---

1.1 What SquachWatch is

SquachWatch-CYD is open-source firmware that turns an ESP32 touchscreen board, by default the ~$15 ESP32-2432S028R “Cheap Yellow Display” (CYD), into a standalone, pocketable surveillance-device detector. It puts the ESP32’s Wi-Fi radio in promiscuous mode and runs a NimBLE scan on Bluetooth Low Energy at the same time. Every frame and advert it hears is compared against a table of documented wireless signatures: OUI prefixes, SSIDs, BLE service UUIDs, company IDs, advertised names and payload formats. A match produces a full-screen ALERT card naming the device class, the vendor, the address, a signal meter and a confidence grade.

The project’s own one-line description is “Surveillance-device detector for the ESP32-2432S028R (‘Cheap Yellow Display’), and a growing list of other ESP32 boards.” On the 2.8” CYD it is a self-contained device: “no PC, no extras, just plug it into USB.”

Three things set it apart from a generic Wi-Fi/BLE scanner:

1. It names things rather than listing addresses. A Flock Safety ALPR camera is announced as FLOCK, a Ray-Ban Meta pair as META, a Bluetooth card-skimmer module as SKIMMER. A plain scanner would show an Espressif MAC and an RSSI.
2. Every signature carries a confidence grade. The author audited every hardware prefix against the IEEE registry: of 97 rows, 33 are graded High, 4 Medium and 60 Low. The ALERT FILTER setting is a minimum-confidence gate, so Low-grade matches can be logged without taking over the screen. The details are in Vol 7.
3. It is meant to stay switched on. The UI wraps the detector in a vaporwave “SquachWare” aesthetic with a mascot, Squachy, who reacts to catches, earns nineteen outfits and pets, and keeps a diary. The author puts it plainly: “None of this finds anything. All of it is why you leave him on.” A BORING MODE strips all of it out for anyone who wants a plain instrument (Vol 8).

  SquachWatch at a glance
  ═══════════════════════════════════════════════════════════════════
  ┌──────────────────────── 2.4 GHz air ─────────────────────────────┐
  │  Wi-Fi beacons / probes / data frames      BLE advertisements    │
  └───────────────┬─────────────────────────────────────┬────────────┘
                  │ promiscuous RX                       │ NimBLE scan
                  ▼                                      ▼          (passive, active
  ┌──────────────────────────────────────────────────────────────┐   only when quiet)
  │ ESP32 detection engine                                        │
  │  OUI table · SSID prefixes · service UUIDs · company IDs ·    │
  │  BLE names · Find My payload check · ASTM F3411 Remote ID     │
  │  decoder · deauth-rate counter · evil-twin comparator ·       │
  │  spam/flood detector                                          │
  └───────┬──────────────────────┬──────────────────────┬────────┘
          ▼                      ▼                      ▼
   ALERT card / LOCKED ON   LOG (≈1,800 sightings   SD card CSV
   / HUNT gauge             in flash, survives       squachwatch-<day>.log
   RGB status light         restarts)                (optional)
  ═══════════════════════════════════════════════════════════════════

Note — “Standalone” is literal. The scanning firmware never joins a network to detect anything; the only Wi-Fi association it makes is an optional one-second boot visit to check for updates and set the clock, and only if a network has been saved. Vol 9 has the complete table of what the device transmits.

1.2 Who made it and when

1.2.1 The author

The firmware is published on GitHub by skizzophrenic, who runs the Talking Sasquach YouTube channel and the talkingsasquach.com brand. The FAQ is written in that persona (“Hey. It’s me, the Sasquach. Yes, I know how to use GitHub.”) and confirms the link: “Any relation to talkingsasquach.com? Yes. That’s me, the actual channel. This device and the whole SquachWare vaporwave look belong to that brand.” Elsewhere in this series the author is called “the author” or “Talking Sasquach”.

The project is not a one-person effort. The README credits contributors for board ports, the LoRa stack, 5 GHz scanning, GPS wardriving and signature research.

Table 1 — 2.1 The author

Contributor	Credited for
DH5DAX	Elecrow CrowPanel 7.0 port, the ESP32-S3 Wi-Fi fix, the LoRa radio driver and every LoRa decoder on the T-Watches
quietradio	RockBase NM-CYD-C5 port and its 5 GHz scanning
jotra7	GPS and wardriving to SD on the CYD, the SD log’s dates (PR #46)
justcallmekoko	The Marauder V8 and the ESP32 Marauder project it comes from
bkbroiler	AWOK 2.4” (Marauder V6.1 hardware) pin mapping and shared-bus touch calibration
greasy-electronics	Freenove ESP32-S3 2.8” port
DevOpsDAdams	Freenove 3.2” pin work
VV-B0Y	3.5” capacitive (ESP32-3248S035C) build
aroth	Emulator build on macOS and its incremental build
Houdini	Testing every build
jbohack (nyanBOX, MIT)	The AirTag Find My payload check, ported from nyanBOX
colonelpanichacks/flock-you (MIT), @NitekryDPaul, DeFlockJoplin	Flock Safety OUI research and the Flock/Raven signatures added in v1.24.0

The nyanBOX credit matters for this hub: the same AirTag payload logic underlies the tracker detection discussed in the Nyan Box deep dive. The ESP32 Marauder link is direct too, since its author’s V8 hardware is now a SquachWatch board (Vol 2 §7).

1.2.2 Timeline

The public clone used for this series carries only recent history (the earliest commit present is dated 2026-10-05), so the dates below come from the release-version references and dated notes inside the repo, the launch video and press coverage. Where only a version number is known, no date is given.

Table 2 — 2.2 Timeline

Date / version	Event	Source
v1.0	The original design contract: CYD only, ILI9341, touch, SD, “no buzzer, no GPS, no battery monitoring”	docs/DESIGN.md §1
v1.5.23	BLE broadcaster role enabled on every build so SquachMesh can advertise	platformio.ini comment
v1.7.0	Two 1.92 MB OTA app slots replace the single 3 MB app partition	platformio.ini comment
v1.12.0	”Black box” flash log: ~1,800 sightings survive a restart	docs/FAQ.md
v1.17.0	Touch calibration offered at first boot	docs/FAQ.md
v1.22.0	CYD boards drop Bluetooth OTA to free memory	docs/FAQ.md
2026-09-03	3.5” ESP32-3248S035R found to boot-loop on hardware; frozen	platformio.ini comment
2026-09-12	Toolchain pinned to [email protected] (Arduino 2.0.14) after a silent platform upgrade broke builds	platformio.ini comment
2026-09-20	Launch video, “I Made a $13 Surveillance Detector (And It Actually Works)“	YouTube, Talking Sasquach
v1.24.0	Flock and Raven signatures added from community research	README.md Credits
v1.25.0	GPS wardriving on the T-Watch S3 Plus (“not road-tested”)	docs/FAQ.md
v1.26.0	LoRa listening (Meshtastic + MeshCore) on both T-Watches	docs/LORA.md
2026-09-26	LoRa research and decoders written and bench-tested on the CrowPanel	docs/LORA.md
2026-09-28	Adafruit blog coverage: “SquachWatch: firmware for the Cheap Yellow Display that gamifies detecting things”	Adafruit blog
2026-09-28	NM-CYD-C5 confirmed on hardware; 5 GHz scanning follows in v1.31.0	docs/NM-CYD-C5.md
v1.33.0	Wi-Fi update failures explain themselves	README.md “Updating”
2026-10-12	v1.36.0; Marauder V8 and T-Deck Plus brought up the same day	README.md, platformio.ini

That is roughly 36 minor releases in the first months of public life, a pace that matters to anyone writing about it: menu names and feature lists move between releases. Everything in this series is pinned to v1.36.0 unless a volume says otherwise.

1.2.3 Licence and where it lives

Table 3 — 2.3 Licence and where it lives

Item	Location
Source	github.com/skizzophrenic/SquachWatch-CYD
Licence	GPL-3.0 (“Fork it, break it, make it weirder. If you ship a changed version, share your source under the same license.”)
Web flasher	squachwatch.com: board picker, Connect & Install, Set Time & Zone, older versions (Vol 5)
Browser emulator	squachwatch.com/emulator/: the real src/ compiled for a PC and the web (Vol 6)
Bluetooth update page	squachwatch.com/update/ (ESP32-S3 boards only, Vol 9)
Releases	Cut by pushing a v*.*.* tag; the same CI run rebuilds and redeploys the flasher

Tip — The emulator is the cheapest way to evaluate the firmware: no board, no driver, no purchase. The README’s animation “was rendered by the same C++ that runs on the board, compiled for a PC.” Driving the emulator for ten minutes before ordering parts shows the full UI the hardware will run.

1.3 What it detects

Seventeen detection types ship in v1.36.0. Vol 7 covers each in depth; this is the index.

Table 4 — 3. What it detects

Type	Target	Radio	Matched on (summary)
FLOCK	Flock Safety ALPR cameras	Wi-Fi + BLE	49 OUI prefixes, flock-/Flock SSIDs, BLE names, company ID 0x09C8, Flock’s BLE service UUID
AXON	Axon body cameras, TASERs	Wi-Fi	3 OUIs + SSID prefixes AB2-/AB3-/AB4-/AXON-
META	Ray-Ban Meta, Snap Spectacles	BLE	Service UUID 0xFD5F + Meta/Luxottica/Snap company IDs
SKIMMER	BT card skimmers (HC-05/06/03, RN42, BT04-A)	BLE (+3 OUIs)	Advertised name + SPP UUID 0x1101
RAVEN	Raven gunshot detector	BLE	Any service UUID 0x3100–0x3500
AIRTAG	Apple Find My	BLE	Company ID 0x004C + Find My payload check
DRONE	Remote ID drones	BLE + Wi-Fi	ASTM F3411 message, decoded to position, altitude, serial, operator location
ALPR	Motorola Solutions / Genetec	Wi-Fi	7 OUIs
CAMERA	Generic / covert IP cameras	Wi-Fi	17 OUIs (Wyze, Amazon, Tuya, Verkada, Avigilon, Axis …)
SAMSUNG_TAG	Galaxy SmartTag / SmartTag+	BLE	Service UUID 0xFD5A
GOOGLE_TAG	Find My Device trackers	BLE	Service UUID 0xFEAA
TILE	Tile	BLE	Service UUID 0xFEED / 0xFEEC
RING	Ring doorbells/cameras	Wi-Fi	15 OUIs
DEAUTH	Deauthentication floods	Wi-Fi	Rate-detected burst
EVILTWIN	Rogue/spoofed APs	Wi-Fi	One SSID from two BSSIDs disagreeing on encryption
IBEACON	Retail beacons	BLE	Apple header 4C 00 02 15; off by default
HACKER	Flipper Zero, Pwnagotchi, Pineapple, deauthers	Wi-Fi + BLE	Flipper UUIDs 0x3081–0x3083, company ID 0x0E29, OUI 0C:FA:22; Pwnagotchi beacon; Pineapple_/pwned SSIDs

The author states which of these are solid: “Detection is reliable for the high-priority targets (Flock, Axon, skimmer, camera glasses). Remote ID and iBeacon are exact-format matches. Raven, generic ALPR and the Google tracker network are best-effort.”

Warning — A FLOCK match on a Low-grade OUI is weak evidence. Exactly one of the 49 Flock prefixes is registered to Flock Safety; the rest belong to generic chip and module makers (Espressif, Liteon, Silicon Labs and others), “real evidence, shared with every dev board on earth.” The audit also removed 00:0E:58, which had been labelled “Vigilant” for eleven releases and is registered to Sonos, so “every speaker in range was being logged as a plate reader.” Read the confidence grade before reading the type.

1.4 What it does not do

Being clear about the limits is as important as the feature list. Each row below comes from the repo or follows directly from the radio hardware.

Table 5 — 4. What it does not do

Not done	Why	Source / reasoning
Attack, deauth, inject or crack anything	Detection firmware only; “doesn’t break into networks or decrypt anyone’s traffic”	docs/FAQ.md “Is this legal?”
See 5 GHz Wi-Fi on the CYD	The ESP32-WROOM-32 radio is 2.4 GHz only; only the ESP32-C5 boards (NM-CYD-C5, Marauder V8) add 5 GHz	README.md; docs/NM-CYD-C5.md
Bluetooth Classic inquiry	Not switched on anywhere; conflicts with NimBLE on a single radio. SKIMMER is a BLE name match	docs/NM-CYD-C5.md
Find cameras that do not radiate	Anything SD-only, wired-only or cellular is invisible to a Wi-Fi/BLE listener	radio physics; see the CameraDetection deep dive
Detect cellular/IMSI catchers	No cellular receiver	hardware
Read 802.15.4 (Zigbee/Thread)	The C5 chip could; “nothing in the firmware listens for it yet”	docs/NM-CYD-C5.md
Give a bearing	HUNT is an RSSI gauge, “no compass, so you turn your body”	README.md “Fox hunt”
Track a randomising phone or tag reliably	”Many phones and trackers change their Bluetooth address on purpose to defeat exactly this”	docs/FAQ.md (watch list)
GPS position on a bare CYD	No GPS; optional cyd-gps builds exist but are not on the flasher (Vol 3, Vol 4)	docs/PINOUT.md; platformio.ini
Stay silent on the air	Active BLE scan requests, an optional boot update check, optional SquachMesh adverts	docs/FAQ.md (Vol 9)
Protect data from a USB attacker	The PIN “does not stop someone with a USB cable and some time, because the flash can be read directly”	docs/FAQ.md

Mistaken matches are acknowledged in the docs too: freshly powered AirTags and AirPods send the same advert type, so AirPods can show as AIRTAG (“known and accepted”), and the owner’s own doorbell or tag is “a true positive every single time.”

1.5 The hardware in one page

The default target is a commodity Sunton-family board that costs less than most USB cables in a hardware store. Vol 2 covers it in depth; Vol 3 covers buying it.

  ┌─────────── ESP32-2432S028R quick facts ───────────────────────────┐
  │ MCU      ESP32-WROOM-32 · dual Xtensa LX6 · 240 MHz · no PSRAM     │
  │ Radio    Wi-Fi 802.11 b/g/n 2.4 GHz · Bluetooth 4.2 (BLE + Classic)│
  │ Flash    4 MB → 2 × 1.92 MB OTA slots + NVS + coredump             │
  │ Display  2.8" 240×320 TFT · ST7789 or ILI9341 (batch lottery)      │
  │ Touch    XPT2046 resistive, its own SPI bus                        │
  │ Storage  microSD on VSPI (optional; FAT32)                         │
  │ Extras   RGB LED (back) · LDR · speaker pad · BOOT + RST buttons   │
  │ USB      CH340-family USB-serial · console at 2,000,000 baud       │
  │ Power    5 V from USB; no battery or charger on the classic board  │
  │ Cost     roughly $8–20 per board depending on seller (Vol 3)       │
  └───────────────────────────────────────────────────────────────────┘

Sources: docs/PINOUT.md, include/cyd_user_setup.h, platformio.ini, docs/FAQ.md; the radio and core figures are Espressif’s ESP32 specification.

Beyond the CYD, v1.36.0 builds for about twenty board configurations. The ones that add a capability are the important ones:

Table 6 — Beyond the CYD, v1.36.0 builds for about twenty board configurations. The ones that add a capability are the important ones

Board	Adds
RockBase NM-CYD-C5, Marauder V8 (ESP32-C5)	5 GHz Wi-Fi scanning; V8 also GPS wardriving + battery gauge
LilyGo T-Watch S3	Wrist form factor, battery, haptic buzz, LoRa receive (Meshtastic/MeshCore)
LilyGo T-Watch S3 Plus	All of the above + GPS wardriving with WiGLE export
LilyGo T-Deck Plus	Keyboard, GPS wardriving, 2000 mAh cell (LoRa left out of v1.36.0)
Freenove ESP32-S3 2.8”/3.5”	Battery connector + lava-lamp gauge, speaker, power-off button
RL Phantom 2.4” (Rabbit Labs)	Sold pre-built with battery and case, status light on the front
Elecrow CrowPanel Advance 7.0	800×480 panel, buzzer
M5Stack StickS3, Cardputer ADV	Button / keyboard driven, no touch

1.6 Where it sits next to the rest of the kit

The Hack Tools hub already has several Wi-Fi/BLE instruments. SquachWatch is the narrowest of them, and the narrowness is the point: it does one job, defensive identification, without a host and without menus of attacks.

Table 7 — 6. Where it sits next to the rest of the kit

Tool (hub deep dive)	Overlap with SquachWatch	What SquachWatch adds	What the other adds
Nyan Box deep dive	Drone Remote ID, tracker and hidden-camera detection, gamified XP	Named signatures with confidence grades, Flock/Axon/skimmer/glasses classes, touchscreen log, mesh, OTA	3× NRF24 (2.4 GHz proprietary protocols), attack tools
CameraDetection deep dive	Wi-Fi camera OUI fingerprinting	A finished, flashable detector today	Analog video, lens-glint, traffic correlation, non-emitting cameras
AirTags deep dive	AirTag/SmartTag/Tile/Google tag detection	Always-on, standalone, watch list + LOCKED ON	Theory of Find My/DULT, OS-native alerts, AirGuard
ESP32 Marauder Firmware deep dive	Same ESP32 class, same promiscuous sniffing	Classification and alerting rather than raw lists	Attacks, PCAP, wardriving on more hardware
AWOK Dual Touch V3 deep dive	Marauder-class Wi-Fi/BLE hardware	Detection-first UI	Dual ESP32, GPS, full Marauder feature set
Flipper Zero deep dive	Is a HACKER target (UUIDs 0x3081–0x3083)	n/a	Sub-GHz, NFC, RFID, IR
M5Stack Cardputer ADV / M5Stick S3 deep dives	Both are SquachWatch boards (BETA)	A defensive firmware option for hardware already covered	General-purpose platforms

Note the AWOK board SquachWatch supports is the AWOK 2.4” (ESP32 Marauder V6.1 hardware), built as env:awok. Whether that matches the AWOK Dual Touch V3 in the hub has not been confirmed from the repo; the Dual Touch V3 is a dual-ESP32 Flipper module, and SquachWatch’s AWOK build describes a single WROOM-32 with a 2.4” ILI9341. Treat it as unverified until a unit is tried.

Note — Another SquachWatch, an ESP32 Marauder or a nyanBOX is “the same chip, and none of them is flagged as hacking hardware on that alone.” Running Marauder and SquachWatch side by side does not make them set each other off.

1.7 Decision graph

                         Want to know what surveillance gear
                         is broadcasting around you?
                                      │
                    ┌─────────────────┴─────────────────┐
                    │ Just evaluating?                   │
                    ▼                                    ▼
           squachwatch.com/emulator/            Ready to buy hardware
           (no hardware, free)                           │
                                    ┌────────────────────┼──────────────────────┐
                                    ▼                    ▼                      ▼
                          Cheapest, desk/pocket   Want it on your wrist   Want 5 GHz too
                                    │              (+LoRa, GPS)                  │
                                    ▼                    ▼                      ▼
                          2.8" CYD ESP32-2432S028R  T-Watch S3 Plus      NM-CYD-C5 (BETA)
                          ~$8–20, web-flash         (GPS) or S3 (no GPS)  or Marauder V8
                                    │
                     ┌──────────────┼───────────────────────┐
                     ▼              ▼                       ▼
            Want messaging   Want battery, no      Want GPS on the CYD?
            (SquachMesh)?    soldering, no case    cyd-gps build + ATGM336H,
            buy a 2-pack     printing?             build from source (Vol 4)
                             RL Phantom pre-built
                             (ships with SquachWatch
                             as a firmware option)

The 2-pack advice is the author’s: the launch video description recommends the ST7789 CYD “in a 2-pack (‘you’ll want two for SquachMesh’).” SquachMesh is opt-in and has privacy costs; read Vol 9 before switching TRANSMIT on.

1.8 How to read the series

Table 8 — 8. How to read the series

Vol	Title	Read it when
1	Overview	First
2	Hardware	Choosing a board, or debugging pins/display/touch
3	Parts and where to get them	Ordering
4	Building it	Case, power, battery, SD, optional GPS wiring
5	Flashing it	Getting firmware on; white screens; drivers; updates
6	Programming it	Building from source, adding a signature, the emulator
7	What it detects and how	Interpreting an alert; false positives
8	Using it	Day-to-day operation, filters, PIN/duress, power
9	SquachMesh, updates and the watch	Squads, messaging, OTA, T-Watch LoRa/GPS
10	Cheatsheet, legal and comparison	Field cards, legal envelope, which tool to carry

Conventions used throughout:

• Menu paths are written as the firmware shows them, in capitals: Settings → SYSTEM → UPDATE FIRMWARE.
• Build names are PlatformIO environments in code type: cyd, cyd-ili9341, twatch-s3.
• Sources: repo paths refer to SquachWatch-CYD at v1.36.0. Prices are ranges with the date checked.
• No unit has been built for this series yet. Everything is drawn from the source code, its documentation and the author’s published material. Where the repo itself says something is unverified (BETA boards, untested builds), the series says so too.

1.9 Cheatsheet updates from this volume

Table 9 — 9. Cheatsheet updates from this volume

Fact	Value
What	GPL-3.0 Wi-Fi + BLE surveillance-device detector firmware
Author	skizzophrenic / Talking Sasquach
Version covered	v1.36.0 (2026-10-12)
Default board	ESP32-2432S028R 2.8” CYD, ~$8–20
Flasher / emulator	squachwatch.com · squachwatch.com/emulator/
Detection types	17 (iBeacon off by default)
OUI confidence audit	97 rows: 33 High / 4 Medium / 60 Low
Bands	2.4 GHz Wi-Fi + BLE on CYD; +5 GHz on ESP32-C5 boards; +LoRa RX on T-Watch
Transmits?	A little: BLE scan requests, optional boot update check, opt-in SquachMesh (Vol 9)
First rule of alerts	Read the confidence grade before the type