Flash. Control. Coordinate. 52 firmware profiles, 5 flash backends, one screen.
🚧 Under heavy development — moving fast; pin a release if you need stability.
Download · Website + live demo · Hardware guides · Changelog · Discord
The single-window dashboard — development build, no devices connected.
Flashing an ESP32 and then driving it usually means five different tools, a pile of esptool flags, and a fresh way to brick a board every time. Cyber Controller is the one app that does both. Pick a firmware, flash it (chip auto-detected, correct offsets, anti-brick guard), then control it live in the same window. Connect a whole bench of boards and fire one command at all of them at once: one board finds an AP, another deauths it, a third grabs the handshake, all from a single screen.
Built to run a multi-device cyberdeck on a 7″ touchscreen, headless over SSH, or from your phone, but just as happy flashing a single $12 board on your desk. Self-taught hobby project, hardened as it grows. Authorized security testing, education, and CTF use only.
⚠️ Lawful, authorized use only. Use it only on hardware and networks you own or have explicit permission to test. Provided as-is, no warranty; you assume all risk. See DISCLAIMER.md.
Jump to: Highlights · Firmware · Hardware · Interfaces · Quick start · Security · Learn more
v2.0.1 keeps flash output visible beside the firmware workflow, adds a collapsible target list, and improves connection recovery, Flipper controls, Rayhunter reports, web-session handling and installation reliability. Linux builds now include the native renderer and check the packaged interface before upload. See the platform requirements below before downloading.
The full version-by-version history, down to every fix, hardening pass, and added firmware, is in the Changelog and the Releases. Where it's headed next is on the roadmap at cybercontroller.org.
🔥 Flash. 52 firmware profiles across 5 flash backends (esptool for ESP32, qFlipper for Flipper Zero, ADB for Android, SD-image for Pi/SBC boards, and the Realtek RTL8720 loader) — a few more (TI CC2652/Sniffle, HackRF/PortaPack, nRF52 DFU, RP2040 UF2) have their flow unit-tested but aren't validated on real silicon yet, so they don't count toward that 5. A flash core (connect/detect/read hardware-validated on real silicon; write+verify validation is in progress, see the beta caveats) auto-detects the chip (esptool chip_id first, never hardcoded), applies the critical --flash_size detect anti-brick patch and the correct per-chip bootloader offsets (including the ESP32-C5 0x2000 gotcha), and kills the child process on error so a failed flash never holds the port. Batch flash, backup & restore, and handling for the awkward formats (GhostESP .zip, Meshtastic per-chip archives, AmebaD multi-image).
Offline Vault controls are still being connected to the single-window interface. The existing cache supports selected merged images; it cannot store firmware that needs separate bootloader, partition and application files.
🎮 Control. A protocol-aware serial monitor with per-device firmware selection and per-firmware command palettes. 14 native parsers ship. Dangerous transmit commands are labeled and confirmed, never blocked (full capability retained). Macro playback with variable substitution (recording is in the desktop Qt UI; the current single-window UI plays saved macros), and a tamper-evident SHA-256 audit trail over every flash and command.
🛰 Coordinate. The Unified Action Broadcast: one intent (Find APs, Deauth All, BLE Scan, Capture Handshakes, STOP ALL) fans out to every connected radio at once, each translated into that firmware's own native command. A shared target pool means one board's discovery is instantly actionable by another.
♻️ In-app update checks · 🔒 optional physical-key access gate · 🧨 Dead Man's Switch anti-forensic provisioning · 🗺 Flock/ALPR awareness map · 📡 WiGLE CSV upload. Recognized standalone binaries support in-place updates; Windows installer builds use the latest installer. Live survey capture and track rendering in the single-window Map view remain in development. Details below and in the docs.
52 firmware profiles ship in src/config/profiles/. These are download and board definitions, not a bundled image library. Depending on the profile, the source is the latest upstream release, a named or pinned build, or a local file. Some entries have no downloadable image yet.
Check the exact board variant before flashing, especially for display, pinout and flash-size differences. Automatic selection starts from the chip family; it cannot identify every board that uses that chip.
📚 Hardware Guides →: a per-firmware walkthrough for every entry below (what to buy, how to build it, how to flash & run it, how to wire it into Cyber Controller, and troubleshooting), each with a downloadable PDF.
See all 52 firmware profiles (click to expand)
| Firmware | Purpose | Chips / boards | Backend |
|---|---|---|---|
| ESP32 Marauder | Wi-Fi/BLE recon + attack suite | ESP32 / S2 / S3 / C5 | esptool |
| GhostESP | Wi-Fi/BLE/SubGHz multitool | ESP32 / S2 / S3 / C-series | esptool (zip) |
| Bruce | Pentest multitool | ESP32 / S3 / C-series | esptool (merged) |
| M5Launcher | Multi-board firmware launcher / SD app loader (bmorcelli) | ESP32 / S3 / C5 / C6 (~70 boards) | esptool (merged) |
| POSEIDON ⚠ illegal-tx | Keyboard-first pentest multitool (163 features) — includes a 2.4GHz CW/sub-GHz jammer + deauth/BLE-spam TX; authorized lab only, CC flashes firmware and authors no TX | ESP32-S3 (M5 Cardputer-Adv) | esptool (merged) |
| Nautilus | Sub-GHz RF (CC1101 300–928 MHz RX/TX) | ESP32-S3 (LilyGo T-Embed CC1101) | esptool (merged) |
| ESP32-DIV | Wi-Fi/RF Swiss-army firmware | ESP32-S3 (v2) | esptool |
| HaleHound | CYD-native Wi-Fi tool | ESP32 (Cheap Yellow Display) | esptool |
| MinigotchiV3 | Pwnagotchi-style handshake hunter | ESP32 dual-core / S3 | esptool |
| Meshtastic | LoRa off-grid mesh comms | ESP32-S3 / Heltec LoRa | esptool (zip) |
| MeshCore | LoRa mesh (companion/repeater/room-server) | ESP32 / S3 / C3 / C6 | esptool (merged) |
| MCLite (MeshCore fork) | Off-grid mesh comms | ESP32-S3 (T-Deck Plus / T-Watch Ultra) | esptool (merged) |
| RNode | Reticulum LoRa radio interface | ESP32 / S3 (T-Beam / T3S3 / Heltec V3 / T-Deck / XIAO) | esptool (per-board zip) |
| T-REX | LilyGo T-Deck pentest terminal | ESP32-S3 (T-Deck / T-Deck Plus) | esptool (merged) |
| ESP32 Bit Pirate | Bus Pirate-style hardware hacking | ESP32-S3 (XIAO / Cardputer / T-Embed) | esptool (merged) |
| M5Stick NEMO | M5 multitool | ESP32 / S3 (StickC Plus2 / Cardputer / StickS3) | esptool (merged) |
| M5Gotchi | Pwnagotchi for M5Stack | ESP32-S3 (M5Cardputer / Stick-S3) | esptool (merged) |
| AirTag Scanner | Detect nearby AirTags / trackers | ESP32 / S3 | esptool |
| Chasing Your Tail NG | Counter-surveillance tail detection — no prebuilt ESP32 image to flash yet (upstream is a Linux/Pi Python analyzer) | ESP32 | esptool |
| OUI-Spy | Target device by MAC/OUI | ESP32-S3 | esptool |
| Sky-Spy | Drone Remote-ID sniffer | ESP32-S3 / C5 | esptool |
| Drone Mesh Mapper | Passive WiFi drone Remote-ID detector, RX-only (mesh node-relay) | ESP32-C3 / S3 (Xiao) | esptool (merged) |
| ESP32 Dual-Band Wardriver | Passive 2.4+5 GHz WiFi/BLE WiGLE logger (RX-only, SD) | ESP32-C5-DevKitC-1 | esptool (pinned) |
| ESP32 BLE Collector | Passive BLE advert logger to SD (app-only update) | M5Stack Core2/Fire/Basic, Odroid-GO, CoreS3 | esptool (pinned) |
| RNode (nRF52) | Reticulum LoRa transport (nRF52840) | RAK4631 / T-Echo / Heltec T114 | nrf_dfu (Nordic DFU) |
| WHAD ButteRFly | Multi-protocol BLE/Zigbee/ESB/Unifying/Mosart/ANT research fw | nRF52840 (Nordic dongle / Makerdiary MDK) | nrf_dfu / uf2 |
| Sniffle ⚠ lab-only | BLE 4.x/5.x link-layer sniffer (follow/relay) | TI CC13xx/CC26xx (SONOFF CC2652P / CatSniffer V3) | cc2538_bsl |
| Z-Stack Coordinator | Zigbee 3.x coordinator/router | TI CC2652/CC1352 (Sonoff ZBDongle-E) | cc2538_bsl |
| CatSniffer V3 | Passive 802.15.4/Zigbee/Thread/BLE/sub-GHz sniffer | TI CC1352P7 + RP2040 bridge | cc2538_bsl / uf2 |
| nRF Sniffer for 802.15.4 | Passive Zigbee/Thread capture into Wireshark (RX-only) | Nordic nRF52840 Dongle (PCA10059) | nrf_dfu |
| PortaPack Mayhem ⚠ illegal-tx | HackRF+PortaPack SDR firmware — RX recon (ADS-B, POCSAG/ACARS, TPMS, spectrum) + on-device TX apps on protected bands (authorized lab only; CC flashes firmware, authors no TX) | HackRF One / Pro / PortaRF (LPC43xx) | hackrf_spiflash |
| Flock-You | Passive ALPR / Flock camera detector | ESP32-S3 | esptool |
| LxveOS | Security-panel OS — passive Wi-Fi/BLE recon + defensive detectors, capture, arm-gated ops, LXVEOS/1 serial control bridge | ESP32 / S3 | esptool |
| RayHunter | IMSI-catcher / cell-site detector | Orbic RC400L (LTE hotspot) | network |
| Flipper Zero — Momentum | Feature-rich Flipper custom firmware | STM32WB55 | qFlipper |
| Flipper Zero — Unleashed | Unlocked Flipper custom firmware | STM32WB55 | qFlipper |
| Flipper Zero — RogueMaster | Bleeding-edge Flipper custom firmware | STM32WB55 | qFlipper |
| BW16 Deauther ⚠ | Dual-band 2.4/5 GHz Wi-Fi + BLE deauther (authorized testing) | RTL8720DN (AmebaD) | rtl8720 |
| Pwnagotchi | AI handshake-hunting SBC | Raspberry Pi | SD image |
| RaspyJack | Pi drop-box / LAN implant — install-script overlay, not a prebuilt flashable image | Raspberry Pi (LCD/GPIO HAT) | SD image |
| Kali Linux ARM | Full pentest distro — image URL pending (no auto-resolved download yet) | Raspberry Pi (ARM64) | SD image |
| Hydra32 / ESP32-Deauther ⚠ | Wi-Fi deauth (authorized testing) | ESP32 DevKit V1 | esptool (SHA-256-pinned) |
| ESP8266 Deauther ⚠ | Spacehuhn classic (authorized testing) | ESP8266 (D1 mini / NodeMCU / DSTIKE) | esptool (merged) |
| WiFiDuck ⚠ | Wi-Fi BadUSB (authorized testing) | ESP8266 (DSTIKE WiFi Duck / Malduino W) | esptool (merged) |
| ESP32 WiFi Penetration Tool ⚠ | PMKID / handshake attacks (authorized) | ESP32 (DevKit / WROOM) | esptool (SHA-256-pinned) |
| M5PORKCHOP ⚠ | M5 offensive multitool (authorized) | ESP32-S3 (M5Cardputer) | esptool (merged) |
| BlueJammer-V2 (ESP32) ⚠⚠ lab-only | BT/BLE jammer — flash-and-study only | ESP32-WROOM-32U | esptool |
| BlueJammer-V2 (BW16) ⚠⚠ lab-only | BT/BLE jammer — flash-and-study only | RTL8720DN (AmebaD) | rtl8720 |
| nRF BlueNullifier 2 ⚠⚠ lab-only | 2.4 GHz nRF24 RF stress — flash-and-study | 2× nRF24L01 + ESP32 | esptool |
| BlueStress ⚠⚠ STAGED / illegal-tx | 2.4 GHz/BLE disruption (LxveLabs, GPL-3.0, derived from wirebits/nrfBlueNullifier + smoochiee Noisy-boy) — staged/preview: firmware not yet published, cannot flash in this build | ESP32 + nRF24L01 | esptool |
| ESP-AT | Espressif AT-command Wi-Fi/BT modem firmware | ESP32 / S2 / S3 / C3 | esptool (zip) |
Custom / local .bin |
Flash your own build | any ESP32 | esptool |
⚠ marks firmware that can transmit and is included for authorized testing only. ⚠⚠ BlueJammer-V2 is a flash-and-study target for an authorized lab: RF jamming is illegal to transmit (FCC 47 U.S.C. §333). Per the label, never block doctrine its binaries are SHA-256-pinned + fetched at flash time (never vendored), and Cyber Controller exposes no operate/transmit control for it. The parser is telemetry-only.
Available profiles and backends cover these hardware classes. Flashing and live-control support depend on the selected firmware and board:
- ESP32 family: ESP32 (WROOM/WROVER/PICO), ESP32-S2, S3, C3, C6, and the dual-band Wi-Fi 6 ESP32-C5 (2.4 + 5 GHz).
- ESP8266: D1 mini, NodeMCU, DSTIKE (Deauther / WiFiDuck).
- Realtek RTL8720DN / BW16: dual-band 2.4/5 GHz Wi-Fi + BLE, via the AmebaD ImageTool (
rtl8720backend). - Flipper Zero: STM32WB55, via
qFlipper(Momentum / Unleashed / RogueMaster). - Raspberry Pi: Pi 5, Pi Zero 2 W and friends, via verified SD-image writing (Pwnagotchi / RaspyJack / Kali).
- Qualcomm LTE: Orbic RC400L hotspot for RayHunter IMSI-catcher detection (installs over the network via the official rayhunter installer; needs a deactivated SIM to capture).
Board examples — compatibility and tested operations vary by firmware: Lonely Binary ESP32 Gold · Cheap Yellow Display (2.4″/2.8″/3.2″/3.5″; use the resistive 2432S028R) · M5Stack Cardputer / Cardputer ADV / StickC Plus2 / Stick-S3 · LilyGo T-Deck / T-Deck Plus / T-Embed CC1101 / T-Dongle-S3 · Seeed XIAO ESP32-S3 · Heltec LoRa V3 (915 MHz US) · Waveshare ESP32-C5 · Marauder Mini / Mini v3 · Flipper Zero Wi-Fi Dev Board (ESP32-S2) · Ai-Thinker BW16.
The hardware test matrix records earlier bench results. Listing a board here does not mean every firmware, display variant or operation has been tested on it.
Flash-offset reference (the part that bricks boards if you get it wrong)
| Chip family | bootloader | partitions | boot_app0 | app |
|---|---|---|---|---|
| ESP32, ESP32-S2 | 0x1000 |
0x8000 |
0xE000 |
0x10000 |
| ESP32-S3, C2, C3, C6, H2 | 0x0 |
0x8000 |
0xE000 |
0x10000 |
| ESP32-C5, P4 | 0x2000 |
0x8000 |
0xE000 |
0x10000 |
Merged single-image firmwares (Bruce, GhostESP merged.bin) flash at 0x0. The engine never hardcodes the chip; it runs esptool chip_id first.
Two modes, one reformed single-window UI underneath — the same dashboard whether it runs in a native window or a browser.
| Mode | How it renders | Best for |
|---|---|---|
| Normal GUI | Native desktop window (WebView2 on Windows, QtWebEngine on Linux, WebKit on macOS) | Day-to-day use on a laptop, mini-PC, or 7″ touchscreen |
| Web based | Flask + SocketIO in your browser (auth + CSRF, binds 127.0.0.1 by default) |
Phone control of a headless Pi, or any remote box |
Launch with no --ui for a picker. A Simple / Pro depth toggle (Ctrl+M) trims or reveals controls with zero feature penalty. Which mode suits which machine → docs/RECOMMENDED-SPECS.md.
# Python 3.12+ — extras: desktop / web / full / dev
pip install -e ".[full]"
cyber-controller # Normal GUI (native desktop window)
cyber-controller --ui web # Web based, binds 127.0.0.1:5000Prefer a prebuilt binary? Grab the latest release (Windows portable .exe + installer, Linux, macOS, ARM), each with SHA256SUMS.txt and a VirusTotal report. The build isn't code-signed yet, so Windows SmartScreen may warn; docs/WINDOWS-SECURITY.md explains why and gives three ways to verify your download.
The Linux x64 binary requires glibc 2.35 or later and is built on Ubuntu 22.04. The Linux ARM64 binary requires glibc 2.39 or later and is built on Ubuntu 24.04. A graphical session is required for the desktop window; use --ui web on a headless machine. The two Linux downloads have different compatibility floors.
After downloading on Linux, grant executable permission and launch from a terminal. For x64:
chmod +x cyber-controller-v2.0.1-linux-x64
./cyber-controller-v2.0.1-linux-x64Use the linux-arm64 filename for ARM64. If startup fails, keep the terminal error with your distribution and version when reporting it. Windows installer users: run the new installer to upgrade; automatic installer upgrades are still in development.
Cyber Controller drives real RF and flashing hardware, so it's hardened to match: an optional fail-closed physical-key access gate (salted-scrypt, brute-force lockout, opt-in duress self-wipe), an authenticated web remote (per-session CSRF token, CSP nonce, CORS allowlist, no default creds), supply-chain-hardened firmware downloads (HTTPS host allowlist, SSRF-safe redirects, SHA-256 pinning), and AES-256-GCM session storage that fails closed. Full posture + honest limits in SECURITY.md. Report a vulnerability to the address there, not a public issue.
Dead Man's Switch ships as a submodule for owner-only anti-forensic provisioning (boot-password gate, fail-count wipe, GPIO trigger, eFuse + flash encryption). Provision it from cyber-controller --deadman-setup or Tools ▸ Dead Man's Switch Setup; the password is hashed host-side (PBKDF2, never stored). Bundles flash with TOCTOU-safe per-file SHA-256 verification. Cyber Controller only flashes a bundle the provisioner already built; it never burns eFuses itself. Honest scope in the DMS docs.
A few things in the works (no dates, but they're coming):
- A browser-based flasher on cybercontroller.org — flash any supported firmware from the site, no install.
- OUI vendor lookup in the device/scan views, deeper per-firmware command coverage, and live Meshtastic reads.
- A big UI + website overhaul — the current look is a work in progress, not the destination.
- LxveLabs hardware — open-source PCBs and buildable kits, starting with a multi-node Xiao-C5 wardriver.
| For… | Go to |
|---|---|
| Interactive demo, firmware library, downloads | cybercontroller.org |
| Per-firmware buy → build → flash → run guides (PDF) | cyber-controller-guides |
| Full version history + what changed | CHANGELOG.md · Releases |
| Security posture + reporting | SECURITY.md |
| Windows download trust / verification | docs/WINDOWS-SECURITY.md |
| Which UI for which machine | docs/RECOMMENDED-SPECS.md |
| Questions, help, or just to talk it through | discord.gg/lxvelabs |
| Project | What |
|---|---|
| headless-marauder-gui | Standalone Marauder controller + flasher (4 UIs) |
| LxveFlasher | Multi-firmware flasher + device manager |
| deadmans-switch | Anti-forensic firmware provisioner |
| cybercontroller.org | Flagship site — demo, firmware library, downloads |
| esp32marauder.com | ESP32 security-tools hub |
Issues and PRs welcome. Run python -m pytest before submitting; the suite covers the flash core, protocols, backends, the security hardening, and the broadcast engine.
Cyber Controller flashes, drives, and coordinates firmware and tools it did not write. It builds on the work of many upstream authors, none of whom endorse it. Firmware images are normally downloaded from upstream sources. Profiles with known SHA-256 pins enforce them; verification coverage varies by profile. Bundled tools and dependencies retain their upstream licenses and credits. Full acknowledgments + licenses in CREDITS.md.
A few shout-outs for pointing the way:
- ESP Terminator — a great map of which ESP32 firmwares are worth supporting; it helped shape our flasher's coverage list.
- JustCallMeKoko — the ESP32 Marauder project and its wiki are the reference we ground our Marauder support (commands, boards, offsets) against.
- RedneckNetrunner (GOS Discord) — coverage requests and real-device testing that shaped the M5 / Cardputer support.
Trademarks belong to their respective owners.
MIT — Copyright © 2026 LxveAce. See LICENSE.
Discord: discord.gg/lxvelabs · GitHub: @LxveAce · Email: LxveLabs@proton.me (business) · lxveace@proton.me (direct) · Sites: lxvelabs.com · cybercontroller.org