WAVE SENTINEL

⚡ Install Firmware

🧠 WaveKai Cloud — Rolling Code Cracking

Cloud-backed rolling-code analysis service built specifically for WaveSentinel. Capture a hopping-code remote on the device, tap Crack, and the WaveKai server returns the manufacturer key, serial number, and current counter. Generate the next valid codes on demand for replay testing — all from the touchscreen, no laptop required.

• KeeLoq + Variants — 66 verified manufacturer keys covering BFT, Beninca, FAAC SLH, Genie, Hormann HSM, Linear, Mercedes-Benz, Mongoose, NICE, Subaru, DoorHan, Sommer, Stilmatic, Cenmax, Sheriff, Pantera, Tomahawk, Alligator, and more
• 130+ Protocols Auto-Detect — Full Momentum + Unleashed + Xtreme + RogueMaster coverage including Princeton, CAME 12/24, Nice FLO/Flor-S/One/Smilo, Gate TX, Linear/Linear Delta-3, KeeLoq (HCS200/300/301/362), Security+ v1/v2/2.0, Holtek HT12, Ansonic, Clemsa, Doitrand, BETT, Hörmann HSM & BiSecur, Somfy Telis & Keytis & RTS, BFT Mitto, FAAC SLH/RC,XT, Came Atomo, Star Line, Scher-Khan, Marantec, Phoenix V2, Alutech AT-4N, Genie Intellicode, Magellan, Power Smoke, Dickert MAHS, Visonic PowerCode, Honeywell WDB, KingGates Stylo 4K, Mastercode, Jarolift, Roger, Ditec GOL4, SMC5326, Nero Radio, Nord Ice, Gangqi, Allstar Firefly, Dooya, Legrand, X10, Acurite/Bresser/Oregon/LaCrosse weather, Schrader/Kia TPMS, and dozens more
• 4-Tier Score Discipline — Full decoder > protocol-specific detect > family fingerprint > raw fallback. The re-ranker suppresses detect-only hits whenever any full decoder fires above 80% confidence, so the top result is always the most specific match
• Auto-Crack Mode — Every capture is sent to the server automatically and the result lands on screen seconds later
• Rolling Code Generator — Compute the next N valid codes for any cracked remote and replay them on demand
• Built-In Account UI — Sign-up, login, token balance display, all from the device. Credentials persist in flash via NVS
• Save / Replay — Generated codes save back to SD as Flipper-compatible .sub files for offline replay
• Server-Side OTA — Pull firmware updates straight from the WaveKai server via the Account screen
• Token-Based Usage — Free signup tokens, monthly Pro plan, lifetime + token packs available

📡 Sub-GHz RF (CC1101)

Full-spectrum Sub-GHz radio powered by the CC1101 transceiver. Capture, replay, scan, and decode RF signals across the 300–928 MHz band.

• Read RAW — Dedicated CC1101 OOK async capture loop with IRAM ISR on GDO0, 4096-entry ring buffer, OOK 270 / OOK 650 / FSK 238 / FSK 476 preset chooser, live edge counter, fill bar, and pulsing "● CAPTURING" indicator. Saves Flipper-compatible RAW_Data .sub with the correct preset header
• BinRAW Decoder — On-device generic bitstream decoder. Pick any saved .sub, hit DECODE: returns detected Te (µs), encoding (PWM / PPM / Manchester / NRZ), bit count, hex, and the first 80 bits in a popup
• KeeLoq Clone — Capture any KeeLoq frame, decrypt with manufacturer key, increment counter, re-encrypt, and TX the next valid rolling code. Full Microchip HCS200/300/301 cipher (528 rounds, NLF 0x3A5C742E) implemented on the device
• Frequency Analyzer — Flipper-style FFT spectrum sweep with live RSSI bars, snap-to-preset detection with hit counters, threshold slider, and Geiger-style audio feedback whose pitch tracks signal strength. Hot-swap freq from the dropdown without stopping the scan
• Protocol Analyzer (Cloud) — Auto-identify across 130+ protocols against the WaveKai server in <500 ms
• Flipper Player Screen — Hand-coded SD browser: folder + .sub file dropdowns auto-populate from real directories, PLAY / STOP / READ RAW / DECODE / KEELOQ CLONE actions, status line, dirty-write auto-save
• CHAOS Tab — Tesla US (315 MHz) + Tesla EU (433.92 MHz) charge-port emulation, plus configurable Packet Generator for raw modulation testing
• World Mode Toggle — NVS-persisted region unlock. US default (315 / 433.92 / 915 MHz) or WORLD (full CC1101 300–928 MHz) selectable from the Settings screen
• Universal Remote — 35-button programmable remote (Numbers, Nav, Media). Assign any .sub file to any button. NVS-persisted last profile auto-loads on screen entry; auto-save on EDIT → DONE and on screen exit
• RCSwitch Types A–D — DIP switch, rotary/sliding, Intertechno, and REV remote control transmit
• Full CC1101 Config — Frequency, modulation (ASK/FSK/GFSK/MSK), bandwidth, deviation, data rate, TX power, sync mode, packet format
• Flipper .sub I/O — Load, save, and play Flipper Zero sub files. RAW captures write with the correct FuriHalSubGhz preset header (Ook270 / Ook650 / 2FSKDev238 / 2FSKDev476)

🔅 Infrared (IR) Transmit

Built-in IR LED transmitter for universal remote control of TVs, audio equipment, fans, projectors, and other consumer electronics. Modulated at standard 38 kHz carrier with configurable timing.

• Flipper .ir Files — Load and transmit Flipper Zero IR captures stored on the SD card
• Universal Remote (IR mode) — Same 35-button programmable layout as the RF remote — assign any IR signal to any button, save profiles to SD
• Brand Browser — Built-in catalog organized by manufacturer for quick device pairing
• Raw IR Transmit — Send arbitrary pulse sequences with configurable carrier frequency for non-standard protocols
• NEC / RC5 / RC6 / Sony — Standard consumer IR protocol support

📶 WiFi Tools

802.11 b/g/n network auditing suite using the ESP32-S3's native WiFi radio with raw frame injection and promiscuous capture. Full WiFi Mantis tool set (28 dedicated screens across the WiFi Mantis menu).

• Network Scanner / Join — Discover and connect to APs with on-screen keyboard, NVS-saved credentials
• AP & Station Scan — Active AP enumeration + promiscuous station discovery; tap to add to persisted Target List (NVS)
• EAPOL / PMKID Capture — Passive PMKID grab from WPA2 handshakes; saved hashcat-22000-format to SD
• Packet Count Graph — Live strip chart of mgmt / data / probe frame counts
• Signal Monitor — Per-AP RSSI bar chart from the latest scan
• Channel Analyzer — 1-14 channel utilization histogram with continuous sweep
• MAC Track — Follow one station's RSSI across channels, lv_chart over time
• Pwnagotchi Detect — Recognize other Pwnagotchi beacons by SSID prefix + vendor IE
• Raw Sniff — Most-permissive promiscuous capture; ring of 256 frame headers, SD-saved .bin
• Ping Scan — ICMP sweep of the local /24 with RTT per host
• Beacon Flood — Random / rickroll / funny SSIDs
• Probe Request Flood — Crafted probe frames cycling SSIDs + MACs
• Karma / AP Clone Spam — Capture probe SSIDs, then broadcast beacons advertising them
• Evil Portal — SoftAP + DNS hijack + captive HTML; logs creds to SD as JSON
• Deauth + Association Sleep Attack — L2 attacks: deauth flood, repeated assoc+deauth keeping clients in sleep loop
• Bad Msg + SAE Commit / Flood — Malformed action frames + WPA3 SAE-Commit (group 19) single shot or flood
• OTA Updates — Over-the-air firmware updates via built-in web server
• Local REST API — HTTP endpoints on port 80 for status, config, capture/replay, scanning, and remote OTA flash

🔌 Bluetooth Low Energy

BLE 5.0 toolset powered by the NimBLE stack for advertisement analysis and broadcast testing. Full BLE Mantis feature set (10 dedicated screens across the BLE Mantis menu).

• BLE Scanner — Discover nearby devices with name, MAC, RSSI, and configurable scan window
• AirTag Sniff — Passive Apple FindMy detection (mfg 0x004C + lost-mode subtype). Last 16 unique tags with RSSI / age / hit count
• AirTag Monitor — Lock onto a sniffed AirTag, plot RSSI ring buffer on lv_chart, distance estimate via path-loss formula
• AirTag Spoof — Broadcast counterfeit FindMy beacon (random pub key per ad, rotating NRPA MAC)
• Card Skimmer Detection — 26-name signature DB (HC-0x, JDY-xx, AT-09, MLT-BT05, DL16, etc.) flags suspicious BT modules
• Flock Sniff — Detect Mantis Flock social-broadcast packets (mfg 0xFFFF + "FLOCK" magic), decode ASCII payload
• Meta Detect — Identify Meta/Facebook devices via service UUID 0xFEF4 + vendor IDs + Quest/Oculus name prefixes
• BLE Analyzer Dashboard — Total ads, unique devices, 5-bucket RSSI histogram, connectable/name/mfg counts, per-vendor breakdown
• Sour Apple — Malformed Apple-continuity payloads (oversize subtype, garbage TLV) on rotating MACs — iOS BLE crash test
• SwiftPair Spam — Microsoft SwiftPair pairing-prompt flood (mfg 0x0006) with 8 rotating device names
• Spam+ — Samsung Buds Live / Buds Pro / Buds 2 / Galaxy Watch / Flipper Zero / Apple Watch variants
• NimBLE Stack — Low memory footprint (~15KB vs 70KB Bluedroid)

🎮 Hidden Goodies

A few non-essential extras that make the device feel alive when you're not actively cracking something.

• Wave Invaderz — Hold the rat icon on the main menu for 5 seconds to launch a classic-arcade Space Invaders clone with composite invader sprites (Squid / Crab / Octopus), bonus UFO crossings, score / lives HUD, wave progression, and synthesized 4-note marching audio that speeds up as the swarm thins
• Animated Lightning Strikes — Idle main menu fires randomized bolts (7–12 segment paths, 4 palette variants, partial-length flash variants, vertical / diagonal / cloud-to-cloud orientations). After 12 s of inactivity, each strike pairs with synthesized rolling thunder 500–1400 ms later
• Volume + Brightness Controls — Live sliders in Settings, NVS-persisted across reboots
• Rotate 180° — Settings button flips display orientation on the fly
• About Box — Firmware version, MAC, IP, uptime, and active region all in one screen
• Status Bar — Persistent WiFi 3-bar + battery icons drawn from primitives (no font-glyph dependency) — visible across every screen, transparent to touches

🖼 Hardware & Interface

• 3.5" Touchscreen — 480x320 capacitive IPS display, full touch-driven LVGL UI
• Persistent Status Bar — WiFi and battery icons visible across all screens
• microSD Card — Save/load RF captures, Flipper .sub files, remote profiles, and presets
• I2S Audio Feedback — Event tones for boot, scanner hits, captures, TX, cracks, and errors via dedicated I2S DAC; Geiger-style continuous pitch tracking while scanning
• TouchTunes Remote — Wireless jukebox control with full command set
• Dual-Core Architecture — Core 0 handles display, Core 1 handles RF/WiFi/BLE operations

🛒 What You Need

⚙ Hardware Specs

📌 Pin Mapping

🚀 Getting Started

1. Get the hardware — WT32-SC01-PLUS board, CC1101 module, microSD card, and a USB-C data cable
2. Wire the CC1101 — Connect MISO(11), MOSI(10), SCLK(14), CS(12), GDO0(13), VCC(3.3V), and GND
3. Flash the firmware — Use the Install button above (Chrome/Edge), or build from source with pio run --target upload
4. Insert SD card — FAT32 formatted, for saving captures and loading Flipper .sub files
5. Power on & tap — The splash screen shows the firmware version. Tap anywhere to enter the main menu

🛠 Build from Source

Requires PlatformIO (CLI or VS Code extension).

git clone https://github.com/OzInFl/WaveSentinel-refactored2.git
cd WaveSentinel-refactored2
pio run                      # Build
pio run --target upload      # Flash via USB