GhostESP: The ESP-IDF Native Wireless Security and Radio Auditing Platform for ESP32

TL;DR: GhostESP (developed by the GhostESP Revival team) is an open-source wireless security and multi-protocol auditing platform built directly on Espressif’s native ESP-IDF v6.0 rather than the Arduino core. Supporting over 46 hardware targets (including the M5Stack Cardputer, LilyGO T-Deck, CYD, and Flipper Zero Wi-Fi Devboard), GhostESP delivers deep 802.11 Wi-Fi packet analysis, live Wireshark USB streaming, BLE reconnaissance, Sub-GHz CC1101 RF capture/replay, ST25R3916/PN532 NFC analysis, dual-device GhostLink radio meshing, and a sandboxed Lua/native app ecosystem.

For wireless security researchers, penetration testers, and radio experimenters, the ESP32 microcontroller has become the universal hardware foundation for portable field tools. However, almost all popular offensive security firmware suites, including ESP32 Marauder and Bruce, are developed on top of the Arduino abstraction layer. While Arduino simplifies initial development, its wrapper libraries introduce latency, restrict fine-grained memory management, and delay access to cutting-edge silicon features.

The GhostESP project (available at ghostesp.net and on GitHub) breaks away from this limitation by building directly on Espressif’s native ESP-IDF v6.0 framework.

By operating bare-metal against Espressif’s native FreeRTOS kernel and low-level radio hardware abstraction layers (HAL), GhostESP delivers research-grade packet capture, true live Wireshark streaming, split-channel multi-device orchestration (GhostLink), and a full sandboxed application runtime without third-party middleware bottlenecks.

Last updated: August 2026.

What is GhostESP?

GhostESP is an open-source, GPL-3.0 licensed wireless security, packet capture, and multi-protocol radio exploration platform engineered natively in C on the Espressif ESP-IDF framework for ESP32 family microcontrollers.

+-------------------------------------------------------------------------+
|                  GhostESP Core Operating Architecture                   |
|  [On-Device LVGL 9 UI]   [Serial CLI Engine]   [WebUI & Remote Relay]   |
+------------------------------------+------------------------------------+
                                     |
+------------------------------------v------------------------------------+
|                  GhostESP Extensibility & App Runtime                   |
|  - GhostScript: Sandboxed Lua 5.4 Engine for On-The-Fly Scripts        |
|  - Native SD Apps: Binary SDK Apps with Scoped Storage & Permissions    |
|  - Ghostchi: 50-Level Gamified Companion & Telemetry Engine             |
|  - Cloud Store: In-App OTA Updates, Script Repo, & Custom Themes        |
+------------------------------------+------------------------------------+
                                     |
+------------------------------------v------------------------------------+
|              Multi-Protocol Radio & Physical Layer Engines              |
|  +----------------+----------------+----------------+----------------+  |
|  |  802.11 Wi-Fi  | Bluetooth / BLE| Sub-GHz CC1101 | NFC / RFID     |  |
|  |  - Extcap Pcap | - BLE Wireshark| - 315-915 MHz  | - ST25R3916    |  |
|  |  - WPA3 / SAE  | - BadBLE HID   | - 64-Ch Scan   | - PN532 EMV    |  |
|  |  - Airspace Mon| - OpenDroneID  | - Flipper .sub | - Hardnested   |  |
|  +----------------+----------------+----------------+----------------+  |
|  |  Infrared (IR) | USB Controller | Ethernet W5500 | GhostLink Mesh |  |
|  |  - Flipper .ir | - DuckyScript  | - Raw PCAP MITM| - Dual-ESP32   |  |
|  |  - 38kHz Dazzle| - HID Injector | - Cred Sniffer | - Remote Radio |  |
|  +----------------+----------------+----------------+----------------+  |
+------------------------------------+------------------------------------+
                                     |
+------------------------------------v------------------------------------+
|          Espressif ESP-IDF v6.0 Core (FreeRTOS / Bare-Metal HAL)         |
|  - Direct Radio HAL  - Hardware Timers  - Zero-Copy Ring Buffers        |
+-------------------------------------------------------------------------+

Unlike tools that treat microcontrollers as basic attack injectors, GhostESP operates as a comprehensive modular operating system. It features an advanced LVGL graphical user interface, an interactive command-line interface (CLI), a local WebUI, and direct integration with desktop analysis suites like Wireshark and Hashcat.

Why ESP-IDF Native Architecture Matters

Building on native ESP-IDF instead of the Arduino wrapper provides significant engineering advantages for RF auditing:

+-------------------------------------------------------------------------+
|                  Arduino Core vs Native ESP-IDF v6.0                    |
+------------------------------------+------------------------------------+
| Traditional Arduino Wrapper        | GhostESP Native ESP-IDF v6.0       |
+------------------------------------+------------------------------------+
| - Heavy memory overhead            | - Direct zero-copy ring buffers    |
| - Polling loops waste CPU cycles   | - True FreeRTOS priority tasks     |
| - Abstracted Wi-Fi/BLE drivers     | - Direct hardware register control |
| - Delayed support for new chips    | - Day-one ESP32-C5 (5GHz)/C6 IEEE  |
| - Fragile USB-CDC streaming        | - Native Wireshark extcap pipeline |
+------------------------------------+------------------------------------+

1. Zero-Copy Packet Pipelines: GhostESP captures 802.11 management, control, and data frames directly from the radio baseband into DMA-backed ring buffers, eliminating dropped frames during high-density channel sweeps.
2. True Multithreading: FreeRTOS tasks split processing cleanly across CPU cores. One core continuously services the radio RX FIFO, while the second core handles on-device PCAP filtering, LVGL UI rendering, and USB streaming.
3. Advanced Silicon Support: Direct access to Espressif’s newest silicon features, including IEEE 802.15.4 (Zigbee/Thread) and dual-band 2.4 GHz / 5 GHz Wi-Fi on modern ESP32-C5 and C6 chips.

Comprehensive Feature Breakdown

+-------------------------------------------------------------------------+
|                   GhostESP Multi-Domain Protocol Matrix                 |
+-------------------+--------------------+-------------------+------------+
| 802.11 Wi-Fi      | Bluetooth / BLE    | Sub-GHz CC1101    | NFC / RFID |
| - Wireshark Extcap| - BadBLE Keyboard  | - 64-Channel Scan | - ST25R3916|
| - WPA3/SAE Audit  | - OpenDroneID Track| - Live Waterfall  | - PN532 EMV|
| - Airspace Monitor| - BLE Wireshark    | - Flipper .sub    | - Transit  |
| - Karma & Evil AP | - Skimmer Detector | - 20+ Decoders    |   Parsers  |
+-------------------+--------------------+-------------------+------------+

1. Advanced 802.11 Wi-Fi Auditing & Defense Analysis

• Wireshark USB Extcap Stream: Connect the ESP32 to a PC via USB to stream live 802.11 monitor mode frames directly into Wireshark in real time, turning the board into an inexpensive wireless sniffer.
• On-Device PCAP Browser & Hashcat Export: Inspect captured .pcap files directly on the device’s colour screen, with automatic extraction of 4-way EAPOL handshakes and PMKIDs into hc22000 format ready for Hashcat cracking.
• WPA3/SAE Auditing: Built-in WPA3 Simultaneous Authentication of Equals (SAE) compliance testing, authentication flooding, and downgrade attack analysis.
• Wi-Fi Airspace Monitor: Real-time visual spectrum analyser displaying channel congestion, packet-per-second sparklines, fast channel hopping, and suspect rogue device cards.
• Attack & Reconnaissance Engine: Evil Portal with dynamic HTML buffer injection, Karma attack chaining, client isolation testing, DHCP starvation, ARP poisoning, and automated Pwnagotchi-style capture (Capture PWN).
• Tactical Defenses: Integrated DNS Sinkhole for NXDOMAIN blocklists, PineAP detector, Flock surveillance camera detector, and drone telemetry monitor.

2. Bluetooth Low Energy (BLE) Intelligence

• BLE Live Wireshark Streaming: Streams raw Bluetooth Low Energy advertising and connection packets over USB into desktop analysers.
• BadBLE Wireless Keystroke Injection: Executes DuckyScript payloads wirelessly over Bluetooth HID keyboard profiles.
• OpenDroneID / Aerial Threat Tracker: Scans, decodes, and tracks remote drone identification broadcasts (FAA / ASTM F3411 OpenDroneID standard) in real time with threat classification.
• BLE Ecosystem Auditing: Multi-brand BLE advertisement spam testing (Apple iOS AirDrop/AirPods, Google Android Fast Pair, Samsung, Windows SwiftPair), AirTag tracking/spoofing, and point-of-sale BLE skimmer detection.

3. Sub-GHz RF Transceiver (CC1101)

Operating across 315, 390, 433.92, 868.35, and 915 MHz bands:

• 64-Channel Spectrum Scanner & Waterfall: Real-time signal activity scanning with an on-screen waterfall display.
• Flipper Zero Compatibility: Seamlessly reads, captures, and transmits .sub files formatted according to the Flipper Zero standard.
• 20+ Hardware Decoders: On-device demodulation and decoding for Princeton, Nice Flo, Somfy, Keeloq, weather stations, and industrial remote sensors.

4. NFC & RFID Dual-Engine (ST25R3916 & PN532)

• High-End ST25R3916 NFC Backend: Supports EMV payment card structure reading, DESFire application and file tree exploration, and HID PicoPass / iCLASS transponder queries.
• Mifare Classic Penetration Toolkit: Embedded dictionary attacks, session key reuse, sector sweeps, and hardware-accelerated nested/hardnested recovery.
• Transit & Access Card Parsers: Built-in parsers for worldwide RFID systems (Clipper, CharlieCard, Troika, Ventra, Saflok, Gallagher, Disney Infinity, Amiibo).
• Chameleon Ultra Integration: Direct serial, UI, and BLE control over external Chameleon Ultra HF/LF RFID emulators.

5. GhostLink: Wireless Dual-Device Orchestration

One of GhostESP’s most innovative capabilities is GhostLink, a peer-to-peer ESP-NOW protocol that links two ESP32 units:

• Remote Radio Tethering: Place a weatherproof ESP32 node with high-gain antennas outdoors or up an antenna mast, while controlling all radio functions, packet sniffers, and injection modules wirelessly from an M5Stack Cardputer in your hand.
• Split-Channel Wardriving: Two paired devices simultaneously scan alternate Wi-Fi channels (e.g., Node A sweeps 1-6 while Node B sweeps 7-14), doubling wardriving capture efficiency.
• Peer-to-Peer OTA: Wirelessly flash updated firmware or transfer application packages from one device to another in the field without internet access.

+-------------------------------------------------------------------------+
|                  GhostLink Dual-Device Architecture                     |
+------------------------------------+------------------------------------+
| Handheld Controller (Operator)     | Concealed Remote Node (Target Site)|
| - M5Stack Cardputer / T-Deck       | - High-Power ESP32 + Directional Ant|
| - Full Keyboard & LVGL Display     | - Sub-GHz CC1101 + ST25R3916 NFC   |
| - Real-Time Packet Feed Display    | - Mounted in Attic / Mast / Vehicle|
+------------------------------------+------------------------------------+
                  ^                                    ^
                  +======= [ESP-NOW Mesh Link] ========+

6. Native Apps, GhostScript, and Ghostchi

• GhostScript (Lua 5.4): Run custom lightweight scripts stored on the micro-SD card without recompiling the main firmware binary.
• Native SDK & Binary Apps: Build independent, compiled C applications with scoped filesystem permissions using the gbt (Ghost Build Tool) SDK.
• Ghostchi Gamified Companion: An integrated on-screen virtual companion featuring a 50-level XP progression system that rewards real-world radio discovery (capturing handshakes, identifying drones, scanning BLE beacons, and logging GPS wardrive coordinates).

Comparison: GhostESP vs Alternatives

Hardware Targets and Web Flashing Guide

GhostESP supports over 46 distinct hardware configurations across the ESP32 ecosystem.

+-------------------------------------------------------------------------+
|                    Popular GhostESP Hardware Targets                    |
+--------------------+---------------------+------------------------------+
| M5Stack Cardputer  | LilyGO T-Deck       | ESP32-2432S028R (CYD)        |
| - 56-Key Keyboard  | - 2.8" IPS Screen   | - 2.8" Touch Color LCD       |
| - 1.14" Color TFT  | - Trackball & LoRa  | - Ultra-Budget ($10-$15)     |
| - Internal Battery | - Native ESP32-S3   | - Desktop & Handheld Cases   |
+--------------------+---------------------+------------------------------+

Supported Hardware Highlights

• M5Stack: Cardputer, CoreS3, Core2, StickC Plus, StickC Plus 2, Dial.
• LilyGO: T-Deck, T-Embed, T-Watch (with DRV2605 haptic feedback), T-Display S3.
• Cheap Yellow Display (CYD): ESP32-2432S028R 2.8″ touchscreen boards.
• Flipper Zero Devboard: ESP32-S2 / ESP32-WROOM official and third-party modules.
• Custom RF Builds: ESP32-S3 devkits with external CC1101, PN532, ST25R3916, W5500 Ethernet, and GPS modules.

Installation via Browser Web Flasher

1. Connect your ESP32 device to your computer with a high-quality USB data cable.
2. Open a Chromium-based browser (Chrome, Edge, Brave) and navigate to: https://ghostesp.net/flasher.
3. Select your exact board target from the dropdown list.
4. Click Connect & Install, pick your device’s COM port, and confirm.
5. The web tool automatically provisions partitions and flashes the latest stable release.

Frequently Asked Questions (FAQ)

What makes GhostESP different from Marauder and Bruce?

GhostESP is built natively on Espressif’s ESP-IDF v6.0 rather than the Arduino core. This enables direct zero-copy radio control, live USB Wireshark streaming, true multithreading, and support for dual-device GhostLink mesh operation.

Can GhostESP stream packets directly into Wireshark?

Yes. GhostESP supports native USB extcap packet streaming, allowing operators to capture and inspect live 802.11 Wi-Fi and Bluetooth Low Energy packets directly inside desktop Wireshark in real time.

What is GhostLink?

GhostLink is a proprietary ESP-NOW wireless protocol that connects two GhostESP devices. It lets an operator use a handheld Cardputer as a master controller while a second high-power ESP32 acts as a remote antenna and radio relay.

Does GhostESP support Flipper Zero file formats?

Yes. GhostESP natively reads, captures, and transmits Sub-GHz radio files in the Flipper Zero .sub format and imports/exports NFC files in the .nfc format.

Is GhostESP free and open-source?

Yes. GhostESP is fully open-source and licensed under the GNU General Public License v3.0 (GPL-3.0), with full source code and documentation hosted on GitHub.

Summary: The Next Evolution of ESP32 Radio Security

GhostESP represents a major technical leap forward for the embedded security community. By discarding the Arduino abstraction layer in favour of native ESP-IDF v6.0 engineering, the GhostESP Revival team has delivered a research-grade platform that rivals high-end dedicated hardware tools. From real-time Wireshark streaming and WPA3 compliance analysis to dual-device GhostLink orchestration, GhostESP transforms off-the-shelf ESP32 boards into professional RF auditing powerhouses.

73 from 9M2PJU.

Sources and Further Reading

• Official GhostESP Portal – Web flasher, documentation, and hardware guides.
• GhostESP-Revival GitHub Repository – Complete open-source firmware, SDK, and issue tracker.
• Official GhostESP Documentation – Detailed command reference and hardware pinouts.
• Espressif ESP-IDF Documentation – Official technical documentation for Espressif’s IoT Development Framework.