POSEIDON

★ FEATURED · STABILITY AND HEAP HARDENING

Rock solid: a deck that will not crash, leak, or look frozen

A pentest deck is only as good as the moment you actually need it. This pass is all about reliability: a full memory safety audit, a real heap budget so the radios stop starving each other on cold boot, and an active indicator on every screen you wait on so nothing ever reads as a hang.

✓ STABILITY AUDIT · MEMORY SAFETY AND LIFECYCLE PASS

Eleven real bugs, found and closed

Use after free, double free, unchecked allocations, and teardown races, the kind that reboot you mid capture. Hunted across the whole feature set and fixed at the root, not papered over.

$ stability audit · memory safety and lifecycle

memory safety and lifecycle bugs closed: 11

heap budget guard: ACTIVE cold boot WiFi scan ENOMEM: GONE

scan and wait screens that can look frozen: 0

RESULT: STABLE UNDER LOAD · NOTHING READS AS A HANG

Reliability, engineered in

Four fronts, one goal: a deck you can trust in the field.

Memory safety audit

Eleven memory safety and lifecycle bugs traced and fixed: use after free, double free, unchecked allocations, and teardown races that crashed features mid run. Closed at the source.

AUDIT

A real heap budget

The radios share a tight heap. A heap budget guard plus the removal of idle BSS and DMA hogs stopped the cold boot WiFi scan from dying on ENOMEM, so scans come up on the first try.

HEAP

Nothing looks frozen

Every scan, connect, and capture screen now animates while you wait: a live radar sweep and a moving count, or a labeled working frame where a radio call has to block. No more guessing whether it hung.

Proven on host tests

Portable logic carries native unit tests that run off device, so the safety fixes stay fixed. Green on the host before it ever reaches the metal.

TDD

The unglamorous work that separates a demo from a tool: it comes up, it stays up, and it always tells you what it is doing.

◐ WORK IN PROGRESS · KERBEROS

KERBEROS: a FIDO2 passkey, built from the protocol up

◐ Work in progress · functional and verified, still hardening toward release

Press k from the root menu and the Cardputer becomes a real hardware security key. Not a wrapper around a library — the U2F and CTAP2 stacks are hand written on the ESP32-S3. It registers and authenticates as a FIDO2 and U2F key over USB, creates on device passkeys, and signs in usernameless. Every signature it produces is checked against Yubico's own reference library.

✓ VERIFIED WITH python-fido2 · YUBICO'S REFERENCE IMPLEMENTATION

It actually works, and here is the receipt

Not "it looks like a key." Tested end to end against the industry reference implementation. Attestation and assertion signatures both verify. Non-resident and resident (discoverable) credentials both pass.

$ python fido2 · talk raw CTAP to the device

versions: ['U2F_V2', 'FIDO_2_0'] options: {rk: true, up: true}

non-resident assertion signature: VERIFIED

resident passkey · discoverable assertion: VERIFIED

RESULT: CTAP2 ALL PASS · passkeys work end to end

Hard systems, built by hand

One feature key on the Cardputer. The whole FIDO protocol underneath it, written from scratch.

The whole FIDO stack, by hand

U2F and CTAP2 implemented from scratch on the ESP32-S3: CBOR, COSE key encoding, ECDSA over NIST P256, attestation objects, authenticator data. No off the shelf FIDO library. Credential private keys never leave the device.

PROTOCOL

The dead transport, and the fix

It enumerated as a FIDO device but went silent. I put live packet counters on the Cardputer screen, traced the fault to the Arduino USB layer jamming the IN endpoint on its first reply, and fixed it by driving TinyUSB directly. That one bug was the line between a device that looks like a key and one that is a key.

DEBUGGING

Tested, not hoped

A portable protocol core carries native unit tests over the CBOR, COSE, and command logic. Then the real device is checked end to end against python-fido2. Green on the host, verified on the metal.

TDD

Why a Cardputer, not a YubiKey

A commercial key is a blind button. This one has a screen and a keyboard, so approval happens on the device itself, and it opens the door to showing you which site is asking and taking a PIN on device. Hardware a sealed key cannot match.

PLATFORM

Lives in src/features/kerberos* and lib/kerberos_core. Design, plan, and full test suite in the repo. Built and verified in a single day. It guards your own keys, on your own device.

★ FEATURED DROP · v0.6.3

Argus & the visual overhaul

The biggest single drop since 0.5.0. Argus finally has a real character — a 96x96 mood sprite that watches every handshake and shifts mood live. Six full themes (POSEIDON / MATRIX / E-INK / SYNTHWAVE / PHANTOM / BLOOD). Seven idle screensavers keyed off the active theme. Carousel menu style with cyberpunk pictographs. Ambient procedural motion painted behind every menu draw. The whole device feels alive.

Argus — the watchful gotchi

Twelve mood portraits (Watching, Pleased, Annoyed, Resigned, Calculating, Old Fury, Sleeping, Reflective…). Mood-mapped to hunt state — Argus sleeps when idle, gets pleased on catch, fully unhinged on Feral burst. Sprite is cached to internal SRAM to dodge MMU stalls during raw-TX.

v0.6 · CHARACTER

Six themes + carousel menu

POSEIDON, MATRIX, E-INK, SYNTHWAVE, PHANTOM, BLOOD. Magenta splashes across the dashboard chrome, matrix rain on a 4x speed-up, ambient procedural motion painted under every screen. Carousel menu style toggles in System — big-card single-focus with pictograph icons.

v0.6 · LOOK

Raw-IDF AP path

Bruce's pinned libnet80211.a crashes Arduino's WiFi.softAP() in ieee80211_hostap_attach +0x2c. New path bypasses Arduino entirely — esp_bt_controller_mem_release(BTDM) → raw netif → 4/16 buffer init → esp_wifi_set_config(WIFI_IF_AP) → post-start channel set. Portal, Beacon Spam, Evil Twin all back on-air.

v0.6 · WIFI

7 idle screensavers

Sonar sweep, port scan, hex cascade, terminal crack, neural arc, glitch BSOD, tide waves. Kicks in at 2 min idle, pulled from a pool keyed off the active theme. Pick your favorite at System → Screensaver.

v0.6 · IDLE

BLE cooperative tick

Sour Apple, Spam, Karma, Flood, FindMy refactored from xTaskCreate (silent rc=-1 because NimBLE eats 4 KB of heap) to cooperative ticks called from each feature's UI loop. Every nearby phone now sees the spam. Confirmed against iOS + Android.

v0.6 · BLE

C5 protocol v3 + terminator fix

TRIDENT C5 satellite jumps to wire protocol v3 — 9 new commands (clients hunt, beacon spam, probe sniff, deauth detect, karma, AP clone, spectrum, CIW). Critical fix: C5 now sends a zero-payload terminator when a scan finishes so POSEIDON stops spinning forever on empty results.

v0.6 · C5

Plus IR LED polarity finally fixed (active-HIGH, not active-LOW), Samsung remote codes verified against Flipper-IRDB, Evil Twin, AP Signal Test, BLE BlueDucky, SATCOM Tracker, Drone Remote ID, Surveillance Hunter, Defensive Monitor, and four nRF52 hat features. Full changelog on GitHub.

★ FEATURED DROP · v0.4

SaltyJack — the LAN arsenal

Press j from the root menu. Full wired/wireless LAN attack suite with a pirate UX — DHCP starvation, rogue DHCP (STA + AP), Responder (LLMNR/NBT-NS/SMB), WPAD PAC harvest, on-device NTLMv2 cracker. No PC tether. No Pi server. Pocket-sized.

★ BIG HOMAGE · SALTYJACK'S ORIGINAL ARCHITECT

@7h30th3r0n3

SaltyJack is a direct port, not inspiration. Every attack module — DHCP starve, rogue DHCP, Responder, WPAD, NTLMv2 cracker — is a reforge of the work 7h30th3r0n3 shipped first on the Pi (RaspyJack) and on Cardputer (Evil-M5Project / Evil-Cardputer). We reorganized the code into POSEIDON's style, added a pirate sprite pack, built a custom renderer. The attacks themselves — protocol framing, timing, pool-exhaustion detection, hashcat 5600 output path — that's all 7h30th3r0n3. Go star both repos. Seriously.

★ RaspyJack ★ Evil-M5Project Profile →

What's inside

Six modules behind one menu key. Phase 1 shipped in v0.3, phase 2 in v0.4.

DHCP Starvation

Floods the network's DHCP server with random-MAC Discover/Request cycles until the pool exhausts. Live counters. Auto-detects exhaustion on NAK ≥ 20.

PHASE 1

Rogue DHCP (STA + AP)

Races the real server with our own Offer/Ack (STA mode) or is the DHCP server for clients on our SoftAP (AP mode). Gateway + DNS poisoning for chained MitM.

PHASE 2

Responder

LLMNR + NBT-NS name-poisoning plus SMB1 NTLMv2 Type-2 builder. Captured hashes logged to SD in hashcat mode-5600 format. Feed directly to the on-device cracker.

PHASE 2

WPAD NTLM harvest

Serves PAC file on port 80 + HTTP 407 Proxy-Authenticate challenge. Windows clients auto-fetch WPAD, auto-auth with current domain creds.

PHASE 2

On-device NTLMv2 cracker

Pure-C HMAC-MD5 wordlist runner. Reads hashcat-5600 lines from SD, tries each password. No PC needed. Seeds a starter wordlist on first run.

PHASE 2

Custom UX

Own renderer — list / grid / carousel views, RaspyJack-faithful info pages, screensaver, 7-sprite pirate icon pack baked from PNG via tools/sprite_sheet_to_icons.py.

Every file in src/features/saltyjack/ opens with an attribution header crediting @7h30th3r0n3. Authorized testing only — hunt your own LAN.

★ FEATURED DROP · v0.4.1

WhisperPair — CVE probe for hundreds of millions of devices

Press W in the BLE menu. Scans for Google Fast Pair accessories — Sony XM5, Pixel Buds Pro, Jabra, JBL, Marshall, Nothing, OnePlus, Soundcore, Logitech — and probes each one for CVE-2025-36911. Vulnerable firmware responds to a Key-Based Pairing write even when it's not in pairing mode, silently letting an attacker take over the device in about ten seconds.

★ CREDIT · COSIC @ KU LEUVEN

The researchers who disclosed it

CVE-2025-36911 was disclosed by Preneel, Singelée, Antonijević, Duttagupta, and Wyns at COSIC, KU Leuven in January 2026. $15K Google bounty. POSEIDON's probe is a demonstration + self-check tool built on top of their published findings — stand on giants' shoulders, always.

★ Disclosure writeup whisperpair.eu →

What the probe does

Scan + classify

Active scan for Fast Pair service UUID 0xFE2C. Classifies each hit as pairable (spec-compliant) or in-use (shouldn't accept pairing — the vulnerable column). Model-ID lookup names the device on-screen.

STAGE 1

Real crypto probe

secp256r1 ephemeral keypair via mbedTLS (hardware accelerated on ESP32-S3). AES-128-ECB encrypts a valid Key-Based Pairing plaintext. 80-byte envelope lands on the target's KBP characteristic.

STAGE 2

Verdict + MAC lift

Response in 3 seconds = VULNERABLE. Silent drop = patched. When we have the accessory's anti-spoofing pubkey, we decrypt the response and extract the hidden BR/EDR MAC. Logged to /poseidon/whisperpair.csv.

STAGE 3

Probe-only. ESP32-S3 has no Classic Bluetooth radio so the full attack (bond + HFP mic capture + Find Hub registration) needs external hardware. Roadmap: nRF52 companion hat closes the loop. Authorized targets only — patches are rolling out unevenly, scan your own gear.

◆ COMING NEXT · v0.7 queued

What's landing next

The flagship in the pipeline turns the TRIDENT C5 into a through-wall sensing radar. Beyond it: a real nRF52840 BLE dongle, Thread/Matter recon, and the Hydra RF hat sweep. Everything below is planned, not promised.

★ FLAGSHIP · IN R&D · TRIDENT C5

Full C5 CSI Integration — see through walls

WiFi Channel State Information sensing on the ESP32-C5 turns the TRIDENT satellite into a passive radar. Ambient WiFi becomes a live presence + motion map — count bodies, track movement, even pick up breathing — through drywall, no camera, no contact. The C5 captures and processes CSI on-chip and streams a real-time heatmap to POSEIDON over ESP-NOW. This is the endgame for the satellite.

Through-wall presence

Subcarrier amplitude + phase shifts reveal bodies behind drywall — occupancy count, room-by-room, entry/exit events.

Motion + breathing

Micro-Doppler on the CSI stream catches movement and chest-rise — vital-sign sensing with nothing worn on the target.

Live on the Cardputer

The C5 does the DSP and streams a presence/motion heatmap to POSEIDON over ESP-NOW. No PC, no cloud — pocket radar.

nRF52840 companion — real BLE 5.0

USB-CDC nRF52840 dongle for full BLE 5.0 sniffing, LE Secure Connection attacks, Coded PHY S=8 long-range, and direction finding. The S3 can scan and spam BLE but can't MITM a real pairing — nRF52 closes that gap. The four nRF52 features (scan, scout-strike, MITM relay, WiFi+BLE combo) shipped in v0.6.0 against a Feather hat; v0.7 hardens the path with a dedicated dongle.

v0.7 · HEADLINE

On-device WPA2 cracker

Dual-core PBKDF2-SHA1 runner that eats .22000 files straight from SD. Seeded wordlist, custom dictionary support, resume-from-last-line. No PC tether. Listed here because testers keep asking and we have the hashcat-format captures already.

v0.7 · CRACK

Sub-GHz on the Hydra hat

Dedicated Hydra RF hat regression sweep — CC1101 RF / nRF24 mousejack / sub-GHz replay / Pocket SDR all queued for hardening once the hat is on the bench.

v0.6.3 · SUB-GHZ

Thread / Matter enumeration (via TRIDENT)

TRIDENT's 802.15.4 radio already sniffs Zigbee. Next step: passive Thread discovery, node enumeration, commissioning-invite detection, Matter bridge fingerprinting. Output to SD as structured JSON.

v0.7 · 802.15.4

MIMIR drop-box (aspirational)

Design sketch, not code. Future companion drop-box on a Banana Pi BPI-M4 Zero running hcxdumptool + WPA2 cracker + Bjorn-style action DAG. POSEIDON would act as the USB-C control client. No ETA, no implementation today.

future · IDEA

Full timeline on the roadmap page. Want to shape priorities? File a GitHub issue.

POSEIDON

Rock solid: a deck that will not crash, leak, or look frozen

Eleven real bugs, found and closed

Reliability, engineered in

Memory safety audit

A real heap budget

Nothing looks frozen

Proven on host tests

KERBEROS: a FIDO2 passkey, built from the protocol up

It actually works, and here is the receipt

Hard systems, built by hand

The whole FIDO stack, by hand

The dead transport, and the fix

Tested, not hoped

Why a Cardputer, not a YubiKey

Argus & the visual overhaul

Argus — the watchful gotchi

Six themes + carousel menu

Raw-IDF AP path

7 idle screensavers

BLE cooperative tick

C5 protocol v3 + terminator fix

SaltyJack — the LAN arsenal

@7h30th3r0n3

What's inside

DHCP Starvation

Rogue DHCP (STA + AP)

Responder

WPAD NTLM harvest

On-device NTLMv2 cracker

Custom UX

WhisperPair — CVE probe for hundreds of millions of devices

The researchers who disclosed it

What the probe does

Scan + classify

Real crypto probe

Verdict + MAC lift

What's landing next

Full C5 CSI Integration — see through walls

Through-wall presence

Motion + breathing

Live on the Cardputer

nRF52840 companion — real BLE 5.0

On-device WPA2 cracker

Sub-GHz on the Hydra hat

Thread / Matter enumeration (via TRIDENT)

MIMIR drop-box (aspirational)

Explore POSEIDON

Every Radio. Every Attack.

Four Hats. Every Frequency.

Where we've been. Where we're going.

Help us harden v0.6.

Shoulders of Giants.

The code itself.

Ready to Dive?