Hello M5Stack Community! 📡
I am excited to announce Wi-Fi & BLE Radar ADV (V4.0) - the largest architectural update yet to my direction-finding and spectrum analysis tool for the M5Stack Cardputer / Cardputer ADV.
Version 4.0 moves beyond standard background scanning: it introduces a 250 Hz Promiscuous Wi-Fi Engine, an Active BLE GATT Auditor ([P]), an automatic close-range Pinpoint Geiger Locator, passive Hidden SSID & Client (>STA) unmasking, OpenDroneID GPS decoding, and real-time WIDS attack alerts.
⚡ V4.0 Technical Highlights:
250 Hz Promiscuous Wi-Fi Engine & Live PPS: In Single Target and Device Info modes, the radio locks directly onto the target's channel instead of running slow full-band scans. It captures Management and Data frames at up to 250 Hz with a live packet rate counter (pps) and a 36-point RSSI oscilloscope to spot active video streams from IP cameras and drones.
Auto Pinpoint Geiger Locator (<= 1.65m): When you get within 1.65 meters of a locked target, the radar automatically switches to a close-range Geiger HUD featuring aiming gates, WARMER / COLDER / HOTSPOT trend indicators, a 16-segment Peak Hold bar, and dual-tone Geiger audio.
Active BLE GATT Probe ([P] Key): Select any BLE target and press [P] to open a non-pairing HCI connection. A non-blocking FreeRTOS task reads the hidden GAP Device Name (0x1800), Model, Manufacturer, Firmware & PnP ID (0x180A), Exact Battery % (0x180F), and hidden HID (0x1812) / UART (0xFFE0) services.
Hidden SSID (~Name) & Client Station (>STA) Unmasking: Automatically reveals the real name of hidden Wi-Fi networks (~Name) by correlating virtual/mesh BSSIDs with sibling interfaces on the same router or capturing Probe Response (0x50) and Association (0x00/0x20) frames. It also intercepts transmitting non-AP client devices (>STA)-detecting wireless IP cameras (Hikvision, Dahua, Ezviz, Imou, Reolink, Axis), drones (DJI, Autel), GoPro, Flipper Zero, Raspberry Pi, and ESP32 nodes.
BLE De-Anonymization & RPA Auto-Relock (FP:XXXX):
Tracks targets across random MAC rotations using a 16-bit packet fingerprint (FP:XXXX) and triggers a RPA ROTATED -> RELOCKED alert without losing bearing.
Decodes Apple Continuity (AirPods L/R/Case battery %, iPhone Call / Screen ON / Apple Watch status, separated AirTag [Lost] alerts), Xiaomi MiBeacon (extracting the real factory MAC RM: hidden inside the payload + temp/humidity/battery), Google FastPair 24-bit audio models, Windows SwiftPair names, RuuviTag, Govee, BTHome v2, SwitchBot, Meshtastic LoRa, and covert BLE UART Skimmers.
Drone ID GPS (OpenDroneID & DJI): Extracts live UAV GPS coordinates (Lat, Lon), speed (m/s), and serial numbers from BLE (0xFFFA) and Wi-Fi Beacon (FA:0B:BC / 26:37:12) broadcasts, plus active DJI BLE controller links (0x08AA).
802.11 PHY Telemetry & WIDS Alerts: Passively decodes Wi-Fi 6 (11ax) / Wi-Fi 4 (11n), 20/40MHz width, connected client count (STA), channel load (CU%), and 802.11w PMF status. Triggers instant visual and audio alerts for Wi-Fi Deauth attacks (with Reason Code RC:X), Evil Twin clones, Pwnagotchi, Beacon Floods, and BLE Spam.
Multi-Region ([R]), MicroSD Logger ([L]) & Built-in Manual ([I]): Includes 500+ router/ISP prefixes (EU, Asia, RU/CIS, US/Global) with automatic 802.11d Country Code (IE 0x07) detection, one-key CSV export to microSD (/radar_log.csv), NVS calibration save ([S] instant boot bypass), and a 10-page on-screen Field Manual ([I]).
⚠️ Important Hardware Limitation:
The ESP32-S3 chip inside the Cardputer supports 2.4 GHz Wi-Fi (Channels 1-14) and Bluetooth Low Energy (BLE) only-not 5 GHz Wi-Fi or Bluetooth Classic. It will easily track modern smartphones, smartwatches, IoT sensors, drones, and Wi-Fi devices, but it will not see legacy Bluetooth Classic devices like old car stereos or PS3/PS4 controllers.
📥 How to Install:
Available right now in M5Burner and on GitHub Releases:
Open M5Burner.
Search for Zeloksa or Wi-Fi & BLE Radar ADV.
Download version V4.0 and burn to your Cardputer ADV.
📖 Manual & Feedback:
Press [I] anytime on the device to open the built-in 10-page Field Manual, or read the full documentation and hotkey guide on my GitHub repository. If you find bugs or have suggestions, feel free to open an issue:
👉 https://github.com/Zeloksa/Cardputer-ADV-WiFi-BLE-Radar
☕ Support Development:
If this tool is useful for your diagnostics, security audits, or hobby projects, consider supporting my work. It helps me build more advanced tools for the Cardputer ecosystem!
👉 https://boosty.to/zeloksa
📸 Firmware Screenshots:
[image: 1793179195441-img_20261028_115926454-resized.jpg] [image: 1793179195735-img_20261028_120247264.png] [image: 1793179195823-img_20261028_120407264.jpg] [image: 1793179195934-img_20261028_120348046.jpg]
Let me know what you think of the new V4.0 engine and Pinpoint Geiger mode!
