A $7 touchscreen, four plug-in radios, forty-odd modules, and a proprietary firmware that ships empty

Figure 1 — A hand-built HaleHound-CYD 3.5" complete unit. The external CC1101 and NRF24L01+PA+LNA radios and their antennas sit above the touchscreen; the PN532 and GPS add to the stack. Photo: H… — Figure 1 — A hand-built HaleHound-CYD 3.5" complete unit. The external CC1101 and NRF24L01+PA+LNA radios and their antennas sit above the touchscreen; the PN532 and GPS add to the stack. Photo: HaleHound.com.

1.1 About this Volume

This volume is the map for the rest of the HaleHound deep dive. It states what the device is, draws the line around what it is not, and explains the single fact that most changes how the project should be understood: the firmware is proprietary, not open source, even though it is free to flash. It then sets out the two hardware build paths, the radio complement, the liability gate that controls the offensive modules, and where the device belongs among the other handhelds on the bench. It closes with a decision tree — which build path and which of the 22 store SKUs fit which buyer — and a depth index pointing into Volumes 2 through 12.

Everything here is source-grounded against the HaleHound-CYD v4.0 firmware README and LICENSE (released 2026-10-15; the public repository was created 2026-02-17 and carries 1800+ stars), the vendor Shopify catalogue snapshot of 2026-10-16, and the Hack Tools buying dossier. Prices are quoted in USD as of 2026-10-16 and drift often — this is an active one-person catalogue. Nothing in this deep dive is written from a built unit; the voice is reference throughout.

Note — The product and the firmware are both spelled HaleHound, one word, authored by Jesse C. Hale (GitHub JesseCHale). The vendor’s community persona “Talking Sasquatch” (with a t) overlaps by coincidence with the separate SquachWatch project by skizzophrenic. They are different people and different firmwares — do not conflate the two. SquachWatch is covered in its own deep dive and is referenced here only for contrast.

1.2 What HaleHound is — and what it is not

HaleHound-CYD is a multi-protocol offensive-security toolkit that runs on a sub-$20 ESP32 touchscreen development board known in the maker community as the Cheap Yellow Display (CYD). The ESP32’s own 2.4 GHz radio supplies Wi-Fi and Bluetooth; four external modules plug into the CYD’s breakout headers to add sub-GHz, dedicated 2.4 GHz with a power amplifier, NFC/RFID, and GPS. The whole thing is driven from the resistive touchscreen — no companion phone, no laptop tether in the field, no buttons beyond the on-screen UI. The firmware advertises 40+ attack modules spanning Wi-Fi, Bluetooth, sub-GHz, 2.4 GHz, and NFC, plus defensive jam-detection, SIGINT/wardriving, and an anti-drone suite.

It is:

A standalone handheld. Everything runs on-device; loot is written to a microSD card.
A capability aggregator. One touchscreen fronts radios that would otherwise be a Flipper plus a Marauder board plus a Proxmark plus a GPS puck.
Cheap per capability. The bare board is $7–18; a complete hand-built unit is $235–245; the firmware itself is free.
Transmit-first. The README is blunt — “All radios transmit at maximum power. No training wheels.” This is not a passive scanner.

It is not:

Open source. The firmware is proprietary (§3). The binaries are free to flash but the source is not published.
A 5 GHz device. The ESP32-WROOM-32 is 2.4 GHz only. There is no Wi-Fi 6/6E path on this silicon; see Volume 10 for where the platform can and cannot go.
A software-defined radio. The CC1101 and NRF24 are fixed-function transceiver chips, not an SDR front end. For arbitrary-waveform capture across wide bands, that is a HackRF’s job (see Volume 11).
A legal shield. Maximum-power transmit on sub-GHz and 2.4 GHz bands, deauthentication, and jamming-class carriers are restricted or illegal in most jurisdictions outside a lab or an authorized engagement. The VALHALLA gate (§6) is a posture control, not a permission.

Warning — HaleHound’s default stance is full offensive transmit. Deauthentication floods, broadband 2.4 GHz carriers, and sub-GHz “scorch” modes interfere with legitimate communications and can violate 47 U.S.C. §333 and FCC Part 15 in the United States, with equivalents elsewhere. Operate only on hardware and networks you own or have explicit written authorization to test. The authorization envelope is treated as load-bearing throughout this deep dive and is collected in Volume 12.

1.2.1 The capability surface, at category level

The README advertises “40+ attack modules.” Following the posture this bench applies to the WiFi Pineapple, ESP32 Marauder, and Ducky Script deep dives, those capabilities are summarised here at category level — what class of thing each radio subsystem does and why — and not as a reproduced module-by-module menu or as step-by-step offensive procedure. Volume 8 covers the UI and the categories within that same ceiling.

Table 1 — 2.1 The capability surface, at category level

Subsystem	Radio	Capability category (what class of thing)
Wi-Fi	ESP32 2.4 GHz	Monitoring and frame capture; deauthentication; beacon/SSID flooding; evil-twin / captive-portal credential harvest; client enumeration
Bluetooth	ESP32 BLE	Advertisement flooding and pairing spam; GATT recon and honeypot; tracker detect/spoof; known-CVE probes against specific chipsets
2.4 GHz	NRF24+PA	Channel/spectrum analysis; promiscuous packet capture; wireless-peripheral keystroke injection; broadband carrier
Sub-GHz	CC1101	OOK capture/replay; automated code generation (brute force); spectrum analysis; `.sub` playback; fixed-payload transmit
NFC/RFID	PN532 (or Chameleon over BLE)	Card scan/read/clone/brute/emulate of MIFARE-class credentials; NTAG tooling
Drone	NRF24 + Wi-Fi	Passive Remote-ID detection and fingerprinting; Remote-ID beacon spoofing; targeted/broadband disruption
Jam-detect	all	Defensive — detect deauth floods, sub-GHz carrier jamming, broadband 2.4 GHz disruption
SIGINT	Wi-Fi + GPS	WPA handshake/PMKID capture; GPS-tagged wardriving; LAN recon; passive ALPR-camera detection; unified loot browser

The breadth is the product. No single subsystem rivals a purpose-built tool — the CC1101 is not a HackRF, the PN532 is not a Proxmark — but having all eight categories behind one touchscreen for the price of a mid-range Flipper accessory is what the device is for. Volume 11 draws each head-to-head.

1.3 The proprietary-firmware posture and the ESP32-DIV lineage

The licensing is the single most consequential fact about HaleHound and the one most often gotten wrong. The firmware is proprietary: Copyright (c) 2026 Jesse C. Hale. All rights reserved. The LICENSE grants free use — flashing and running on hardware you own, authorized testing, and sharing a link to the official repository — and prohibits redistributing the binaries through any channel other than the official repo or flash.halehound.com, reverse engineering or decompiling, creating derivative works from the binaries, reselling, mirroring, and removing branding. The LICENSE states plainly: “The source code for HaleHound-CYD is proprietary and not publicly available. The compiled firmware binaries in this repository are provided for end-user use only.”

HaleHound began as a fork of CiferTech’s ESP32-DIV, released under the MIT License in 2023. In accordance with MIT, the LICENSE preserves CiferTech’s 2023 copyright notice for the inherited portion, then draws the boundary: the original ESP32-DIV code has been “extensively rewritten, expanded, and refactored,” and “all HaleHound-CYD additions, modifications, and new features are the proprietary work of Jesse C. Hale.” The firmware also links a set of permissively- and LGPL-licensed libraries (ESP32 Arduino Core, RCSwitch, TinyGPSPlus, EspSoftwareSerial, LSatan’s SmartRC-CC1101 driver, Bodmer’s TFT_eSPI, ArduinoJson, Stoffregen’s XPT2046 driver, Adafruit PN532, ESP-IDF). The author records zero GPL-licensed code in the build and notes clean-room implementations for the NRF24 raw driver and the FFT (nrf24_raw.h, halehound_fft.h) written from public specifications. For the LGPL-2.1 components the LICENSE carries the standard three-year written offer to point users to the unmodified upstream sources.

  Firmware-licensing lineage and sibling posture
  ════════════════════════════════════════════════════════════════════
   CiferTech ESP32-DIV (2023, MIT)  ──fork──►  HaleHound-CYD (2026)
        │  open source                              │  PROPRIETARY
        │                                           │  free to flash,
        │                                           │  source NOT published
        ▼                                           ▼
   anyone may copy/modify/sell              binaries only, official
                                            channel only, no derivatives
  ────────────────────────────────────────────────────────────────────
   Sibling CYD/ESP32 firmwares for contrast:
     SquachWatch ....... GPL-3.0   (copyleft, source open)
     nyanBOX ........... MIT       (permissive, source open)
     ESP32-DIV ......... MIT       (the parent)
     HaleHound ......... PROPRIETARY (the outlier)
  ════════════════════════════════════════════════════════════════════

Table 2 — 3. The proprietary-firmware posture and the ESP32-DIV lineage

Project	Licence	Source published	Fork-friendly	Posture
HaleHound-CYD	Proprietary (© 2026 J. C. Hale)	No	No	Offensive
ESP32-DIV (parent)	MIT	Yes	Yes	Offensive/experimental
SquachWatch	GPL-3.0	Yes	Yes (copyleft)	Defensive / detection
nyanBOX	MIT	Yes	Yes	Multi-radio handheld

Practically, the closed source means three things for a buyer. First, the exact module behaviour cannot be audited line-by-line — trust rests on the author and the community. Second, there is no sanctioned way to patch, extend, or re-license it; a feature gap is a feature request, not a pull request. Third, updates arrive only as official binaries, delivered through the web flasher or OTA from SD (Volume 7). For a bench that already runs GPL and MIT firmware on the same silicon, this is a deliberate trade: HaleHound buys the widest capability-per-dollar at the cost of the openness its neighbours have.

Note — community credit. The README credits the project’s direction to its users: @CircuitZ (the IoT Recon idea), @ValleytechSolutions (the Jam Detect concept), BKBroiler (the NRF Tuning panel), and a wider group — @ValleytechSolutions, @TalkingSasquach, @Notorious-Squirrel, @Man-In-The-Mayhem, @hamspiced — credited with “the efforts and ideas that created the OPSEC of the HaleHound.” The Fire Weasel build path was designed by Midwest Gadgets, inspired by BkBroiler, with Hamspice. The closed source does not mean a closed process: the device is shaped through a Discord-and-email community even though the binaries are the only public artifact. This is worth keeping in view when weighing the proprietary posture — the trust model is community reputation, not code review.

1.4 The two build paths at a glance

The firmware is identical regardless of how the hardware is assembled. What differs is the carrier that holds the external radios and how much wiring the builder does. There are two sanctioned paths.

Classic — a bare “exposed-SPI” CYD plus a Cinder Ferret carrier board that holds the CC1101, NRF24, and (where fitted) GPS, joined by a wiring harness. More connections, more soldering, the lowest parts cost, and the most flexibility to mix modules. The Cinder Ferret has gone through revisions: V1, V2 (adds an on-board ATGM336H GPS with a 1.25 mm JST), and V2.2 “DOUBLE NRF” (dual NRF24 for full-spectrum 2.4 GHz work).

Fire Weasel — an integrated radio board that pre-places the sub-GHz and 2.4 GHz front ends, joined to the CYD by a short flat cable the vendor calls the “leash.” Designed by Midwest Gadgets, inspired by BkBroiler, with Hamspice — the goal was accessibility. The vendor quotes a ~45-minute build for someone with soldering experience. It is the premium, lower-friction path.

  CLASSIC                                   FIRE WEASEL
  ─────────────────────────────            ─────────────────────────────
   ┌───────────────┐                        ┌───────────────┐
   │  exposed-SPI  │                        │  exposed-SPI  │
   │      CYD      │                        │      CYD      │
   └───────┬───────┘                        └───────┬───────┘
           │ wiring harness                         │ "leash" (flat cable)
   ┌───────┴───────┐                        ┌───────┴───────┐
   │ Cinder Ferret │  holds CC1101,         │  Fire Weasel  │  radios
   │   carrier     │  NRF24, GPS            │     board     │  pre-placed
   └───────────────┘                        └───────────────┘
   more wiring, lower cost,                 ~45 min, premium,
   mix-and-match modules                    pre-integrated front ends

Figure 2 — The Fire Weasel integrated radio board with its "leash." The radios are pre-placed on the board; the leash carries the bus to the CYD. Photo: HaleHound.com.

Figure 3 — A Cinder Ferret V2 carrier board, the heart of the Classic build. It holds the CC1101 and NRF24 (and, from V2, an on-board GPS) and ships soldered with harnesses. Photo: HaleHound.com.

Volume 5 walks the Classic build end to end; Volume 6 does the same for Fire Weasel and covers the shared power section. The short version of the trade-off:

Table 3 — Volume 5 walks the Classic build end to end; Volume 6 does the same for Fire Weasel and covers the shared power section. The short version of the trade-off

Dimension	Classic (CYD + Cinder Ferret)	Fire Weasel (integrated + leash)
Build time (experienced)	Longer — harness + per-radio wiring	~45 min
Soldering load	Higher	Lower (board pre-placed)
All-in parts cost	Lowest	Higher
Flexibility	High — swap/add modules, dual-NRF option	Fixed front-end layout
Beginner-friendly	Less	More
Firmware/capability	Identical	Identical

For the full supported-hardware table — every board, both build paths, and their build targets in one place — see Vol 2, §5.0.

1.5 The radios at a glance

HaleHound stacks one built-in radio and four external modules. All external radios share the ESP32’s VSPI bus (GPIO 18/19/23) with the on-board SD card; an SPI manager in the firmware arbitrates so only one device talks at a time. The schematic-grade wiring, per-board chip-select differences, and the independent-power requirement for the amplified modules are the subject of Volume 3 — this is the one-screen summary.

Table 4 — 5. The radios at a glance

Radio	Role	Band	Interface	Required?
ESP32 Wi-Fi	802.11 b/g/n attacks & SIGINT	2.4 GHz	Built-in	Built-in
ESP32 BLE	Bluetooth LE attacks & recon	2.4 GHz	Built-in	Built-in
CC1101 (HW-863 or E07-433M20S)	Sub-GHz capture/replay/brute	300–439 MHz (firmware scope)	VSPI + GDO0/GDO2	Required
NRF24L01+PA+LNA	2.4 GHz flood, MouseJack, spectrum	2400–2525 MHz	VSPI + CSN/CE/IRQ	Required
PN532 V3 (Elechouse, SPI)	NFC/RFID card suite	13.56 MHz	VSPI + SS	Required for NFC; no longer bundled on most SKUs
GPS (GT-U7 / NEO-6M / ATGM336H)	Wardriving, geotag, satellite view	GNSS	UART0 (GPIO 1)	Required for GPS features

Note — The store copy describes the CC1101 as covering “300–928 MHz.” The v4.0 firmware scopes its sub-GHz features to 300–439 MHz. The chip can be tuned to the higher ISM bands, but the shipped feature set — the hunts, brute-forcers, and Tesla-charge payloads — targets the 300–439 MHz range. Treat 300–439 MHz as the operational figure and the store’s 300–928 MHz as the chip’s theoretical envelope. Volume 3 resolves this in detail.

Transmit power is deliberately maximised on every attack radio:

Table 5 — Transmit power is deliberately maximised on every attack radio

Radio	TX power
Wi-Fi (ESP32)	+20.5 dBm
NRF24+PA+LNA	+20 dBm
CC1101	+12 dBm stock / +20 dBm with E07 PA
BLE (ESP32)	+9 dBm

  TX power (dBm) — attack radios at maximum
  Wi-Fi  +20.5  ███████████████████████████████████████████  ~112 mW
  NRF24  +20.0  ██████████████████████████████████████████   100 mW
  CC1101 +20.0  ██████████████████████████████████████████   100 mW (E07 PA)
  CC1101 +12.0  █████████████████████████                     ~16 mW (stock)
  BLE    +9.0   ███████████████████                           ~8 mW

Warning — The two amplified Ebyte modules — the E07-433M20S sub-GHz PA and the E01-2G4M27SX NRF24 PA — draw more current than the CYD’s on-board 3.3 V regulator can supply. They must be powered from a separate 5 V→3.3 V buck converter; sharing the CYD 3.3 V rail causes brownouts, random resets, and failed radio init. Only the VCC pin gets the independent supply — the signal wires still go to ESP32 GPIO, and all grounds tie together. This is the single most common first-build failure. Volume 3 §(power) and Volume 6 cover it.

1.6 VALHALLA gating and Blue Team mode

Every offensive module is held behind a liability gate the firmware calls the VALHALLA Protocol. On launch of an offensive tool the user is shown a disclaimer. Accepting unlocks the offensive modules. Declining drops the device into Blue Team mode — defensive and passive modules only (the jam-detect suite, passive scanning, GPS, detection functions). Blue Team mode persists across reboots, and the home screen carries a VALHALLA/BLUE TEAM banner showing the current mode.

   Power on
      │
      ▼
   ┌──────────────────────────┐
   │  VALHALLA disclaimer      │
   └──────────┬───────────────┘
      accept  │   decline
      ┌───────┴────────┐
      ▼                ▼
  ┌─────────┐     ┌──────────────────────────┐
  │ Offensive│     │  BLUE TEAM MODE          │
  │ + defensive    │  defensive/passive only  │
  │ unlocked │     │  persists across reboots │
  └─────────┘     └──────────────────────────┘

This matters for how the device is documented. Following the posture of the WiFi Pineapple, ESP32 Marauder, and Ducky Script deep dives on this bench, HaleHound’s capabilities are described at category level — what class of thing each subsystem does and why — and not as a reproduced module-by-module menu tree or as step-by-step offensive procedures. Volume 8 covers the categories, the UI, the VALHALLA gate, and the SD loot layout within that ceiling. An optional 4-digit boot PIN (Settings) adds a second, physical-access control on top of VALHALLA.

1.7 Where it sits on the bench

HaleHound’s natural neighbours are the other ESP32/CYD-class handhelds and the purpose-built RF tools. Its distinguishing move is breadth on one cheap touchscreen: it is not the best at any single band, but it fronts more bands from one UI than anything near its price. The headline contrast is with SquachWatch — same CYD platform, opposite posture: SquachWatch detects surveillance and attack gear, HaleHound is the attack gear (with a defensive Blue Team fallback).

Table 6 — 7. Where it sits on the bench

Device	Platform	Posture	Bands covered	Source
HaleHound-CYD	ESP32 CYD + 4 ext. radios	Offensive (+ Blue Team)	Wi-Fi, BLE, sub-GHz, 2.4 GHz, NFC, GPS	Proprietary
SquachWatch	ESP32 CYD	Defensive / detection	Wi-Fi, BLE (detection)	GPL-3.0
Nyan Box	ESP32-WROOM + 3× NRF24	Multi-radio / education	2.4 GHz, Wi-Fi/BLE	MIT
ESP32 Marauder	ESP32 (various boards)	Offensive Wi-Fi/BLE	Wi-Fi, BLE	GPL
Wired Hatters Banshee	Dual-MCU ESP32 (C5+S3)	Offensive multi-modal	Wi-Fi (incl. 5 GHz), BLE, 2.4 GHz, IR	Runs GhostESP
Chameleon Ultra	nRF52840	NFC/RFID emulate/clone	13.56 MHz + 125 kHz	GPL-3.0

Three quick read-offs from that table, expanded in Volume 11:

vs SquachWatch — buy both. They are mirror images on identical hardware; one finds the trackers and ALPR cameras, the other transmits.
vs ESP32 Marauder / Banshee — HaleHound trades Marauder’s open-source auditability and Banshee’s 5 GHz reach for one unified touchscreen across five bands including sub-GHz and NFC, which neither of those covers.
vs Flipper / HackRF / Proxmark — HaleHound is the generalist; those are the specialists. HaleHound can even drive a Chameleon Ultra over BLE for NFC work, acknowledging where its own PN532 stops.

1.7.1 Capability-per-dollar, and where it is thin

The reason to reach for HaleHound is coverage breadth against spend. A rough positioning — not a benchmark, a map — against the cost of equivalent single-purpose coverage:

  Bands fronted from one UI, by device (more bars = broader)
  HaleHound   ██████████  Wi-Fi · BLE · sub-GHz · 2.4 GHz · NFC · GPS
  Banshee     ████████    Wi-Fi (incl 5 GHz) · BLE · 2.4 GHz · IR
  Marauder    ████        Wi-Fi · BLE
  Flipper     ███████     sub-GHz · NFC · RFID · IR · GPIO (no Wi-Fi/BLE native)
  HackRF      ██████████  1 MHz–6 GHz SDR (but no touchscreen app surface)
  Proxmark    ███         13.56 MHz + 125 kHz RFID/NFC (deepest NFC)
  SquachWatch ████        Wi-Fi · BLE (detection only)

Where HaleHound is genuinely thin: no 5 GHz (ESP32 silicon ceiling), no SDR-grade capture (fixed-function transceivers), NFC depth below a Proxmark (which is why the firmware can hand NFC off to a Chameleon Ultra), and no auditability (closed source). Everything else it covers adequately, and nothing near its price covers as much. The works-with relationships — driving a Chameleon over BLE, sharing the SquachWatch platform, overlapping Marauder’s Wi-Fi/BLE — are mapped in Volume 11.

1.8 Decision tree — which path, which SKU

The Shopify catalogue carries 22 SKUs. They group into complete builds, DIY kits, Fire Weasel parts, Cinder Ferret carriers, bare CYD boards, cases, and accessories; Volume 4 breaks every one down with real part numbers and all-in costs. The decision tree below picks the path; the SKU table narrows it.

  START
    │
    ├─ Want it built, tested, ready to flash?
    │     └─ YES ─► COMPLETE BUILD (4" $245 / 3.5" $235) — solder battery, flash, go
    │
    ├─ Will build it, want lowest friction?
    │     └─ Fire Weasel path ─► 4" DIY Fire Weasel kit $198
    │                            or Fire Weasel + leash PRO DIY $185
    │                            or just board+leash $48 (bring your own CYD)
    │
    ├─ Will build it, want lowest cost / most flexibility?
    │     └─ Classic path ─► DIY 3.5" kit $149 / DIY 2.8" kit $139
    │                        or bare CYD $15.85–18 + Cinder Ferret $30–40 + parts
    │
    └─ Just experimenting / already own a CYD?
          └─ Bare 2.8" E32R28T exposed-SPI CYD $15.85, flash free, add radios later

Table 7 — 8. Decision tree — which path, which SKU

SKU	Path	Price (2026-10-16)	For whom
4in Complete Build	Complete	$245	Wants it done; solder battery + flash only
3.5” Complete Unit	Complete	$235	Same, larger screen
Fire Weasel 4in DIY kit	Fire Weasel	$198	Low-friction builder, full kit
Fire Weasel + leash PRO DIY	Fire Weasel	$185	Low-friction builder, 3.5” PRO kit
DIY 3.5” kit	Classic	$149	Cost/flexibility builder, 3.5”
DIY 2.8” kit	Classic	$139	Cost/flexibility builder, 2.8”
Fire Weasel board + leash (DIY)	Fire Weasel part	$48	Already have a CYD
Cinder Ferret V2.2 double-NRF	Classic carrier	$40	Full-spectrum 2.4 GHz builder
Cinder Ferret V2	Classic carrier	$40	Classic carrier with on-board GPS
Cinder Ferret (V1)	Classic carrier	$30	Budget Classic carrier
3.5” exposed-SPI CYD	Bare board	$18	Bring-your-own-radios 3.5”
2.8” E32R28T exposed-SPI CYD	Bare board	$15.85	Cheapest entry; experiment
Cases (2.8”/3.5”/Fire Weasel/Sasquatch)	Enclosure	$30–45	Finish the build
Weasel leash replacement	Accessory	$8	Spare leash

Tip — The cheapest honest entry to the whole project is a $15.85 bare E32R28T CYD plus the free firmware — flash it at flash.halehound.com and the UI, Wi-Fi, and BLE work with zero external radios. The sub-GHz, 2.4 GHz-NRF24, NFC, and GPS modules light up as those modules are added. A buyer can start at the price of lunch and grow the device one radio at a time.

Two SKU caveats carried forward into Volume 4: no SKU includes firmware, a battery, or antennas, and the PN532 is no longer bundled in most DIY kits (the DIY kit copy says so in capital letters). Budget those four separately.

1.8.1 Ordering reality

Three operational facts about buying one, from the store copy, that shape expectations:

Lead time. Complete builds are hand-made to order; the store quotes roughly 5.5 weeks after order, “sometimes faster.” These are not off-the-shelf items.
Signature on delivery. Every order over $100 ships signature-required with tracking — the vendor cites repeated fraudulent chargebacks as a one-person shop. Someone must be home to sign.
Sold as-is, no returns. Units are sold AS-IS with no warranty; all sales final, each tested before shipping. The purchase terms also assert the buyer is 18+, assumes all responsibility for use, and agrees to the authorization/indemnity language reproduced in Volume 12.

  First-order timeline (complete build)
   order ──► hand-build queue (~5.5 wk) ──► ship (signature req.) ──►
   solder battery ──► flash at flash.halehound.com ──► first boot ──► go

Against that, the bare-board and carrier SKUs ship fast (they are stock parts) — another argument for the scratch/upgrade path when time matters more than a finished unit.

1.9 Depth index into Volumes 2–12

Table 8 — 9. Depth index into Volumes 2–12

Vol	Title	What it answers
2	The CYD platform & hardware	The ESP32-2432S028R family, the four supported boards, display controllers, exposed-SPI variants, USB connectors, SD/VSPI bus, power rails, cases
3	The radios	CC1101, NRF24, PN532, GPS — full pinouts, per-board CS differences, the independent 3.3 V buck, VSPI arbitration, schematic-grade
4	Parts & sourcing	The complete BOM with real part numbers + prices, the 22 SKUs grouped, what’s not in the box, buy-vs-source decision matrix
5	Full build — Classic	Exposed-SPI CYD + Cinder Ferret + harness, step by step to a verified unit
6	Full build — Fire Weasel	The ~45-minute integrated build, shared power section, first-power checklist
7	Flashing	Web Serial flasher, CH340 driver per-OS, first-boot calibration, OTA, recovery
8	Capabilities & UI	Capability categories (category level only), touch UI, VALHALLA/Blue Team, SD loot layout, TX power
9	Use cases	Authorized red-team, RF survey, wardriving, NFC audit, drone awareness, Blue Team scenarios, field OPSEC
10	Updates, upgrades & ecosystem	v4.0 cadence, OTA path, hardware upgrades, the ESP32-DIV parent and the wider CYD-firmware fork landscape, the 5 GHz gap
11	Comparison & where it fits	Head-to-head vs SquachWatch, Nyan Box, Marauder, Flipper, Banshee, Chameleon Ultra; works-with map; decision matrix
12	Cheatsheet / legal / glossary	Laminate-ready field cards, the legal/authorization envelope, glossary

1.9.1 Who it is for — and who should look elsewhere

Table 9 — 9.1 Who it is for — and who should look elsewhere

Buyer profile	HaleHound fit	Reason
RF generalist wanting one touchscreen across five bands	Strong	Nothing near the price covers as much
Authorized red-teamer needing a cheap, pocketable multi-tool	Strong	Standalone, loot-to-SD, Blue Team fallback
Buyer who wants to audit or extend the firmware	Poor	Proprietary; no source, no derivatives
5 GHz / Wi-Fi 6 work	No	ESP32 silicon is 2.4 GHz only
SDR-grade capture across wide bands	No	Fixed-function transceivers, not an SDR
Deepest-possible NFC/RFID	Partial	PN532-class; hand off to Chameleon/Proxmark for depth
Defensive-only / detection buyer	Partial	Blue Team mode works, but SquachWatch is the purpose-built detector

1.9.2 Firmware context — v4.0

The deep dive is pinned to v4.0, released 2026-10-15. The public repository was created 2026-02-17 and has drawn 1800+ stars in the intervening months — a fast-moving, actively-developed project for a one-person proprietary firmware. Because the source is closed, the version number on the device is the only handle on what it can do; the About screen reports the firmware version and an “armed module list.” Updates arrive as whole binaries through the web flasher or OTA from SD (Volume 7), and the release cadence and the wider fork landscape it sits in are Volume 10’s subject.

The thread that runs through all twelve: cheap, broad, transmit-first, closed-source, and gated behind a disclaimer that is a posture, not a licence to transmit. Volume 2 starts at the board.

HaleHound Volume 1 — Overview & Decision Tree