Security & Firmware Tools
ESP32 Marauder
Open-source ESP32 WiFi & Bluetooth security toolkit / by LxveAce
About
A collection of open-source tools for ESP32 Marauder — from headless serial controllers and multi-firmware flashers to anti-forensic security layers and cross-device attack coordination. Everything is free, open source, and built to run standalone with no cloud dependency.
These tools cover the full lifecycle: flash any firmware to any board, control it headlessly from a desktop or terminal, layer on anti-forensic protections, and coordinate multiple devices in real time. Built for pentesters, security researchers, CTF competitors, and hardware hackers.
Cyber Controller
The all-in-one security hardware controller and cyberdeck GUI for field deployments. Flash, control, coordinate, and log all your security hardware from a single dashboard — 50 firmware profiles across 5 core backends (esptool, Realtek AmebaD for the dual-band BW16, ADB, qFlipper, SD image, with cc2538-bsl, HackRF SPI-flash, and Nordic nRF-DFU in progress), a Software-OS flashing tab (Kali/Tails/Arch to USB), a GPS-tagged Wardriving tab, an in-app Access-Gate setup, 14 protocol-aware serial parsers, a unified action broadcast that fires one intent across every connected radio at once, cross-device target sharing with auto-routing, and hardware-validated anti-forensic wipes via Dead Man's Switch. I hardened it and fixed the security issues I found along the way.
Hardware-Validated Flash Core
50 firmware profiles across 5 backends (incl. Realtek AmebaD for the dual-band BW16), chip auto-detection, per-chip bootloader offsets, the critical --flash_size detect anti-brick patch. Carried over from my older headless-marauder-gui, where I'd already shaken most of the bugs out.
Cross-Device Coordination
Shared target pool across all connected devices with auto-routing. One board discovers an AP, another deauths it, another sniffs the handshake — the full loop is hardware-validated.
Anti-Forensic Integration
Dead Man's Switch built in as a submodule. ROM-bypass forensic obliteration hardware-validated on ESP32. Guardian firmware-agnostic dead-man gate. Host-side password provisioning — plaintext never touches the device.
Hardened
I did a security pass and fixed the issues it surfaced. SSRF-hardened downloads, scrypt web auth, AES-256-GCM encryption, CSRF protection, rate limiting, and control-char injection guards.
Shipped in v1.4.0
Smart installation: recognizes a previous install and reconciles it — upgrades carry settings + the encrypted vault forward; a downgrade/overwrite prompts to keep or back up (old config moved aside, never deleted). Animated startup with a four-interface launcher (PyQt5 / Tkinter / Textual TUI / Web Remote). Secure container (AES-256-GCM, sealed while the access gate is locked), brute-force lockout and an opt-in duress self-wipe, plus a dual-depth Simple/Pro interface. Built on the Wardriving + Software-OS (Kali/Tails/Arch to USB, SHA-256 + OpenPGP) + in-app Access-Gate foundation. As the all-in-one controller and cyberdeck GUI, Cyber Controller folds flashing, logging, and pentest into one dashboard.
Tools
Dead Man's Switch
Universal anti-forensic dead-man gate for ESP32 security firmware. Successor to Suicide Marauder with planned multi-board support — ESP32-S3, ESP32-C3, ESP32-C6, Flipper Zero, and Raspberry Pi Pico W. The Guardian variant is firmware-agnostic: it gates boot at the factory partition level and works with any firmware, not just Marauder. ROM SPI bypass brick hardware-validated on classic ESP32.
Firmware-Agnostic Gate
Guardian variant works with any ESP32 firmware — Marauder, GhostESP, Bruce, HaleHound, Meshtastic, or custom. Gates boot at the factory partition level.
Multi-Board Roadmap
ESP32-S3, ESP32-C3, ESP32-C6, Flipper Zero companion app, and Raspberry Pi Pico W. Each board adds its chip-specific ROM SPI entry points.
ROM SPI Bypass Brick
Bypasses IDF flash protection via the ROM SPI driver to erase the running app from within itself. Hardware-validated on classic ESP32.
Cyber Controller Integration
Designed as a git submodule for Cyber Controller. Remote arm/disarm, host-side provisioning, one-click flash, and cross-device cascade wipes.
Supported Boards
The boards Marauder and the LxveAce stack run on. Third-party hardware — documented here and credited to its makers.
justcallmekoko’s Wi-Fi/BLE pentest board — a classic ESP32 (WROOM) is the cheapest way in.
Board page → Cheap Yellow DisplayCYD · ESP32Low-cost ESP32 with a 2.8″ touch TFT — a screened build without soldering a display.
Board page → Heltec WiFi LoRa 32V3 / V4 · ESP32-S3ESP32-S3 + SX1262 LoRa with an OLED — the Meshtastic mesh board, native-USB flashing.
Board page →ESP32-DIV
WiFi, BLE, and 2.4GHz pen-test multi-tool by CiferTech — fully integrated into Cyber Controller with in-app serial control, Dead Man's Switch support, and complete flash library. Scan, deauth, capture PMKID/handshakes, BLE spam, 2.4GHz spectrum analysis, and NRF24 sniffing. Current v2 hardware runs on ESP32-S3; legacy v1 on classic ESP32.
WiFi Arsenal
Scan APs & clients, deauthentication, beacon spam (random/clone/rickroll), probe flood, PMKID capture, WPA handshake capture, packet sniffing, and channel hopping.
BLE & 2.4GHz
BLE device scan and notification spam (Apple, Samsung, Google Fast Pair, Windows Swift Pair). 2.4GHz spectrum analysis, NRF24 scanning, and sniffing.
Full Serial Control
60+ commands across WiFi, BLE, 2.4GHz, capture, storage, and system categories. Protocol-aware parsing for live data tables, target selection, and right-click context actions.
Complete Flash Support
ESP32-S3 (DIV v2, 8MB, 80MHz) and classic ESP32 (DIV v1, 4MB, 40MHz). Multi-file flash with bootloader, partitions, and boot_app0. Dead Man's Switch enabled.
Security & Hardware Projects
19 cybersecurity and hardware hacking projects with step-by-step build guides, firmware references, and shopping lists. Flagship: a 14-device Pelican 1300 cyberdeck with dual-band WiFi, LoRa mesh, IMSI catcher detection, and network pentesting — all from one battery.
Pelican Cyberdeck
14-device portable security rig in an IP67 Pelican 1300 case. 12 toggle switches, 7 SMA antenna bulkheads.
ESP32 Marauder Builds
Multiple board configs and enclosures. CYD touchscreen, Gold headless, standalone portable units.
HaleHound Toolkit
Multi-protocol IoT attack station — WiFi, BLE, SubGHz (CC1101), 2.4GHz (NRF24), and NFC (PN532).
Pwnagotchi + Meshtastic
WiFi deauth AI on Pi Zero 2 W + LoRa mesh networking on Heltec V3. Autonomous + mesh capable.
Headless Marauder
The all-in-one ESP32 Marauder controller and multi-firmware flasher. Four native UIs, suicide build support, security-hardened flashing, and standalone executables — no Python, no browser, no cloud.
All-in-One
Controller and multi-firmware flasher in a single app. Marauder, DIV, Bruce, or custom bins.
Suicide Build
Anti-forensic firmware with boot password, 2-fail wipe, and GPIO dead-man switch.
Security Hardened
HTTPS-only fetching, SHA256 verification, path-traversal and SSRF protection.
One-Click Exe
Standalone binaries with everything bundled. Download, run, plug in your board.
Universal Flasher
One unified flasher with two clearly separate tabs. The Firmware tab handles hardware — ESP32 (Marauder, GhostESP, Bruce, and more), the dual-band Realtek RTL8720DN (BW16), Flipper Zero, ADB hardware, and Raspberry Pi SD images. The Software tab flashes PC/USB operating systems — Kali Linux, Tails OS, and Arch — with SHA-256 / signature integrity verification before any write, plus --list-os / --flash-os CLI. An auto-updating catalog (kept current by a weekly CI job) works fully offline. Strictly a flasher: no controller, logger, or wardriving. 19+ firmware profiles, 5 flash backends, batch flashing, and firmware backup/restore.
Two-Tab Flash
Firmware tab: esptool for ESP32, Realtek for BW16, SD image writer for Pi, qFlipper, ADB. Software tab: Kali, Tails, Arch, and more written to USB.
Batch Flash
Queue multiple boards and firmware profiles for sequential or parallel flashing in a single session.
Backup & Restore
Full firmware backup before flashing with one-click restore. Never lose a working setup.
Auto-Update & Offline
Self-updating firmware/OS catalog stays current, with integrity-verified images. Goes fully offline too — cached catalog + downloaded images flash with no internet. The app self-updates.
Guided Every Step
In-app tooltips on every control plus a thorough How-To / tutorial tab. Drop-in plugin profiles for community firmware and device auto-detect on plug-in.
Suicide Marauder
The original anti-forensic firmware provisioner for ESP32 Marauder. Brick primitive is hardware-validated on ESP32 (CYD board) — ROM SPI driver bypass confirmed. Guardian variant provides a firmware-agnostic dead-man gate that works with any firmware. Password parity hardening ensures host-side provisioning with plaintext never touching the device. Overwrite-then-erase with raw-read verify for forensic obliteration. Prepackaged into both Headless Marauder GUI and Cyber Controller. See also: Dead Man's Switch — the universal successor with expanded board support.
Boot Password Gate
PBKDF2-HMAC-SHA256 password challenge before Marauder loads. Supports serial, touch, joystick, and button input.
2-Fail Wipe
Power-cycle-safe attempt counter persisted before responding. Two wrong passwords and flash, NVS, SD — everything wipes.
GPIO Dead-Man Switch
Hardware kill line tied to a GPIO pin. Tamper detection, panic button, or open-case trigger. Cut the wire and the board wipes.
eFuse + Flash Encryption
T2 tier burns Secure Boot v2 and flash encryption to eFuses. Permanent, hardware-enforced, can't be bypassed.
Universal Flasher & UI
The prototype that proved the concept — its features have been absorbed into Cyber Controller, the flagship all-in-one security hardware controller. Flash + device communication + cross-device coordination in one app. The codebase remains available as a reference, but all active development continues in Cyber Controller.
Cross-Device Communication
Shared target pool and event bus. Device A finds an AP, Device B auto-targets it for PMKID sniffing.
Protocol Support
Marauder, GhostESP, Bruce, HaleHound, and Flipper Zero. Each protocol parsed natively.
Flash Everything
4 backends (esptool, SD image, ADB, qFlipper) and 14+ firmware profiles. Batch flash, backup, restore.
Live Serial UI
Per-firmware command interface with live data tables, target picker, and real-time serial output.
Contact
Open to collaboration, consulting, and interesting conversations.