nyanBOX: The ESP32 and Triple-NRF24 Handheld 2.4GHz RF, Wi-Fi, and BLE Toolkit

TL;DR: The nyanBOX is an open-source handheld wireless security toolkit that combines an ESP32-WROOM-32U with triple NRF24L01+ transceivers. It provides standalone 2.4 GHz spectrum analysis, Wi-Fi client and camera reconnaissance, BLE tracker hunting, and drone RemoteID decoding without requiring a laptop or external power.

The 2.4 GHz Industrial, Scientific, and Medical (ISM) frequency band is without question the most congested slice of radio spectrum in modern society. From standard 802.11b/g/n Wi-Fi networks and Bluetooth Low Energy (BLE) beacons to proprietary drone telemetry, wireless security cameras, smart home peripherals, and personal asset trackers, our immediate physical environment is saturated with digital RF traffic.

For amateur radio operators, field communications engineers, and security researchers, inspecting this 2.4 GHz activity in the field has historically involved awkward compromises. High-end Software Defined Radios (SDRs) like the HackRF One or BladeRF offer full spectrum capture. But they demand high power, bulky laptop connections, and complex software pipelines. Meanwhile, popular compact pentesting gadgets often focus on Sub-GHz frequencies (such as the Flipper Zero) or limit their 2.4 GHz analysis to basic Wi-Fi deauthentication frames.

nyanBOX tackles this specific problem directly. Created by Nyan Devices and actively maintained by developers jbohack and zr_crackiin, nyanBOX is a dedicated, pocket-sized wireless reconnaissance and security analysis laboratory. By coupling an ESP32-WROOM-32U microcontroller with triple NRF24L01+ 2.4 GHz transceiver modules, an onboard OLED display, and a rechargeable 2500mAh lithium battery, it delivers a standalone hardware toolkit for surveying, analysing, and understanding the entire 2.4 GHz spectrum without needing external computers or cables.

Last updated: August 2026.

What Is nyanBOX?

nyanBOX is a portable, open-source multi-protocol wireless security and RF spectrum analysis toolkit built on the ESP32 and triple NRF24 transceivers.

Designed as a standalone pocket instrument, it allows network engineers, security auditors, and radio hobbyists to audit 2.4 GHz Wi-Fi networks, decode Bluetooth Low Energy advertising packets, locate personal tracking tags, and sweep the 2.4 GHz RF noise floor via a simple menu-driven physical interface.

Hardware Architecture: The Power of Triple NRF24 Modules

nyanBOX relies on a deliberate division of radio duties. While a standard ESP32 contains an integrated 2.4 GHz Wi-Fi and Bluetooth radio, asking a single radio core to simultaneously sniff 802.11 frames, hop BLE advertisement channels, and perform sweeping spectrum analysis results in crippling bottlenecks and packet loss.

+-------------------------------------------------------------------------+
|                              nyanBOX Handheld Unit                      |
|                                                                         |
|  +------------------------+                  +-----------------------+  |
|  |     ESP32-WROOM-32U    |                  |  Power & User UI      |  |
|  |  (Dual-Core Xtensa LX6)|                  |                       |  |
|  |                        |                  |  - 128x64 I2C OLED    |  |
|  |  [Internal 2.4GHz RF]  |                  |  - 5-Way Nav Controls |  |
|  |    * 802.11b/g/n Wi-Fi |                  |  - 2500mAh LiPo Bat   |  |
|  |    * BLE 4.2 / BR/EDR  |                  |  - USB-C Charge/UART  |  |
|  |    * U.FL Antenna Port |                  +-----------------------+  |
|  +-----------+------------+                              |              |
|              | SPI Bus                                   |              |
|              +-------------------------------------------+              |
|              |                                                          |
|      +-------+-------+---------------+---------------+                  |
|      |               |               |                                  |
|  +---+----+      +---+----+      +---+----+                             |
|  | NRF24  |      | NRF24  |      | NRF24  |                             |
|  | Mod #1 |      | Mod #2 |      | Mod #3 |  (Nordic Semi 2.4GHz ISM)   |
|  +---+----+      +---+----+      +---+----+                             |
|      |               |               |                                  |
|   Antenna         Antenna         Antenna    (2400 MHz - 2525 MHz)      |
+-------------------------------------------------------------------------+

To overcome single-radio limitations, nyanBOX integrates three discrete NRF24L01+ transceiver modules connected over high-speed SPI alongside the ESP32. This hardware configuration provides several operational advantages:

• Parallel Frequency Sweeping: The triple NRF24 modules can divide the 126 available 1 MHz channels across the 2.400-2.525 GHz spectrum, allowing near-instantaneous RF power detection and waterfall updates.
• Dedicated Protocol Offloading: While the ESP32 handles promiscuous 802.11 frame capture and BLE advertisement decoding, the NRF24 modules independently monitor proprietary 2.4 GHz links, frequency-hopping controllers, and raw RF carriers.
• External RF Front-End: Utilizing the ESP32-WROOM-32U module means antenna connections are exposed via standard U.FL/SMA connectors, enabling the use of high-gain omnidirectional whips or directional patch and Yagi antennas for precise direction-finding.

Hardware Specifications

The Wi-Fi Analysis and Audit Suite

The Wi-Fi toolset in nyanBOX goes well beyond simple network SSID listings. Operating the ESP32 radio in promiscuous mode, the firmware captures and reconstructs 802.11 management and data frames in real time.

[802.11 Beacon / Probe Frames] ---> [ESP32 Promiscuous Sniffer] ---> [OUI / MAC Dissector]
                                                                              |
                                     +----------------------------------------+
                                     |
                                     v
                 +---------------------------------------+
                 |          Detection Engine             |
                 |  - Connected Client Tracking          |
                 |  - Channel Congestion Bar Chart       |
                 |  - Passive Wireless Camera Classifier |
                 |  - Rogue Deauth Transmitter Locator   |
                 |  - Pwnagotchi / Pineapple Identifiers |
                 +---------------------------------------+

Key Wi-Fi Capabilities

• Wi-Fi Scanner with Client Mapping: Scans all 2.4 GHz channels to identify access points, BSSIDs, signal strengths (RSSI), and active encryption standards. It actively identifies client devices associated with each network, displaying their MAC addresses and packet activity levels.
• Channel Congestion Analyser: Visualises RF channel utilisation across channels 1 through 14 using a live bar chart. This provides immediate visibility into which channels suffer from overlapping interference in crowded urban environments.
• Passive Wireless Camera Detector: Uses a combination of MAC Organisationally Unique Identifier (OUI) matching and frame timing heuristics to identify wireless surveillance cameras without transmitting any RF packets. The detector recognizes hardware from Ring, Blink, Nest, Arlo, Wyze, Reolink, Eufy, Hikvision, Dahua, Axis, and over 20 other manufacturers. Users can lock onto a detected camera and use a live signal strength meter to physically pinpoint its location.
• Deauthentication Monitoring and Direction Finding: The Deauth Scanner monitors 802.11 management frames for deauthentication and disassociation attacks. It logs the source MAC address, target BSSID, channel, and instantaneous RSSI, allowing security personnel to locate rogue deauthentication transmitters in the field.
• Packet Monitor and Serial Export: Captures raw 802.11 packets, classifies them by frame type (Management, Control, Data), displays live packet counters on the OLED screen, and streams raw CSV summaries over the USB-C serial port for logging in Wireshark.
• Network Wardriving & Tool Identification: Includes dedicated decoders to spot nearby Hak5 Wi-Fi Pineapple devices and Pwnagotchi AI wardriving nodes, parsing Pwnagotchi beacon payloads to display their peer names, mood faces, and running epochs.

Bluetooth Low Energy (BLE) Reconnaissance and Anti-Tracking

With the proliferation of miniature BLE trackers and smart wearables, the 2.4 GHz BLE spectrum has become an active vector for unwanted tracking, physical surveillance, and wireless skimming. NyanBOX incorporates a broad BLE reconnaissance subsystem designed for personal privacy defense and hardware auditing.

                           +-------------------------------+
                           |     BLE 2.4GHz Advertising    |
                           |     (Channels 37, 38, 39)     |
                           +---------------+---------------+
                                           |
                                           v
                           +-------------------------------+
                           |      nyanBOX BLE Inspector    |
                           | - Service UUID Dissection     |
                           | - Manufacturer Data Parsing   |
                           | - Raw Hex Payload Output      |
                           +---------------+---------------+
                                           |
                +--------------------------+--------------------------+
                |                                                     |
                v                                                     v
+-------------------------------+                     +-------------------------------+
|     Anti-Tracking Defenses    |                     |   Physical Hardware Audits    |
| - Apple AirTag & FindMy       |                     | - ATM / Pump Skimmer Hunting  |
| - Samsung Galaxy SmartTag     |                     |   (HC-03/05/06 UART Bridges)  |
| - Tile Bluetooth Trackers     |                     | - Flipper Zero / Meshtastic   |
| - Meta Ray-Ban Smart Glasses  |                     | - Law Enforcement Gear (Axon) |
+-------------------------------+                     +-------------------------------+

BLE Features and Privacy Tools

• BLE Packet Inspector: Sniffs advertising packets across BLE primary advertising channels (37, 38, and 39). It breaks down service UUIDs, manufacturer-specific data, TX power levels, advertising flags, and complete raw hex payloads directly on the display.
• Multi-Platform Tracker Detection: Continuously scans for unsolicited personal trackers, including Apple AirTags, Samsung SmartTags, and Tile devices. It alerts the operator to stationary or following beacons.
• Apple FindMy Beeper Trigger: Explores the Apple FindMy accessory protocol to issue localized chime commands to detected AirTags, AirPods, and compatible FindMy trackers, forcing them to emit an acoustic tone for rapid physical recovery.
• Smart Glasses & Wearable Detection: Identifies nearby Meta Ray-Ban smart glasses and other camera-equipped BLE wearables, giving users immediate situational awareness in privacy-sensitive venues.
• Bluetooth Skimmer Hunting: Specifically flags the default MAC prefixes and advertising signatures of HC-03, HC-05, and HC-06 serial Bluetooth modules commonly wired into automated teller machines (ATMs) and petrol pump payment terminals by financial card skimmers.
• Public Safety & Mesh Gear Discovery: Contains signature filters to detect Axon body-worn cameras and law enforcement communications hardware, as well as nearby LoRa mesh nodes running Meshtastic or MeshCore over BLE.
• iBeacon Analysis and Location Spoofing: Decodes commercial retail tracking iBeacons used in shopping malls and transit hubs for indoor telemetry. The spoofer tool can clone and simulate duplicate beacons, testing how indoor location services handle beacon multipath and identity duplication.
• Protocol Robustness Testing: Features test modules for AppleJuice (Sour Apple), Google FastPair (Sour Droid), and Microsoft Windows Swift Pair to evaluate how mobile operating systems and desktop clients handle high-volume BLE advertising frames.

2.4GHz Spectrum Analysis and Drone RemoteID

Where standard Wi-Fi pentesting gadgets hit a wall is non-802.11 RF. Because nyanBOX houses triple NRF24L01+ modules, it can observe raw RF power levels across the entire 2.4 GHz band, regardless of whether the transmitting device adheres to Wi-Fi or Bluetooth framing.

Relative
Power
  ^
  |        [Wi-Fi Ch 1]             [Bluetooth AFH]             [Wi-Fi Ch 6]
  |       +------------+             | | | | | | |             +------------+
  |      /              \            | | | | | | |            /              \
  |     /                \          | | | | | | | |          /                \
  |----+------------------+---------+-+-+-+-+-+-+-+---------+------------------+---> Frequency
     2.412 GHz                  2.426 GHz - 2.435 GHz     2.437 GHz

Real-Time RF Spectrum Analyser

Building on the open-source legacy of the classic “Poor Man’s 2.4GHz Scanner”, nyanBOX turns its NRF24 front-ends into an agile spectrum scanner:

• 126-Channel Sweep: The receiver cycles across frequencies from 2.400 GHz to 2.525 GHz in 1 MHz steps.
• Auto-Scaling Waterfall & Bar Graph: Dynamic graphical displays on the OLED show carrier strength, noise floor variations, and peak frequencies in real time.
• Selective Band Filters: Operators can isolate specific Wi-Fi channels, Bluetooth hopping sequences, or custom narrowband sub-slices with instantaneous hardware filter switching.
• RF Jamming & Interference Detector: Establishes a calibrated dynamic baseline of ambient RF energy. When broad-spectrum noise or sustained continuous-wave (CW) carriers saturate the band, the system triggers an audible and visual interference alert.

Drone RemoteID Monitoring and Auditing

Under international aviation safety frameworks (including the FAA in the United States and EASA in Europe), commercial and recreational drones are required to broadcast Direct Remote ID (DRI) telemetry.

NyanBOX integrates decoders for the ASTM F3411 and ASD-STAN Open Drone ID standards broadcast over 2.4 GHz Wi-Fi NaN (Neighbor Awareness Networking) and BLE advertising beacons:

• Telemetry Decoding: Parses drone serial numbers, registration IDs, latitude/longitude GPS coordinates, current altitude, ground speed, heading, and pilot/ground station location.
• Direction Finding Mode: Provides a dedicated RSSI tracker that assists search and rescue teams or security officers in locating rogue unmanned aircraft systems (UAS) or their operators.
• Protocol Simulation: Incorporates a Remote ID spoofer capable of broadcasting test ASTM F3411 packets with customizable telemetry strings for testing airfield monitoring systems and RF airspace management tools.

Built-In RPG Gamification Engine

A distinctive design element in nyanBOX is its integrated RPG progression system. While primarily intended to keep workshops, DEF CON villages, and security training exercises engaging, the leveling system serves a functional diagnostic role.

+-------------------------------------------------------------+
|                     nyanBOX STATUS SCREEN                   |
|                                                             |
|   CALLSIGN / ID : NYAN-ALPHA                                |
|   OPERATOR RANK : SPECTRUM WIZARD [RANK 7/9]                |
|   LEVEL         : 42                                        |
|   EXPERIENCE    : [||||||||||||||||||.......] 68%           |
|                                                             |
|   STATS:                                                    |
|   - Wi-Fi Scans  : 1,420      - BLE Devices Found : 3,890   |
|   - RF Sweeps    : 520 hrs    - Deauths Located   : 48      |
+-------------------------------------------------------------+

• XP Accumulation: Users gain experience points based on real-time activity across distinct tool categories (passive scanning, spectrum analysis, protocol testing, and defensive auditing).
• Rank Hierarchy: Operators progress through 9 distinct ranks, reflecting hands-on familiarity with different wireless layers.
• Persistent Memory: Level statistics and achievements are stored in non-volatile EEPROM storage, preserving data across power cycles.
• Peer Discovery Protocol: When two nyanBOX units come within radio range, they automatically exchange discovery beacons, showing nearby peer ranks, firmware builds, and signal strengths on the local OLED.

Tool Comparison: How nyanBOX Stacks Up

To understand where nyanBOX fits into an engineer’s field bag, it is helpful to contrast it with other common portable RF gadgets:

Getting Started: Flashing and Field Deployment

Deploying or updating nyanBOX requires minimal friction. Because the project uses modern browser capabilities through the Web Serial API, operators don’t need to install complex local toolchains or compile code from scratch.

[PC / Laptop running Chrome/Edge] 
            |
            | USB-C (CP210x / CH340)
            v
[nyanBOX Hardware Unit] <--- Web Serial API (nyandevices.com/flasher)

Installation Steps

1. Connect via USB-C: Plug the nyanBOX into a workstation running Google Chrome, Microsoft Edge, or any Web Serial-compatible browser.
2. Launch Web Flasher: Navigate to the official installer at nyandevices.com/flasher.
3. Select Serial Port: Click Install nyanBOX Firmware, choose the detected CP210x or CH340 USB-to-UART bridge port, and initiate the write.
4. Boot Confirmation: Once the flash completes, the device restarts directly into the main OLED menu system. If the serial bootloader fails to respond, hold down the hardware BOOT button while connecting the cable.

Field Deployment and Operational Best Practices

• Antenna Selection: For broad situational awareness, keep standard 2 dBi omnidirectional ducky antennas attached to all SMA ports. When hunting for rogue deauthers, camera bugs, or skimmers, attach a small 2.4 GHz directional patch or Yagi antenna to the primary receiver port to narrow down signal bearings.
• Responsible Spectrum Use: nyanBOX contains active transmission tools (such as deauth injectors and beacon flooders) designed solely for authorized penetration testing and resilience evaluation. Operating transmission attacks on public infrastructure or unauthorized private networks violates telecommunications laws (including MCMC regulations in Malaysia and FCC rules internationally). Keep active testing confined to laboratory testbenches or authorized environments.
• Battery Preservation: When performing extended spectrum logging, the OLED display timeout can be adjusted in the Settings menu to extend operational runtime beyond 14 hours.

Frequently Asked Questions (FAQ)

What hardware does the nyanBOX use?

nyanBOX uses an ESP32-WROOM-32U microcontroller paired with three discrete Nordic Semiconductor NRF24L01+ transceivers, a 128×64 I2C OLED display, and an integrated 2500mAh lithium rechargeable battery.

How does nyanBOX differ from the Flipper Zero?

While Flipper Zero focuses primarily on Sub-GHz RF, RFID, and NFC, nyanBOX is purpose-built for the 2.4 GHz spectrum, offering triple-radio parallel spectrum sweeping, Wi-Fi camera detection, and native Drone RemoteID decoding.

Can nyanBOX detect Apple AirTags and hidden surveillance cameras?

Yes. It passively sniffs BLE advertising channels to detect AirTags, Tile, and SmartTags, and uses MAC OUI and frame timing heuristics to identify over 20 brands of Wi-Fi security cameras.

Is nyanBOX legal to own and operate?

Yes, possessing nyanBOX and performing passive RF scanning or authorized audits is legal. However, transmitting deauthentication frames or interfering with unauthorized networks violates telecommunications laws in most jurisdictions.

How do you update or flash nyanBOX firmware?

Connect the device to a computer via USB-C and open the official web flasher at nyandevices.com/flasher in Chrome or Edge using the Web Serial API without installing local drivers.

Why nyanBOX Matters for Field Communicators

The nyanBOX is a pragmatic, well-engineered addition to the open-source hardware landscape. By acknowledging that a single micro-controller radio can’t handle the entire 2.4 GHz spectrum alone, the developers made a sensible architectural choice: combining the ubiquitous ESP32 with dedicated NRF24L01+ hardware.

The result is an accessible, responsive, and highly capable field instrument. Whether you’re conducting wireless site surveys before establishing an emergency field network, auditing physical facilities for hidden trackers and skimmers, verifying drone RemoteID compliance, or simply exploring the invisible RF environment around you, nyanBOX puts the entire 2.4 GHz band right into the palm of your hand.

73 from 9M2PJU.

Sources and Further Reading

• nyanBOX GitHub Repository (jbohack/nyanBOX)
• Nyan Devices Official Website
• nyanBOX Web Flasher Utility
• Nyan Devices Community Discord
• cifertech/nRFBox (Original Base Project)
• Poor Man’s 2.4 GHz Scanner Project (Arduino Forum)
• OpenDroneID Core C Implementation
• Flock You: Surveillance Camera Detection
• ESP32-Sour-Apple BLE Resilience Tool