | |
| ST25R3916 NFC support | [x] | [x] | | |
| Chameleon Ultra support | [x] | [x] | | |
| Chameleon Ultra BLE control | [x] | [x] | | |
| Flipper import/export | [x] | [x] | | |
| Flipper NFC parser collection | [x] | | | |
| MIFARE Classic default-key attack | [x] | [x] | [x] | |
| MIFARE Classic embedded dictionary | [x] | [x] | [x] | |
| MIFARE Classic user dictionary file | [x] | [x] | | |
| MIFARE Classic session key reuse / sector sweep | [x] | | | |
| MIFARE Classic hardnested recovery | [x] | | | |
| PicoPass / iCLASS reading | [x] | | | |
| MIFARE DESFire application / file tree reads | [x] | | | |
| EMV / payment card reader | [x] | [x] | | |
| BadUSB / DuckyScript | [x] | [x] | | |
| USB keyboard host mode | [x] | | | |
| USB HID keyboard output mode | [x] | [x] | | |
| Remote keyboard over dual-device link | [x] | | | |
| BadUSB VID/PID identity options | [x] | | | |
| BadUSB mouse jiggler / trackpad | [x] | | | |
| IR learn / capture / replay | [x] | [x] | | |
| Flipper file support | [x] | [x] | | |
| Universal IR library transmit | [x] | [x] | | |
| CC1101 SubGHz scan / replay | [x] | [x] | [x] | |
| CC1101 waterfall spectrum analyzer | [x] | [x] | [x] | |
| Flipper read/write support | [x] | [x] | [x] | |
| SubGHz protocol decoders | [x] | [x] | [x] | |
| NRF24 spectrum analyzer | [x] | [x] | [x] | [x] |
| NRF24 MouseJack | | [x] | [x] | |
| Passive jamming detection | [x] | [x] | [x] | |
| Active RF jamming shipped | Not shipped | [x] | [x] | [x] |
| Zigbee / 802.15.4 packet capture | [x] | | | |
| Ethernet W5500 support | [x] | [x] | | |
| Ethernet ARP poisoning / MITM tools | [x] | [x] | | |
| Ethernet fingerprint / port / ping tools | [x] | [x] | | |
| Ethernet DNS / NTP / HTTP / trace tools | [x] | | | |
| TLS SNI / HTTP / FTP credential capture over Ethernet | [x] | | | |
| Camera streaming / motion detection | [x] | | | |
| Motion alerts with webhook support | [x] | | | |
| Network printer / PJL output | [x] | | | |
| DIAL / Chromecast testing | [x] | | | |
| On-device setup wizard | [x] | | | |
| PIN / password lock | [x] | | [x] | [x] |
| On-device OTA / SD firmware update | [x] | | [x] | |
| Firmware verification / rollback protection | [x] | | | |
| GhostLink peer firmware update | [x] | | | |
| Wired screen mirroring | [x] | | | [x] |
| Web screen mirroring | [x] | [x] | | |
| SD config backup / restore | [x] | | | |
| SD file manager / browser | [x] | [x] | [x] | |
| Native SD app/plugin system | [x] | | | |
| Native app SDK / build tooling | [x] | | | |
| Sandboxed on-device scripting runtime | Lua 5.4 | JavaScript | | |
| Cloud app / script / asset store | [x] | [x] | | |
| Apps gallery / launcher | [x] | [x] | | |
| Ghostchi / virtual pet | [x] | [x] | | |
| Audio player | [x] | [x] | | |
| Microphone spectrum / visualizer | [x] | [x] | | |
| RGB LED visualizer modes | [x] | [x] | | |
| Clock / RTC screen | [x] | [x] | | |
| Compass screen | [x] | | | |
| Accelerometer screen | [x] | | | |
| ENV-III temperature / humidity / pressure | [x] | | | |
| Battery monitoring / fuel gauge support | [x] | [x] | | |
| Sensor / RTC hardware support | [x] | [x] | | |
| M5 Cardputer keyboard support | [x] | [x] | | |
| Android companion app | [x] | | | |
| Accessibility modes / reduced motion | [x] | | [x] | |
| Custom theme / UI palette system | [x] | [x] | [x] | |
| Custom SD asset packs | [x] | [x] | | |
| LoRa support | [x] | [x] | | |
| FM radio support | | [x] | | |
GhostESP does not ship active jamming features. Distribution, promotion, sale, and use of jamming devices or firmware is illegal in many jurisdictions.
Credits
Special thanks to:
Attributions
LoRa region slot math, header layout, AES-CTR nonce, PKI wire format, and BLE PhoneAPI sequencing are modeled on Meshtastic® firmware and protobufs (GPL-3.0). SX126x bring-up references RadioLib documentation. X25519 is vendored verbatim from curve25519-donna (Google Inc., BSD, see LICENSES/curve25519-donna-BSD.txt); all other GhostESP LoRa code is original under this project's GPL-3.0.
Meshtastic® is a registered trademark of Meshtastic LLC. Meshtastic software components are released under various licenses, see GitHub for details. No warranty is provided - use at your own risk.
GhostESP is not affiliated with or endorsed by Meshtastic.
Contributing
GhostESP welcomes contributions, from a one-line board config to a new feature.
- Adding a board: https://docs.ghostesp.net/latest/development/custom-board-configs/
- Fixing a bug or adding a feature: check open issues - anything tagged
good first issue is a solid place to start.
- Building a native app: see the
gbt (Ghost Build Tool) docs and example apps (Device Inspector, ESP32Finder) for the SDK pattern.
- Questions before you start? Ask in Discord - the team is responsive.
Disclaimers
Ghost ESP is intended solely for educational and ethical security research. Unauthorized or malicious use is illegal. Familiarize yourself with your local laws, and always obtain proper permission before conducting any network tests.
Note: this is a detached fork of Spooky's GhostESP, which has been archived and is no longer in development.
For guidelines on using the GhostESP name and logo, see BRAND GUIDELINES.
Interested in becoming an official partner? Email partners@ghostesp.net.
Open Source Contributions
This project is open source and welcomes your contributions. If you've added new features or enhanced device support, please submit your changes!