OUI-SPY
ESP32-S3 based multi-mode detection system with integrated buzzer and power management.
This board has sick PCB art. Available on Tindie and colonelpanic.tech - Ready-to-use, no additional components required.
All current firmware is passive and detection-only. Nothing transmitted, nothing exploited — just listening. This is the Blue Edition (defensive/recon). A Red Edition with offensive capabilities is in development and will be released separately. Stay tuned.
Firmware Options
OUI-SPY Unified Blue ⭐ RECOMMENDED
All four modes in one firmware — select from a boot menu, reboot, and go.
One flash, four capabilities. The unified build combines Detector, Foxhunter, Flock-You, and Sky Spy into a single firmware with a WiFi-based boot selector. No reflashing needed to switch modes.
- Boot selector on AP
oui-spy/ouispy123at192.168.4.1 - Hold BOOT button 2 seconds to return to the selector from any mode
- MAC randomization on every boot for privacy
- Global buzzer toggle from the selector menu
- Distinct boot sounds per mode — each plays its own retro tune so you know which firmware you're in
- Persistent mode selection — remembers your last choice across power cycles
- Configurable AP — change the selector SSID/password from the web UI
Includes all features from the standalone firmwares below, plus GPS wardriving in Flock-You mode, session persistence to flash, KML export for Google Earth, and a prior session history tab.
Use Cases: Everything. Flash once, switch modes on the fly.
OUI-SPY Detector
Multi-target BLE device scanner with OUI filtering
- Detects multiple devices simultaneously by MAC address or manufacturer OUI
- Web-based configuration portal for target management
- Smart cooldown system prevents alert spam
- Audio feedback with different beep patterns for new vs. re-detected devices
- Persistent configuration storage
- Good for general surveillance and device monitoring
Use Cases: Security monitoring, device inventory, general BLE scanning
OUI-SPY Foxhunter
Precision proximity tracker for radio direction finding
- Single target MAC address tracking with real-time RSSI analysis
- Variable proximity beeping based on signal strength (closer = faster beeps)
- Optimized for directional antenna usage and triangulation
- Aggressive scanning parameters for maximum sensitivity
- Clean audio feedback system for field operations
- Good for foxhunting competitions and asset recovery
Use Cases: Radio direction finding, asset tracking, security device location, RF analysis
OUI-SPY UniPwn
Advanced Unitree robot exploitation system with web interface
- BLE-based command injection exploits for Unitree Go2, G1, H1, and B2 robots
- AutoPwn automation with 7-step exploitation and bulletproof error handling
- Real-time BLE scanning with signal strength indicators and target management
- Custom command injection with SSID/password injection methods
- Comprehensive web interface with operations logging and system monitoring
- AES-CFB128 encryption implementation for Unitree's crypto protocol
- Based on original research by Bin4ry and d0splash
Use Cases: Security research, authorized penetration testing, educational robotics security assessment
Flock-You
Flock Safety & Raven surveillance device detector with web dashboard and GPS wardriving
- BLE-only detection — MAC prefix, device name, manufacturer ID (
0x09C8XUNTONG), Raven UUID fingerprinting - WiFi AP dashboard at
192.168.4.1with live detection feed, pattern DB, and export tools - GPS wardriving via phone browser Geolocation API — tags every detection with coordinates
- Session persistence to flash (SPIFFS) with prior session history tab
- Export as JSON, CSV, or KML (Google Earth) — current and prior sessions
- Flask-compatible serial JSON output for live desktop ingestion
- Crow call boot sounds, detection alerts, and heartbeat audio feedback
- 200 unique device storage with thread-safe FreeRTOS mutex
- Companion Flask desktop app in
api/folder with JSON/CSV/KML import
Use Cases: Surveillance detection, privacy auditing, wardriving, security research
Sky-Spy
Drone RemoteID detection and real-time mapping system
- Dual-protocol scanning: WiFi promiscuous mode + BLE for OpenDroneID (ASTM F3411)
- Real-time GPS coordinate extraction from drone broadcasts (location, altitude, speed, heading)
- Operator/pilot location tracking and identification
- JSON serial output for mesh-mapper.py visualization integration
- Thread-safe audio alerts: 3 quick beeps on detection, heartbeat every 5 seconds
- Multi-drone tracking: Monitor up to 8 drones simultaneously
- Non-blocking buzzer implementation with dedicated FreeRTOS task
Use Cases: Drone detection, airspace monitoring, RemoteID compliance verification, counter-UAS awareness
Remote-ID-Spoofer
WiFi Remote ID spoofer and simulator with swarm mode
WARNING: Transmitting spoofed Remote ID signals is illegal in many jurisdictions. See the full legal disclaimer before use. This firmware is for authorized security research and education only.
- WiFi-based ASTM F3411 Remote ID broadcast via NAN action frames and AP beacon vendor IEs
- Flask web UI with cyberpunk dark theme, dual control panels, and map-based flight path planning
- Swarm mode: spoof up to 20 simultaneous drones with configurable formations, offset/random flight paths, and stagger start
- Realistic variation engine: altitude drift, speed variation, GPS jitter, heading wobble, TX timing jitter -- all toggleable with live sliders
- Live telemetry feeds showing real-time broadcast data and per-drone swarm status
- Play/Pause/Stop state machine with status ticker and TX count
- Buzzer and LED feedback with mute controls
- 1Hz broadcast rate matching real Remote ID transmitters
- Inspired by d0tslash and H.A.R.D (Hackers Against Remote ID)
Use Cases: Security research, Remote ID protocol analysis, counter-UAS testing, educational demonstration
3D Prints
Enhance your OUI-SPY with custom 3D printed cases and accessories:
OUI-SPY Case with External Antenna Hole
by out0fstep
- Protective case with external antenna hole for enhanced RF performance
- Secure fit for OUI-SPY board with proper ventilation
- Compatible with external directional antennas for foxhunting applications
OUI-SPY Travel Case
by out0fstep
- Compact travel case for portable OUI-SPY operations
- Protective design for field use and storage
- Easy access to controls and indicators
OUI-SPY Keychain
by out0fstep
- Portable keychain case for everyday carry
- Compact design for discreet operations
- Easy access to all controls and indicators
Mini Yagi Case
by out0fstep
- Specialized case for directional antenna operations
- Designed for use with 2.4G Directional Antenna 10.5dB High Gain SMA
- Optimized for foxhunting and directional RF detection
- Professional-grade directional antenna setup
OUI-SPY SMA Spacer
by Nitekry D Paul
- SMA connector spacer for external antenna mounting
- Ensures proper antenna positioning and signal optimization
- Compatible with various SMA antenna configurations
OUI-SPY Tacti-kewl yagi grip with accessory mounts
by out0fstep
- Universal yagi Grip for foxhunting
- picitinny rail compatibility
Hardware Specifications
- MCU: ESP32-S3 dual-core processor
- Connectivity: WiFi 802.11n, Bluetooth 5.0, BLE
- Audio: Integrated buzzer with PWM control
- Power: USB-C powered with efficient power management
- Antenna: Built-in antenna with option for external directional antenna
- Form Factor: Compact PCB design optimized for portable use
Quick Start
- Purchase your OUI-SPY board from Tindie or colonelpanic.tech
- Flash the Unified Blue firmware — one flash, all four modes
- Power on and connect to WiFi AP
oui-spy/ passwordouispy123 - Select your mode from the web selector at
http://192.168.4.1 - Device reboots into your chosen mode — hold BOOT 2s to return to menu anytime
Technical Features
Advanced BLE Scanning
- Maximum aggressive scanning parameters for optimal detection
- Dual-core processing for concurrent web interface and scanning
- Real-time RSSI analysis and signal strength reporting
- Support for both active and passive scanning modes
Privacy & Security
- MAC address randomization for stealth operation
- No traceable hardware fingerprints
- Secure web configuration with timeout protection
- Local processing - no cloud dependencies
Audio System
- Multiple beep patterns for different alert types
- Variable frequency proximity indication
- Clean startup and ready signals
- Non-overlapping audio sequencing
OUI Reference
Looking for manufacturer prefixes? Check the full list here: OUI List (ouis.md)
Gotta catch 'em all — contribute your findings!
If you need to verify an OUI, use one of these lookup tools:
- Official IEEE OUI Lookup: https://standards.ieee.org/products-services/regauth/oui/index.html
- Alternate OUI Lookup: https://macaddress.io/
Choose your firmware above and start detecting.
License
Open source project. Hardware available commercially on Tindie and colonelpanic.tech.