GhostESP - The open-source wireless research platform for ESP

项目说明

<img width="800" alt="ghostesp_logo_white_transparent_2x_shine" src=" />

> The ESP-IDF-nati security platform for ESP32.
> Deep Wi-Fi and BLE assessment, research-grade capture and export, and a real app ecosystem. Built directly on Espressif's ESP-IDF rather than through the Arduino core, so new silicon and radio features land first and there is no abstraction layer between GhostESP and the hardware.

![]()
![ESP-IDF]()
![Discord]()

> ⚠️ Only flash GhostESP with the official flasher or bins from our GitHub releases. We can't integrity or provide support for third-party flashers and mirrors.
>
⭐️ Enjoying GhostESP? Please give the repo a star. It helps a lot.

---

What's New

v2.2: LoRa goes dual-stack, captures get richer, and detection widens.

Earlier: v2.1 (Revival) added on-device OTA with rollback protection, the ST25R3916 NFC backend, the Cloud Store, and GhostScript (sandboxed Lua). v2.0 rebuilt the UI and introduced the native app ecosystem.

<img width="320" height="170" alt="app-gallery2" src=" /> <img width="320" height="170" alt="airspace-monitor" src=" />

Full history in CHANGELOG.md.

---

Get Started

| Flash your device | Community and support | Learn more |
| --- | --- | --- |
| ghostesp.net/flasher | Discord | Documentation · Website |

---

Why GhostESP

GhostESP is a platform, not a bag of tools. Fi set it apart:

---

Features

<details>
<summary><strong>WiFi Features</strong></summary>

<details>
<summary><strong>BLE Features</strong></summary>

<details>
<summary><strong>USB Features</strong></summary>

<details>
<summary><strong>IR Features</strong></summary>

<details>
<summary><strong>NFC Features</strong></summary>

<details>
<summary><strong>SubGHz Features</strong></summary>

<details>
<summary><strong>Audio Features</strong></summary>

<details>
<summary><strong>Display & Sensor Features</strong></summary>

<details>
<summary><strong>Apps & Extensibility</strong></summary>

<details>
<summary><strong>Additional Features</strong></summary>

<details>
<summary><strong>LoRa Features</strong></summary>

---

Supported ESP32

> Note: Feature a by chip. S2 lacks Bluetooth hardware. C5 has 5 GHz and 802.15.4 or Zigbee support. P4 uses an external ESP32-C6 for Wi-Fi and Bluetooth .

---

Supported Boards

62 board targets build in CI (.github/workflows/compile_all.yml) from 61 configs in configs/. Awok V5 shares the generic ESP32-S2 config.

<details>
<summary><strong>Board feature matrix (click to expand)</strong></summary>

| Board | Bluetooth | NFC (PN532) | NFC (Chameleon) | IR TX | IR RX | GPS Default | Keyboard | Display | SD | OTA | Native SD Apps | LoRa |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ESP32-Wroom DevKitC | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| ESP32-S2 DevKitC | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| ESP32-S3 DevKitC | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| ESP32-C3 DevKitC | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| ESP32-C5 DevKitC | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| ESP32-C6 DevKitC | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Awok V5 | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| GhostBoard | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Marauder v4 | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | Full | ✓ | ✓ | ✗ | ✗ |
| Marauder v6 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✗ | ✗ | ✗ | ✗ |
| AWOK Mini | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | Full | ✗ | ✗ | ✓ | ✗ |
| Cardputer | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | Full | ✓ | ✓ | ✗ | ✗ |
| Heltec V3 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Status | ✓ | ✗ | ✗ | ✓ |
| CYD2 USB | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| CYD2 Micro USB | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| CYD2 Dual USB | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| CYD2 USB 2.4" | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| CYD2 USB 2.4" (C ) | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| CYD 2432S028R | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| Wa 7" Touch | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| Crowtech 7" | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✗ | ✓ | ✗ |
| CrowPanel Advance 7" (S3, TFCard mode) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| CrowPanel 4.2" E-paper (400×300) | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | E-paper | ✓ | ✗ | ✓ | ✗ |
| CrowPanel 5.79" E-paper (792×272) | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | E-paper | ✓ | ✗ | ✓ | ✗ |
| CrowPanel Advance 2.4" (S3, 320×240) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✓ |
| CrowPanel Advance 2.8" (S3, 320×240) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✓ |
| CrowPanel Advance 3.5" (S3, 480×320) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| CrowPanel Advance 4.3" (S3, 800×480) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✓ |
| CrowPanel Advance 5" (S3, 800×480) | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| CrowPanel 1.28" Rotary (S3, 240×240) | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| CrowPanel Ad P4 7/9/10.1" (v1.2+) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✓ |
| CrowPanel Ad P4 7/9/10.1" (v1.1) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✓ |
| CrowPanel Ad P4 5" RGB | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| Sunton 7" | ✓ | ✗ | ✓* | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| JC3248W535EN | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| Flipper JCMK GPS | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| T-Deck | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | Full | ✓ | ✗ | ✓ | ✓ |
| T-Embed CC1101 | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| GhostLink P1 Core | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| GhostLink P1 Peer | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| T-Dongle-S3 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✗ | ✗ |
| T-Dongle-C5 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| S3TWatch | ✓ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | Full | has 4MB | ✓ | ✗ | ✗ |
| T-Display S3 Touch | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | Full | ✓ | ✗ | ✗ | ✗ |
| JCMK De Pro | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Minion | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Lolin S3 Pro | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✓ | ✗ |
| Cardputer ADV | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | Full | ✓ | ✓ | ✗ | ✗ |
| Poltergeist | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗ | Status | ✓ | ✗ | ✗ | ✗ |
| Banshee (C5 display MCU) | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✗ | Full + Status | ✓ | ✗ | ✓ | ✗ |
| Banshee (S3 main) | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | - | ✗ | ✓ | ✗ | ✗ |
| Febris Pro | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | - | ✗ | ✗ | ✗ | ✗ |
| ACE C5 | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| NM-CYD-C5 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| ACE S3 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Seeed XIAO ESP32-S3 Sense | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✓ | ✗ | ✗ |
| Seeed XIAO ESP32-S3 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✓ | ✗ | ✗ |
| Seeed XIAO ESP32-C5 | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | - | ✓ | ✗ | ✗ | ✗ |
| Marauder v8 | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | Full | ✓ | ✗ | ✓ | ✗ |
| Pancake C5 | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | Full | ✓ | ✗ | ✓ | ✗ |
| M5Stack CoreS3-SE | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | Full | ✓ | ✓ | ✓ | ✗ |
| M5Stack AtomS3R | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | Full | has 1MB | ✗ | ✗ | ✗ |

*: the checked-in config for this board predates a Kconfig option (NFC_CHAMELEON) that defaults on for BLE-capable boards; no board-specific o is present, so this reflects the Kconfig default rather than an explicit setting in the file. Most unstarred BLE-capable boards set the symbol explicitly, but some generic configs may also rely on the Kconfig default.

M5Stack Gro: the M5Stack CoreS3-SE and AtomS3R configs expose their HY2.0-4P Gro on I2C port 1 (PORT.A: SDA=G2, SCL=G1; the CoreS3-SE also has PORT.B G8/G9 and PORT.C G17/G18). Plug an ST25R3916 NFC module (I2C, 0x50) and/or an M5Stack ENV III unit (SHT30 0x44 + QMP6988 0x70) into Grove PORT.A and open the NFC or ENV III app; both devices share the same bus.

Display: Full = L UI. Status = secondary small status display only (shares the IO-expander I2C bus), no full UI. - = headless, no display.

SD: most boards use SPI-mode SD. JC3248W535EN and T-Dongle-S3 use SDMMC 1-bit mode instead; the SDMMC bus option exists in Kconfig for other boards.

NFC (Chameleon): Chameleon Ultra support rides over BLE, so it's on by default for any BLE-capable board and off where BLE is una (ESP32-S2 boards) or explicitly disabled (Marauder v8, Pancake C5).

Native SD Apps: at compile time the feature depends only on CONFIG_SPIRAM (main/Kconfig.projbuild:1410). At runtime the app gallery checks MALLOC_CAP_SPIRAM and renders into the full L, so a display is required for the UI to be usable. That leaves it enabled on: AWOK Mini, Wa/Crowtech/Sunton 7″, CrowPanel Advance 2.4/2.8/3.5/4.3/5″, CrowPanel Ad P4 5″/7/9/10.1″ (v1.1/v1.2+), JC3248W535EN, CrowPanel 1.28″ Rotary, T-Deck, T-Embed CC1101, GhostLink P1 Core, T-Dongle-C5, NM-CYD-C5, M5Stack CoreS3-SE, Banshee (C5), and Marauder v8/Pancake C5. Boards with a screen but no PSRAM (Cardputer, Cardputer ADV, the CYD2 family, S3TWatch, T-Dongle-S3, M5Stack AtomS3R, etc.) don't get it.

Banshee ships as two configs: the S3 main board (headless) and the C5 module that drives its display and status LED, paired o. Self-OTA is disabled on the C5 in v2.2; update it o from the S3 or by USB.

</details>

---

ESP32 Firmware Comparison

Marauder is the focused, hardware-first Wi-Fi and BLE toolset that much of this space grew out of, and GhostESP credits it directly (see Credits). GhostESP covers the same Wi-Fi and BLE ground and adds the capture-to-analysis pipeline, multi-device control through GhostLink, and the native app ecosystem described above, on an ESP-IDF base rather than Arduino.

The table below compares GhostESP against other broad-scope firmware. It is based on GhostESP's feature set and the publicly a source for each listed project. It is not a complete feature list for every firmware. HaleHound and nyanBOX are compared against the latest public source a to us. If newer releases are closed source, this table cannot be independently against those builds.

<details>
<summary><strong>View comparison table</strong></summary>

| Feature | GhostESP | Bruce | HaleHound | nyanBOX |
| --- | --- | --- | --- | --- |
| Current source a for audit | [x] | [x] | Limited / older public source | Limited / older public source |
| ESP-IDF-nati | [x] | | | |
| Arduino / PlatformIO architecture | | [x] | [x] | [x] |
| Supported board targets | 62 CI targets | 48+ | 4 | 1 |
| Full L UI | [x] | | | |
| Web dashboard / REST control | [x] | [x] | | |
| Capti web server | [x] | [x] | [x] | [x] |
| AP / station WiFi scanning | [x] | [x] | [x] | [x] |
| Deauth / disassoc testing | [x] | [x] | [x] | [x] |
| Beacon spam | [x] | [x] | [x] | [x] |
| Karma / probe response attack | [x] | [x] | [x] | |
| Handshake / EAPOL capture | [x] | [x] | [x] | |
| On-device PCAP browser / hc22000 export | [x] | | [x] | |
| PMKID capture / export | [x] | | [x] | |
| Li USB streaming | [x] | | | |
| SAE flood / WPA3-specific testing | [x] | | | |
| WPA3 compliance checker | [x] | | | |
| EAPOL logoff attack | [x] | | | |
| Channel switch attack | [x] | | | |
| GTK abuse / client isolation testing | [x] | | | |
| DHCP star | [x] | [x] | | |
| ARP / port / SSH scanners | [x] | [x] | [x] | |
| mDNS discovery | [x] | | | |
| NetBIOS scanner | [x] | | | |
| HTTP banner scanner | [x] | | [x] | |
| SNMP probe | [x] | | | |
| WiFi OUI lookup | [x] | [x] | [x] | |
| PineAP / Evil Twin detection | [x] | | | [x] |
| WPS detection / reporting | [x] | [x] | | |
| Pwnagotchi-style automated capture mode | [x] | [x] | | |
| Pwnagotchi detector / spam | | [x] | | [x] |
| Channel congestion analysis | [x] | [x] | | [x] |
| Live WiFi packet monitor / | [x] | | [x] | [x] |
| WiFi Airspace Monitor | [x] | | | |
| DNS sinkhole / blocklist NXDOMAIN | [x] | | | |
| GPS WiFi wardriving | [x] | [x] | [x] | |
| BLE wardriving | [x] | [x] | [x] | |
| WiGLE upload integration | [x] | [x] | | |
| 802.15.4 capture and PCAP export | [x] | | | |
| GhostLink dual-ESP control | [x] | | | |
| GhostLink BLE bridge to Android | [x] | | | |
| Split-channel wardriving helper | [x] | | | |
| GhostLink remote radio support | [x] | | | |
| Drone / OpenDroneID detect | [x] | | | [x] |
| Drone / OpenDroneID spoof | [x] | | | [x] |
| BLE scanning | [x] | [x] | [x] | [x] |
| Raw BLE scanner | [x] | [x] | | [x] |
| BLE spam modes | [x] | [x] | [x] | [x] |
| AirTag scan / spoof | [x] | [x] | [x] | [x] |
| BLE tracker detection tools | [x] | | [x] | [x] |
| Flipper Zero finder | [x] | | | [x] |
| GATT / service enumeration | [x] | [x] | [x] | |
| BLE device tracking by RSSI | [x] | | | |
| BLE stream to Wireshark | [x] | | | |
| BLE skimmer detection | [x] | | | [x] |
| FastPair / pairing exploit research | | [x] | [x] | [x] |
| BLE HID injection / DuckyScript over BLE | | [x] | | |
| BLE keyboard mode | | [x] | | |
| BLE GATT honeypot / cloned peripheral | | | [x] | [x] |
| BLE profiling | | [x] | | |
| Flock / sur detector | [x] | | [x] | [x] |
| PN532 NFC support | [x] | [x] | [x] | |
| ST25R3916 NFC support | [x] | [x] | | |
| Chameleon Ultra support | [x] | [x] | | |
| Chameleon Ultra BLE control | [x] | [x] | | |
| Flipper .nfc import/export | [x] | [x] | | |
| Flipper NFC parser collection | [x] | | | |
| MIFARE Classic default-key attack | [x] | [x] | [x] | |
| MIFARE Classic embedded dictionary | [x] | [x] | [x] | |
| MIFARE Classic user dictionary file | [x] | [x] | | |
| MIFARE Classic session key reuse / sector sweep | [x] | | | |
| MIFARE Classic hardnested recovery | [x] | | | |
| PicoPass / iCLASS reading | [x] | | | |
| MIFARE DESFire application / file tree reads | [x] | | | |
| EM card reader | [x] | [x] | | |
| BadUSB / DuckyScript | [x] | [x] | | |
| USB keyboard host mode | [x] | | | |
| USB HID keyboard output mode | [x] | [x] | | |
| Remote keyboard o link | [x] | | | |
| BadUSB VID/PID identity options | [x] | | | |
| BadUSB mouse jiggler / trackpad | [x] | | | |
| IR learn / capture / replay | [x] | [x] | | |
| Flipper .ir file support | [x] | [x] | | |
| Uni IR library transmit | [x] | [x] | | |
| CC1101 SubGHz scan / replay | [x] | [x] | [x] | |
| CC1101 waterfall spectrum analyzer | [x] | [x] | [x] | |
| Flipper .sub read/write support | [x] | [x] | [x] | |
| SubGHz protocol decoders | [x] | [x] | [x] | |
| NRF24 spectrum analyzer | [x] | [x] | [x] | [x] |
| NRF24 MouseJack | | [x] | [x] | |
| Passi detection | [x] | [x] | [x] | |
| Active RF jamming shipped | Not shipped | [x] | [x] | [x] |
| Zigbee / 802.15.4 packet capture | [x] | | | |
| Ethernet W5500 support | [x] | [x] | | |
| Ethernet ARP poisoning / MITM tools | [x] | [x] | | |
| Ethernet fingerprint / port / ping tools | [x] | [x] | | |
| Ethernet DNS / NTP / HTTP / trace tools | [x] | | | |
| TLS SNI / HTTP / FTP credential capture o | [x] | | | |
| Camera streaming / motion detection | [x] | | | |
| Motion alerts with webhook support | [x] | | | |
| Network printer / PJL output | [x] | | | |
| DIAL / Chromecast testing | [x] | | | |
| On-device setup wizard | [x] | | | |
| PIN / password lock | [x] | | [x] | [x] |
| On-device OTA / SD firmware update | [x] | | [x] | |
| Firmware / rollback protection | [x] | | | |
| GhostLink peer firmware update | [x] | | | |
| Wired screen mirroring | [x] | | | [x] |
| Web screen mirroring | [x] | [x] | | |
| SD config backup / restore | [x] | | | |
| SD file manager / browser | [x] | [x] | [x] | |
| Native SD app/plugin system | [x] | | | |
| Native app SDK / build tooling | [x] | | | |
| Sandboxed on-device scripting runtime | Lua 5.4 | Ja | | |
| Cloud app / script / asset store | [x] | [x] | | |
| Apps gallery / launcher | [x] | [x] | | |
| Ghostchi / pet | [x] | [x] | | |
| Audio player | [x] | [x] | | |
| Microphone spectrum / | [x] | [x] | | |
| RGB LED modes | [x] | [x] | | |
| Clock / RTC screen | [x] | [x] | | |
| Compass screen | [x] | | | |
| Accelerometer screen | [x] | | | |
| ENV-III temperature / humidity / pressure | [x] | | | |
| Battery monitoring / fuel gauge support | [x] | [x] | | |
| Sensor / RTC hardware support | [x] | [x] | | |
| M5 Cardputer keyboard support | [x] | [x] | | |
| Android companion app | [x] | | | |
| Accessibility modes / reduced motion | [x] | | [x] | |
| Custom theme / UI palette system | [x] | [x] | [x] | |
| Custom SD asset packs | [x] | [x] | | |
| LoRa support | [x] | [x] | | |
| FM radio support | | [x] | | |

> GhostESP does not ship acti features. Distribution, promotion, sale, and use of jamming devices or firmware is illegal in many jurisdictions.

</details>

---

Credits

Special thanks to:

<table>
<tr>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="JustCallMeKoKo"/><br/>
<b>JustCallMeKoKo</b>
</a><br/>
_{ESP32Marauder foundational de}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="thibauts"/><br/>
<b>thibauts</b>
</a><br/>
_{CastV2 protocol insights}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="MarcoLucidi01"/><br/>
<b>MarcoLucidi01</b>
</a><br/>
_{DIAL protocol integration}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="SpacehuhnTech"/><br/>
<b>SpacehuhnTech</b>
</a><br/>
_{Reference deauthentication code}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="Spooks4576"/><br/>
<b>Spooks4576</b>
</a><br/>
_{Original GhostESP De}
</td>
</tr>
<tr>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="Tototo31"/><br/>
<b>Tototo31</b>
</a><br/>
_{Large contributions to the project}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="WillyJL"/><br/>
<b>WillyJL</b>
</a><br/>
_{Core Flipper Firmware functionality and BLE Spam code}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="flipperdevices"/><br/>
<b>Flipper Zero firmware</b>
</a><br/>
_{Core IR &amp; NFC implementation (flipperdevices/flipperzero-firmware &amp; contributors)}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="Garag"/><br/>
<b>Garag</b>
</a><br/>
_{Core NFC library}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="connornishijima"/><br/>
<b>connornishijima</b>
</a><br/>
_{<a href=" - MIC RGB algorithms &amp; inspiration}
</td>
</tr>
<tr>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="DarkFlippers"/><br/>
<b>DarkFlippers</b>
</a><br/>
_{Flipper Zero Unleashed firmware (SubGHz protocol decoders)}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="xMasterX"/><br/>
<b>xMasterX</b>
</a><br/>
_{Flipper Zero Unleashed SubGHz impro}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="DecentLabs"/><br/>
<b>DecentLabs</b>
</a><br/>
_{<a href=" - multi-pass ARP scanning &amp; lwIP thread-safety techniques}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="jaylikesbunda"/><br/>
<b>jaylikesbunda</b>
</a><br/>
_{Project maintainer}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="Play2BReal"/><br/>
<b>Play2BReal</b>
</a><br/>
_{WiGLE upload &amp; IO expander support}
</td>
</tr>
<tr>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="the1anonlypr3"/><br/>
<b>the1anonlypr3</b>
</a><br/>
_{Art and assets}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="Billi-Green"/><br/>
<b>Billi-Green</b>
</a><br/>
_{Audio &amp; ENV-III sensor support}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="Next-Flip"/><br/>
<b>Next-Flip</b>
</a><br/>
_{Momentum-Firmware - NFC parser base (EM, hardnested, transit parsers; Gallagher by Nick Mooney)}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="noproto"/><br/>
<b>noproto</b>
</a><br/>
_{MIFARE Classic hardnested / nested recovery}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="leptopt1los"/><br/>
<b>Leptopt1los</b>
</a><br/>
_{EM parser}
</td>
</tr>
<tr>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="bettse"/><br/>
<b>bettse</b>
</a><br/>
_{<a href=" - PicoPass / iCLASS support}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="micolous"/><br/>
<b>micolous</b>
</a><br/>
_{Opal transit card parser}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="emilytrau"/><br/>
<b>emilytrau</b>
</a><br/>
_{myki transit card parser}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="holiman"/><br/>
<b>holiman</b>
</a><br/>
_{loclass - MIFARE key recovery algorithms}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="RfidResearchGroup"/><br/>
<b>RfidResearchGroup</b>
</a><br/>
_{proxmark3 - RFID research tooling}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" alt="M-Powered by Meshtastic"/><br/>
<b>Meshtastic®</b>
</a><br/>
_{Mesh framing, crypto, and PhoneAPI reference}
</td>
</tr>
<tr>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="jgromes"/><br/>
<b>RadioLib</b>
</a><br/>
_{SX126x dri}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="agl"/><br/>
<b>cur</b>
</a><br/>
_{X25519 for Meshtastic PKI directs (BSD, )}
</td>
<td align="center">
<a href="
<img src=" width="80" height="80" style="border-radius: 50%;" alt="HighCodeh"/><br/>
<b>TentacleOS</b>
</a><br/>
_{LoRa modem preset table cross-check (GPL-3.0, no code used)}
</td>
</tr>
</table>

Attributions

LoRa region slot math, header layout, AES-CTR nonce, PKI wire format, and BLE PhoneAPI sequencing are modeled on Meshtastic® firmware and protobufs (GPL-3.0). SX126x bring-up references RadioLib documentation. X25519 is from cur (Google Inc., BSD, see LICENSES/cur.txt); all other GhostESP LoRa code is original under this project's GPL-3.0.

> Meshtastic® is a registered trademark of Meshtastic LLC. Meshtastic software components are released under licenses, see GitHub for details. No warranty is provided - use at your own risk.

GhostESP is not affiliated with or endorsed by Meshtastic.

---

Contributing

GhostESP welcomes contributions, from a one-line board config to a new feature.

---

Disclaimers

Ghost ESP is intended solely for educational and ethical security research. Unauthorized or malicious use is illegal. Familiarize yourself with your local laws, and always obtain proper permission before conducting any network tests.

> Note: this is a detached fork of Spooky's GhostESP, which has been archived and is no longer in de.

For guidelines on using the GhostESP name and logo, see BRAND GUIDELINES.

Interested in becoming an official partner? Email .

---

Open Source Contributions

This project is open source and welcomes your contributions. If you' new features or enhanced device support, please submit your changes!

项目信息

开发语言：C

Star 数：1038

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕The open-source wireless research platform for ESP32.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。