GhostESP v2.2-pre1

The ESP-IDF-native wireless security platform for ESP32. Deep Wi-Fi and BLE assessment, research-grade capture and export, and a real app ecosystem. Built directly on Espressif's ESP-IDF rather than through the Arduino core, so new silicon and radio features land first and there is no abstraction layer between GhostESP and the hardware.

⚠️ Only flash GhostESP with the official flasher or bins from our GitHub releases. We can't verify integrity or provide support for third-party flashers and mirrors.

⭐️ Enjoying GhostESP? Please give the repo a star. It helps a lot.

---

What's New

v2.2: LoRa goes dual-stack, captures get richer, and detection widens.

• LoRa: Meshtastic and MeshCore on SX1262, switchable at runtime, with the official apps over BLE. Ships on Heltec V3, T-Deck, CrowPanel Advance 2.4/2.8/4.3", and CrowPanel Advanced P4 7/9/10.1".
• Captures: per-frame signal, channel and rate in Wireshark; 802.1Q/QinQ VLAN tags; control frames (RTS/CTS/ACK) in EAPOL and Wireshark captures.
• Detection: a wider BLE device-detect list (Tile, SmartTag, Chipolo, AirPods, Apple Watch, FindMy, Fast Pair, hearing aids and more), plus bledetect, mdnssniff, and dualwd BLE + Wi-Fi wardriving.
• Apps: Game Boy / Game Boy Color emulator, gallery folders (Tools, System, Games, Communication, Media, Sensors), and a richer plugin UI API.
• Quality of life: status-bar clock with analog and seven-segment faces, Country selector, Row Height setting, runtime IR TX/RX pin config, custom channel hopping, USB SD passthrough (S3), and T-Deck audio.

Earlier: v2.1 (Revival) added on-device OTA with rollback protection, the ST25R3916 NFC backend, the Cloud Store, and GhostScript (sandboxed Lua). v2.0 rebuilt the UI and introduced the native app ecosystem.

Full history in CHANGELOG.md.

---

Get Started

Flash your device	Community and support	Learn more
ghostesp.net/flasher	Discord	Documentation · Website

---

Why GhostESP

GhostESP is a platform, not a bag of tools. Five things set it apart:

• Built on ESP-IDF, not Arduino. Unlike Marauder and Bruce, GhostESP works against Espressif's SDK directly. It gets new chips and radio features first (802.15.4, Zigbee, 5 GHz on the C5) and lower-level control of the radios, memory, and partitions. Arduino-based firmware can reach the same APIs, just not as directly.
• Live capture and on-device analysis. Stream traffic into Wireshark in real time over USB, and browse, inspect, and convert captures (PCAP, hc22000, WiGLE, 802.15.4) on the device itself.
• GhostLink. Pair two ESP32s so one runs the other's radio, keyboard, and display, with BLE bridging to the Android app, split-channel wardriving, and peer OTA.
• Native apps. SD apps with their own permissions and storage, built with gbt and a plugin SDK, installed from the Cloud Store, plus a Lua runtime for scripts. Examples: Device Inspector, ESP32Finder, a Doom port, a QR generator.
• One command set, many front ends. Drive GhostESP from the on-device UI, serial CLI, WebUI, Flipper Zero app, Android app, or a GhostLink-connected device, all against the same commands.

---

Features

WiFi Features

• Evil Portal (with custom HTML from buffer via serial)
• Deauth / disassoc attacks
• Channel switch attack
• GTK abuse / client isolation testing
• EAPOL logoff attack
• Karma (with custom SSID lists and custom portal chaining)
• Beacon spam (single/list/random/Rickroll)
• AP scan / STA scan / scanall
• Multi-select APs and stations
• Probe request listening (with auto-spawned Evil Twin)
• Handshake + PMKID capture
• WiFi capture to SD (PCAP) with on-device PCAP browser + hc22000 export
• USB dongle mode for Wireshark (extcap stream)
• Per-frame signal, channel and rate in captures, plus 802.1Q/QinQ VLAN tag and control-frame (RTS/CTS/ACK) support
• DHCP starvation
• ARP / port / SSH / local IP scanners
• mDNS discovery / NetBIOS scan / HTTP banner scan / SNMP probe (with per-host and per-subnet variants)
• Passive local-name sniffer (mdnssniff: mDNS/LLMNR/SSDP/NetBIOS) per ARP-discovered host
• WiFi OUI vendor lookup
• WPA3/SAE attacks (flood + compliance checker)
• Wardriving exports (WiFi/BLE/GPS) + sweep CSV (WiFi/BLE/GPS/802.15.4)
• Split-channel wardriving helper via GhostLink
• Dual-band dualwd BLE + Wi-Fi coexistence wardriving (PSRAM boards)
• RSSI tracking (AP/station) with live RSSI meter view
• Drone detection / spoofing
• PineAP detection
• Flock / surveillance detector
• WPS detection
• Pwnagotchi-style automated capture mode (Capture PWN)
• Channel congestion analysis
• Custom channel-hopping plans for attacks, AP/station scans, Airspace Monitor and packet hopping
• WiFi Airspace Monitor (real-time packet/threat insights, fast channel hopping, suspect device cards, packets/sec sparkline)
• DNS Sinkhole (blocklist-based NXDOMAIN blocking with built-in blocklist downloads)
• Web UI + filesystem + remote command relay

BLE Features

• BLE scan modes (general, AirTag, Flipper, raw)
• BLE advertisement scan with OUI prefix/vendor filtering + RGB match pulses
• BLE spam modes (Apple, Microsoft, Samsung, Google, Random) with optional custom advertiser name (blespam -name)
• AirTag scan / spoof / select
• BLE packet capture
• BLE stream to Wireshark
• Flipper finder + RSSI
• GATT/service scan + per-device enumeration + device tracking (live RSSI meter)
• BLE wardriving
• BLE skimmer detection
• BLE device detect scan (bledetect) with list, track and AirTag-spoof actions: Tile, Samsung SmartTag, Chipolo, AirPods (per-model), Apple Watch, generic FindMy clones, Fast Pair / Find Hub, hearing aids, exposure beacons and Chameleon Ultra
• Drone / OpenDroneID scan / list / track / spoof
• Aerial (drone) detector with threat classification
• GhostLink BLE bridge to the Android companion app

USB Features