A pocket WiFi handshake hunter. BBoink turns a LilyGo, Waveshare or M5Stack board into a capture rig: it channel-hops, deauths eligible APs, grabs WPA 4-way handshakes + PMKIDs, and gets them cracked — in the cloud or on your own machine — then shows the recovered password right on the screen. One firmware, five boards.
New to this? A handshake / PMKID is the crackable proof a network was in range; a deauth briefly knocks a device off so it reconnects and reveals one. You then try to recover the password offline. Only do this to networks you own or are authorised to test — see the legal note below.
🌐 Site + live screenshots · ⚡ Web flasher · 📖 Getting started · 🧭 Reference
⚠️ BBoink transmits deauth frames to force handshakes. Use it only on networks you own or are explicitly authorized to test.
Five boards, one firmware. Buy links are the official vendor stores; the wiki/docs links are the manufacturer's own hardware documentation.
|
LilyGo T-Embed CC1101 / PLUS |
LilyGo T-Display C5 |
|
Waveshare ESP32-C5-LCD-1.47 |
M5Stack Cardputer ADV |
|
LilyGo T-Dongle S3 |
Open the web flasher in Chrome/Edge, plug
the board in over USB, pick your board + version, click Install — no esptool, no drivers.
(Or grab the .bin from Releases and flash
it by hand.)
Heads-up — T-Display C5: the browser flasher can fail with "Failed to initialize" (its ROM rejects esptool's stub loader). Flash that board on the command line instead —
esptool --chip esp32c5 --no-stub write_flash 0x0 bboink-tdisplay-c5.bin(see getting started). The T-Embed, Waveshare, Cardputer ADV and T-Dongle S3 flash fine in the browser.
Drive the board with its buttons + on-screen menu (T-Embed / T-Display), or entirely from your phone over Bluetooth — the BLE portal, a web page that needs nothing installed and is the only UI on the single-button boards (Waveshare / Cardputer ADV / T-Dongle S3). No access point, no web server on the device.
Hit CAPTURE and it channel-hops (2.4 and 5 GHz on the C5 boards), deauths eligible APs, and saves handshakes + PMKIDs — with live per-event stats. Networks are remembered in a registry, and you can mark any SSID never-attack.
Get the captures cracked — pick whatever suits you:
- Cloud — send them to a free cracking service (wpa-sec · OnlineHashCrack · PwnCrack). A key from any one is enough. Button boards can upload directly over WiFi; or your phone forwards them through a tiny relay you host (a small free web service you deploy in a few clicks — see Getting started; the only path on the single-button Waveshare / Cardputer ADV / T-Dongle S3).
- Local — no account, fully offline: Download hashes (.hc22000) from the BLE portal
and run
hashcat -m 22000 bboink.hc22000 <wordlist>on your own machine.
Cracked passwords are written back to the device and shown on the capture (with a WiFi join QR).
→ Getting-started guide — step-by-step per board (buttons vs BLE-only): flashing, deploying the optional relay, configuring keys, and the full capture → crack loop. Have a button board and just want it working? It's a short path with no relay and no phone.
All free — bring a key from any one, or skip the cloud and crack locally.
| Service | What BBoink does | |
|---|---|---|
| wpa-sec | uploads the .pcap, reads back cracked passwords |
wpa-sec.stanev.org |
| OnlineHashCrack | submits WPA 22000 hashes (GPU service) |
onlinehashcrack.com |
| PwnCrack | uploads hc22000, reads back cracked passwords |
pwncrack.org |
| Local (hashcat) | download .hc22000 from the BLE portal, crack offline |
hashcat -m 22000 |
→ Reference covers the details this overview skips: the on-device
menu + options, exact controls, the relay deploy, firmware updates / OTA,
capture file formats, storage, releases / CI, build from source, and
provenance. Design notes: docs/DESIGN-ble-bridge.md.
WiFi OTA works on every board with A/B partitions — including the single-button Cardputer ADV and T-Dongle S3 that have no on-device menu. From the BLE portal's Update tab, Update to latest flags a fetch and reboots; at a clean heap (WiFi alone, no BLE contention) the board writes the latest release into the spare OTA slot and boots it — progress on the LCD. (The 4 MB Waveshare C5-LCD is single-slot, so it has no OTA — update it over USB with the web flasher.)
Most boards can also switch firmware — hop to a sibling app over OTA into the spare slot, then switch back from its portal. A hidden action (tap the BBoink brand 3×) lists the targets for that board:
- T-Embed CC1101 · T-Dongle S3 · Cardputer ADV → hid-ble-poc (a USB/BLE HID tool) and bb-portal (a T&C captive portal).
- T-Display C5 → bb-portal only (the PoC has no ESP32-C5 build).
- Waveshare C5-LCD stays standalone — its 4 MB flash holds a single app slot, too small for A/B switching.
Same OTA machinery, byte-compatible slots. Each firmware advertises a distinct BLE address so the host's GATT cache doesn't collide across a switch.
Five PlatformIO envs from one codebase — t-embed-cc1101 (ESP32-S3), tdisplay-c5,
waveshare-c5-lcd (ESP32-C5), cardputer-adv (ESP32-S3), tdongle-s3 (ESP32-S3).
pio run -e <env>; per-board bits are gated with build_src_filter. Full build/flash notes
are in the reference.
Stuck, hit a bug, or have a question? Please open a GitHub issue — that's the place to ask for help: https://github.com/whitewhidow/bboink/issues. Include your board, firmware version, and what you tried.