skizzophrenic/SquachWatch-CYD

What it does

SquachWatch-CYD is a standalone firmware for ESP32-based touchscreen boards, centered on the 2.8" ESP32-2432S028R "Cheap Yellow Display". The board sniffs 2.4 GHz WiFi and Bluetooth LE for wireless signatures associated with Flock Safety ALPR cameras, Axon body cameras, camera glasses, Bluetooth card skimmers, AirTags and other trackers, Remote ID drones, Ring devices, deauthentication floods, evil-twin access points, and pentest hardware such as Flipper Zero and Pwnagotchi. It runs on the bare board over USB, with no PC required. A browser emulator lets you drive the actual UI before buying hardware.

The interface is a gamified vaporwave presentation: animated backgrounds, a mascot named Squachy, full-screen alert cards, a persistent detection log (about 1,800 sightings in flash), optional CSV logging to microSD, and extras such as desk mode, bingo, and a detection encyclopedia.

Supported hardware

The default target is the 2.8" CYD; many other ESP32 display boards are supported at varying maturity levels, including 3.2" and 3.5" CYD variants, Freenove ESP32-S3 panels, Elecrow CrowPanel 7.0, RockBase NM-CYD-C5 and Waveshare ESP32-C5 boards with 5 GHz scanning, LilyGo T-Deck Plus, M5Stack devices, and the LilyGo T-Watch S3/S3 Plus. Builds marked BETA have had less testing. The board table and per-board notes are the place to check before buying a variant.

Quick start

The shortest path is the browser flasher: open the web flasher, pick the board from the list (there is a box for the code printed on the back if unsure), plug the board in over USB, and click Connect & Install. It works in desktop Firefox, Chrome, Edge, or Brave. After flashing, the board boots into the main screen; the three soft buttons are [ SCAN ] for the idle view, [ LOG ] for the detection log, and [ DESK ] for desk mode. Detections raise full-screen alert cards that clear after 10 seconds or on tap.

To build from source instead, install PlatformIO, clone the repository, and run pio run -t upload from the project directory, or name a specific environment such as pio run -e freenove-s3 -t upload. A beginner walkthrough is in the build guide.

Detection confidence and limits

The firmware grades every signature by confidence, checked against the IEEE OUI registry; of 97 hardware prefixes, 33 are rated High, 4 Medium, and 60 Low. This matters most for Flock: only one of 49 prefixes is registered to Flock Safety, while the rest belong to generic chip and module vendors, so a nearby ESP32 can match. The ALERT FILTER setting can require High confidence before an alert takes over the screen. The project describes Flock, Axon, skimmer, and camera-glasses detection as reliable, Remote ID and iBeacon as exact-format matches, and Raven, generic ALPR, and the Google tracker network as best-effort. Per-signature provenance is documented separately.

Privacy, security, and operational notes

The board can scan without joining a network, but it joins a saved network briefly at boot for an update check and NTP time sync unless UPDATE CHECK is turned off. SquachMesh, the optional board-to-board feature, is off by default; TRANSMIT broadcasts a stable identifier that a scanner could use to reconstruct your presence, and the firmware presents a full-screen warning before it can be enabled. Device PIN, duress PIN, privacy mode for filming, and remote-update controls are available. Over-the-air updates are signed and each board rejects firmware not built for it. The project is licensed GPL-3.0.

HotRepo's take

On the C++ daily list for 2026-11-09, the repository recorded 492 stars and 82 forks, with 7 stars added that day and a best position of 13. That is one snapshot rather than a trend, but it places a niche, hardware-specific detector among the more visible C++ projects of that day. The more notable signal is the engineering depth behind the novelty: signature grading, a host test suite, a PC emulator compiled from the same source, and per-signature provenance documentation. The trade-off is that the most eye-catching UI sits on top of detections whose confidence varies widely by target, so the project's own confidence labels are the part worth reading before acting on an alert.

Project source and documentation