Open-Source All-in-One Security Hardware Controller
Cyber Controller
Flash · Control · Coordinate / by LxveAce
>
About
Cyber Controller is the dashboard I use to run all my security hardware from one place. Flash any firmware to any board, drive it from a desktop or terminal, and coordinate several devices at once. No cloud, works fully offline, runs on Windows / Linux / macOS.
I built it for the kind of hardware I actually own and mess with — ESP32 (classic / S2 / S3 / C-series), the dual-band Realtek RTL8720DN (BW16), Flipper Zero, Raspberry Pi, and ADB devices. It runs 5 flash backends, 14 serial parsers, and 50 firmware profiles. I also did a security pass over it myself and fixed what I found.
Three Pillars
Flash
50 firmware profiles across 5 core backends: esptool for ESP32, the Realtek AmebaD ImageTool for the dual-band BW16 / RTL8720DN, SD image writer for Raspberry Pi, qFlipper for Flipper Zero, and ADB for Android-based hardware — with cc2538-bsl (TI CC2652 sniffers), HackRF SPI-flash (PortaPack Mayhem), and Nordic nRF-DFU paths in progress. Chip auto-detection, per-chip bootloader offsets, and the --flash_size detect step that keeps you from bricking a board on the wrong flash size. Batch-flash a few boards in one go, and back up or restore full firmware.
Control
14 parsers that actually read each firmware's serial output, so instead of a scrolling wall of text you get live tables of APs, clients, BLE devices, SubGHz and NFC. Right-click a target and the actions you get are the ones that make sense for it. Four ways to run it: the full Qt desktop app, a lighter Tkinter build, a TUI for headless terminals, and a Flask+SocketIO web mode you can pull up from a browser or phone.
Coordinate
All your connected devices share one target pool, so when one board finds something the others can act on it and I'm not shuttling data around by hand. One board finds an AP, another deauths it, another grabs the handshake. I've had that full chain running on real hardware, not just on paper. Targets get picked up and routed to the right device automatically.
Interactive Demo
A live, in-browser simulation of the real PyQt5 dashboard: connect to fake devices, flash firmware, scan for access points, pick a target, and broadcast actions across every radio. By default it's the full build (every feature on). Use the Demo build picker to preview what each shipped release (v1.0.0 → v1.8.0) actually included, and the tabs, firmware count and features change to match. On the full build, hit ⌡ on the tab strip to pop a tab out into its own draggable, resizable window (send it to a second monitor on the desktop). No real hardware, and nothing is transmitted.
The full build also adds: Loadout (Settings ▸ Configure — tailor the GUI to just the firmwares/hardware you use, or Full Stack), a clickable Device View reconstruction (Marauder / GhostESP / ESP32-DIV) that sends when a matching device is connected (else previews), and a BlueJammer safe-control panel (lab-only stop/contain — connect the BlueJammer-V2 device to see it). Try Device View ↗ in the Devices tab.
100% in-browser simulation — no real devices, and no RF is transmitted. It mirrors the desktop GUI and demonstrates the workflow only; the actual tool is for authorized, lawful use.
Downloads
The latest release, straight from GitHub — older versions are one click away.
🔍 VirusTotal & malware-scan transparency — why a few engines flag the Windows build (and why it’s a false positive)
Every release links its own VirusTotal report and ships a SHA256SUMS.txt so you can check the exact file you downloaded. Open the live scan for each v1.8.0 build below — the numbers stay current as engines re-scan (verify the SHA-256 against SHA256SUMS.txt in the release):
| File (v1.8.0) | SHA-256 (prefix) | Live scan |
|---|---|---|
windows-x64.exe | b9d79d2612b2ea94 | view report → |
windows-x64-setup.exe | b514df842d07a0d7 | view report → |
linux-x64 | 326b5adc5c89df7c | view report → |
linux-arm64 | 926514a40e9dd47f | view report → |
macos-arm64 | 6d898b7e54ac2154 | view report → |
Why those specific engines flag it: across every release the only Windows hits come from the same handful of heuristic / machine-learning / reputation engines — never a named malware family, never a mainstream engine:
- APEX — a pure ML engine; it flags the shape of a PyInstaller bundle (a stub that unpacks a compressed Python runtime), which resembles a packer. High false-positive rate on legit packed apps.
- Bkav — aggressive heuristic/ML (generic “AIDetect” labels); flags virtually every unsigned PyInstaller exe.
- Gridinsoft / Zillya / Yandex — heuristic engines that label unsigned, packed binaries as generic PUA/Trojan on sight.
- Microsoft Defender — occasionally tags a brand-new, unsigned, low-prevalence build by reputation; it clears as downloads accumulate or once the build is code-signed.
The three root causes are all about distribution, not the program: (1) the PyInstaller unpack-and-run shape, (2) no code-signing certificate yet, and (3) low prevalence of a fresh release. The tell that it’s a false positive: a small minority of heuristic engines with generic labels, while Kaspersky, ESET, BitDefender, Sophos, Symantec, Malwarebytes and the rest pass — and the Linux/macOS builds (same source, same CI) come back completely clean. A real infection looks the opposite: a named family agreed on across many engines and platforms.
Verify it yourself: open the VirusTotal link on any GitHub release, check the file against SHA256SUMS.txt, or build from source. Full write-up: docs/WINDOWS-SECURITY.md →
Firmware Library
50 firmware profiles ship — the most-used are featured below; the Hardware Guides cover the full set with per-firmware buy → build → flash walkthroughs. Every profile includes chip detection, bootloader offsets, flash frequencies, and Dead Man's Switch compatibility.
ESP32 Firmware
ESP32 Marauder
StableWiFi/BLE offensive security suite. Scan, sniff, deauth, PMKID, handshake capture, beacon spam, Evil Portal.
GhostESP
StableWiFi/BLE/GPS multi-tool with wardrive, portal capture, beacon spam, probe sniff, BLE spam, and SD logging.
Bruce
StableMulti-purpose offensive firmware. WiFi, BLE, IR, SubGHz, RFID, NFC, BadUSB on ESP32-based boards.
ESP32-DIV
StableWiFi/BLE/2.4GHz pen-test multi-tool. Scan, deauth, BLE spam, PMKID, NRF24, spectrum analysis.
HaleHound
StableMulti-protocol IoT attack station. WiFi, BLE, SubGHz (CC1101), 2.4GHz (NRF24), NFC (PN532).
Meshtastic
StableLoRa mesh networking. Off-grid encrypted messaging, GPS tracking, telemetry, and repeater nodes.
BW16 Vampire Deauther
StableDual-band 2.4 / 5 GHz WiFi + BLE on the Realtek RTL8720DN (BW16). AT+ serial CLI — scan, deauth, beacon spam. The deck's 5 GHz radio.
CYT-NG
StableCustom Marauder-family firmware with extended features for CYD touchscreen boards.
Flock-You
StablePassive, receive-only detector for Flock Safety ALPR (license-plate reader) cameras — it sniffs the WiFi/BLE beacons the cameras emit and flags them so you know what is watching. It transmits nothing. Source-first build, so a formal release can 404.
OUI-Spy
StablePassive WiFi device tracking via OUI lookup. Identify device manufacturers from probe requests.
Sky-Spy
StableDrone/UAV detection via WiFi probe analysis. Passive detection of common drone control protocols.
AirTag Scanner
StableDetect and locate nearby Apple AirTags and other BLE trackers via advertisement scanning.
MinigotchiV3
StableMiniature Pwnagotchi companion. BLE deauthentication and WiFi reconnaissance on ESP32 boards.
NEMO
StableWiFi/BLE/IR/BadUSB multi-tool for M5Stack and Cardputer. Huge community, active development.
Deauther
StableMost downloaded ESP hacking firmware. WiFi deauthentication, beacon spam, and probe flooding.
EvilPortal
Coming SoonCaptive portal phishing framework for ESP32. Custom login pages for credential harvesting.
Wardriver.uk
Coming SoonDedicated wardriving firmware with GPS logging, WiGLE export, and dual-radio scanning.
PacketMonitor
Coming SoonReal-time WiFi packet visualization. Channel utilization, frame types, and traffic density.
Hash Monster
Coming SoonDedicated PMKID and handshake capture station. Export to hashcat/aircrack format.
ESP32-NAT-Router
Coming SoonWiFi NAT router and MitM relay. Rogue AP, traffic routing, and network interception.
Reticulum / RNode
Coming SoonEncrypted mesh networking over LoRa. Off-grid encrypted communications, Meshtastic alternative.
LoRa APRS iGate
Coming SoonAmateur radio position tracking gateway. APRS over LoRa for off-grid location monitoring.
Flipper Zero Firmware
Momentum
StableFeature-rich custom Flipper firmware. Extended SubGHz, NFC, RFID, IR, BadUSB, GPIO, and app ecosystem.
Unleashed
StableUnlocked Flipper firmware with extended frequency ranges, SubGHz protocols, and community apps.
RogueMaster
StableThird major custom Flipper firmware. Extended apps, SubGHz, NFC, RFID with massive plugin library.
Raspberry Pi & Linux
Kali ARM
StableFull Kali Linux for ARM boards. Complete penetration testing distribution with 600+ tools.
Pwnagotchi
StableAI-powered WiFi audit tool. Autonomous WPA handshake capture with machine learning optimization.
RaspyJack
StableRaspberry Pi-based network attack platform. Rogue AP, MITM, credential harvesting, and DNS spoofing.
RayHunter
StableIMSI catcher detection on Orbic mobile devices. Detect cell-site simulators via Qualcomm diag interface.
P4wnP1 A.L.O.A.
Coming SoonUSB attack platform. HID injection, network MitM, data exfiltration, and covert channel attacks.
Parrot Security OS
Coming SoonFull pentest and OSINT distribution. Privacy tools, reverse engineering, and forensics focused.
NetHunter (Pi)
Coming SoonKali NetHunter for Raspberry Pi. Mobile penetration testing platform with injection support.
NetHunter (Phone)
Coming SoonADB sideload NetHunter to supported Android phones. Full Kali toolchain on mobile hardware.
OpenWrt
Coming SoonPortable pentest router. Rogue AP, traffic capture, DNS manipulation, and VLAN segmentation.
Kismet
Coming SoonDedicated 802.11/BLE/Zigbee passive recon sensor. Wireless network detection and sniffing.
SDR & RF Hardware Coming Soon
HackRF One
Coming Soon1MHz–6GHz SDR transceiver. RF replay, signal analysis, jamming research, and custom protocol work.
Proxmark3
Coming SoonRFID/NFC research platform. Clone badges, analyze protocols, fuzz readers, emulate cards.
YARD Stick One
Coming SoonSub-GHz ISM band transceiver. Garage doors, car keyfobs, IoT protocols, and custom RF work.
Ubertooth One
Coming SoonBluetooth baseband sniffer. Passive BLE/BR/EDR capture and Bluetooth protocol analysis.
GreatFET One
Coming SoonUSB hacking and hardware analysis platform. USB fuzzing, protocol analysis, and debug probing.
USB & Microcontroller Coming Soon
Pi Pico / RP2040
Coming Soon$4 BadUSB and HID injection platform. Rubber Ducky alternative with CircuitPython support.
Chameleon Ultra
Coming SoonMulti-slot NFC card emulator and cloner. HF + LF RFID with slot management and card sniffing.
Circuit Playground
Coming SoonSensor and HID platform for physical pentest nodes. Motion, sound, light, and capacitive touch.
Specialty Hardware Coming Soon
Bus Pirate
Coming SoonUniversal protocol analyzer. SPI, I2C, UART, JTAG debugging and hardware reverse engineering.
WiFi Coconut
Coming Soon14-channel simultaneous WiFi monitor. Full 2.4GHz spectrum capture on all channels at once.
Crazyradio PA
Coming SoonMouseJack and wireless keyboard injection attacks. 2.4GHz nRF24-based long-range radio.
O.MG Cable
Coming SoonUSB implant cable. Remote keystroke injection, WiFi exfiltration, and covert payload delivery.
CANtact / CAN Bus
Coming SoonVehicle network analysis. CAN bus sniffing, replay attacks, and automotive protocol research.
Protocol Parsers
Every supported firmware talks its own dialect over serial. These 14 parsers read that output directly and turn it into live tables you can actually work with, with auto-detection, right-click target actions, and target sharing between devices.
Marauder
AP/client/BLE scan results, PMKID/handshake capture, deauth status, channel info, SD operations
GhostESP
AP/client/BLE/probe discovery, deauth/beacon/portal events, GPS/wardrive data, SD logging
Bruce
WiFi/BLE/IR/SubGHz/RFID/NFC events, multi-protocol scan results, BadUSB status, system events
Flipper Zero
SubGHz captures, RFID/NFC reads, IR signals, BadUSB execution, GPIO data, app output
HaleHound
Multi-protocol scan results across WiFi, BLE, CC1101 (SubGHz), NRF24 (2.4GHz), PN532 (NFC)
Meshtastic
Mesh node discovery, message routing, GPS telemetry, signal quality, channel configuration
ESP32-DIV
WiFi AP/client scan, BLE device discovery, 2.4GHz spectrum, NRF24 sniffing, PMKID/handshake capture
BW16
Dual-band 2.4/5 GHz Vampire Deauther on the Realtek RTL8720DN. AT+ serial CLI — parses scan results (SSID, channel, RSSI), deauth and beacon-spam status, and boot/system events
Flock-You
Passive, receive-only 2.4 GHz sniffer that spots Flock Safety ALPR cameras by their WiFi OUI and probe-request fingerprint. Parses detection events into map targets — it transmits nothing, you just notice what is watching you
BlueJammer
Read-only telemetry parser for the BlueJammer-V2 RF-research rig — decodes boot, mode, and nRF status lines into info/status events. No serial command channel; Cyber Controller reads telemetry for lab study only
Security & Anti-Forensic
Input Hardening
CSRF protection on the web remote, per-endpoint rate limiting, and control-character injection guards on every input, so crafted requests and malicious pages can't drive the app.
Web Auth Hardened
scrypt password hashing for the web remote interface. AES-256-GCM mandatory encryption for all stored credentials. Session tokens with configurable TTL and automatic expiry.
Dead Man's Switch
Anti-forensic firmware integration via the deadmans-switch submodule (successor to Suicide Marauder). ROM SPI bypass brick hardware-validated on ESP32. Guardian firmware-agnostic dead-man gate. Host-side password provisioning — plaintext never touches the device.
Duress & Panic Wipe
Configurable duress password triggers immediate flash obliteration. 2-fail auto-wipe with power-cycle-safe attempt counter. GPIO dead-man switch for tamper/open-case detection. Cascade wipe across all connected devices.
SSRF Hardened
All firmware download URLs validated against allowlist. Private IP ranges blocked. Redirect chains terminated. Path-traversal protection on all file operations. No arbitrary URL fetching.
Cross-Platform
Windows, Linux, macOS. ARM and x64. Full Qt desktop GUI, lightweight Tkinter, headless TUI, and browser-based web remote. Standalone executables with everything bundled.
Ecosystem
Cyber Controller is the main thing I work on, but it grew out of a bunch of smaller tools I built before it. They're all open source, and each one still works on its own.
| Name | Version | Notes |
|---|---|---|
| Headless Marauder GUI | v1.3.4 | The original all-in-one Marauder controller and multi-firmware flasher. 4 UIs, standalone exe builds. github.com/LxveAce/headless-marauder-gui |
| Dead Man's Switch | Active | Universal anti-forensic dead-man gate. Multi-board successor to Suicide Marauder. github.com/LxveAce/deadmans-switch |
| Suicide Marauder | v1.0.1 | The original anti-forensic firmware. ROM SPI bypass brick, Guardian gate, boot password. HW-validated. github.com/LxveAce/Suicide-Marauder |
| Hardware Guides | Docs | In-depth, per-firmware walkthroughs for every supported device — purchasing, building, flashing, integrating into Cyber Controller, and troubleshooting — each with a downloadable PDF. 29 guides. github.com/LxveAce/cyber-controller-guides |
| Universal Flasher | v1.4.0 | Focused standalone flasher (no controller/logger/wardriving). Multi-firmware ESP32 flashing plus Software-OS flashing (Kali/Tails/Arch to USB) via --list-os / --flash-os, auto-updating catalog + offline. Batch flash, backup/restore, plugin system. github.com/LxveAce/universal-flasher |
| Universal Flasher & UI | v0.1.0 | Flash + serial control + cross-device coordination prototype. Absorbed into Cyber Controller. github.com/LxveAce/universal-flasher-ui |
| esp32marauder.com | Website | ESP32 security tools hub. Build guides, downloads, and project documentation. esp32marauder.com |
Roadmap
What's now shipping in cyber-controller v1.8.0 (and universal-flasher v1.4.0).
Captured-Handshake Log Shipped v1.7.2
Every WPA handshake and PMKID a connected board captures now lands in a live Captured handshakes list in the Crack Lab — SSID, BSSID, channel, client MAC, EAPOL vs PMKID, RSSI, source device and the on-device .pcap/.hc22000 path. Double-click to load one straight into the cracker; a solved key writes back and the row turns green. Export the whole log to CSV or JSON (every attacker-influenced field neutralised against CSV injection). Firing a targeted Deauth AP arms a short window and logs a first-class “handshake captured — deauth confirmed” line when a matching capture lands. Backend correlation only — Cyber Controller issues firmware CLI commands and never authors radio frames.
Multi-Device Wardriving Shipped v1.6.0
Drive several boards at once from one shared GPS into a single merged WiGLE CSV, with per-board AP counts and a running total. Each board is sent its own firmware's native scan command (Marauder, GhostESP, Flock-You, and so on), and every capture routes through the shared device manager — so a board already open in the Devices tab is shared, not double-opened (which on Windows would fail with Access Denied).
Live Flock Driving Map Shipped v1.6.0
The Flock Map tab records a live drive: located ALPR cameras drop onto the map as they're found, each checkpointed to disk for crash-safety. The recorder keeps running while the tab is hidden — only the repaint pauses — and the map catches up when you return to it.
Wireless Relay + Node Firmware Shipped v1.6.0
Real ESP32 firmware for the two wireless roles: a crypto-free USB↔ESP-NOW relay and an AES-256-GCM sensor node, with a byte-exact wire protocol and anti-replay. The node's on-device crypto is contract-tested against the host. Shipped as source you compile and flash yourself.
Smart Installation & Version-Aware Startup Shipped v1.4.0
Cyber Controller now recognizes a previous install on launch and reconciles it automatically. An upgrade carries your settings and encrypted vault forward silently; a downgrade (running an older build over a newer config — the “paths collide / overwrite” case) prompts you to Keep & Continue or Back up & Start Fresh — and your old config is always moved aside, never deleted, so it stays restorable. A .installed_version marker is written so future launches classify correctly; fully silent for headless/CLI use.
Animated Startup & Four-Interface Launcher Shipped v1.3.3
Launching the packaged app now shows an animated loading screen within a second or two (logo, progress sweep, status text) that cross-fades into the dashboard — no more staring at nothing while the one-file build self-extracts. Motion follows the project's motion-design tokens and honors reduced-motion. Double-click with no --ui flag and the Select Interface launcher offers all four front-ends — Full GUI (PyQt5) · Lightweight (Tkinter) · Terminal UI (Textual) · Web Remote — with Web Remote now opening your browser automatically.
Security Hardening & Secure Container Shipped v1.3.0
An opt-in secure container encrypts app saves at rest (AES-256-GCM) and keeps them sealed and unreadable while the access gate is locked — ciphertext-only, tamper fails closed. The gate adds brute-force lockout (persistent, exponential backoff), an opt-in duress self-wipe, and boot/startup-bypass resistance (no pre-auth reset; enforced before any UI loads). Honest threat model documented in SECURITY.md.
Dual-Depth Simple / Pro Interface Shipped v1.3.0
A streamlined Simple view shows just the essentials per tab for newcomers, while Pro (the default) keeps every control with zero penalty. Switch any time via View › Interface Mode, the status-bar badge, or Ctrl+M — the choice persists. Safety and authorization prompts always show in both modes. Plus 4 new firmware profiles: T-REX, MCLite (MeshCore), ESP32 Bit Pirate, and Hydra32.
Unified Flashing — One App, Two Tabs Shipped v1.2.1
One flasher with two clearly separated tabs. The Firmware tab handles hardware — ESP32 Marauder, GhostESP, Bruce and the rest of the library, plus Raspberry Pi SD images. The Software tab handles PC/USB operating systems. Same workflow, no second tool to learn. Also in universal-flasher v1.4.0 via --list-os / --flash-os, alongside its ESP32 firmware flasher.
Software OS Flashing to USB Shipped v1.2.1
The Software tab writes verified operating systems — Kali Linux, Tails OS, Arch and more — to a USB stick. The latest version is auto-resolved (with an offline bundled fallback), every image is integrity-verified with SHA-256 and OpenPGP before any write, and the target is confirmed to be a removable, non-system disk first. Also available in universal-flasher v1.4.0 (Kali/Tails/Arch to USB).
Auto-Updating Catalog & Offline Use Shipped v1.2.1
A self-updating firmware and OS catalog keeps versions current without manual edits — a weekly CI job keeps the bundled OS catalog current in both cyber-controller and universal-flasher v1.4.0 — and the app self-updates too. Fully offline-capable: a cached catalog plus already-downloaded images flash with no internet connection at all — built for the field.
Wardriving — GPS-Tagged Logging Shipped v1.2.1
A dedicated Wardriving tab: GPS-tagged capture of Wi-Fi access points and stations exported to WiGLE CSV, wired into the shared target pool. Strictly for lawful, owner-authorized assessment of networks you are permitted to test — consistent with the dashboard's responsible-use posture.
Cyberdeck Main GUI Shipped v1.2.1
The primary front-end for cyberdeck builds — one all-in-one controller, flasher, logger and pentest dashboard driving every connected board from a single screen, across the Qt desktop, lightweight, TUI and web-remote modes.
In-App Tooltips & How-To Tab Shipped v1.2.1
Helpful tooltips on every control so each option explains itself, plus a dedicated How-To tab walking through flashing, OS-to-USB, and field setup step by step — lowering the bar for newcomers without slowing experts down.
Physical-Key Access Gate Shipped v1.2.1
Set it up right in the app — Settings → Access Gate lets you set an admin password, provision a USB stick as a physical key, and choose the policy (password-only, key-only, or both) from the GUI, backed by a salted-scrypt + encrypted vault. The keyed USB and/or password are then required before the app unlocks, covering the web remote as well as the desktop. Designed fail-closed; intended to deter casual access, not a funded forensic adversary.
Frozen-Build Hardening Shipped v1.2.1
Bundled-asset loads route through a single resource resolver so the packaged executable degrades gracefully instead of failing on a missing asset — the prior Windows one-click .exe startup crash is fixed and verified. Installer and code-signing work continues to reduce platform friction.
Contact
Open to collaboration, consulting, and interesting conversations.