An original ESP32-C5 wizard pet and mobile field console, with dashboard organization inspired by Ragnar. It does not contain Ragnar code or run Ragnar's Linux tools.
Waveshare ESP32-C5-LCD-1.47, ESP32-C5 revision 1.0 identified over USB. 4 MB flash, no PSRAM, 172 × 320 ST7789 LCD, no touch.
BOOT is GPIO28. Tap changes screens, double-tap casts a spell, hold for 1.2 seconds shows hotspot credentials. RESET is wired to CHIP_PU and remains a hardware reset. Holding BOOT during startup retains download/recovery mode. Brightness is capped at 45%, following Waveshare's recommendation to stay below 50%.
LCD: clock 7, MOSI 6, CS 23, DC 24, reset 26, backlight 10, X gap 34. microSD CS4 is held inactive; this version stores captures in internal LittleFS. No SD card required.
- Offline mobile dashboard: Overview, Wireless recon, Network tools, Attacks, Captures, Familiar, Device. No CDNs, accounts, or internet required for the dashboard.
- Passive 2.4 / 5 GHz Wi-Fi survey: SSID, BSSID, RSSI, channel, advertised authentication mode; channel counts and open/legacy filter. A persisted radio-band setting (2.4 GHz home channels 1–11, or 5 GHz home channels 36/40/44/48/149/153/157/161/165) is applied at boot; a survey lists every AP channel the active band can observe.
- Channel hopping: capture, station observation, and probe watching can sweep through every channel on the active band (configurable dwell, default 150 ms). With hop enabled you can listen for a selected AP, station, or probe request on any channel without retuning the hotspot. Because the radio sweeps, the hotspot follows and the dashboard may briefly disconnect until the sweep returns home.
- Selected-BSSID passive EAPOL-Key collection in PCAP (DLT 105). Real-time detection of complete WPA2 handshakes (M1+M2 from the same station). Auto-capture mode starts listening on the strongest matching AP after a survey, with no channel changes, and stops on the first complete handshake.
- 802.11 packet injection: broadcast or per-station deauthentication (configurable reason code, frame count, or run until stopped), beacon flood, and probe-request flood (spoofed probes for a chosen SSID). Frame injection uses
esp_wifi_80211_tx()and requires on-board verification; the dashboard warns if the driver refuses. - Probe watcher: 15-second passive watch that lists probe requests — the SSIDs nearby stations are searching for.
- Single-host TCP checks for 12 common (or any comma-separated) ports, DNS resolution, bounded HTTP HEAD/header inspection, and a best-effort LAN subnet sweep for management ports. Port and HTTP checks accept one IPv4 or hostname at a time — a LAN device or any single internet host you operate — and require an in-request confirmation that you own or are authorized to test that target, which is recorded in the activity log. The subnet sweep stays inside the connected LAN.
- Device telemetry, activity log, JSON reports, password-protected API and hotspot (default password
admin).
There is one shared radio. Wi-Fi survey, capture, observation, probe watching, and attack injection are mutually exclusive operations. Joining a network can move the hotspot to its channel. To listen on another channel without hopping, disconnect the test-network connection and choose the desired channel; the phone may need to reconnect to the hotspot.
A persisted radio band setting selects 2.4 GHz (default) or 5 GHz. The radio operates only on the selected band, so surveys, captures, hoping, and the hotspot all use that band. Home channels are 2.4 GHz 1–11 or 5 GHz 36/40/44/48/149/153/157/161/165 (non-DFS). A survey still lists 5 GHz DFS channels (52–64, 100–144) for observation, but the hotspot cannot be tuned to a DFS channel as a home channel. Changing band or channel requires stopping radio operations and disconnecting the test network.
Channel hopping moves the radio through every home channel of the active band during capture, observation, or probe watching (hop flag + dwell in Device settings). With hop active, a capture or observation can target a BSSID on any surveyed channel. Hop is stopped automatically at the end of each operation and the radio returns to the configured channel. Deauth attacks are pinned to the hotspot channel and refuse to run while a sweep is active, because deliberate single-channel attacks and random sweeping do not mix well.
Attacks page provides targeted deauthentication (to all stations of an AP, or to a specific observed client), beacon flood, and probe-request flood; every attack can run as a fixed count or until stopped. A probe watcher (15 s) reveals the SSIDs nearby stations are searching for. These are built using esp_wifi_80211_tx() with 802.11 management frames. The ESP32-C5 SDK officially advertises support for beacon, probe, action, and non-QoS data injection; deauth frame injection may require firmware/driver support that varies by board. Use these tools only on networks you own or have written permission to test.
Capture only records unencrypted, unfragmented pairwise EAPOL-Key frames for a selected AP. It waits for natural client authentication. The board detects a complete handshake (M1+M2 from the same station) in real time; a full 4-way handshake is not required for useful offline analysis. Individual message counts can include retries or multiple clients. WPA3 observations do not imply a crackable password exchange. The declared EAPOL length determines the saved frame boundary, excluding any trailing FCS. PCAP timestamps are monotonic device uptime, not wall-clock time. Frames over 768 bytes are dropped. The callback only validates/copies to a bounded queue; storage writes happen in the main loop. If the "stop on handshake" option is enabled, the session ends as soon as M1+M2 from any station are observed.
Each session ends at approximately 64 KiB or 10 minutes. The dedicated 1.5 MiB filesystem has reserved free space; old files are never silently deleted. A new/unmountable Grimoire filesystem is formatted at startup. Back up the current board flash before the initial installation. Abrupt power loss can lose the most recent buffered data. This is a USB-powered board; the UI does not invent a battery meter.
Installed locally: Arduino CLI, Espressif Arduino core 3.3.11, GFX Library for Arduino 1.6.7, ArduinoJson 7.4.2. Python needs Pillow; esptool 5.4.0 supports C5. The generated headers stay inside the firmware directory.
.venv/bin/python tools/build_assets.py
./tools/arduino-cli --config-file arduino-cli.yaml compile \
-b esp32:esp32:esp32c5:CDCOnBoot=cdc,FlashSize=4M,PartitionScheme=custom \
--build-property upload.maximum_size=2621440 --build-path build firmware/grimoireThe custom partition is 2.5 MiB app plus 1.5 MiB LittleFS. No OTA partition: firmware updates use USB. arduino-cli.yaml currently points to this checkout's local toolchain directories; change those paths if moving the project.
- Power the board; connection details appear on the display. Hold BOOT to show them again.
- Join
DarkSecLabs-XXXXwith hotspot password admin. Accept the phone's option to remain connected without internet. - Browse to http://192.168.4.1 and enter the same password.
- Wireless recon runs without joining another network. For LAN tools, join your test network under Device. Credentials for that test network remain in RAM for the session.
The dashboard uses HTTP over the local WPA2 hotspot and Basic authentication. When the board joins a LAN, its HTTP server is also reachable there; use a trusted test LAN. There is no internet-facing deployment configuration. Captures are stored unencrypted in device flash. The hotspot and dashboard password is hard-coded to admin for easy access to a dedicated test device; use a trusted LAN and do not expose the hotspot to untrusted networks.
python3 -m http.server 8765 --bind 127.0.0.1 --directory webOpen http://127.0.0.1:8765/?demo=1. The yellow preview banner marks sample data. Demo buttons simulate UI state only and never operate a radio. Without demo=1, the UI expects a real board API and shows the unlock screen.
- Board: https://docs.waveshare.com/ESP32-C5-LCD-1.47
- Vendor schematic/examples: https://github.com/waveshareteam/esp32-c5-lcd-1.47
- C5 Wi-Fi driver: https://docs.espressif.com/projects/esp-idf/en/stable/esp32c5/api-guides/wifi-driver/index.html
- Dashboard reference: https://github.com/PierreGode/Ragnar