OUI-SPY · Volume 3
OUI-SPY Volume 3 — Hardware
3.1 About this Volume
This is the hardware volume: what OUI-SPY runs on, why that board was chosen, how it is wired, and — the canonical answer to the most practical question in the whole series — what can I flash this firmware onto? That last question is answered by the “Where this firmware runs” supported-hardware table in Section 6, which Volume 1 points down to and which this volume keeps current.
The default and reference target is the Seeed Studio XIAO ESP32-S3. The volume walks it top to bottom (SoC, memory, radio, USB, antenna), lays out the pinout and the specific GPIO pins the firmware uses, then covers the finished retail boards, the supported alternatives (and their caveats), the buzzer/LED/antenna/enclosure choices, and finally a build-your-own bill of materials with a realistic cost.
Voice note. No board here has been built or bench-measured on this bench.
Where a build log or a field photo would belong, a JEFF'S STORY GOES HERE marker
and a FIGURE SLOT flag the gap. Specifications are from Seeed’s published XIAO
ESP32-S3 datasheet and the OUI-SPY READMEs as of 2026-10-16; anything not
confirmable is marked.
3.2 Why the XIAO ESP32-S3 is the default
OUI-SPY deliberately does not target a touchscreen board. SquachWatch and HaleHound build on the ESP32-2432S028R “Cheap Yellow Display”; OUI-SPY goes the other direction — the smallest, cheapest competent ESP32-S3 board it can, with no screen at all. The rationale is a direct expression of the project’s “depth + minimalism” thesis:
- Cost. A XIAO ESP32-S3 is about US$7.49. The whole instrument — board, piezo, cable — lands near the cost of a sandwich. Cheap enough to leave one in a car, mail one to a friend, or lose one without regret.
- Size. At roughly 21 × 17.8 mm it is thumbnail-sized. That is what makes the Earrings variant (Section 5) and keychain/travel cases physically possible, and what makes the detector easy to conceal or forget about.
- The radio is the point, not the screen. The ESP32-S3 gives 2.4 GHz Wi-Fi b/g/n and BLE 5.0 — exactly the two receivers the signature engine needs — and the XIAO exposes a U.FL external-antenna connector, which matters enormously for the Foxhunter’s direction-finding (a directional/Yagi antenna, Volume 8).
- Memory headroom. The S3R8 part carries 8 MB flash + 8 MB PSRAM. The PSRAM is what lets the packet-capture firmware buffer pcaps in RAM, and gives the web-dashboard and signature tables room to breathe.
- Native USB-C. The S3’s native USB means a single data-USB-C cable both flashes the board (browser web-flasher, Volume 10) and carries JSON detections to the host Flask app over USB-CDC serial (Volume 6).
Set against the touchscreen detectors, the trade is stark and deliberate:
Table 1 — Set against the touchscreen detectors, the trade is stark and deliberate
| Axis | XIAO ESP32-S3 (OUI-SPY) | ESP32-2432S028R “CYD” (SquachWatch / HaleHound) |
|---|---|---|
| Price | ~US$7.49 | ~US$13–15 |
| Size | ~21 × 17.8 mm (thumbnail) | ~2.8″/3.5″ board + screen |
| Display | none (buzzer + LED) | color resistive touchscreen |
| External antenna | U.FL (DF-capable) | typically none |
| PSRAM | 8 MB | 0–8 MB (varies by CYD rev) |
| On-board UX | audible tier tones | full graphical HUD |
| Concealability | high (earring/keychain) | low (visible screen) |
The XIAO wins on cost, size, concealability and the U.FL direction-finding path; the CYD wins on at-a-glance readability. OUI-SPY picks the former on purpose.
The cost of going headless is that the board itself cannot show you anything — the alert is a buzzer tone and an LED blink, and any map or log lives on a host or a tiny on-device web page. For a single-purpose passive detector, the project treats that as a feature.
3.3 The XIAO ESP32-S3 in depth
The reference board is the Seeed Studio XIAO ESP32-S3, Seeed SKU 113991114. The core specifications:
Table 2 — The core specifications
| Parameter | Value |
|---|---|
| Module / SoC | ESP32-S3R8 (dual-core Xtensa LX7) |
| Clock | up to 240 MHz |
| SRAM | 512 KB on-die |
| Flash | 8 MB (external) |
| PSRAM | 8 MB (external, OPI) |
| Wi-Fi | 2.4 GHz 802.11 b/g/n |
| Bluetooth | BLE 5.0 (Bluetooth LE) |
| USB | native USB-C (USB-OTG / CDC / JTAG) |
| Antenna | onboard ceramic chip antenna + U.FL external connector |
| Battery | Li-ion charge pads on the underside (B+ / B−) |
| GPIO | 11 usable GPIO on a 14-pin header (2 × 7) |
| Dimensions | ~21 × 17.8 mm (thumbnail) |
| Price | ~US$7.49 |
Reading the spec against the mission:
- Dual-core LX7 at 240 MHz is comfortable headroom for running a promiscuous Wi-Fi receiver and a NimBLE BLE scan concurrently while the signature engine evaluates every frame against the tier gates (Volumes 4–5). One core can carry the radio callbacks; the other, the matching and the optional web server.
- 8 MB PSRAM is the quiet enabler. The signature tables, the 100-device NVS
history (detector firmware), and — critically — the in-RAM pcap buffer of
the capture firmwares all rely on having real RAM beyond the 512 KB on-die
SRAM.
ouispy-pcapdownloading a capture “from PSRAM” is only possible because the S3R8 has it. - The dual-antenna arrangement is the headline feature for this use. The onboard ceramic antenna is fine for omnidirectional detection; the U.FL connector lets a builder snap on an external whip for range, or a directional/Yagi for the Foxhunter to turn RSSI into a bearing. A board without U.FL (many ESP32 dev boards) forecloses serious direction-finding.
- Native USB-C removes the USB-to-UART bridge entirely — the S3 is the USB device. That is why the browser web-flasher (Web Serial) works with no driver, and why USB-CDC can stream JSON to the Flask companion over the same cable that powers the board.
- Li-ion charge pads mean a small LiPo turns the detector battery-powered and portable — the basis of the Earrings’ 100 mAh pack and of any pocket/keychain build.
[FIGURE SLOT — Vol 3 §3] A labelled close-up of the XIAO ESP32-S3 top and bottom: the U.FL connector and ceramic antenna on top, the B+/B− LiPo charge pads on the bottom, and the 2 × 7 castellated/through-hole header.
3.4 Pinout and the pins OUI-SPY uses
The XIAO exposes a small, fixed header. OUI-SPY uses only a handful of pins — the buzzer, an LED, the BOOT button, and a serial mirror — leaving the rest free. The table is the authoritative “which pin does what” for a build-your-own unit.
Table 3 — 4. Pinout and the pins OUI-SPY uses
| Pin / GPIO | OUI-SPY use | Notes |
|---|---|---|
| GPIO3 | Passive piezo buzzer | The primary alert channel; optional 100 Ω series resistor |
| GPIO21 | Onboard LED | active-low (drive low to light) |
| GPIO4 | NeoPixel (optional) | WS2812-style addressable RGB, alternative/added status light |
| GPIO0 | BOOT button | Hold ~1.5 s to return to the mode selector (Unified Blue); also enters bootloader |
| GPIO43 | Serial1 TX mirror | Mirrors serial out for an external monitor/logger |
| USB-C | Flash + USB-CDC | Web-flasher and host JSON stream share this |
| B+ / B− pads | LiPo | Optional battery; charge managed on-board |
Seeed XIAO ESP32-S3 — header + the pins OUI-SPY drives
════════════════════════════════════════════════════════════════
┌──────────── USB-C (flash + USB-CDC JSON) ───────────┐
│ │
┌────┴─────────────────────────────────────────────────────┴────┐
│ [ ] 5V 3V3 [ ] │
│ [ ] GND Seeed XIAO ESP32-S3 GND [ ] │
│ [ ] 3V3 ESP32-S3R8 · 8MB/8MB (NC) [ ] │
│... (11 usable GPIO on the 2×7 header)... │
└────────────────────────────────────────────────────────────────┘
│ GPIO3 ──[ ~100Ω ]──►|■ passive piezo |──► GND (alert tone)
│ GPIO21 ──────────────► onboard LED (active-LOW) (status)
│ GPIO4 ──────────────► NeoPixel DIN (optional RGB)
│ GPIO0 ◄───── BOOT button (hold 1.5 s → mode selector)
│ GPIO43 ──────────────► Serial1 TX mirror (ext monitor)
│ B+/B− ◄───── optional LiPo (100 mAh in Earrings)
U.FL ●──────────────► external antenna (whip for range / Yagi for DF)
chip ▭ onboard ceramic antenna (omnidirectional, default)
════════════════════════════════════════════════════════════════
(Header silkscreen simplified; consult the Seeed pinout for exact
positions. The DF antenna path is the reason U.FL is load-bearing.)The GPIO3 passive piezo is the heart of the headless UX. A passive piezo (not a self-driving active buzzer) is required because the firmware generates the tones itself — the five confidence tiers map to five distinct tone/cadence patterns (two-note sweeps for the high Wi-Fi tiers, single blips at descending frequencies for the lower tiers), and the Foxhunter and axeoff modulate cadence with RSSI. That only works if the MCU controls the waveform, which a passive element allows and an active buzzer does not. The full tier→tone map is Volume 6; the Foxhunter cadence bands are Volume 8.
3.5 The finished OUI-SPY board and the Earrings variant
Not everyone wants to solder a piezo to a XIAO. The author sells finished, pre-flashed boards at colonelpanic.tech, in two published forms:
- The OUI-SPY board — a finished detector built on the reference hardware, ready to run out of the box. Its retail price is not published on the captured store page, so this series quotes no figure; the build-your-own BOM in Section 9 (~US$7.50 of parts) is the honest floor on the hardware cost.
- The OUI-SPY Earrings — a wearable variant: a 100 mAh LiPo on the XIAO’s charge pads, and no buzzer. Dropping the buzzer is a form-factor necessity (an audible piezo in an earring is impractical), so the Earrings’ alert channel is the LED / NeoPixel plus the optional web dashboard rather than the tiered tones. It trades the audible tier-encoding for wearability.
Both finished forms are functionally the reference XIAO build; the difference from a home build is assembly, a case/form, and pre-flashing. Nothing about the finished boards changes the supported-hardware story below — they are the XIAO ESP32-S3 target.
[FIGURE SLOT — Vol 3 §5] Store photos of the finished OUI-SPY board and the Earrings variant from colonelpanic.tech, side by side with a bare XIAO + piezo home build, to show the three physical forms of the same instrument.
3.6 Where this firmware runs — supported hardware
This is the canonical “what can I flash this on” table. It lists one row per supported board and per distinct build/variant, because different builds are genuinely different targets with different feature levels. The XIAO ESP32-S3 is the default; everything else is an alternative with caveats. Columns: the board, its SoC, the build target or variant, the feature level / notes, and where to get the board.
Table 4 — 6. Where this firmware runs — supported hardware
| Board / device | SoC | Build target / variant | Feature level / notes | Where to get it |
|---|---|---|---|---|
| Seeed XIAO ESP32-S3 (default) | ESP32-S3R8 (LX7, 8 MB flash / 8 MB PSRAM) | seeed_xiao_esp32s3 (PlatformIO); all Blue firmwares | Full: Wi-Fi+BLE, GPIO3 buzzer, U.FL antenna for DF, PSRAM for pcap. The reference target. | Seeed Studio XIAO ESP32-S3 (SKU 113991114, ~US$7.49) |
| Seeed XIAO ESP32-S3 | ESP32-S3R8 | Sky-Spy build | Full drone Remote ID receive (Wi-Fi + BLE RID). | as above |
| Seeed XIAO ESP32-C6 | ESP32-C6 (RISC-V, Wi-Fi 6) | Sky-Spy alternative | Wi-Fi 6 radio; Sky-Spy alt target. 2.4 GHz only. | Seeed Studio XIAO ESP32-C6 |
| Seeed XIAO ESP32-C5 | ESP32-C5 (RISC-V, dual-band) | Sky-Spy xiao-c5-5g | Dual-band 2.4 + 5 GHz — catches 5 GHz drone RID the 2.4-only boards miss. | Seeed Studio (XIAO ESP32-C5) |
| Generic ESP32-S3 dev board | ESP32-S3 | seeed_xiao_esp32s3 base, external buzzer on GPIO3 | Works, but wire an external passive piezo to GPIO3; U.FL/antenna varies by board. | any ESP32-S3 dev board vendor |
| LilyGO T-Dongle-S3 | ESP32-S3 (+ ST7735 TFT, APA102 LED) | flock-you (planned) | Not yet buildable — environment planned but not released; no buzzer on the dongle (TFT + APA102 instead). | LilyGO T-Dongle-S3 |
Reading the table:
- If in doubt, buy the XIAO ESP32-S3. It is the default, the cheapest, the reference for every Blue firmware, and the only board that gets the full feature set (buzzer + U.FL DF antenna + PSRAM pcap).
- The C6 and C5 exist for Sky-Spy. The C5’s dual-band 2.4 + 5 GHz is the only way in the family to catch drone Remote ID transmitted on 5 GHz; the 2.4-only S3/C6 miss it. Choose the C5 specifically when 5 GHz RID coverage matters (Volume 9).
- A generic ESP32-S3 works if a bare XIAO is not to hand, but the builder must add the GPIO3 passive piezo and should check for a U.FL/external-antenna option if direction-finding is wanted.
- The T-Dongle-S3 is a “planned, not yet” entry. The flock-you environment for it is planned but not buildable as captured, and the dongle has no buzzer (it carries an ST7735 TFT and an APA102 LED instead), so even when it builds, the alert UX will differ. Do not plan around it yet.
None of the boards in this table is itself a separate Hack Tools hub tool, so there are no in-hub cross-links to seed here; the links point to the vendor/product pages.
3.7 The alternative boards in detail
Seeed XIAO ESP32-C6. A RISC-V XIAO with a Wi-Fi 6 (802.11ax) radio, same tiny XIAO form factor and footprint. It is listed as a Sky-Spy alternative target. Wi-Fi 6 brings nothing special to passive detection of legacy frames, and it is 2.4 GHz only, so it offers no 5 GHz coverage advantage; its value is simply “a XIAO you might already have that Sky-Spy will run on.”
Seeed XIAO ESP32-C5. The important alternative. The C5 is dual-band — 2.4 GHz
and 5 GHz — and Sky-Spy ships a dedicated xiao-c5-5g build for it. Drone
Remote ID can be broadcast on 5 GHz Wi-Fi; a 2.4-GHz-only receiver (S3, C6) is
blind to those. The C5 build closes that gap. If the job is comprehensive drone
RID, the C5 is the board to pick (Volume 9). exact Seeed SKU and
availability.
Generic ESP32-S3 dev boards. Any ESP32-S3 board can run the S3 firmware. The two things a generic board usually lacks versus the XIAO: a convenient passive piezo (wire one to GPIO3 with an optional 100 Ω series resistor) and a U.FL connector (needed for the Foxhunter’s directional antenna). PSRAM presence varies by board and matters for the pcap firmware — confirm an 8 MB PSRAM part if packet capture is wanted.
LilyGO T-Dongle-S3. A USB-stick-form ESP32-S3 with a small ST7735 TFT and an APA102 RGB LED, but no buzzer. flock-you lists it as a planned build target whose environment is not yet buildable. When it lands, it will trade the audible tier-tones for an on-screen display — a different, arguably nicer, UX for a headless family — but it is not a current option. Track it; do not buy it for OUI-SPY yet.
Board decision, hardware-only (pair with the Vol 1 firmware decision graph)
──────────────────────────────────────────────────────────────────────────
Need the full feature set (buzzer + DF antenna + pcap)? → XIAO ESP32-S3
Need 5 GHz drone Remote ID coverage? → XIAO ESP32-C5 (xiao-c5-5g)
Already have a C6 and only want Sky-Spy? → XIAO ESP32-C6
Only have a generic ESP32-S3 on the shelf? → generic S3 + wire GPIO3 piezo
Want an on-screen dongle UX? → T-Dongle-S3 (NOT YET buildable)
──────────────────────────────────────────────────────────────────────────3.8 Buzzer, LED, antenna and enclosure
Buzzer (GPIO3, passive piezo). The single most important peripheral on a headless detector. Use a passive piezo element — the MCU generates the tone — with an optional 100 Ω series resistor to tame current and volume. The firmware encodes the confidence tier in the tone: two-note sweeps for the highest Wi-Fi tiers, descending single blips for the lower tiers (full map in Volume 6). The Foxhunter and axeoff instead modulate cadence with RSSI — faster beeps as the emitter gets closer (Volume 8). A build without a buzzer (the Earrings, the T-Dongle) loses this entire channel and must fall back to LED/web.
LED / NeoPixel. Two options: the XIAO’s onboard LED on GPIO21 (note: active-low — drive the pin low to light it), or an external NeoPixel (WS2812-class) on GPIO4 for colour-coded status. The detector firmware uses a NeoPixel for at-a-glance state; the Earrings lean on the LED as their primary visible alert.
Antenna. The XIAO’s onboard ceramic antenna is the omnidirectional default and is fine for “is anything here?” detection. The U.FL connector is what unlocks the rest: snap on an external whip for range, or a directional / Yagi for the Foxhunter to resolve a bearing to an emitter. Direction-finding is the reason U.FL is treated as load-bearing in this series — it is the hardware precondition for Volume 8’s technique.
Enclosure. There is no official enclosure. The community has published 3D cases in several styles — travel, keychain, and a mini-Yagi housing that integrates the directional antenna for foxhunting. A bare board on a cable works fine for a desk or car; a case matters mainly for pocket-carry, concealment, or mounting the DF antenna rigidly.
[FIGURE SLOT — Vol 3 §8] A photo of a community 3D-printed case — ideally the mini-Yagi foxhunting housing — with the XIAO and U.FL antenna installed, to show the direction-finding hardware assembled.
3.9 Build-your-own bill of materials
The minimum viable OUI-SPY detector is three parts. The optional rows add the status light and the direction-finding antenna.
Table 5 — 9. Build-your-own bill of materials
| Item | Spec | Qty | ~Cost (USD) | Why |
|---|---|---|---|---|
| Seeed XIAO ESP32-S3 | ESP32-S3R8, 8 MB/8 MB, U.FL | 1 | 7.49 | The board; Wi-Fi + BLE + PSRAM + USB-C |
| Passive piezo buzzer | small PCB piezo element | 1 | ~0.50 | The alert channel (wire to GPIO3) |
| USB-C cable | data cable (not charge-only) | 1 | ~2.00 | Flash + power + USB-CDC JSON to host |
| 100 Ω resistor (optional) | ¼ W | 1 | ~0.02 | Series with buzzer to tame current/volume |
| NeoPixel (optional) | WS2812-class | 1 | ~0.30 | RGB status on GPIO4 |
| LiPo (optional) | e.g. 100 mAh (Earrings) up to larger | 1 | ~3–5 | Portable / wearable power (B+/B− pads) |
| U.FL whip / Yagi (optional) | 2.4 GHz, U.FL | 1 | ~3–15 | Range; directional for foxhunting (Vol 8) |
| 3D-printed case (optional) | community travel/keychain/mini-Yagi | 1 | filament | Pocket-carry / conceal / rigid DF antenna |
Floor cost of a working detector: about US$10 (board + piezo + a data cable). That is the “honest floor” this series uses in place of the unpublished finished-board price. Everything above the first three rows is optional polish: a status light, a battery for portability, and — the one genuinely capability-changing add — a directional U.FL antenna that turns the detector into a foxhunting DF rig.
A few assembly notes for a first build:
- Solder the piezo to GPIO3 and a GND pin. If using the 100 Ω resistor, put it in series on the GPIO3 leg. A passive element has no polarity to worry about.
- Use a known-good data USB-C cable. Charge-only cables are the single most common first-flash failure: the browser web-flasher needs the data lines to see the board’s USB-CDC interface (Volume 10). If the board never appears in the flasher’s serial picker, suspect the cable before the board.
- Leave the antenna choice until the use is known. The onboard ceramic antenna needs nothing. Fit a U.FL whip only for range, or a directional/Yagi only if foxhunting — and note that attaching a U.FL antenna typically disconnects the onboard ceramic antenna on these modules, so it is one or the other.
- Battery is optional and last. A LiPo on the B+/B− pads makes the unit portable but adds a charge-safety consideration; a desk or in-car build runs happily off USB and skips it.
Minimum build (what actually beeps)
─────────────────────────────────────────────
XIAO ESP32-S3 ──GPIO3──[100Ω]──►|■ piezo |──GND
│
└── USB-C (data) ──► laptop (flash + optional Flask map)
─────────────────────────────────────────────
Total ≈ $10. No screen. It beeps by tier; the laptop is optional.3.10 What this volume establishes
- The default and reference board is the Seeed XIAO ESP32-S3 (SKU 113991114, ~US$7.49): ESP32-S3R8, dual LX7 @240 MHz, 8 MB flash + 8 MB PSRAM, Wi-Fi b/g/n + BLE 5.0, native USB-C, and — the features that matter most — a U.FL external-antenna connector (for direction-finding) and LiPo charge pads (for portability).
- OUI-SPY uses only a few pins: GPIO3 passive piezo (the headless alert), GPIO21 onboard LED (active-low), optional GPIO4 NeoPixel, GPIO0 BOOT (hold to return to the mode selector), GPIO43 Serial1 TX mirror.
- Finished boards (the OUI-SPY board and the no-buzzer, 100 mAh Earrings) are sold at colonelpanic.tech; the board’s retail price is unpublished , so the ~US$10 build-your-own floor is the honest cost reference.
- The supported-hardware table (Section 6) is the canonical flash-target
answer: XIAO ESP32-S3 for the full feature set, XIAO ESP32-C5 (
xiao-c5-5g) for 5 GHz drone RID, XIAO ESP32-C6 as a Sky-Spy alternative, generic ESP32-S3 with an external GPIO3 piezo, and the T-Dongle-S3 as a planned-not-yet target with no buzzer. - Direction-finding hardware is the standout capability. The U.FL connector plus a directional/Yagi antenna is the hardware precondition for the Foxhunter (Volume 8), and is the one feature that separates OUI-SPY’s hardware from the touchscreen detectors.
With the targets (Volume 2) and the hardware (this volume) established, Volumes 4 and 5 open the matching engine itself — the Wi-Fi OUI union and wildcard-probe IE fingerprint, the BLE signature tables, and the five-tier confidence model that decides which tone the GPIO3 piezo plays.
Comments (0)