github.com/GhostESP-Revival/GhostESP @v2.0

The open-source wireless research platform for ESP32. Built on ESP-IDF v6.0. v2.0 turns GhostESP into a full graphical, extensible, multi-radio environment.

⭐️ Enjoying GhostESP? Please give the repo a star. It helps a lot.

---

What's New in 2.0

v2.0 is the largest update in the project's history, building on v1.9.10 with a rebuilt user experience, a first-class app ecosystem, expanded radio and device workflows, and broad platform hardening.

• Redesigned UI experience: 60 FPS rendering, toast notifications, a cleaner status bar, custom asset packs (icons, themes, backgrounds) loaded from SD, touch-drag scrolling, polished setup wizard styling with Home WiFi setup, and a comprehensive accessibility suite (font size, high contrast, reduced motion, input repeat, epilepsy-safe mode).
• Native SD Apps & App Gallery: A new app system for loading tools from SD with permissions, scoped storage, custom icons, accent colors, and a central launcher. ESP32-C5 builds can also run supported app code directly from flash (XIP), avoiding the small internal-RAM ceiling for app code. Build your own apps with the Ghost Build Tool (gbt), the native app SDK, and example apps.

• WiFi Airspace Monitor: Real-time packet/threat insights with adaptive channel dwell, a learned EWMA baseline that adapts to the local environment, a unified threat/insight engine, and an on-screen packets/sec sparkline.

• Expanded Ghostchi: The companion system now has 50 levels, 27 XP sources, passive/aggressive modes, a global mood system, level-up toasts, and a persistent status-bar badge.
• PIN lockscreen: A new overlay lockscreen with auto-lock support, so active captures (wardriving, sniffing) keep running while the device is locked.

• Expanded BadUSB: Trackpad/cursor control, full touch support, USB HID keyboard output mode, mouse jiggler, type_char CLI, and a dedicated WebUI page.
• Redesigned WebUI: A completely refreshed browser interface with a dedicated BadUSB page and improved remote control flow.
• More on-device workflows: SD Browser, text previews, copy/move staging, on-device PCAP browser with hc22000 export, runtime GPS baud settings, on-device AP/STA credential editing, timezone quick-edit, and live RSSI meter views.
• New network recon: SSH, NetBIOS, HTTP banner, and SNMP scanners (with per-host and per-subnet variants) plus a WPA3 compliance checker.
• GhostLink BLE bridge: Assign a connected chip to bridge a main chip and the Android companion app, plus wdstream CLI streaming for companion wardriving.
• More board support: Added Marauder V8, Pancake C5, and LilyGo T-Dongle-S3/C5 builds, plus S3TWatch DRV2605 haptics, Cardputer ENV-III support, and fixes for NM-CYD-C5 SD app loading.
• Under the hood: v2.0 brings a major internal cleanup over v1.9.10: the commandline has been split into focused modules, repeated SD mount/unmount logic now goes through shared on-demand helpers, and the core is safer under memory pressure. The release also hardens the platform with checked allocations, bounded string handling, safer cleanup paths, concurrency fixes, lower memory use on non-PSRAM builds, and stability fixes across WiFi, BLE, audio, GPS, LVGL async calls, shared SPI/UART buses, NFC, DIAL, SD mounting, and app loading.

See CHANGELOG.md for the full v2.0 development history.

---

Get Started

Flash your device	Community & support	Learn more
ghostesp.net/flasher	Discord	Documentation · Website

---

Flagship Capabilities

A few things set GhostESP apart from every other ESP32 firmware:

• Native SD App ecosystem: Create, package, discover, launch, inspect, and stop SD-loaded apps with permissions and scoped storage. Build your own with gbt.
• ESP-IDF-native architecture: built directly on Espressif's SDK instead of Arduino/PlatformIO, giving GhostESP tighter control over Wi-Fi, Bluetooth, USB, memory, and low-level hardware features.
• GhostLink: dual-ESP32 command/display interface with remote radio, remote keyboard, BLE bridging, and split-channel wardriving.
• Multi-interface control: use GhostESP from the on-device UI, Flipper Zero app, serial CLI, WebUI, Android companion app, or GhostLink-connected devices.
• Broad hardware and radio coverage: Wi-Fi, BLE, NFC, IR, SubGHz, NRF24, Ethernet, GPS, USB HID, and 802.15.4/Zigbee across 45 board targets.
• Research-ready capture workflows: PCAP, hc22000, WiGLE CSV, sweep captures, Wireshark streaming, SD browsing, and on-device export tools.
• Full graphical UI platform: carousel, grid, and list layouts with themes, asset packs, touch/keyboard/encoder support, and accessibility options.

---

Features

WiFi Features

• Evil Portal (with custom HTML from buffer via serial)
• Deauth / disassoc attacks
• Channel switch attack
• GTK abuse / client isolation testing
• EAPOL logoff attack
• Karma (with custom SSID lists and custom portal chaining)
• Beacon spam (single/list/random/Rickroll)
• AP scan / STA scan / scanall
• Multi-select APs and stations
• Probe request listening (with auto-spawned Evil Twin)
• Handshake + PMKID capture
• WiFi capture to SD (PCAP) with on-device PCAP browser + hc22000 export
• USB dongle mode for Wireshark (extcap stream)
• DHCP starvation
• ARP / port / SSH / local IP scanners
• mDNS discovery / NetBIOS scan / HTTP banner scan / SNMP probe (with per-host and per-subnet variants)
• WiFi OUI vendor lookup
• WPA3/SAE attacks (flood + compliance checker)
• Wardriving exports (WiFi/BLE/GPS) + sweep CSV (WiFi/BLE/GPS/802.15.4)
• Split-channel wardriving helper via GhostLink
• RSSI tracking (AP/station) with live RSSI meter view
• Drone detection / spoofing
• PineAP detection
• Flock / surveillance detector
• WPS detection
• Pwnagotchi-style automated capture mode (Capture PWN)
• Channel congestion analysis
• WiFi Airspace Monitor (real-time packet/threat insights, fast channel hopping, suspect device cards, packets/sec sparkline)
• DNS Sinkhole (blocklist-based NXDOMAIN blocking with built-in blocklist downloads)
• Web UI + filesystem + remote command relay

BLE Features

• BLE scan modes (general, AirTag, Flipper, raw)
• BLE advertisement scan with OUI prefix/vendor filtering + RGB match pulses
• BLE spam modes (Apple, Microsoft, Samsung, Google, Random)
• AirTag scan / spoof / select
• BLE packet capture
• BLE stream to Wireshark
• Flipper finder + RSSI
• GATT/service scan + per-device enumeration + device tracking (live RSSI meter)
• BLE wardriving
• BLE skimmer detection
• Drone / OpenDroneID scan / list / track / spoof
• Aerial (drone) detector with threat classification
• GhostLink BLE bridge to the Android companion app

USB Features

• USB keyboard host mode (ESP32-S3 builds)
• Remote keyboard control over GhostLink
• BadUSB script runner
• BadUSB identity options (VID/PID/manufacturer/product/layout/randomize)
• BadUSB trackpad (touchpad-style cursor control)
• BadUSB mouse jiggler
• BadUSB type_char CLI for typing individual ASCII characters
• USB HID keyboard output mode (forward on-device keystrokes over USB)
• Dedicated WebUI BadUSB page

IR Features

• IR TX/RX on supported boards
• IR learn mode
• IR easy learn mode
• Flipper .ir file support
• Universal library transmit
• IR CLI tools
• IR dazzler (38 kHz high duty)

NFC Features

• PN532 NTAG/MIFARE Classic support
• Flipper .nfc import/export
• MIFARE Classic dictionary attack (default + user dictionary + session key reuse / sector sweep)
• Full embedded MIFARE Classic dictionary
• Flipper NFC parser set (transit, parking, access, amusement, loyalty): BIP, Clipper, CharlieCard, Troika, Plantain, Zolotaya Korona, Ventra, WashCity, Social Moscow, Sonicare, Saflok, Gallagher, Disney Infinity, Skylanders, Aime, Hi, HWorld, Two Cities, Umarsh, Microel, MIZIP, MetroMoney, Kazan, SmartRider, TRT, and more
• MIFARE Desfire detection
• Chameleon Ultra support (CLI + UI + BLE control)
• Chameleon Ultra HF/LF RFID scan + reader controls

SubGHz Features

• Signal scanning across 64 channels
• Frequency analyzer with waterfall display
• Signal capture and decoding
• 20+ protocol decoders based on Flipper Unleashed/xMasterX
• Signal transmission and replay
• Saved signals as .sub files
• Flipper SubGhz Key File format compatibility
• CC1101 hardware support
• Frequency bands: 315, 390, 433.92, 868.35, 915 MHz
• Full CLI support
• SubGHz remote radio support via GhostLink

Audio Features

• I2S DAC audio player (MP3 playback with headphone detection and volume control)
• Audio receiver (TLV320DAC I2S)
• Music visualizer (RGB LED audio visualization)
• Microphone spectrum / MIC visualizer (microphone-driven RGB LED effects with multiple modes, color modes, sensitivity, smoothing, and contrast)

Display & Sensor Features

• Full LVGL graphical UI with carousel, grid, and list layouts
• Custom asset packs loaded from SD (icons, colors, backgrounds, themes)
• 17+ color themes
• On-screen splash/boot animation with progress bar
• Toast notification system
• Persistent status bar with level badge
• Touch drag scroll + tap-to-wake
• Configurable screen timeout, brightness, and orientation
• Idle animations (Game of Life, Ghost, Starfield, HUD, Matrix, Flying Ghosts, Spiral, Falling Leaves, Bouncing Text)
• On-screen Clock
• Compass screen (magnetometer)
• Accelerometer screen (G-force, tilt, orientation, shake, speed)
• ENV-III sensor screen (temperature, humidity, pressure, dew point, altitude)
• PIN Lock screen with auto-lock (overlay mode keeps captures running while locked)
• Trackpad / cursor control
• Setup wizard with Home WiFi configuration
• Accessibility settings (font size, high contrast, reduced motion, input repeat speed, epilepsy-safe mode)
• Terminal font size control
• Rave mode (display builds)
• DRV2605 haptic feedback (S3TWatch)

Apps & Extensibility

• Apps Gallery (central launcher for native SD apps, with categorical submenus)
• Native SD app system (load, list, inspect, launch, stop, reset apps with permissions and scoped storage)
• Ghost Build Tool (gbt) for scaffolding, building, and packaging apps and firmware
• Plugin/app SDK and example apps (Device Inspector, ESP32Finder)
• Ghostchi virtual pet companion (50-level XP system, 27 XP sources, passive/aggressive modes, companion lockscreen, global mood, level-up toasts, status-bar badge)
• SD Browser (file/folder browsing, rename, delete, copy/move, text file preview)
• On-device PCAP browser with hc22000 export
• On-device Info screen (device, runtime, build, credits)
• Reusable confirmation popups for dangerous UI actions

Additional Features

• GhostLink (dual-device command and display interface) with remote radio support and keyboard relay
• Setup wizard (display builds)
• Wired + web screen mirroring
• Ethernet mode (W5500) + full toolset: fingerprint scan, port scan, ping sweep, ARP scan, ARP poisoning, MITM, HTTP, DNS, NTP, trace route, MAC tools, statistics
• TLS SNI / HTTP / FTP credential capture over Ethernet
• DIAL / Chromecast V2 support
• GPS integration (gpsinfo) with WiGLE manual upload, runtime baud config, and wdstream companion streaming
• Network printer output (powerprinter, PJL)
• RGB LED modes (Normal, Rainbow, Stealth, Knight Rider, MIC Visualizer, custom colors) with neopixel brightness control
• Timezone configuration (timezone) + NTP time set
• Camera motion detection with SD card snapshot capture and Discord webhook alerts (XIAO S3 Sense)
• Live MJPEG camera stream (/camera)
• NRF24 spectrum analyzer with passive 2.4 GHz jamming detection
• Zigbee / 802.15.4 packet capture + sweep CSV (ESP32-C5/C6)
• 802.15.4 / Zigbee channel capture
• Battery monitoring / fuel gauge support
• Sensor / RTC hardware support (PCF8563)
• M5 Cardputer / Cardputer ADV keyboard support
• Android companion app
• On-device CH422G / ST7262 / AXS15231B / APX2102 display driver support
• Light-sleep idle + frequency scaling + Wi-Fi power saving
• Reduced-motion animations
• SD config backup / restore

---

Supported ESP32 Variant