bump version to 0.10.0

Co-authored-by: Will Greenberg <willg@eff.org>

.cargo/audit.toml

@@ -0,0 +1,11 @@
+[advisories]
+ignore = [
+    # RSA Marvin Attack in `rsa`, dragged in through rustcrypto (dev builds)
+    # and adb_client (USB signing only, unrelated to marvin attack which
+    # targets decryption).
+    "RUSTSEC-2023-0071",
+    # paste crate being unmaintained is not important. it's not dealing with
+    # user-input. we could get rid of this warning by disabling the image
+    # dependency in adb-client.
+    "RUSTSEC-2024-0436",
+]

.cargo/config.toml

@@ -1,3 +1,15 @@
+[alias]
+# Build the daemon with "firmware" profile and "ring" TLS backend.
+# Requires a cross-compiler (see github actions workflows) and is very slow to build.
+build-daemon-firmware = "build -p rayhunter-daemon --bin rayhunter-daemon --target armv7-unknown-linux-musleabihf --profile firmware --no-default-features --features ring-tls"
+# Build the daemon with "firmware-devel" profile and "rustcrypto" backend.
+# Works with just the Rust toolchain, and is medium-slow to build. Binaries are slightly larger.
+build-daemon-firmware-devel = "build -p rayhunter-daemon --bin rayhunter-daemon --target armv7-unknown-linux-musleabihf --profile firmware-devel"
+# Build rootshell for firmware
+build-rootshell-firmware = "build -p rootshell --bin rootshell --target armv7-unknown-linux-musleabihf --profile firmware"
+# Build rootshell for development
+build-rootshell-firmware-devel = "build -p rootshell --bin rootshell --target armv7-unknown-linux-musleabihf --profile firmware-devel"
+
 [target.aarch64-apple-darwin]
 linker = "rust-lld"
 rustflags = ["-C", "target-feature=+crt-static"]

.github/ISSUE_TEMPLATE/bug.yaml

@@ -2,6 +2,12 @@ name: Bug Report
 description: File a bug report.
 labels: ["bug"]
 body:
+  - type: checkboxes
+    attributes:
+      label: Prerequisites
+      options:
+        - label: I have read [CONTRIBUTING.md](https://github.com/EFForg/rayhunter/blob/main/CONTRIBUTING.md)
+          required: true
   - type: textarea
     attributes:
       label: Bug Report Details

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,10 @@
-blank_issues_enabled: true
+blank_issues_enabled: false
 contact_links:
-  - name: Rayhunter Mattermost
-    url: https://opensource.eff.org/signup_user_complete/?id=6iqur37ucfrctfswrs14iscobw&md=link&sbr=su
-    about: If you're having trouble using Rayhunter and aren't sure you've found a bug or request for a new feature, please first try asking for help here. There is a much larger community there of people familiar with the project who will be able to more quickly answer your questions.
+  - name: Frequently Asked Questions
+    url: https://efforg.github.io/rayhunter/faq.html
+  - name: Questions and community
+    url: https://efforg.github.io/rayhunter/support-feedback-community.html
+    about: If you're having trouble using Rayhunter and aren't sure you've found a bug or request for a new feature, please first try asking for help on GitHub discussions or Mattermost
   - name: Rayhunter Security Policy
     url: https://github.com/EFForg/rayhunter/security/advisories/new
     about: Please report security vulnerabilities here.

.github/ISSUE_TEMPLATE/feature.yaml

@@ -2,6 +2,12 @@ name: Feature Request
 description: Suggest a new feature or improvement to Rayhunter
 labels: ["enhancement"]
 body:
+  - type: checkboxes
+    attributes:
+      label: Prerequisites
+      options:
+        - label: I have read [CONTRIBUTING.md](https://github.com/EFForg/rayhunter/blob/main/CONTRIBUTING.md)
+          required: true
   - type: textarea
     id: problem
     attributes:

.github/ISSUE_TEMPLATE/installer-bug.yaml

@@ -2,6 +2,12 @@ name: Installer Issue
 description: File an bug related to an installer issue.
 labels: ["bug", "installer"]
 body:
+  - type: checkboxes
+    attributes:
+      label: Prerequisites
+      options:
+        - label: I have read [CONTRIBUTING.md](https://github.com/EFForg/rayhunter/blob/main/CONTRIBUTING.md)
+          required: true
   - type: input
     attributes:
       label: Rayhunter Version
@@ -15,8 +21,8 @@ body:
         What device are you trying to install Rayhunter on?
       options:
         - Orbic RC400L
-        - Tplink HW7350
-        - Tplink HW7310
+        - Tplink M7350
+        - Tplink M7310
         - Tmobile TMOHS1
         - Wingtech CT2MHS0
         - Pinephone

.github/pull_request_template.md

@@ -1,6 +1,8 @@
 ## Pull Request Checklist
 
-- [ ] The Rayhunter team has recently expressed interest in reviewing a PR for this. If not, this PR may be closed due our limited resources and need to prioritize how we spend them.
+- [ ] The Rayhunter team has recently expressed interest in reviewing a PR for this.
+  - If not, this PR may be closed due our limited resources and need to prioritize how we spend them.
 - [ ] Added or updated any documentation as needed to support the changes in this PR.
-- [ ] Code has been linted and run through `cargo fmt`
-- [ ] If any new functionality has been added, unit tests were also added
+- [ ] Code has been linted and run through `cargo fmt`.
+- [ ] If any new functionality has been added, unit tests were also added.
+- [ ] [CONTRIBUTING.md](https://github.com/EFForg/rayhunter/blob/main/CONTRIBUTING.md) has been read.

.github/workflows/main.yml

@@ -20,49 +20,70 @@ jobs:
     permissions:
       contents: read
     outputs:
-      code_changed: ${{ steps.files_changed.outputs.code_count }}
-      daemon_changed: ${{ steps.files_changed.outputs.daemon_count }}
-      web_changed: ${{ steps.files_changed.outputs.web_count }}
-      docs_changed: ${{ steps.files_changed.outputs.docs_count }}
-      installer_changed: ${{ steps.files_changed.outputs.installer_count }}
-      rootshell_changed: ${{ steps.files_changed.outputs.rootshell_count }}
+      code_changed: ${{ steps.files_changed.outputs.code_count != '0' }}
+      daemon_changed: ${{ steps.files_changed.outputs.daemon_count != '0' }}
+      daemon_needed: ${{ steps.files_changed.outputs.daemon_count != '0' || steps.files_changed.outputs.installer_build != '0' }}
+      web_changed: ${{ steps.files_changed.outputs.web_count != '0' }}
+      docs_changed: ${{ steps.files_changed.outputs.docs_count != '0' }}
+      installer_changed: ${{ steps.files_changed.outputs.installer_count != '0' }}
+      installer_gui_changed: ${{ steps.files_changed.outputs.installer_gui_count != '0' }}
+      rootshell_needed: ${{ steps.files_changed.outputs.rootshell_count != '0' || steps.files_changed.outputs.installer_build != '0' }}
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: detect file changes
         id: files_changed
         run: |
           lcommit=${{ github.event.pull_request.base.sha || 'origin/main' }}
 
-          # If we are on main, or if these workflow files are being changed, run everything
-          if [ ${{ github.ref }} = 'refs/heads/main' ] || git diff --name-only $lcommit..HEAD | grep -qe ^.github/workflows/ -e ^.cargo
+          # If we are on main, if workflow/cargo config files changed, or if
+          # the latest commit message contains "#build-all", run everything.
+          # Use #build-all in a commit message to force a full build on a PR
+          # branch (useful for testing release builds without merging to main).
+          if [ ${GITHUB_REF} = 'refs/heads/main' ] || git diff --name-only $lcommit..HEAD | grep -qe ^.github/workflows/ -e ^.cargo || git log -1 --format='%s %b' | grep -qF '#build-all'
           then
             echo "building everything"
             echo code_count=forced >> "$GITHUB_OUTPUT"
             echo daemon_count=forced >> "$GITHUB_OUTPUT"
             echo web_count=forced >> "$GITHUB_OUTPUT"
             echo docs_count=forced >> "$GITHUB_OUTPUT"
+            echo installer_build=forced >> "$GITHUB_OUTPUT"
             echo installer_count=forced >> "$GITHUB_OUTPUT"
+            echo installer_gui_count=forced >> "$GITHUB_OUTPUT"
             echo rootshell_count=forced >> "$GITHUB_OUTPUT"
           else
             echo "code_count=$(git diff --name-only $lcommit...HEAD | grep -e ^daemon -e ^installer -e ^check -e ^lib -e ^rootshell -e ^telcom-parser | wc -l)" >> "$GITHUB_OUTPUT"
             echo "daemon_count=$(git diff --name-only $lcommit...HEAD | grep -e ^daemon -e ^lib -e ^telcom-parser | wc -l)" >> "$GITHUB_OUTPUT"
             echo "web_count=$(git diff --name-only $lcommit...HEAD | grep -e ^daemon/web | wc -l)" >> "$GITHUB_OUTPUT"
             echo "docs_count=$(git diff --name-only $lcommit...HEAD | grep -e ^book.toml -e ^doc | wc -l)" >> "$GITHUB_OUTPUT"
-            echo "installer_count=$(git diff --name-only $lcommit...HEAD | grep -e ^installer | wc -l)" >> "$GITHUB_OUTPUT"
             echo "rootshell_count=$(git diff --name-only $lcommit...HEAD | grep -e ^rootshell | wc -l)" >> "$GITHUB_OUTPUT"
+
+            installer_count=$(git diff --name-only $lcommit...HEAD | grep -e ^installer/ | wc -l)
+            installer_gui_count=$(git diff --name-only $lcommit...HEAD | grep -e ^installer-gui | wc -l)
+
+            if [ $installer_count != "0" ] || [ $installer_gui_count != "0" ]; then
+              echo "installer_build=1" >> "$GITHUB_OUTPUT"
+            else
+              echo "installer_build=0" >> "$GITHUB_OUTPUT"
+            fi
+
+            echo "installer_count=$installer_count" >> "$GITHUB_OUTPUT"
+            echo "installer_gui_count=$installer_gui_count" >> "$GITHUB_OUTPUT"
           fi
 
   mdbook_test:
     name: Test mdBook Documentation builds
     needs: files_changed
-    if: needs.files_changed.outputs.docs_changed != '0'
+    if: needs.files_changed.outputs.docs_changed == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install mdBook
         run: |
           cargo install mdbook --no-default-features --features search --vers "^0.4" --locked
@@ -80,6 +101,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Install mdBook
         run: |
           cargo install mdbook --no-default-features --features search --vers "^0.4" --locked
@@ -98,12 +121,17 @@ jobs:
 
   check_and_test:
     needs: files_changed
-    if: needs.files_changed.outputs.code_changed != '0'
+    if: needs.files_changed.outputs.code_changed == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - uses: dtolnay/rust-toolchain@stable
+      with:
+        components: rustfmt, clippy
     - uses: Swatinem/rust-cache@v2
     - name: Check formatting
       run: cargo fmt --all --check
@@ -121,9 +149,37 @@ jobs:
       run: |
         NO_FIRMWARE_BIN=true cargo clippy --verbose
 
-  test_web_frontend:
+  installer_gui_check:
+    # we test the GUI installer separately to:
+    # 1) mimic the default behavior of cargo commands for rayhunter devs where
+    #    installer-gui isn't one of the default workspace packages
+    # 2) avoid slowing down development on changes unrelated to the GUI installer
     needs: files_changed
-    if: needs.files_changed.outputs.web_changed != '0'
+    if: needs.files_changed.outputs.installer_gui_changed == 'true'
+    # we run this on macos simply because no additional OS packages need to be
+    # installed
+    runs-on: macos-latest
+    permissions:
+      contents: read
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - uses: dtolnay/rust-toolchain@stable
+      with:
+        components: clippy
+    - uses: Swatinem/rust-cache@v2
+    # we don't need to run cargo fmt here because both cargo fmt and cargo
+    # fmt --all runs on all workspace packages so this is handled by
+    # check_and_test above
+    - name: Check
+      run: NO_FIRMWARE_BIN=true cargo check --package installer-gui --verbose
+    - name: Run clippy
+      run: NO_FIRMWARE_BIN=true cargo clippy --package installer-gui --verbose
+
+  test_daemon_frontend:
+    needs: files_changed
+    if: needs.files_changed.outputs.web_changed == 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -132,19 +188,40 @@ jobs:
         working-directory: daemon/web
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - run: npm install
       - run: npm run lint
       - run: npm run check
       - run: npm run test
 
+  test_installer_frontend:
+    needs: files_changed
+    if: needs.files_changed.outputs.installer_gui_changed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: installer-gui
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - run: npm install
+      - run: npm run lint
+      - run: npm run check
+
   windows_installer_check_and_test:
     needs: files_changed
-    if: needs.files_changed.outputs.installer_changed != '0'
+    if: needs.files_changed.outputs.installer_changed == 'true'
     runs-on: windows-latest
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: Swatinem/rust-cache@v2
       - name: cargo check
         shell: bash
@@ -158,7 +235,7 @@ jobs:
           NO_FIRMWARE_BIN=true cargo test --verbose --no-default-features
 
   build_rayhunter_check:
-    if: needs.files_changed.outputs.daemon_changed != '0'
+    if: needs.files_changed.outputs.daemon_changed == 'true'
     needs:
       - check_and_test
       - files_changed
@@ -181,7 +258,7 @@ jobs:
             os: macos-latest
             target: aarch64-apple-darwin
           - name: macos-intel
-            os: macos-13
+            os: macos-latest
             target: x86_64-apple-darwin
           - name: windows-x86_64
             os: windows-latest
@@ -189,6 +266,8 @@ jobs:
     runs-on: ${{ matrix.platform.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.platform.target }}
@@ -202,7 +281,7 @@ jobs:
           if-no-files-found: error
 
   build_rootshell:
-    if: needs.files_changed.outputs.rootshell_changed != '0'
+    if: needs.files_changed.outputs.rootshell_needed == 'true'
     needs:
       - check_and_test
       - files_changed
@@ -211,12 +290,14 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: armv7-unknown-linux-musleabihf
       - uses: Swatinem/rust-cache@v2
       - name: Build rootshell (armv7)
-        run: cargo build --bin rootshell --target armv7-unknown-linux-musleabihf --profile=firmware
+        run: cargo build -p rootshell --bin rootshell --target armv7-unknown-linux-musleabihf --profile=firmware
       - uses: actions/upload-artifact@v4
         with:
           name: rootshell
@@ -224,7 +305,7 @@ jobs:
           if-no-files-found: error
 
   build_rayhunter:
-    if: needs.files_changed.outputs.daemon_changed != '0'
+    if: needs.files_changed.outputs.daemon_needed == 'true'
     needs:
       - check_and_test
       - files_changed
@@ -234,10 +315,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: armv7-unknown-linux-musleabihf
       - uses: Swatinem/rust-cache@v2
+      - name: Install ARM cross-compilation toolchain
+        run: sudo apt-get update && sudo apt-get install -y gcc-arm-linux-gnueabihf
       - name: Build rayhunter-daemon (armv7)
         run: |
           pushd daemon/web
@@ -252,7 +337,7 @@ jobs:
           # what the feature selection in rayhunter-daemon is.
           #
           # https://github.com/rust-lang/cargo/issues/4463
-          cargo build -p rayhunter-daemon --bin rayhunter-daemon --target armv7-unknown-linux-musleabihf --profile=firmware
+          CC_armv7_unknown_linux_musleabihf=arm-linux-gnueabihf-gcc cargo build-daemon-firmware
       - uses: actions/upload-artifact@v4
         with:
           name: rayhunter-daemon
@@ -260,7 +345,7 @@ jobs:
           if-no-files-found: error
 
   build_rust_installer:
-    if: needs.files_changed.outputs.installer_changed != '0'
+    if: needs.files_changed.outputs.installer_changed == 'true'
     permissions:
       contents: read
       packages: write
@@ -285,7 +370,7 @@ jobs:
             os: macos-latest
             target: aarch64-apple-darwin
           - name: macos-intel
-            os: macos-13
+            os: macos-latest
             target: x86_64-apple-darwin
           - name: windows-x86_64
             os: windows-latest
@@ -293,6 +378,8 @@ jobs:
     runs-on: ${{ matrix.platform.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/download-artifact@v4
       - uses: dtolnay/rust-toolchain@stable
         with:
@@ -305,6 +392,145 @@ jobs:
           path: target/${{ matrix.platform.target }}/release/installer${{ matrix.platform.os == 'windows-latest' && '.exe' || '' }}
           if-no-files-found: error
 
+  build_installer_gui_linux:
+    if: needs.files_changed.outputs.installer_gui_changed == 'true'
+    permissions:
+      contents: read
+      packages: write
+    needs:
+      - build_rayhunter
+      - build_rootshell
+      - files_changed
+      - installer_gui_check
+      - test_installer_frontend
+    strategy:
+      matrix:
+        platform:
+          # we want to use the oldest supported version of ubuntu here to
+          # maximize compatibility with older versions of glibc
+          - name: linux-x64
+            os: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+          - name: linux-aarch64
+            os: ubuntu-22.04-arm
+            target: aarch64-unknown-linux-gnu
+    runs-on: ${{ matrix.platform.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.platform.target }}
+      - uses: Swatinem/rust-cache@v2
+      - name: Install tauri dependencies
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev build-essential curl wget file libxdo-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev xdg-utils
+      - name: Build GUI installer
+        shell: bash
+        run: |
+          cd installer-gui
+          npm install
+          npm run tauri build -- --target ${{ matrix.platform.target }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: gui-installer-${{ matrix.platform.name }}-appimage
+          path: target/${{ matrix.platform.target }}/release/bundle/appimage/*.AppImage
+          if-no-files-found: error
+      - uses: actions/upload-artifact@v4
+        with:
+          name: gui-installer-${{ matrix.platform.name }}-deb
+          path: target/${{ matrix.platform.target }}/release/bundle/deb/*.deb
+          if-no-files-found: error
+      - uses: actions/upload-artifact@v4
+        with:
+          name: gui-installer-${{ matrix.platform.name }}-rpm
+          path: target/${{ matrix.platform.target }}/release/bundle/rpm/*.rpm
+          if-no-files-found: error
+
+  build_installer_gui_macos:
+    if: needs.files_changed.outputs.installer_gui_changed == 'true'
+    permissions:
+      contents: read
+      packages: write
+    needs:
+      - build_rayhunter
+      - build_rootshell
+      - files_changed
+      - installer_gui_check
+      - test_installer_frontend
+    strategy:
+      matrix:
+        platform:
+          - name: macos-arm
+            target: aarch64-apple-darwin
+          - name: macos-intel
+            target: x86_64-apple-darwin
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.platform.target }}
+      - uses: Swatinem/rust-cache@v2
+      - name: Build GUI installer
+        shell: bash
+        run: |
+          cd installer-gui
+          npm install
+          npm run tauri build -- --target ${{ matrix.platform.target }}
+          cd ..
+          mv "target/${{ matrix.platform.target }}/release/bundle/macos/"*.app .
+          zip -r "rayhunter-installer-${{ matrix.platform.name }}.app.zip" ./*.app
+      - uses: actions/upload-artifact@v4
+        with:
+          name: gui-installer-${{ matrix.platform.name }}-app
+          path: ./*.app.zip
+          if-no-files-found: error
+
+  build_installer_gui_windows:
+    if: needs.files_changed.outputs.installer_gui_changed == 'true'
+    permissions:
+      contents: read
+      packages: write
+    needs:
+      - build_rayhunter
+      - build_rootshell
+      - files_changed
+      - installer_gui_check
+      - test_installer_frontend
+    env:
+      TARGET: x86_64-pc-windows-msvc
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ env.TARGET }}
+      - uses: Swatinem/rust-cache@v2
+      - name: Build GUI installer
+        shell: bash
+        run: |
+          cd installer-gui
+          npm install
+          npm run tauri build -- --target ${{ env.TARGET }}
+      - uses: actions/upload-artifact@v4
+        with:
+          name: gui-installer-msi
+          path: target/${{ env.TARGET }}/release/bundle/msi/*.msi
+          if-no-files-found: error
+      - uses: actions/upload-artifact@v4
+        with:
+          name: gui-installer-exe
+          path: target/${{ env.TARGET }}/release/bundle/nsis/*.exe
+          if-no-files-found: error
+
   build_release_zip:
     permissions:
       contents: read
@@ -326,6 +552,8 @@ jobs:
           - windows-x86_64
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/download-artifact@v4
       - name: Fix executable permissions on binaries
         run: chmod +x installer-*/installer rayhunter-check-*/rayhunter-check rayhunter-daemon/rayhunter-daemon
@@ -335,10 +563,15 @@ jobs:
       - name: Setup versioned release directory
         run: |
           platform="${{ matrix.platform }}"
-          dest="rayhunter-v${{ env.VERSION }}-${{ matrix.platform }}"
+          dest="rayhunter-v${VERSION}-${{ matrix.platform }}"
           mkdir "$dest"
-          mv installer-$platform/installer* "$dest"/installer
-          cp -r rayhunter-daemon rootshell/rootshell dist/* installer/install.ps1 "$dest"/
+          # Handle installer with proper extension for Windows
+          if [ "$platform" = "windows-x86_64" ]; then
+            mv installer-$platform/installer.exe "$dest"/installer.exe
+          else
+            mv installer-$platform/installer "$dest"/installer
+          fi
+          cp -r rayhunter-check-* rayhunter-daemon dist/scripts "$dest"/
           zip -r "$dest.zip" "$dest"
           sha256sum "$dest.zip" > "$dest.zip.sha256"
 

.github/workflows/release.yml

@@ -14,10 +14,12 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Ensure all Cargo.toml files have the same version defined.
         run: |
-          defined_versions=$(find lib check daemon installer rootshell telcom-parser -name Cargo.toml -exec grep ^version {} \; | sort -u | wc -l)
-          find lib check daemon installer rootshell telcom-parser -name Cargo.toml -exec grep ^version {} \;
+          defined_versions=$(find lib check daemon installer installer-gui rootshell telcom-parser -name Cargo.toml -exec grep ^version {} \; | sort -u | wc -l)
+          find lib check daemon installer installer-gui rootshell telcom-parser -name Cargo.toml -exec grep ^version {} \;
           echo number of defined versions = $defined_versions
           if [ $defined_versions != "1" ]
           then
@@ -41,6 +43,8 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/download-artifact@v4
       - name: Create release
         run: |

CONTRIBUTING.md

@@ -0,0 +1,75 @@
+# How to contribute to Rayhunter
+
+## Filing issues and starting discussions
+
+Our issue tracker is [on GitHub](https://github.com/EFForg/rayhunter/issues).
+
+- If your rayhunter has found an IMSI-catcher, we strongly encourage you to
+  [send us that information
+  privately.](https://efforg.github.io/rayhunter/faq.html#help-rayhunters-line-is-redorangeyellowdotteddashed-what-should-i-do) via Signal.
+
+- Issues should be actionable. If you don't have a
+  specific feature request or bug report, consider [creating a
+  discussion](https://github.com/EFForg/rayhunter/discussions) or [joining our Mattermost](https://efforg.github.io/rayhunter/support-feedback-community.html) instead.
+
+  Example of a good bug report:
+
+  - "Installer broken on TP-Link M7350 v3.0"
+  - "Display does not update to green after finding"
+  - "The documentation is wrong" (though we encourage you to file a pull request directly)
+
+  Example of a good feature request:
+
+  - "Use LED on device XYZ for showing recording status"
+
+  Example of something that belongs into discussion:
+
+  - "In region XYZ, do I need an activated SIM?"
+  - "Where to buy this device in region XYZ?"
+  - "Can this device be supported?" While this is a valid feature
+    request, we just get this request too often, and without some exploratory
+    work done upfront it's often unclear initially if that device can be
+    supported at all.
+
+- The issue templates are mostly there to give you a clue what kind of
+  information is needed from you, and whether your request belongs into the issue
+  tracker. Fill them out to be on the safe side, but they are not mandatory.
+
+## Contributing patches
+
+To edit documentation or fix a bug, make a pull request. If you're about to
+write a substantial amount of code or implement a new feature, we strongly
+encourage you to talk to us before implementing it or check if any issues have
+been opened for it already. Otherwise there is a chance we will reject your
+contribution after you have spent time on it.
+
+On the other hand, for small documentation fixes you can file a PR without
+filing an issue.
+
+Otherwise:
+
+- Refer to [installing from
+  source](https://efforg.github.io/rayhunter/installing-from-source.html) for
+  how to build Rayhunter from the git repository.
+
+- Ensure that `cargo fmt` and `cargo clippy` have been run.
+
+- If you add new features, please do your best to both write tests for and also
+  manually test them. Our test coverage isn't great, but as new features are
+  added we are trying to prevent it from becoming worse.
+
+If you have any questions [feel free to open a discussion or chat with us on Mattermost.](https://efforg.github.io/rayhunter/support-feedback-community.html)
+
+## Making releases
+
+This one is for maintainers of Rayhunter.
+
+1. Make a PR changing the versions in `Cargo.toml` and other files.
+   This could be automated better but right now it's manual. You can do this easily with sed:
+   `sed -i "" -E 's/x.x.x/y.y.y/g' */Cargo.toml`
+
+2. Merge PR and make a tag.
+
+3. [Run release workflow.](https://github.com/EFForg/rayhunter/actions/workflows/release.yml)
+
+4. Write changelog, edit it into the release, announce on mattermost.

Cargo.toml

@@ -7,5 +7,17 @@ members = [
     "rootshell",
     "telcom-parser",
     "installer",
+    "installer-gui/src-tauri",
+]
+# at least for now, let's keep installer-gui out of the list of default
+# packages. installer-gui is still experimental and requires many new packages
+# both from cargo and the underlying operating system
+default-members = [
+    "lib",
+    "daemon",
+    "check",
+    "rootshell",
+    "telcom-parser",
+    "installer",
 ]
 resolver = "2"

README.md

@@ -1,7 +1,19 @@
-![Rayhunter Logo - An Orca taking a bite out of a cellular signal bar](https://www.eff.org/files/styles/media_browser_preview/public/banner_library/rayhunter-banner.png)
-
 # Rayhunter
-
 ![Tests](https://github.com/EFForg/rayhunter/actions/workflows/main.yml/badge.svg)
 
-Rayhunter is an IMSI Catcher Catcher for the Orbic mobile hotspot. To learn more, check out the [Rayhunter Book](https://efforg.github.io/rayhunter/).
+![Rayhunter Logo - An Orca taking a bite out of a cellular signal bar](https://www.eff.org/files/styles/media_browser_preview/public/banner_library/rayhunter-banner.png)
+
+Rayhunter is a project for detecting IMSI catchers, also known as cell-site simulators or stingrays. It was first designed to run on a cheap mobile hotspot called the Orbic RC400L, but thanks to community efforts, it can [support some other devices as well](https://efforg.github.io/rayhunter/supported-devices.html).
+It's also designed to be as easy to install and use as possible, regardless of your level of technical skills, and to minimize false positives. 
+
+→  Check out the [installation guide](https://efforg.github.io/rayhunter/installation.html) to get started.
+
+→ To learn more about the aim of the project, and about IMSI catchers in general, please check out our [introductory blog post](https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying). 
+
+→ For discussion, help, or to join the mattermost channel and get involved with the project and community check out the [many ways listed here](https://efforg.github.io/rayhunter/support-feedback-community.html)!
+
+→ To learn more about the project in general check out the [Rayhunter Book](https://efforg.github.io/rayhunter/).
+
+**LEGAL DISCLAIMER:** Use this program at your own risk. We believe running this program does not currently violate any laws or regulations in the United States. However, we are not responsible for civil or criminal liability resulting from the use of this software. If you are located outside of the US please consult with an attorney in your country to help you assess the legal risks of running this program.
+
+*Good Hunting!*

check/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rayhunter-check"
-version = "0.5.1"
+version = "0.10.0"
 edition = "2024"
 
 [dependencies]
@@ -10,5 +10,4 @@ log = "0.4.20"
 tokio = { version = "1.44.2", default-features = false, features = ["fs", "signal", "process", "rt-multi-thread"] }
 pcap-file-tokio = "0.1.0"
 clap = { version = "4.5.2", features = ["derive"] }
-simple_logger = "5.0.0"
 walkdir = "2.5.0"

check/src/main.rs

@@ -16,19 +16,19 @@ use walkdir::WalkDir;
 #[derive(Parser, Debug)]
 #[command(version, about)]
 struct Args {
-    #[arg(short = 'p', long)]
+    #[arg(short = 'p', long, help = "A file or directory of packet captures")]
     path: PathBuf,
 
-    #[arg(short = 'P', long)]
+    #[arg(short = 'P', long, help = "Convert qmdl files to pcap before analysis")]
     pcapify: bool,
 
-    #[arg(long)]
+    #[arg(long, help = "Show why some packets were skipped during analysis")]
     show_skipped: bool,
 
-    #[arg(short, long)]
+    #[arg(short, long, help = "Only print warnings/errors to stdout")]
     quiet: bool,
 
-    #[arg(short, long)]
+    #[arg(short, long, help = "Show debug messages")]
     debug: bool,
 }
 
@@ -65,10 +65,10 @@ impl Report {
                 EventType::Informational => {
                     info!("{}: INFO - {} {}", self.file_path, timestamp, event.message,);
                 }
-                EventType::QualitativeWarning { severity } => {
+                EventType::Low | EventType::Medium | EventType::High => {
                     warn!(
                         "{}: WARNING (Severity: {:?}) - {} {}",
-                        self.file_path, severity, timestamp, event.message,
+                        self.file_path, event.event_type, timestamp, event.message,
                     );
                     self.warnings += 1;
                 }
@@ -177,14 +177,7 @@ async fn main() {
     } else {
         log::LevelFilter::Info
     };
-    simple_logger::SimpleLogger::new()
-        .with_colors(true)
-        .without_timestamps()
-        .with_level(level)
-        //Filter out a stupid massive amount of uneccesary warnings from hampi about undecoded extensions
-        .with_module_level("asn1_codecs", log::LevelFilter::Error)
-        .init()
-        .unwrap();
+    rayhunter::init_logging(level);
 
     let harness = Harness::new_with_config(&AnalyzerConfig::default());
     info!("Analyzers:");

daemon/Cargo.toml

@@ -1,7 +1,13 @@
 [package]
 name = "rayhunter-daemon"
-version = "0.5.1"
+version = "0.10.0"
 edition = "2024"
+rust-version = "1.88.0"
+
+[features]
+default = ["rustcrypto-tls"]
+rustcrypto-tls = ["reqwest/rustls-tls-webpki-roots-no-provider", "dep:rustls-rustcrypto"]
+ring-tls = ["reqwest/rustls-tls-webpki-roots"]
 
 [dependencies]
 rayhunter = { path = "../lib" }
@@ -12,16 +18,17 @@ axum = { version = "0.8", default-features = false, features = ["http1", "tokio"
 thiserror = "1.0.52"
 libc = "0.2.150"
 log = "0.4.20"
-env_logger = { version = "0.11", default-features = false }
 tokio-util = { version = "0.7.10", features = ["rt", "io", "compat"] }
 futures-macro = "0.3.30"
 include_dir = "0.7.3"
 chrono = { version = "0.4.31", features = ["serde"] }
-tokio-stream = { version = "0.1.14", default-features = false }
+tokio-stream = { version = "0.1.14", default-features = false, features = ["io-util"] }
 futures = { version = "0.3.30", default-features = false }
 serde_json = "1.0.114"
 image = { version =  "0.25.1", default-features = false, features = ["png", "gif"] }
 tempfile = "3.10.1"
 async_zip = { version = "0.0.17", features = ["tokio"] }
 anyhow = "1.0.98"
+reqwest = { version = "0.12.20", default-features = false }
+rustls-rustcrypto = { version = "0.0.2-alpha", optional = true }
 async-trait = "0.1.88"

daemon/src/analysis.rs

@@ -1,5 +1,5 @@
 use std::sync::Arc;
-use std::{future, pin};
+use std::{cmp, future, pin};
 
 use axum::Json;
 use axum::{
@@ -8,7 +8,7 @@ use axum::{
 };
 use futures::TryStreamExt;
 use log::{error, info};
-use rayhunter::analysis::analyzer::{AnalyzerConfig, Harness};
+use rayhunter::analysis::analyzer::{AnalyzerConfig, EventType, Harness};
 use rayhunter::diag::{DataType, MessagesContainer};
 use rayhunter::qmdl::QmdlReader;
 use serde::Serialize;
@@ -47,15 +47,19 @@ impl AnalysisWriter {
 
     // Runs the analysis harness on the given container, serializing the results
     // to the analysis file, returning the whether any warnings were detected
-    pub async fn analyze(&mut self, container: MessagesContainer) -> Result<bool, std::io::Error> {
-        let mut warning_detected = false;
+    pub async fn analyze(
+        &mut self,
+        container: MessagesContainer,
+    ) -> Result<EventType, std::io::Error> {
+        let mut max_type = EventType::Informational;
+
         for row in self.harness.analyze_qmdl_messages(container) {
             if !row.is_empty() {
                 self.write(&row).await?;
             }
-            warning_detected |= row.contains_warnings();
+            max_type = cmp::max(max_type, row.get_max_event_type());
         }
-        Ok(warning_detected)
+        Ok(max_type)
     }
 
     async fn write<T: Serialize>(&mut self, value: &T) -> Result<(), std::io::Error> {

daemon/src/battery/mod.rs

@@ -0,0 +1,117 @@
+use std::{path::Path, time::Duration};
+
+use log::{info, warn};
+use rayhunter::Device;
+use serde::Serialize;
+use tokio::select;
+use tokio_util::{sync::CancellationToken, task::TaskTracker};
+
+use crate::{
+    error::RayhunterError,
+    notifications::{Notification, NotificationType},
+};
+
+pub mod orbic;
+pub mod tmobile;
+pub mod tplink;
+pub mod wingtech;
+
+const LOW_BATTERY_LEVEL: u8 = 10;
+
+#[derive(Clone, Copy, PartialEq, Debug, Serialize)]
+pub struct BatteryState {
+    level: u8,
+    is_plugged_in: bool,
+}
+
+async fn is_plugged_in_from_file(path: &Path) -> Result<bool, RayhunterError> {
+    match tokio::fs::read_to_string(path)
+        .await
+        .map_err(RayhunterError::TokioError)?
+        .chars()
+        .next()
+    {
+        Some('0') => Ok(false),
+        Some('1') => Ok(true),
+        _ => Err(RayhunterError::BatteryPluggedInStatusParseError),
+    }
+}
+
+async fn get_level_from_percentage_file(path: &Path) -> Result<u8, RayhunterError> {
+    tokio::fs::read_to_string(path)
+        .await
+        .map_err(RayhunterError::TokioError)?
+        .trim_end()
+        .parse()
+        .or(Err(RayhunterError::BatteryLevelParseError))
+}
+
+pub async fn get_battery_status(device: &Device) -> Result<BatteryState, RayhunterError> {
+    Ok(match device {
+        Device::Orbic => orbic::get_battery_state().await?,
+        Device::Wingtech => wingtech::get_battery_state().await?,
+        Device::Tmobile => tmobile::get_battery_state().await?,
+        Device::Tplink => tplink::get_battery_state().await?,
+        _ => return Err(RayhunterError::FunctionNotSupportedForDeviceError),
+    })
+}
+
+pub fn run_battery_notification_worker(
+    task_tracker: &TaskTracker,
+    device: Device,
+    notification_channel: tokio::sync::mpsc::Sender<Notification>,
+    shutdown_token: CancellationToken,
+) {
+    task_tracker.spawn(async move {
+        // Don't send a notification initially if the device starts at a low battery level.
+        let mut triggered = match get_battery_status(&device).await {
+            Err(RayhunterError::FunctionNotSupportedForDeviceError) => {
+                info!("Battery status not supported for this device, disabling battery notifications");
+                return;
+            }
+            Err(e) => {
+                warn!("Failed to get battery status: {e}");
+                true
+            }
+            Ok(status) => status.level <= LOW_BATTERY_LEVEL,
+        };
+
+        loop {
+            select! {
+                _ = shutdown_token.cancelled() => break,
+                _ = tokio::time::sleep(Duration::from_secs(15)) => {}
+            }
+
+            let status = match get_battery_status(&device).await {
+                Err(RayhunterError::FunctionNotSupportedForDeviceError) => {
+                    info!("Battery status not supported for this device, disabling battery notifications");
+                    break;
+                }
+                Err(e) => {
+                    warn!("Failed to get battery status: {e}");
+                    continue;
+                }
+                Ok(status) => status,
+            };
+
+            // To avoid flapping, if the notification has already been triggered
+            // wait until the device has been plugged in and the battery level
+            // is high enough to re-enable notifications.
+            if triggered && status.is_plugged_in && status.level > LOW_BATTERY_LEVEL {
+                triggered = false;
+                continue;
+            }
+            if !triggered && !status.is_plugged_in && status.level <= LOW_BATTERY_LEVEL {
+                notification_channel
+                    .send(Notification::new(
+                        NotificationType::LowBattery,
+                        "Rayhunter's battery is low".to_string(),
+                        None,
+                    ))
+                    .await
+                    .expect("Failed to send to notification channel");
+                triggered = true;
+            }
+        }
+    });
+}

daemon/src/battery/orbic.rs

@@ -0,0 +1,28 @@
+use std::path::Path;
+
+use crate::{
+    battery::{BatteryState, is_plugged_in_from_file},
+    error::RayhunterError,
+};
+
+const BATTERY_LEVEL_FILE: &str = "/sys/kernel/chg_info/level";
+const PLUGGED_IN_STATE_FILE: &str = "/sys/kernel/chg_info/chg_en";
+
+pub async fn get_battery_state() -> Result<BatteryState, RayhunterError> {
+    Ok(BatteryState {
+        level: match tokio::fs::read_to_string(&BATTERY_LEVEL_FILE)
+            .await
+            .map_err(RayhunterError::TokioError)?
+            .chars()
+            .next()
+        {
+            Some('1') => Ok(10),
+            Some('2') => Ok(25),
+            Some('3') => Ok(50),
+            Some('4') => Ok(75),
+            Some('5') => Ok(100),
+            _ => Err(RayhunterError::BatteryLevelParseError),
+        }?,
+        is_plugged_in: is_plugged_in_from_file(Path::new(PLUGGED_IN_STATE_FILE)).await?,
+    })
+}

daemon/src/battery/tmobile.rs

@@ -0,0 +1,16 @@
+use std::path::Path;
+
+use crate::{
+    battery::{BatteryState, get_level_from_percentage_file, is_plugged_in_from_file},
+    error::RayhunterError,
+};
+
+const BATTERY_LEVEL_FILE: &str = "/sys/class/power_supply/bms/capacity";
+const PLUGGED_IN_STATE_FILE: &str = "/sys/devices/78d9000.usb/power_supply/usb/online";
+
+pub async fn get_battery_state() -> Result<BatteryState, RayhunterError> {
+    Ok(BatteryState {
+        level: get_level_from_percentage_file(Path::new(BATTERY_LEVEL_FILE)).await?,
+        is_plugged_in: is_plugged_in_from_file(Path::new(PLUGGED_IN_STATE_FILE)).await?,
+    })
+}

daemon/src/battery/tplink.rs

@@ -0,0 +1,39 @@
+use crate::{battery::BatteryState, error::RayhunterError};
+
+pub async fn get_battery_state() -> Result<BatteryState, RayhunterError> {
+    let uci_battery = tokio::process::Command::new("uci")
+        .arg("get")
+        .arg("battery.battery_mgr.power_level")
+        .output()
+        .await?;
+
+    let uci_plugged_in = tokio::process::Command::new("uci")
+        .arg("get")
+        .arg("battery.battery_mgr.is_charging")
+        .output()
+        .await?;
+
+    if !uci_battery.status.success() {
+        return Err(RayhunterError::BatteryLevelParseError);
+    }
+
+    if !uci_plugged_in.status.success() {
+        return Err(RayhunterError::BatteryPluggedInStatusParseError);
+    }
+
+    let uci_battery = String::from_utf8_lossy(&uci_battery.stdout)
+        .trim_end()
+        .parse()
+        .map_err(|_| RayhunterError::BatteryLevelParseError)?;
+
+    let uci_plugged_in = match String::from_utf8_lossy(&uci_plugged_in.stdout).trim_end() {
+        "0" => Ok(false),
+        "1" => Ok(true),
+        _ => Err(RayhunterError::BatteryPluggedInStatusParseError),
+    }?;
+
+    Ok(BatteryState {
+        level: uci_battery,
+        is_plugged_in: uci_plugged_in,
+    })
+}

daemon/src/battery/wingtech.rs

@@ -0,0 +1,17 @@
+use std::path::Path;
+
+use crate::{
+    battery::{BatteryState, get_level_from_percentage_file, is_plugged_in_from_file},
+    error::RayhunterError,
+};
+
+const BATTERY_LEVEL_FILE: &str =
+    "/sys/devices/78b7000.i2c/i2c-3/3-0063/power_supply/cw2017-bat/capacity";
+const PLUGGED_IN_STATE_FILE: &str = "/sys/devices/8a00000.ssusb/power_supply/usb/online";
+
+pub async fn get_battery_state() -> Result<BatteryState, RayhunterError> {
+    Ok(BatteryState {
+        level: get_level_from_percentage_file(Path::new(BATTERY_LEVEL_FILE)).await?,
+        is_plugged_in: is_plugged_in_from_file(Path::new(PLUGGED_IN_STATE_FILE)).await?,
+    })
+}

daemon/src/config.rs

@@ -5,6 +5,7 @@ use rayhunter::Device;
 use rayhunter::analysis::analyzer::AnalyzerConfig;
 
 use crate::error::RayhunterError;
+use crate::notifications::NotificationType;
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
 #[serde(default)]
@@ -16,6 +17,8 @@ pub struct Config {
     pub ui_level: u8,
     pub colorblind_mode: bool,
     pub key_input_mode: u8,
+    pub ntfy_url: Option<String>,
+    pub enabled_notifications: Vec<NotificationType>,
     pub analyzers: AnalyzerConfig,
 }
 
@@ -30,6 +33,8 @@ impl Default for Config {
             colorblind_mode: false,
             key_input_mode: 0,
             analyzers: AnalyzerConfig::default(),
+            ntfy_url: None,
+            enabled_notifications: vec![NotificationType::Warning, NotificationType::LowBattery],
         }
     }
 }

daemon/src/diag.rs

@@ -1,26 +1,30 @@
 use std::ops::DerefMut;
 use std::pin::pin;
 use std::sync::Arc;
+use std::time::Duration;
 
 use axum::body::Body;
 use axum::extract::{Path, State};
 use axum::http::StatusCode;
 use axum::http::header::CONTENT_TYPE;
 use axum::response::{IntoResponse, Response};
-use futures::{StreamExt, TryStreamExt};
+use futures::{StreamExt, TryStreamExt, future};
 use log::{debug, error, info, warn};
-use rayhunter::analysis::analyzer::AnalyzerConfig;
+use tokio::fs::File;
+use tokio::io::{AsyncBufReadExt, BufReader};
+use tokio::sync::mpsc::{Receiver, Sender};
+use tokio::sync::{RwLock, oneshot};
+use tokio_stream::wrappers::LinesStream;
+use tokio_util::task::TaskTracker;
+
+use rayhunter::analysis::analyzer::{AnalysisLineNormalizer, AnalyzerConfig, EventType};
 use rayhunter::diag::{DataType, MessagesContainer};
 use rayhunter::diag_device::DiagDevice;
 use rayhunter::qmdl::QmdlWriter;
-use tokio::fs::File;
-use tokio::sync::mpsc::{Receiver, Sender};
-use tokio::sync::{RwLock, oneshot};
-use tokio_util::io::ReaderStream;
-use tokio_util::task::TaskTracker;
 
 use crate::analysis::{AnalysisCtrlMessage, AnalysisWriter};
 use crate::display;
+use crate::notifications::{Notification, NotificationType};
 use crate::qmdl_store::{RecordingStore, RecordingStoreError};
 use crate::server::ServerState;
 
@@ -41,7 +45,9 @@ pub struct DiagTask {
     ui_update_sender: Sender<display::DisplayState>,
     analysis_sender: Sender<AnalysisCtrlMessage>,
     analyzer_config: AnalyzerConfig,
+    notification_channel: tokio::sync::mpsc::Sender<Notification>,
     state: DiagState,
+    max_type_seen: EventType,
 }
 
 enum DiagState {
@@ -57,17 +63,21 @@ impl DiagTask {
         ui_update_sender: Sender<display::DisplayState>,
         analysis_sender: Sender<AnalysisCtrlMessage>,
         analyzer_config: AnalyzerConfig,
+        notification_channel: tokio::sync::mpsc::Sender<Notification>,
     ) -> Self {
         Self {
             ui_update_sender,
             analysis_sender,
             analyzer_config,
+            notification_channel,
             state: DiagState::Stopped,
+            max_type_seen: EventType::Informational,
         }
     }
 
     /// Start recording
     async fn start(&mut self, qmdl_store: &mut RecordingStore) {
+        self.max_type_seen = EventType::Informational;
         let (qmdl_file, analysis_file) = qmdl_store
             .new_entry()
             .await
@@ -94,16 +104,15 @@ impl DiagTask {
     /// Stop recording
     async fn stop(&mut self, qmdl_store: &mut RecordingStore) {
         self.stop_current_recording().await;
-        if let Some((_, entry)) = qmdl_store.get_current_entry() {
-            if let Err(e) = self
+        if let Some((_, entry)) = qmdl_store.get_current_entry()
+            && let Err(e) = self
                 .analysis_sender
                 .send(AnalysisCtrlMessage::RecordingFinished(
                     entry.name.to_string(),
                 ))
                 .await
-            {
-                warn!("couldn't send analysis message: {e}");
-            }
+        {
+            warn!("couldn't send analysis message: {e}");
         }
         if let Err(e) = qmdl_store.close_current_entry().await {
             error!("couldn't close current entry: {e}");
@@ -190,16 +199,33 @@ impl DiagTask {
                 .await
                 .expect("failed to update qmdl file size");
             debug!("done!");
-            let heuristic_warning = analysis_writer
+            let max_type = analysis_writer
                 .analyze(container)
                 .await
                 .expect("failed to analyze container");
-            if heuristic_warning {
+
+            if max_type > EventType::Informational {
                 info!("a heuristic triggered on this run!");
-                self.ui_update_sender
-                    .send(display::DisplayState::WarningDetected)
+                self.notification_channel
+                    .send(Notification::new(
+                        NotificationType::Warning,
+                        format!("Rayhunter has detected a {:?} severity event", max_type),
+                        Some(Duration::from_secs(60 * 5)),
+                    ))
                     .await
-                    .expect("couldn't send ui update message: {}");
+                    .expect("Failed to send to notification channel");
+            }
+
+            if max_type > self.max_type_seen {
+                self.max_type_seen = max_type;
+                if self.max_type_seen > EventType::Informational {
+                    self.ui_update_sender
+                        .send(display::DisplayState::WarningDetected {
+                            event_type: self.max_type_seen,
+                        })
+                        .await
+                        .expect("couldn't send ui update message: {}");
+                }
             }
         } else {
             debug!("no qmdl_writer set, continuing...");
@@ -217,10 +243,11 @@ pub fn run_diag_read_thread(
     qmdl_store_lock: Arc<RwLock<RecordingStore>>,
     analysis_sender: Sender<AnalysisCtrlMessage>,
     analyzer_config: AnalyzerConfig,
+    notification_channel: tokio::sync::mpsc::Sender<Notification>,
 ) {
     task_tracker.spawn(async move {
         let mut diag_stream = pin!(dev.as_stream().into_stream());
-        let mut diag_task = DiagTask::new(ui_update_sender, analysis_sender, analyzer_config);
+        let mut diag_task = DiagTask::new(ui_update_sender, analysis_sender, analyzer_config, notification_channel);
         qmdl_file_tx
             .send(DiagDeviceCtrlMessage::StartRecording)
             .await
@@ -409,9 +436,17 @@ pub async fn get_analysis_report(
         .open_entry_analysis(entry_index)
         .await
         .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("{e:?}")))?;
-    let analysis_stream = ReaderStream::new(analysis_file);
+
+    // Read and normalize the NDJSON file
+    let reader = BufReader::new(analysis_file);
+    let lines_stream = LinesStream::new(reader.lines());
+
+    let mut normalizer = AnalysisLineNormalizer::new();
+    let normalized_stream = lines_stream
+        .try_filter(|line| future::ready(!line.is_empty()))
+        .map_ok(move |line| normalizer.normalize_line(line));
 
     let headers = [(CONTENT_TYPE, "application/x-ndjson")];
-    let body = Body::from_stream(analysis_stream);
+    let body = Body::from_stream(normalized_stream);
     Ok((headers, body).into_response())
 }

daemon/src/display/generic_framebuffer.rs

@@ -5,21 +5,29 @@ use std::time::Duration;
 
 use crate::config;
 use crate::display::DisplayState;
+use rayhunter::analysis::analyzer::EventType;
 
 use log::{error, info};
 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
-use tokio::sync::oneshot::error::TryRecvError;
-use tokio_util::task::TaskTracker;
+use tokio_util::{sync::CancellationToken, task::TaskTracker};
 
 use include_dir::{Dir, include_dir};
 
+const REFRESH_RATE: u64 = 1000; //how often in milliseconds to refresh the display
+
 #[derive(Copy, Clone)]
 pub struct Dimensions {
     pub height: u32,
     pub width: u32,
 }
 
+#[derive(Copy, Clone)]
+pub enum LinePattern {
+    Solid,
+    Dashed, // _ _ _ _
+    Dotted, // . . . .
+}
+
 #[allow(dead_code)]
 #[derive(Copy, Clone)]
 pub enum Color {
@@ -31,6 +39,7 @@ pub enum Color {
     Cyan,
     Yellow,
     Pink,
+    Orange,
 }
 
 impl Color {
@@ -44,23 +53,33 @@ impl Color {
             Color::Cyan => (0, 0xff, 0xff),
             Color::Yellow => (0xff, 0xff, 0),
             Color::Pink => (0xfe, 0x24, 0xff),
+            Color::Orange => (0xff, 0xa5, 0),
         }
     }
 }
 
-impl Color {
-    fn from_state(state: DisplayState, colorblind_mode: bool) -> Self {
-        match state {
-            DisplayState::Paused => Color::White,
-            DisplayState::Recording => {
+fn display_style_from_state(state: DisplayState, colorblind_mode: bool) -> (Color, LinePattern) {
+    match state {
+        DisplayState::Paused => (Color::White, LinePattern::Solid),
+        DisplayState::Recording => {
+            if colorblind_mode {
+                (Color::Blue, LinePattern::Solid)
+            } else {
+                (Color::Green, LinePattern::Solid)
+            }
+        }
+        DisplayState::WarningDetected { event_type } => match event_type {
+            EventType::Informational => {
                 if colorblind_mode {
-                    Color::Blue
+                    (Color::Blue, LinePattern::Solid)
                 } else {
-                    Color::Green
+                    (Color::Green, LinePattern::Solid)
                 }
             }
-            DisplayState::WarningDetected => Color::Red,
-        }
+            EventType::Low => (Color::Yellow, LinePattern::Dotted),
+            EventType::Medium => (Color::Orange, LinePattern::Dashed),
+            EventType::High => (Color::Red, LinePattern::Solid),
+        },
     }
 }
 
@@ -120,11 +139,28 @@ pub trait GenericFramebuffer: Send + 'static {
     }
 
     async fn draw_line(&mut self, color: Color, height: u32) {
+        self.draw_patterned_line(color, height, LinePattern::Solid)
+            .await
+    }
+
+    async fn draw_patterned_line(&mut self, color: Color, height: u32, pattern: LinePattern) {
         let width = self.dimensions().width;
-        let px_num = height * width;
         let mut buffer = Vec::new();
-        for _ in 0..px_num {
-            buffer.push(color.rgb());
+
+        for _row in 0..height {
+            for col in 0..width {
+                let should_draw = match pattern {
+                    LinePattern::Solid => true,
+                    LinePattern::Dashed => (col / 4) % 2 == 0, // 4 pixels on, 4 pixels off
+                    LinePattern::Dotted => col % 4 == 0,       // 1 pixel on, 3 pixels off
+                };
+
+                if should_draw {
+                    buffer.push(color.rgb());
+                } else {
+                    buffer.push((0, 0, 0)); // Black background
+                }
+            }
         }
 
         self.write_buffer(buffer).await
@@ -135,17 +171,18 @@ pub fn update_ui(
     task_tracker: &TaskTracker,
     config: &config::Config,
     mut fb: impl GenericFramebuffer,
-    mut ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
     mut ui_update_rx: Receiver<DisplayState>,
 ) {
     static IMAGE_DIR: Dir<'_> = include_dir!("$CARGO_MANIFEST_DIR/images/");
     let display_level = config.ui_level;
     if display_level == 0 {
         info!("Invisible mode, not spawning UI.");
+        return;
     }
 
     let colorblind_mode = config.colorblind_mode;
-    let mut display_color = Color::from_state(DisplayState::Recording, colorblind_mode);
+    let mut display_style = display_style_from_state(DisplayState::Recording, colorblind_mode);
 
     task_tracker.spawn(async move {
         // this feels wrong, is there a more rusty way to do this?
@@ -166,25 +203,25 @@ pub fn update_ui(
             );
         }
         loop {
-            match ui_shutdown_rx.try_recv() {
-                Ok(_) => {
-                    info!("received UI shutdown");
-                    break;
-                }
-                Err(TryRecvError::Empty) => {}
-                Err(e) => panic!("error receiving shutdown message: {e}"),
+            if shutdown_token.is_cancelled() {
+                info!("received UI shutdown");
+                break;
             }
             match ui_update_rx.try_recv() {
                 Ok(state) => {
-                    display_color = Color::from_state(state, colorblind_mode);
+                    display_style = display_style_from_state(state, colorblind_mode);
                 }
                 Err(tokio::sync::mpsc::error::TryRecvError::Empty) => {}
                 Err(e) => error!("error receiving framebuffer update message: {e}"),
             }
 
+            let mut status_bar_height = 2;
             match display_level {
                 2 => fb.draw_gif(img.unwrap()).await,
                 3 => fb.draw_img(img.unwrap()).await,
+                4 => {
+                    status_bar_height = fb.dimensions().height;
+                }
                 128 => {
                     fb.draw_line(Color::Cyan, 128).await;
                     fb.draw_line(Color::Pink, 102).await;
@@ -192,12 +229,14 @@ pub fn update_ui(
                     fb.draw_line(Color::Pink, 50).await;
                     fb.draw_line(Color::Cyan, 25).await;
                 }
-                // this branch id for ui_level 1, which is also the default if an
+                // this branch is for ui_level 1, which is also the default if an
                 // unknown value is used
                 _ => {}
             };
-            fb.draw_line(display_color, 2).await;
-            tokio::time::sleep(Duration::from_millis(1000)).await;
+            let (color, pattern) = display_style;
+            fb.draw_patterned_line(color, status_bar_height, pattern)
+                .await;
+            tokio::time::sleep(Duration::from_millis(REFRESH_RATE)).await;
         }
     });
 }

daemon/src/display/headless.rs

@@ -1,6 +1,6 @@
 use log::info;
 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;
 
 use crate::config;
@@ -9,7 +9,7 @@ use crate::display::DisplayState;
 pub fn update_ui(
     _task_tracker: &TaskTracker,
     _config: &config::Config,
-    _ui_shutdown_rx: oneshot::Receiver<()>,
+    _shutdown_token: CancellationToken,
     _ui_update_rx: Receiver<DisplayState>,
 ) {
     info!("Headless mode, not spawning UI.");

daemon/src/display/mod.rs

@@ -1,3 +1,6 @@
+use rayhunter::analysis::analyzer::EventType;
+use serde::{Deserialize, Serialize};
+
 mod generic_framebuffer;
 
 pub mod headless;
@@ -6,11 +9,18 @@ pub mod tmobile;
 pub mod tplink;
 pub mod tplink_framebuffer;
 pub mod tplink_onebit;
+pub mod uz801;
 pub mod wingtech;
 
-#[derive(Clone, Copy, PartialEq)]
+#[derive(Clone, Copy, PartialEq, Serialize, Deserialize)]
 pub enum DisplayState {
+    /// We're recording but no warning has been found yet.
     Recording,
+    /// We're not recording.
     Paused,
-    WarningDetected,
+    /// A non-informational event has been detected.
+    ///
+    /// Note that EventType::Informational is never sent through this. If it is, it's the same as
+    /// Recording
+    WarningDetected { event_type: EventType },
 }

daemon/src/display/orbic.rs

@@ -4,7 +4,7 @@ use crate::display::generic_framebuffer::{self, Dimensions, GenericFramebuffer};
 use async_trait::async_trait;
 
 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;
 
 const FB_PATH: &str = "/dev/fb0";
@@ -38,14 +38,14 @@ impl GenericFramebuffer for Framebuffer {
 pub fn update_ui(
     task_tracker: &TaskTracker,
     config: &config::Config,
-    ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
     ui_update_rx: Receiver<DisplayState>,
 ) {
     generic_framebuffer::update_ui(
         task_tracker,
         config,
         Framebuffer,
-        ui_shutdown_rx,
+        shutdown_token,
         ui_update_rx,
     )
 }

daemon/src/display/tmobile.rs

@@ -1,10 +1,10 @@
 /// Display module for Tmobile TMOHS1, blink LEDs on the front of the device.
 /// DisplayState::Recording => Signal LED slowly blinks blue.
 /// DisplayState::Paused => WiFi LED blinks white.
-/// DisplayState::WarningDetected => Signal LED slowly blinks red.
+/// DisplayState::WarningDetected { .. } => Signal LED slowly blinks red.
 use log::{error, info};
 use tokio::sync::mpsc;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;
 
 use std::time::Duration;
@@ -27,7 +27,7 @@ async fn stop_blinking(path: String) {
 pub fn update_ui(
     task_tracker: &TaskTracker,
     config: &config::Config,
-    mut ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
     mut ui_update_rx: mpsc::Receiver<DisplayState>,
 ) {
     let mut invisible: bool = false;
@@ -40,13 +40,9 @@ pub fn update_ui(
         let mut last_state = DisplayState::Paused;
 
         loop {
-            match ui_shutdown_rx.try_recv() {
-                Ok(_) => {
-                    info!("received UI shutdown");
-                    break;
-                }
-                Err(oneshot::error::TryRecvError::Empty) => {}
-                Err(e) => panic!("error receiving shutdown message: {e}"),
+            if shutdown_token.is_cancelled() {
+                info!("received UI shutdown");
+                break;
             }
             match ui_update_rx.try_recv() {
                 Ok(new_state) => state = new_state,
@@ -68,7 +64,7 @@ pub fn update_ui(
                     stop_blinking(led!("signal_red")).await;
                     start_blinking(led!("signal_blue")).await;
                 }
-                DisplayState::WarningDetected => {
+                DisplayState::WarningDetected { .. } => {
                     stop_blinking(led!("wlan_white")).await;
                     stop_blinking(led!("signal_blue")).await;
                     start_blinking(led!("signal_red")).await;

daemon/src/display/tplink.rs

@@ -1,6 +1,6 @@
 use log::info;
 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;
 
 use crate::config;
@@ -11,7 +11,7 @@ use std::fs;
 pub fn update_ui(
     task_tracker: &TaskTracker,
     config: &config::Config,
-    ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
     ui_update_rx: Receiver<DisplayState>,
 ) {
     let display_level = config.ui_level;
@@ -23,9 +23,9 @@ pub fn update_ui(
     // The alternative would be to make the entire initialization async
     if fs::exists(tplink_onebit::OLED_PATH).unwrap_or_default() {
         info!("detected one-bit display");
-        tplink_onebit::update_ui(task_tracker, config, ui_shutdown_rx, ui_update_rx)
+        tplink_onebit::update_ui(task_tracker, config, shutdown_token, ui_update_rx)
     } else {
         info!("fallback to framebuffer");
-        tplink_framebuffer::update_ui(task_tracker, config, ui_shutdown_rx, ui_update_rx)
+        tplink_framebuffer::update_ui(task_tracker, config, shutdown_token, ui_update_rx)
     }
 }

daemon/src/display/tplink_framebuffer.rs

@@ -2,13 +2,13 @@ use async_trait::async_trait;
 use std::os::fd::AsRawFd;
 use tokio::fs::OpenOptions;
 use tokio::io::AsyncWriteExt;
+use tokio_util::sync::CancellationToken;
 
 use crate::config;
 use crate::display::DisplayState;
 use crate::display::generic_framebuffer::{self, Dimensions, GenericFramebuffer};
 
 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
 use tokio_util::task::TaskTracker;
 
 const FB_PATH: &str = "/dev/fb0";
@@ -80,14 +80,14 @@ impl GenericFramebuffer for Framebuffer {
 pub fn update_ui(
     task_tracker: &TaskTracker,
     config: &config::Config,
-    ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
     ui_update_rx: Receiver<DisplayState>,
 ) {
     generic_framebuffer::update_ui(
         task_tracker,
         config,
         Framebuffer,
-        ui_shutdown_rx,
+        shutdown_token,
         ui_update_rx,
     )
 }

daemon/src/display/tplink_onebit.rs

@@ -6,8 +6,7 @@ use crate::display::DisplayState;
 
 use log::{error, info};
 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
-use tokio::sync::oneshot::error::TryRecvError;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;
 
 use std::time::Duration;
@@ -112,7 +111,7 @@ const STATUS_WARNING: &[u8] = pixelart! {
 pub fn update_ui(
     task_tracker: &TaskTracker,
     config: &config::Config,
-    mut ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
     mut ui_update_rx: Receiver<DisplayState>,
 ) {
     let display_level = config.ui_level;
@@ -124,19 +123,15 @@ pub fn update_ui(
         let mut pixels = STATUS_SMILING;
 
         loop {
-            match ui_shutdown_rx.try_recv() {
-                Ok(_) => {
-                    info!("received UI shutdown");
-                    break;
-                }
-                Err(TryRecvError::Empty) => {}
-                Err(e) => panic!("error receiving shutdown message: {e}"),
+            if shutdown_token.is_cancelled() {
+                info!("received UI shutdown");
+                break;
             }
 
             match ui_update_rx.try_recv() {
                 Ok(DisplayState::Paused) => pixels = STATUS_PAUSED,
                 Ok(DisplayState::Recording) => pixels = STATUS_SMILING,
-                Ok(DisplayState::WarningDetected) => pixels = STATUS_WARNING,
+                Ok(DisplayState::WarningDetected { .. }) => pixels = STATUS_WARNING,
                 Err(tokio::sync::mpsc::error::TryRecvError::Empty) => {}
                 Err(e) => {
                     error!("error receiving framebuffer update message: {e}");
@@ -145,10 +140,10 @@ pub fn update_ui(
 
             // we write the status every second because it may have been overwritten through menu
             // navigation.
-            if display_level != 0 {
-                if let Err(e) = tokio::fs::write(OLED_PATH, pixels).await {
-                    error!("failed to write to display: {e}");
-                }
+            if display_level != 0
+                && let Err(e) = tokio::fs::write(OLED_PATH, pixels).await
+            {
+                error!("failed to write to display: {e}");
             }
 
             tokio::time::sleep(Duration::from_millis(1000)).await;

daemon/src/display/uz801.rs

@@ -0,0 +1,85 @@
+/// Display module for Uz801, light LEDs on the front of the device.
+/// DisplayState::Recording => Green LED is solid.
+/// DisplayState::Paused => Signal LED is solid blue (wifi LED).
+/// DisplayState::WarningDetected => Signal LED is solid red.
+use log::{error, info};
+use tokio::sync::mpsc;
+use tokio_util::sync::CancellationToken;
+use tokio_util::task::TaskTracker;
+
+use std::time::Duration;
+
+use crate::config;
+use crate::display::DisplayState;
+
+macro_rules! led {
+    ($l:expr) => {{ format!("/sys/class/leds/{}/brightness", $l) }};
+}
+
+async fn led_on(path: String) {
+    tokio::fs::write(&path, "1").await.ok();
+}
+
+async fn led_off(path: String) {
+    tokio::fs::write(&path, "0").await.ok();
+}
+
+pub fn update_ui(
+    task_tracker: &TaskTracker,
+    config: &config::Config,
+    shutdown_token: CancellationToken,
+    mut ui_update_rx: mpsc::Receiver<DisplayState>,
+) {
+    let mut invisible: bool = false;
+    if config.ui_level == 0 {
+        info!("Invisible mode, not spawning UI.");
+        invisible = true;
+    }
+    task_tracker.spawn(async move {
+        let mut state = DisplayState::Recording;
+        let mut last_state = DisplayState::Paused;
+        let mut last_update = std::time::Instant::now();
+
+        loop {
+            if shutdown_token.is_cancelled() {
+                info!("received UI shutdown");
+                break;
+            }
+            match ui_update_rx.try_recv() {
+                Ok(new_state) => state = new_state,
+                Err(mpsc::error::TryRecvError::Empty) => {}
+                Err(e) => error!("error receiving ui update message: {e}"),
+            };
+
+            // Update LEDs if state changed or if 5 seconds have passed since last update
+            let now = std::time::Instant::now();
+            let should_update = !invisible
+                && (state != last_state
+                    || now.duration_since(last_update) >= Duration::from_secs(5));
+
+            if should_update {
+                match state {
+                    DisplayState::Paused => {
+                        led_off(led!("red")).await;
+                        led_off(led!("green")).await;
+                        led_on(led!("wifi")).await;
+                    }
+                    DisplayState::Recording => {
+                        led_off(led!("red")).await;
+                        led_off(led!("wifi")).await;
+                        led_on(led!("green")).await;
+                    }
+                    DisplayState::WarningDetected { .. } => {
+                        led_off(led!("green")).await;
+                        led_off(led!("wifi")).await;
+                        led_on(led!("red")).await;
+                    }
+                }
+                last_state = state;
+                last_update = now;
+            }
+
+            tokio::time::sleep(Duration::from_secs(1)).await;
+        }
+    });
+}

daemon/src/display/wingtech.rs

@@ -10,7 +10,7 @@ use crate::display::generic_framebuffer::{self, Dimensions, GenericFramebuffer};
 use async_trait::async_trait;
 
 use tokio::sync::mpsc::Receiver;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;
 
 const FB_PATH: &str = "/dev/fb0";
@@ -43,14 +43,14 @@ impl GenericFramebuffer for Framebuffer {
 pub fn update_ui(
     task_tracker: &TaskTracker,
     config: &config::Config,
-    ui_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
     ui_update_rx: Receiver<DisplayState>,
 ) {
     generic_framebuffer::update_ui(
         task_tracker,
         config,
         Framebuffer,
-        ui_shutdown_rx,
+        shutdown_token,
         ui_update_rx,
     )
 }

daemon/src/error.rs

@@ -15,4 +15,10 @@ pub enum RayhunterError {
     QmdlStoreError(#[from] RecordingStoreError),
     #[error("No QMDL store found at path {0}, but can't create a new one due to debug mode")]
     NoStoreDebugMode(String),
+    #[error("Error parsing file to determine battery level")]
+    BatteryLevelParseError,
+    #[error("Error parsing file to determine whether device is plugged in")]
+    BatteryPluggedInStatusParseError,
+    #[error("The requested functionality is not supported for this device")]
+    FunctionNotSupportedForDeviceError,
 }

daemon/src/key_input.rs

@@ -3,7 +3,7 @@ use std::time::{Duration, Instant};
 use tokio::fs::File;
 use tokio::io::AsyncReadExt;
 use tokio::sync::mpsc::Sender;
-use tokio::sync::oneshot;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;
 
 use crate::config;
@@ -21,7 +21,7 @@ pub fn run_key_input_thread(
     task_tracker: &TaskTracker,
     config: &config::Config,
     diag_tx: Sender<DiagDeviceCtrlMessage>,
-    mut ui_shutdown_rx: oneshot::Receiver<()>,
+    cancellation_token: CancellationToken,
 ) {
     if config.key_input_mode == 0 {
         return;
@@ -43,7 +43,7 @@ pub fn run_key_input_thread(
 
         loop {
             tokio::select! {
-                _ = &mut ui_shutdown_rx => {
+               _ = cancellation_token.cancelled() => {
                     info!("received key input shutdown");
                     return;
                 }
@@ -61,11 +61,11 @@ pub fn run_key_input_thread(
 
             // On orbic it was observed that pressing the power button can trigger many successive
             // events. Drop events that are too close together.
-            if let Some(last_time) = last_event_time {
-                if now.duration_since(last_time) < Duration::from_millis(50) {
-                    last_event_time = Some(now);
-                    continue;
-                }
+            if let Some(last_time) = last_event_time
+                && now.duration_since(last_time) < Duration::from_millis(50)
+            {
+                last_event_time = Some(now);
+                continue;
             }
             last_event_time = Some(now);
 

daemon/src/main.rs

@@ -1,9 +1,11 @@
 mod analysis;
+mod battery;
 mod config;
 mod diag;
 mod display;
 mod error;
 mod key_input;
+mod notifications;
 mod pcap;
 mod qmdl_store;
 mod server;
@@ -11,15 +13,19 @@ mod stats;
 
 use std::net::SocketAddr;
 use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, Ordering};
 
+use crate::battery::run_battery_notification_worker;
 use crate::config::{parse_args, parse_config};
 use crate::diag::run_diag_read_thread;
 use crate::error::RayhunterError;
+use crate::notifications::{NotificationService, run_notification_worker};
 use crate::pcap::get_pcap;
 use crate::qmdl_store::RecordingStore;
-use crate::server::{ServerState, get_config, get_qmdl, get_zip, serve_static, set_config};
-use crate::stats::{get_qmdl_manifest, get_system_stats};
+use crate::server::{
+    ServerState, debug_set_display_state, get_config, get_qmdl, get_time, get_zip, serve_static,
+    set_config, set_time_offset, test_notification,
+};
+use crate::stats::{get_qmdl_manifest, get_route_status, get_system_stats};
 
 use analysis::{
     AnalysisCtrlMessage, AnalysisStatus, get_analysis_status, run_analysis_thread, start_analysis,
@@ -35,11 +41,13 @@ use log::{error, info};
 use qmdl_store::RecordingStoreError;
 use rayhunter::Device;
 use rayhunter::diag_device::DiagDevice;
+use stats::get_log;
 use tokio::net::TcpListener;
 use tokio::select;
+use tokio::sync::RwLock;
 use tokio::sync::mpsc::{self, Sender};
-use tokio::sync::{RwLock, oneshot};
 use tokio::task::JoinHandle;
+use tokio_util::sync::CancellationToken;
 use tokio_util::task::TaskTracker;
 
 type AppRouter = Router<Arc<ServerState>>;
@@ -50,7 +58,9 @@ fn get_router() -> AppRouter {
         .route("/api/qmdl/{name}", get(get_qmdl))
         .route("/api/zip/{name}", get(get_zip))
         .route("/api/system-stats", get(get_system_stats))
+        .route("/api/route-status", get(get_route_status))
         .route("/api/qmdl-manifest", get(get_qmdl_manifest))
+        .route("/api/log", get(get_log))
         .route("/api/start-recording", post(start_recording))
         .route("/api/stop-recording", post(stop_recording))
         .route("/api/delete-recording/{name}", post(delete_recording))
@@ -60,6 +70,10 @@ fn get_router() -> AppRouter {
         .route("/api/analysis/{name}", post(start_analysis))
         .route("/api/config", get(get_config))
         .route("/api/config", post(set_config))
+        .route("/api/test-notification", post(test_notification))
+        .route("/api/time", get(get_time))
+        .route("/api/time-offset", post(set_time_offset))
+        .route("/api/debug/display-state", post(debug_set_display_state))
         .route("/", get(|| async { Redirect::permanent("/index.html") }))
         .route("/{*path}", get(serve_static))
 }
@@ -70,7 +84,7 @@ fn get_router() -> AppRouter {
 async fn run_server(
     task_tracker: &TaskTracker,
     state: Arc<ServerState>,
-    server_shutdown_rx: oneshot::Receiver<()>,
+    shutdown_token: CancellationToken,
 ) -> JoinHandle<()> {
     info!("spinning up server");
     let addr = SocketAddr::from(([0, 0, 0, 0], state.config.port));
@@ -80,17 +94,12 @@ async fn run_server(
     task_tracker.spawn(async move {
         info!("The orca is hunting for stingrays...");
         axum::serve(listener, app)
-            .with_graceful_shutdown(server_shutdown_signal(server_shutdown_rx))
+            .with_graceful_shutdown(shutdown_token.cancelled_owned())
             .await
             .unwrap();
     })
 }
 
-async fn server_shutdown_signal(server_shutdown_rx: oneshot::Receiver<()>) {
-    server_shutdown_rx.await.unwrap();
-    info!("Server received shutdown signal, exiting...");
-}
-
 // Loads a RecordingStore if one exists, and if not, only create one if we're
 // not in debug mode. If we fail to parse the manifest AND we're not in debug
 // mode, try to recover the manifest from the existing QMDL files
@@ -122,15 +131,10 @@ async fn init_qmdl_store(config: &config::Config) -> Result<RecordingStore, Rayh
 // Start a thread that'll track when user hits ctrl+c. When that happens,
 // trigger various cleanup tasks, including sending signals to other threads to
 // shutdown
-#[allow(clippy::too_many_arguments)]
 fn run_shutdown_thread(
     task_tracker: &TaskTracker,
     diag_device_sender: Sender<DiagDeviceCtrlMessage>,
-    daemon_restart_rx: oneshot::Receiver<()>,
-    should_restart_flag: Arc<AtomicBool>,
-    server_shutdown_tx: oneshot::Sender<()>,
-    maybe_ui_shutdown_tx: Option<oneshot::Sender<()>>,
-    maybe_key_input_shutdown_tx: Option<oneshot::Sender<()>>,
+    shutdown_token: CancellationToken,
     qmdl_store_lock: Arc<RwLock<RecordingStore>>,
     analysis_tx: Sender<AnalysisCtrlMessage>,
 ) -> JoinHandle<Result<(), RayhunterError>> {
@@ -142,17 +146,9 @@ fn run_shutdown_thread(
                 if let Err(err) = res {
                     error!("Unable to listen for shutdown signal: {err}");
                 }
-
-                should_restart_flag.store(false, Ordering::Relaxed);
             }
-            res = daemon_restart_rx => {
-                if let Err(err) = res {
-                    error!("Unable to listen for shutdown signal: {err}");
-                }
-
-                should_restart_flag.store(true, Ordering::Relaxed);
-            }
-        };
+            _ = shutdown_token.cancelled() => {}
+        }
 
         let mut qmdl_store = qmdl_store_lock.write().await;
         if qmdl_store.current_entry.is_some() {
@@ -161,15 +157,7 @@ fn run_shutdown_thread(
             info!("Done!");
         }
 
-        server_shutdown_tx
-            .send(())
-            .expect("couldn't send server shutdown signal");
-        if let Some(ui_shutdown_tx) = maybe_ui_shutdown_tx {
-            let _ = ui_shutdown_tx.send(());
-        }
-        if let Some(key_input_shutdown_tx) = maybe_key_input_shutdown_tx {
-            let _ = key_input_shutdown_tx.send(());
-        }
+        shutdown_token.cancel();
         diag_device_sender
             .send(DiagDeviceCtrlMessage::Exit)
             .await
@@ -184,7 +172,14 @@ fn run_shutdown_thread(
 
 #[tokio::main(flavor = "current_thread")]
 async fn main() -> Result<(), RayhunterError> {
-    env_logger::init();
+    rayhunter::init_logging(log::LevelFilter::Info);
+
+    #[cfg(feature = "rustcrypto-tls")]
+    {
+        rustls_rustcrypto::provider()
+            .install_default()
+            .expect("Couldn't install rustcrypto provider");
+    }
 
     let args = parse_args();
 
@@ -211,11 +206,16 @@ async fn run_with_config(
     let (diag_tx, diag_rx) = mpsc::channel::<DiagDeviceCtrlMessage>(1);
     let (ui_update_tx, ui_update_rx) = mpsc::channel::<display::DisplayState>(1);
     let (analysis_tx, analysis_rx) = mpsc::channel::<AnalysisCtrlMessage>(5);
-    let mut maybe_ui_shutdown_tx = None;
-    let mut maybe_key_input_shutdown_tx = None;
+    let restart_token = CancellationToken::new();
+    let shutdown_token = restart_token.child_token();
+    // Ensure shutdown_token is cancelled when this function exits for any
+    // reason (e.g. diag device init failure), so all spawned tasks get
+    // signaled to stop.
+    let _shutdown_guard = shutdown_token.clone().drop_guard();
+
+    let notification_service = NotificationService::new(config.ntfy_url.clone());
+
     if !config.debug_mode {
-        let (ui_shutdown_tx, ui_shutdown_rx) = oneshot::channel();
-        maybe_ui_shutdown_tx = Some(ui_shutdown_tx);
         info!("Using configuration for device: {0:?}", config.device);
         let mut dev = DiagDevice::new(&config.device)
             .await
@@ -234,6 +234,7 @@ async fn run_with_config(
             qmdl_store_lock.clone(),
             analysis_tx.clone(),
             config.analyzers.clone(),
+            notification_service.new_handler(),
         );
         info!("Starting UI");
 
@@ -243,22 +244,19 @@ async fn run_with_config(
             Device::Tmobile => display::tmobile::update_ui,
             Device::Wingtech => display::wingtech::update_ui,
             Device::Pinephone => display::headless::update_ui,
+            Device::Uz801 => display::uz801::update_ui,
         };
-        update_ui(&task_tracker, &config, ui_shutdown_rx, ui_update_rx);
+        update_ui(&task_tracker, &config, shutdown_token.clone(), ui_update_rx);
 
         info!("Starting Key Input service");
-        let (key_input_shutdown_tx, key_input_shutdown_rx) = oneshot::channel();
-        maybe_key_input_shutdown_tx = Some(key_input_shutdown_tx);
         key_input::run_key_input_thread(
             &task_tracker,
             &config,
             diag_tx.clone(),
-            key_input_shutdown_rx,
+            shutdown_token.clone(),
         );
     }
 
-    let (daemon_restart_tx, daemon_restart_rx) = oneshot::channel::<()>();
-    let (server_shutdown_tx, server_shutdown_rx) = oneshot::channel::<()>();
     let analysis_status_lock = Arc::new(RwLock::new(analysis_status));
     run_analysis_thread(
         &task_tracker,
@@ -267,19 +265,28 @@ async fn run_with_config(
         analysis_status_lock.clone(),
         config.analyzers.clone(),
     );
-    let should_restart_flag = Arc::new(AtomicBool::new(false));
 
     run_shutdown_thread(
         &task_tracker,
         diag_tx.clone(),
-        daemon_restart_rx,
-        should_restart_flag.clone(),
-        server_shutdown_tx,
-        maybe_ui_shutdown_tx,
-        maybe_key_input_shutdown_tx,
+        shutdown_token.clone(),
         qmdl_store_lock.clone(),
         analysis_tx.clone(),
     );
+
+    run_battery_notification_worker(
+        &task_tracker,
+        config.device.clone(),
+        notification_service.new_handler(),
+        shutdown_token.clone(),
+    );
+
+    run_notification_worker(
+        &task_tracker,
+        notification_service,
+        config.enabled_notifications.clone(),
+    );
+
     let state = Arc::new(ServerState {
         config_path: args.config_path.clone(),
         config,
@@ -287,15 +294,16 @@ async fn run_with_config(
         diag_device_ctrl_sender: diag_tx,
         analysis_status_lock,
         analysis_sender: analysis_tx,
-        daemon_restart_tx: Arc::new(RwLock::new(Some(daemon_restart_tx))),
+        daemon_restart_token: restart_token.clone(),
+        ui_update_sender: Some(ui_update_tx),
     });
-    run_server(&task_tracker, state, server_shutdown_rx).await;
+    run_server(&task_tracker, state, shutdown_token.clone()).await;
 
     task_tracker.close();
     task_tracker.wait().await;
 
     info!("see you space cowboy...");
-    Ok(should_restart_flag.load(Ordering::Relaxed))
+    Ok(restart_token.is_cancelled())
 }
 
 #[cfg(test)]

daemon/src/notifications.rs

@@ -0,0 +1,381 @@
+use std::{
+    cmp::min,
+    collections::HashMap,
+    time::{Duration, Instant},
+};
+
+use log::error;
+use serde::{Deserialize, Serialize};
+use thiserror::Error;
+use tokio::sync::mpsc::{self, error::TryRecvError};
+use tokio_util::task::TaskTracker;
+
+#[derive(Error, Debug)]
+pub enum NotificationError {
+    #[error("HTTP request failed: {0}")]
+    RequestFailed(#[from] reqwest::Error),
+    #[error("Server returned error status: {0}")]
+    HttpError(reqwest::StatusCode),
+}
+
+#[derive(Hash, Eq, PartialEq, Debug, Clone, Serialize, Deserialize)]
+pub enum NotificationType {
+    Warning,
+    LowBattery,
+}
+
+pub struct Notification {
+    notification_type: NotificationType,
+    message: String,
+    debounce: Option<Duration>,
+}
+
+impl Notification {
+    pub fn new(
+        notification_type: NotificationType,
+        message: String,
+        debounce: Option<Duration>,
+    ) -> Self {
+        Notification {
+            notification_type,
+            message,
+            debounce,
+        }
+    }
+}
+
+struct NotificationStatus {
+    message: String,
+    needs_sending: bool,
+    last_sent: Option<Instant>,
+    last_attempt: Option<Instant>,
+    failed_since_last_success: u32,
+}
+
+pub struct NotificationService {
+    url: Option<String>,
+    tx: mpsc::Sender<Notification>,
+    rx: mpsc::Receiver<Notification>,
+}
+
+impl NotificationService {
+    pub fn new(url: Option<String>) -> Self {
+        let (tx, rx) = mpsc::channel(10);
+        Self { url, tx, rx }
+    }
+
+    pub fn new_handler(&self) -> mpsc::Sender<Notification> {
+        self.tx.clone()
+    }
+}
+
+/// Sends a notification message to the specified URL.
+pub async fn send_notification(
+    http_client: &reqwest::Client,
+    url: &str,
+    message: String,
+) -> Result<(), NotificationError> {
+    let response = http_client.post(url).body(message).send().await?;
+
+    if response.status().is_success() {
+        Ok(())
+    } else {
+        Err(NotificationError::HttpError(response.status()))
+    }
+}
+
+pub fn run_notification_worker(
+    task_tracker: &TaskTracker,
+    mut notification_service: NotificationService,
+    enabled_notifications: Vec<NotificationType>,
+) {
+    task_tracker.spawn(async move {
+        if let Some(url) = notification_service.url
+            && !url.is_empty()
+        {
+            let mut notification_statuses = HashMap::new();
+            let http_client = reqwest::Client::new();
+
+            loop {
+                // Get any notifications since the last time we checked
+                loop {
+                    match notification_service.rx.try_recv() {
+                        Ok(notification) => {
+                            if !enabled_notifications.contains(&notification.notification_type) {
+                                continue;
+                            }
+
+                            let status = notification_statuses
+                                .entry(notification.notification_type)
+                                .or_insert_with(|| NotificationStatus {
+                                    message: "".to_string(),
+                                    needs_sending: true,
+                                    last_sent: None,
+                                    last_attempt: None,
+                                    failed_since_last_success: 0,
+                                });
+                            // Ignore if we're in the debounce period
+                            if let Some(debounce) = notification.debounce
+                                && let Some(last_sent) = status.last_sent
+                                && last_sent.elapsed() < debounce
+                            {
+                                continue;
+                            }
+                            status.message = notification.message;
+                            status.needs_sending = true;
+                        }
+                        Err(TryRecvError::Empty) => {
+                            break;
+                        }
+                        Err(TryRecvError::Disconnected) => {
+                            return;
+                        }
+                    }
+                }
+
+                // Attempt to send pending notifications
+                for notification in notification_statuses.values_mut() {
+                    if !notification.needs_sending {
+                        continue;
+                    }
+
+                    // Backoff retries, up to a maximum of 256 seconds.
+                    if let Some(last_attempt) = notification.last_attempt {
+                        let min_wait_time = Duration::from_secs(
+                            2u64.pow(min(notification.failed_since_last_success, 8)),
+                        );
+                        if last_attempt.elapsed() < min_wait_time {
+                            continue;
+                        }
+                    }
+
+                    match send_notification(&http_client, &url, notification.message.clone()).await
+                    {
+                        Ok(()) => {
+                            notification.last_sent = Some(Instant::now());
+                            notification.failed_since_last_success = 0;
+                            notification.needs_sending = false;
+                        }
+                        Err(e) => {
+                            error!("Failed to send notification: {e}");
+                            notification.failed_since_last_success += 1;
+                            notification.last_attempt = Some(Instant::now());
+                        }
+                    }
+                }
+
+                tokio::time::sleep(Duration::from_secs(2)).await;
+            }
+        }
+        // If there's no url to send to we'll just discard the notifications
+        else {
+            loop {
+                if notification_service.rx.recv().await.is_none() {
+                    break;
+                }
+            }
+        }
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::{Router, body::Bytes, extract::State, routing::post};
+    use std::sync::Arc;
+    use tokio::net::TcpListener;
+    use tokio::sync::Mutex;
+
+    #[derive(Clone)]
+    struct TestServerState {
+        received_messages: Arc<Mutex<Vec<String>>>,
+    }
+
+    async fn capture_notification(
+        State(state): State<TestServerState>,
+        body: Bytes,
+    ) -> &'static str {
+        let message = String::from_utf8_lossy(&body).to_string();
+        state.received_messages.lock().await.push(message);
+        "OK"
+    }
+
+    async fn setup_test_server() -> (Arc<Mutex<Vec<String>>>, String) {
+        #[cfg(feature = "rustcrypto-tls")]
+        {
+            let _ = rustls_rustcrypto::provider().install_default();
+        }
+
+        let received_messages = Arc::new(Mutex::new(Vec::new()));
+        let test_state = TestServerState {
+            received_messages: received_messages.clone(),
+        };
+
+        let app = Router::new()
+            .route("/", post(capture_notification))
+            .with_state(test_state);
+
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        let url = format!("http://{}", addr);
+
+        tokio::spawn(async move {
+            axum::serve(listener, app).await.unwrap();
+        });
+
+        tokio::time::sleep(Duration::from_millis(100)).await;
+
+        (received_messages, url)
+    }
+
+    async fn cleanup_worker(sender: mpsc::Sender<Notification>, tracker: TaskTracker) {
+        drop(sender);
+        tracker.close();
+        tracker.wait().await;
+    }
+
+    #[tokio::test]
+    async fn test_notification_worker_sends_message() {
+        let (received_messages, url) = setup_test_server().await;
+
+        let task_tracker = TaskTracker::new();
+        let notification_service = NotificationService::new(Some(url));
+        let notification_sender = notification_service.new_handler();
+
+        run_notification_worker(
+            &task_tracker,
+            notification_service,
+            vec![NotificationType::Warning],
+        );
+
+        notification_sender
+            .send(Notification::new(
+                NotificationType::Warning,
+                "test warning message".to_string(),
+                None,
+            ))
+            .await
+            .unwrap();
+
+        tokio::time::sleep(Duration::from_secs(3)).await;
+
+        let messages = received_messages.lock().await;
+        assert_eq!(messages.len(), 1);
+        assert_eq!(messages[0], "test warning message");
+        drop(messages);
+
+        cleanup_worker(notification_sender, task_tracker).await;
+    }
+
+    #[tokio::test]
+    async fn test_notification_worker_filters_disabled_types() {
+        let (received_messages, url) = setup_test_server().await;
+
+        let task_tracker = TaskTracker::new();
+        let notification_service = NotificationService::new(Some(url));
+        let notification_sender = notification_service.new_handler();
+
+        run_notification_worker(
+            &task_tracker,
+            notification_service,
+            vec![NotificationType::Warning],
+        );
+
+        notification_sender
+            .send(Notification::new(
+                NotificationType::Warning,
+                "test warning".to_string(),
+                None,
+            ))
+            .await
+            .unwrap();
+
+        notification_sender
+            .send(Notification::new(
+                NotificationType::LowBattery,
+                "test low battery".to_string(),
+                None,
+            ))
+            .await
+            .unwrap();
+
+        tokio::time::sleep(Duration::from_secs(3)).await;
+
+        let messages = received_messages.lock().await;
+        assert_eq!(messages.len(), 1);
+        assert_eq!(messages[0], "test warning");
+        drop(messages);
+
+        cleanup_worker(notification_sender, task_tracker).await;
+    }
+
+    #[tokio::test]
+    async fn test_notification_worker_sends_enabled_types() {
+        let (received_messages, url) = setup_test_server().await;
+
+        let task_tracker = TaskTracker::new();
+        let notification_service = NotificationService::new(Some(url));
+        let notification_sender = notification_service.new_handler();
+
+        run_notification_worker(
+            &task_tracker,
+            notification_service,
+            vec![NotificationType::Warning, NotificationType::LowBattery],
+        );
+
+        notification_sender
+            .send(Notification::new(
+                NotificationType::Warning,
+                "test warning".to_string(),
+                None,
+            ))
+            .await
+            .unwrap();
+
+        notification_sender
+            .send(Notification::new(
+                NotificationType::LowBattery,
+                "test low battery".to_string(),
+                None,
+            ))
+            .await
+            .unwrap();
+
+        tokio::time::sleep(Duration::from_secs(3)).await;
+
+        let messages = received_messages.lock().await;
+        assert_eq!(messages.len(), 2);
+        // these are interchangeable, ordering not guaranteed
+        assert!(messages.contains(&"test warning".to_string()));
+        assert!(messages.contains(&"test low battery".to_string()));
+        drop(messages);
+
+        cleanup_worker(notification_sender, task_tracker).await;
+    }
+
+    #[tokio::test]
+    async fn test_notification_worker_with_no_url() {
+        let task_tracker = TaskTracker::new();
+        let notification_service = NotificationService::new(None);
+        let notification_sender = notification_service.new_handler();
+
+        run_notification_worker(
+            &task_tracker,
+            notification_service,
+            vec![NotificationType::Warning],
+        );
+
+        notification_sender
+            .send(Notification::new(
+                NotificationType::Warning,
+                "test warning".to_string(),
+                None,
+            ))
+            .await
+            .unwrap();
+
+        tokio::time::sleep(Duration::from_millis(500)).await;
+
+        cleanup_worker(notification_sender, task_tracker).await;
+    }
+}

daemon/src/qmdl_store.rs

@@ -58,7 +58,7 @@ pub struct ManifestEntry {
 
 impl ManifestEntry {
     fn new() -> Self {
-        let now = Local::now();
+        let now = rayhunter::clock::get_adjusted_now();
         let metadata = RuntimeMetadata::new();
         ManifestEntry {
             name: format!("{}", now.timestamp()),
@@ -300,7 +300,8 @@ impl RecordingStore {
         size_bytes: usize,
     ) -> Result<(), RecordingStoreError> {
         self.manifest.entries[entry_index].qmdl_size_bytes = size_bytes;
-        self.manifest.entries[entry_index].last_message_time = Some(Local::now());
+        self.manifest.entries[entry_index].last_message_time =
+            Some(rayhunter::clock::get_adjusted_now());
         self.write_manifest().await
     }
 

daemon/src/server.rs

@@ -9,18 +9,22 @@ use axum::extract::State;
 use axum::http::header::{self, CONTENT_LENGTH, CONTENT_TYPE};
 use axum::http::{HeaderValue, StatusCode};
 use axum::response::{IntoResponse, Response};
+use chrono::{DateTime, Local};
 use log::{error, warn};
+use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 use tokio::fs::write;
 use tokio::io::{AsyncReadExt, copy, duplex};
+use tokio::sync::RwLock;
 use tokio::sync::mpsc::Sender;
-use tokio::sync::{RwLock, oneshot};
 use tokio_util::compat::FuturesAsyncWriteCompatExt;
 use tokio_util::io::ReaderStream;
+use tokio_util::sync::CancellationToken;
 
 use crate::DiagDeviceCtrlMessage;
 use crate::analysis::{AnalysisCtrlMessage, AnalysisStatus};
 use crate::config::Config;
+use crate::display::DisplayState;
 use crate::pcap::generate_pcap_data;
 use crate::qmdl_store::RecordingStore;
 
@@ -31,7 +35,8 @@ pub struct ServerState {
     pub diag_device_ctrl_sender: Sender<DiagDeviceCtrlMessage>,
     pub analysis_status_lock: Arc<RwLock<AnalysisStatus>>,
     pub analysis_sender: Sender<AnalysisCtrlMessage>,
-    pub daemon_restart_tx: Arc<RwLock<Option<oneshot::Sender<()>>>>,
+    pub daemon_restart_token: CancellationToken,
+    pub ui_update_sender: Option<Sender<DisplayState>>,
 }
 
 pub async fn get_qmdl(
@@ -71,11 +76,6 @@ pub async fn serve_static(
     let path = path.trim_start_matches('/');
 
     match path {
-        "rayhunter_icon.png" => (
-            [(header::CONTENT_TYPE, HeaderValue::from_static("image/png"))],
-            include_bytes!("../web/build/rayhunter_icon.png"),
-        )
-            .into_response(),
         "rayhunter_orca_only.png" => (
             [(header::CONTENT_TYPE, HeaderValue::from_static("image/png"))],
             include_bytes!("../web/build/rayhunter_orca_only.png"),
@@ -131,24 +131,81 @@ pub async fn set_config(
     })?;
 
     // Trigger daemon restart after writing config
-    let mut restart_tx = state.daemon_restart_tx.write().await;
-    if let Some(sender) = restart_tx.take() {
-        sender.send(()).map_err(|_| {
+    state.daemon_restart_token.cancel();
+    Ok((
+        StatusCode::ACCEPTED,
+        "wrote config and triggered restart".to_string(),
+    ))
+}
+
+pub async fn test_notification(
+    State(state): State<Arc<ServerState>>,
+) -> Result<(StatusCode, String), (StatusCode, String)> {
+    let url = state.config.ntfy_url.as_ref().ok_or((
+        StatusCode::BAD_REQUEST,
+        "No notification URL configured".to_string(),
+    ))?;
+
+    if url.is_empty() {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            "Notification URL is empty".to_string(),
+        ));
+    }
+
+    let http_client = reqwest::Client::new();
+    let message = "Test notification from Rayhunter".to_string();
+
+    crate::notifications::send_notification(&http_client, url, message)
+        .await
+        .map(|()| {
+            (
+                StatusCode::OK,
+                "Test notification sent successfully".to_string(),
+            )
+        })
+        .map_err(|e| {
             (
                 StatusCode::INTERNAL_SERVER_ERROR,
-                "couldn't send restart signal".to_string(),
+                format!("Failed to send test notification: {e}"),
             )
-        })?;
-        Ok((
-            StatusCode::ACCEPTED,
-            "wrote config and triggered restart".to_string(),
-        ))
-    } else {
-        Ok((
-            StatusCode::ACCEPTED,
-            "wrote config but restart already triggered".to_string(),
-        ))
-    }
+        })
+}
+
+/// Response for GET /api/time
+#[derive(Serialize)]
+pub struct TimeResponse {
+    /// The raw system time (without clock offset)
+    pub system_time: DateTime<Local>,
+    /// The adjusted time (system time + offset)
+    pub adjusted_time: DateTime<Local>,
+    /// The current offset in seconds
+    pub offset_seconds: i64,
+}
+
+/// Request for POST /api/time-offset
+#[derive(Deserialize)]
+pub struct SetTimeOffsetRequest {
+    /// The offset to set, in seconds
+    pub offset_seconds: i64,
+}
+
+pub async fn get_time() -> Json<TimeResponse> {
+    let system_time = Local::now();
+    let adjusted_time = rayhunter::clock::get_adjusted_now();
+    let offset_seconds = adjusted_time
+        .signed_duration_since(system_time)
+        .num_seconds();
+    Json(TimeResponse {
+        system_time,
+        adjusted_time,
+        offset_seconds,
+    })
+}
+
+pub async fn set_time_offset(Json(req): Json<SetTimeOffsetRequest>) -> StatusCode {
+    rayhunter::clock::set_offset(chrono::TimeDelta::seconds(req.offset_seconds));
+    StatusCode::OK
 }
 
 pub async fn get_zip(
@@ -242,6 +299,29 @@ pub async fn get_zip(
     Ok((headers, body).into_response())
 }
 
+pub async fn debug_set_display_state(
+    State(state): State<Arc<ServerState>>,
+    Json(display_state): Json<DisplayState>,
+) -> Result<(StatusCode, String), (StatusCode, String)> {
+    if let Some(ui_sender) = &state.ui_update_sender {
+        ui_sender.send(display_state).await.map_err(|_| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "failed to send display state update".to_string(),
+            )
+        })?;
+        Ok((
+            StatusCode::OK,
+            "display state updated successfully".to_string(),
+        ))
+    } else {
+        Err((
+            StatusCode::SERVICE_UNAVAILABLE,
+            "display system not available".to_string(),
+        ))
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -306,7 +386,8 @@ mod tests {
             diag_device_ctrl_sender: tx,
             analysis_status_lock: Arc::new(RwLock::new(analysis_status)),
             analysis_sender: analysis_tx,
-            daemon_restart_tx: Arc::new(RwLock::new(None)),
+            daemon_restart_token: CancellationToken::new(),
+            ui_update_sender: None,
         })
     }
 

daemon/src/stats.rs

@@ -1,13 +1,15 @@
 use std::sync::Arc;
 
-use crate::qmdl_store::ManifestEntry;
+use crate::battery::get_battery_status;
+use crate::error::RayhunterError;
 use crate::server::ServerState;
+use crate::{battery::BatteryState, qmdl_store::ManifestEntry};
 
 use axum::Json;
 use axum::extract::State;
 use axum::http::StatusCode;
 use log::error;
-use rayhunter::util::RuntimeMetadata;
+use rayhunter::{Device, util::RuntimeMetadata};
 use serde::Serialize;
 use tokio::process::Command;
 
@@ -16,14 +18,24 @@ pub struct SystemStats {
     pub disk_stats: DiskStats,
     pub memory_stats: MemoryStats,
     pub runtime_metadata: RuntimeMetadata,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub battery_status: Option<BatteryState>,
 }
 
 impl SystemStats {
-    pub async fn new(qmdl_path: &str) -> Result<Self, String> {
+    pub async fn new(qmdl_path: &str, device: &Device) -> Result<Self, String> {
         Ok(Self {
-            disk_stats: DiskStats::new(qmdl_path).await?,
-            memory_stats: MemoryStats::new().await?,
+            disk_stats: DiskStats::new(qmdl_path, device).await?,
+            memory_stats: MemoryStats::new(device).await?,
             runtime_metadata: RuntimeMetadata::new(),
+            battery_status: match get_battery_status(device).await {
+                Ok(status) => Some(status),
+                Err(RayhunterError::FunctionNotSupportedForDeviceError) => None,
+                Err(err) => {
+                    log::error!("Failed to get battery status: {err}");
+                    None
+                }
+            },
         })
     }
 }
@@ -40,13 +52,22 @@ pub struct DiskStats {
 
 impl DiskStats {
     // runs "df -h <qmdl_path>" to get storage statistics for the partition containing
-    // the QMDL file
-    pub async fn new(qmdl_path: &str) -> Result<Self, String> {
-        let mut df_cmd = Command::new("df");
+    // the QMDL file.
+    pub async fn new(qmdl_path: &str, device: &Device) -> Result<Self, String> {
+        // Uz801 needs to be told to use the busybox df specifically
+        let mut df_cmd: Command;
+        if matches!(device, Device::Uz801) {
+            df_cmd = Command::new("busybox");
+            df_cmd.arg("df");
+        } else {
+            df_cmd = Command::new("df");
+        }
         df_cmd.arg("-h");
         df_cmd.arg(qmdl_path);
         let stdout = get_cmd_output(df_cmd).await?;
-        let mut parts = stdout.split_whitespace().skip(7).to_owned();
+
+        // Handle standard df -h format
+        let mut parts = stdout.split_whitespace().skip(7);
         Ok(Self {
             partition: parts.next().ok_or("error parsing df output")?.to_string(),
             total_size: parts.next().ok_or("error parsing df output")?.to_string(),
@@ -83,9 +104,16 @@ async fn get_cmd_output(mut cmd: Command) -> Result<String, String> {
 }
 
 impl MemoryStats {
-    // runs "free -k" and parses the output to retrieve memory stats
-    pub async fn new() -> Result<Self, String> {
-        let mut free_cmd = Command::new("free");
+    // runs "free -k" and parses the output to retrieve memory stats for most devices,
+    pub async fn new(device: &Device) -> Result<Self, String> {
+        // Use busybox for Uz801
+        let mut free_cmd: Command;
+        if matches!(device, Device::Uz801) {
+            free_cmd = Command::new("busybox");
+            free_cmd.arg("free");
+        } else {
+            free_cmd = Command::new("free");
+        }
         free_cmd.arg("-k");
         let stdout = get_cmd_output(free_cmd).await?;
         let mut numbers = stdout
@@ -111,7 +139,7 @@ pub async fn get_system_stats(
     State(state): State<Arc<ServerState>>,
 ) -> Result<Json<SystemStats>, (StatusCode, String)> {
     let qmdl_store = state.qmdl_store_lock.read().await;
-    match SystemStats::new(qmdl_store.path.to_str().unwrap()).await {
+    match SystemStats::new(qmdl_store.path.to_str().unwrap(), &state.config.device).await {
         Ok(stats) => Ok(Json(stats)),
         Err(err) => {
             error!("error getting system stats: {err}");
@@ -140,3 +168,39 @@ pub async fn get_qmdl_manifest(
         current_entry,
     }))
 }
+
+pub async fn get_log() -> Result<String, (StatusCode, String)> {
+    tokio::fs::read_to_string("/data/rayhunter/rayhunter.log")
+        .await
+        .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))
+}
+
+#[derive(Debug, Serialize)]
+pub struct RouteStatus {
+    pub has_default_route: bool,
+}
+
+pub async fn get_route_status() -> Json<RouteStatus> {
+    let has_default_route = match check_default_route().await {
+        Ok(result) => result,
+        Err(err) => {
+            log::warn!("Failed to check default route: {err}");
+            // More likely than not, this is a portability issue. The logic hasn't been fully
+            // tested on all devices. We shouldn't scare users unnecessarily.
+            true
+        }
+    };
+
+    Json(RouteStatus { has_default_route })
+}
+
+// Checks for an IPv4 default route by reading /proc/net/route
+// instead of shelling out to `ip route`, which may not be available on all devices.
+async fn check_default_route() -> std::io::Result<bool> {
+    let contents = tokio::fs::read_to_string("/proc/net/route").await?;
+    Ok(contents.lines().skip(1).any(|line| {
+        line.split_whitespace()
+            .nth(1)
+            .is_some_and(|dest| dest == "00000000")
+    }))
+}

daemon/web/.gitignore

@@ -19,6 +19,3 @@ Thumbs.db
 # Vite
 vite.config.js.timestamp-*
 vite.config.ts.timestamp-*
-
-package-lock.json
-yarn.lock

daemon/web/eslint.config.js

@@ -37,6 +37,17 @@ export default ts.config(
                 { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
             ],
             '@typescript-eslint/no-explicit-any': 'off',
+            '@typescript-eslint/naming-convention': [
+                'error',
+                {
+                    selector: 'function',
+                    format: ['snake_case'],
+                },
+                {
+                    selector: 'method',
+                    format: ['snake_case'],
+                },
+            ],
         },
     }
 );

daemon/web/package.json

@@ -17,9 +17,10 @@
     "devDependencies": {
         "@sveltejs/adapter-auto": "^3.0.0",
         "@sveltejs/adapter-static": "^3.0.5",
-        "@sveltejs/kit": "^2.13.0",
-        "@sveltejs/vite-plugin-svelte": "^4.0.0",
+        "@sveltejs/kit": "^2.49.5",
+        "@sveltejs/vite-plugin-svelte": "^6.2.1",
         "@types/eslint": "^9.6.0",
+        "@types/node": "^24.7.0",
         "autoprefixer": "^10.4.20",
         "eslint": "^9.7.0",
         "eslint-config-prettier": "^9.1.0",
@@ -32,7 +33,7 @@
         "tailwindcss": "^3.4.9",
         "typescript": "^5.0.0",
         "typescript-eslint": "^8.0.0",
-        "vite": "^5.0.3",
-        "vitest": "^2.0.4"
+        "vite": "^7.1.11",
+        "vitest": "^3.2.4"
     }
 }

daemon/web/src/app.html

@@ -6,7 +6,7 @@
         <meta name="viewport" content="width=device-width, initial-scale=1" />
         %sveltekit.head%
     </head>
-    <body data-sveltekit-preload-data="hover">
+    <body data-sveltekit-preload-data="hover" style="width: 100%">
         <div style="display: contents" class="m-4 xl:m-8">%sveltekit.body%</div>
     </body>
 </html>

daemon/web/src/lib/action_errors.svelte.ts

@@ -0,0 +1,24 @@
+export class ActionError extends Error {
+    // The number of this an identical error has happened.
+    // This is shown as a number next to the error in the UI.
+    times = $state(1);
+
+    constructor(message: string, cause: Error) {
+        super(message);
+        this.cause = cause;
+    }
+}
+
+export const action_errors: ActionError[] = $state([]);
+
+export function add_error(e: Error, msg: string): void {
+    for (const existing of action_errors) {
+        if (existing.message === msg) {
+            existing.times += 1;
+            return;
+        }
+    }
+    const action_error = new ActionError(msg, e);
+    action_errors.unshift(action_error);
+    console.log(action_errors.length);
+}

daemon/web/src/lib/analysis.svelte.spec.ts

@@ -1,43 +1,7 @@
 import { describe, it, expect } from 'vitest';
-import { AnalysisRowType, EventType, parse_finished_report, Severity } from './analysis.svelte';
+import { AnalysisRowType, parse_finished_report } from './analysis.svelte';
 import { type NewlineDeliminatedJson } from './ndjson';
 
-const SAMPLE_V1_REPORT_NDJSON: NewlineDeliminatedJson = [
-    {
-        analyzers: [
-            {
-                name: 'Analyzer 1',
-                description: 'A first analyzer',
-            },
-            {
-                name: 'Analyzer 2',
-                description: 'A second analyzer',
-            },
-        ],
-    },
-    {
-        timestamp: '2024-10-08T13:25:43.011689003-07:00',
-        skipped_message_reasons: ['The reason why the message was skipped'],
-        analysis: [],
-    },
-    {
-        timestamp: '2024-10-08T13:25:43.480872496-07:00',
-        skipped_message_reasons: [],
-        analysis: [
-            {
-                timestamp: '2024-08-19T03:33:54.318Z',
-                events: [
-                    null,
-                    {
-                        event_type: { type: 'QualitativeWarning', severity: 'Low' },
-                        message: 'Something nasty happened',
-                    },
-                ],
-            },
-        ],
-    },
-];
-
 const SAMPLE_V2_REPORT_NDJSON: NewlineDeliminatedJson = [
     {
         analyzers: [
@@ -62,7 +26,7 @@ const SAMPLE_V2_REPORT_NDJSON: NewlineDeliminatedJson = [
         events: [
             null,
             {
-                event_type: { type: 'QualitativeWarning', severity: 'Low' },
+                event_type: 'Low',
                 message: 'Something nasty happened',
             },
         ],
@@ -70,40 +34,6 @@ const SAMPLE_V2_REPORT_NDJSON: NewlineDeliminatedJson = [
 ];
 
 describe('analysis report parsing', () => {
-    it('parses v1 example analysis', () => {
-        const report = parse_finished_report(SAMPLE_V1_REPORT_NDJSON);
-        expect(report.metadata.report_version).toEqual(1);
-        expect(report.metadata.analyzers).toEqual([
-            {
-                name: 'Analyzer 1',
-                description: 'A first analyzer',
-                version: 0,
-            },
-            {
-                name: 'Analyzer 2',
-                description: 'A second analyzer',
-                version: 0,
-            },
-        ]);
-        expect(report.rows).toHaveLength(2);
-        expect(report.rows[0].type).toBe(AnalysisRowType.Skipped);
-        if (report.rows[1].type === AnalysisRowType.Analysis) {
-            const row = report.rows[1];
-            expect(row.events).toHaveLength(2);
-            expect(row.events[0]).toBeNull();
-            const event = row.events[1];
-            const expected_timestamp = new Date('2024-08-19T03:33:54.318Z');
-            expect(row.packet_timestamp.getTime()).toEqual(expected_timestamp.getTime());
-            if (event !== null && event.type === EventType.Warning) {
-                expect(event.severity).toEqual(Severity.Low);
-            } else {
-                throw 'wrong event type';
-            }
-        } else {
-            throw 'wrong row type';
-        }
-    });
-
     it('parses v2 example analysis', () => {
         const report = parse_finished_report(SAMPLE_V2_REPORT_NDJSON);
         expect(report.metadata.report_version).toEqual(2);
@@ -128,11 +58,7 @@ describe('analysis report parsing', () => {
             const event = row.events[1];
             const expected_timestamp = new Date('2024-08-19T03:33:54.318Z');
             expect(row.packet_timestamp.getTime()).toEqual(expected_timestamp.getTime());
-            if (event !== null && event.type === EventType.Warning) {
-                expect(event.severity).toEqual(Severity.Low);
-            } else {
-                throw 'wrong event type';
-            }
+            expect(event!.event_type).toEqual('Low');
         } else {
             throw 'wrong row type';
         }

daemon/web/src/lib/analysis.svelte.ts

@@ -21,17 +21,7 @@ export class ReportMetadata {
     constructor(ndjson: any) {
         this.analyzers = ndjson.analyzers;
         this.rayhunter = ndjson.rayhunter;
-        if (ndjson.report_version === undefined) {
-            this.report_version = 1;
-            // we consider our legacy (unversioned) heuristics to be v0 --
-            // this'll let us clearly differentiate some known false-positive
-            // results from the pre-versioned era from v1 heuristics
-            this.analyzers.forEach((analyzer) => {
-                analyzer.version = 0;
-            });
-        } else {
-            this.report_version = ndjson.report_version;
-        }
+        this.report_version = ndjson.report_version || 2; // Default to v2
     }
 }
 
@@ -64,77 +54,22 @@ export type PacketAnalysis = {
     events: Event[];
 };
 
-export type Event = QualitativeWarning | InformationalEvent | null;
-export enum EventType {
-    Informational,
-    Warning,
-}
+export type EventType = 'Informational' | 'Low' | 'Medium' | 'High';
 
-export type QualitativeWarning = {
-    type: EventType.Warning;
-    severity: Severity;
+export type Event = {
+    event_type: EventType;
     message: string;
-};
-
-export enum Severity {
-    Low,
-    Medium,
-    High,
-}
-
-export type InformationalEvent = {
-    type: EventType.Informational;
-    message: string;
-};
+} | null;
 
 function get_event(event_json: any): Event {
-    if (event_json.event_type.type === 'Informational') {
-        return {
-            type: EventType.Informational,
-            message: event_json.message,
-        };
-    } else {
-        return {
-            type: EventType.Warning,
-            severity:
-                event_json.event_type.severity === 'High'
-                    ? Severity.High
-                    : event_json.event_type.severity === 'Medium'
-                      ? Severity.Medium
-                      : Severity.Low,
-            message: event_json.message,
-        };
+    if (!['Informational', 'Low', 'Medium', 'High'].includes(event_json.event_type)) {
+        throw `Invalid/unhandled event type: ${event_json.event_type}`;
     }
+
+    return event_json;
 }
 
-function get_v1_rows(row_jsons: any[]): AnalysisRow[] {
-    const rows: AnalysisRow[] = [];
-    for (const row_json of row_jsons) {
-        for (const reason of row_json.skipped_message_reasons) {
-            rows.push({
-                type: AnalysisRowType.Skipped,
-                reason,
-            });
-        }
-        for (const analysis_json of row_json.analysis) {
-            const events: Event[] = analysis_json.events.map((event_json: any): Event | null => {
-                if (event_json === null) {
-                    return null;
-                } else {
-                    return get_event(event_json);
-                }
-            });
-            rows.push({
-                type: AnalysisRowType.Analysis,
-                packet_timestamp: new Date(analysis_json.timestamp),
-                events,
-            });
-        }
-    }
-    return rows;
-}
-
-function get_v2_rows(row_jsons: any[]): AnalysisRow[] {
+function get_rows(row_jsons: any[]): AnalysisRow[] {
     const rows: AnalysisRow[] = [];
     for (const row_json of row_jsons) {
         if (row_json.skipped_message_reason) {
@@ -170,7 +105,7 @@ function get_report_stats(rows: AnalysisRow[]): ReportStatistics {
         } else {
             for (const event of row.events) {
                 if (event !== null) {
-                    if (event.type === EventType.Informational) {
+                    if (event.event_type === 'Informational') {
                         num_informational_logs++;
                     } else {
                         num_warnings++;
@@ -188,12 +123,7 @@ function get_report_stats(rows: AnalysisRow[]): ReportStatistics {
 
 export function parse_finished_report(report_json: NewlineDeliminatedJson): AnalysisReport {
     const metadata = new ReportMetadata(report_json[0]);
-    let rows;
-    if (metadata.report_version === 1) {
-        rows = get_v1_rows(report_json.slice(1));
-    } else {
-        rows = get_v2_rows(report_json.slice(1));
-    }
+    const rows = get_rows(report_json.slice(1));
     const statistics = get_report_stats(rows);
     return {
         statistics,

daemon/web/src/lib/analysisManager.svelte.ts

@@ -23,11 +23,9 @@ export type AnalysisResult = {
 };
 
 export class AnalysisManager {
-    public status: Map<string, AnalysisStatus> = new Map();
-    public reports: Map<string, AnalysisReport | string> = new Map();
-
-    public async run_analysis(name: string) {
-        await req('POST', `/api/analysis/${name}`);
+    public status: Map<string, AnalysisStatus> = $state(new Map());
+    public reports: Map<string, AnalysisReport | string> = $state(new Map());
+    public set_queued_status(name: string) {
         this.status.set(name, AnalysisStatus.Queued);
         this.reports.delete(name);
     }

daemon/web/src/lib/components/ActionErrors.svelte

@@ -0,0 +1,87 @@
+<script lang="ts">
+    import { action_errors } from '../action_errors.svelte';
+    import WarningIcon from './WarningIcon.svelte';
+
+    let pos = $state(0);
+    let current_error = $derived(action_errors[pos]);
+
+    function prev_error() {
+        if (pos > 0) pos -= 1;
+        else pos = action_errors.length - 1;
+    }
+    function next_error() {
+        if (pos + 1 < action_errors.length) pos += 1;
+        else pos = 0;
+    }
+    function clear_errors() {
+        pos = 0;
+        action_errors.length = 0;
+    }
+</script>
+
+{#if action_errors.length > 0}
+    <div
+        class="bg-red-100 border-red-100 drop-shadow p-4 flex flex-col gap-2
+        border rounded-md flex-1 justify-between fixed z-10 right-3 bottom-3 ml-3"
+    >
+        <div class="flex flex-row justify-between">
+            <span class="text-xl font-bold mb-2 mr-5 flex flex-row items-center gap-1 text-red-600">
+                <WarningIcon class="w-6 h-6 text-red-600" />
+                Error Completing Action {current_error.times > 1 ? `x${current_error.times}` : ''}
+            </span>
+            <div class="flex items-center mb-2">
+                {#if action_errors.length > 1}
+                    <span>{pos + 1}/{action_errors.length}</span>
+                    <button title="previous error" aria-label="previous error" onclick={prev_error}>
+                        <svg
+                            aria-hidden="true"
+                            width="24"
+                            height="24"
+                            fill="none"
+                            viewBox="0 0 24 24"
+                        >
+                            <path
+                                stroke="currentColor"
+                                stroke-linecap="round"
+                                stroke-linejoin="round"
+                                stroke-width="2"
+                                d="m 15.499979,19.499979 -6.9999997,-7 6.9999997,-6.9999997"
+                            />
+                        </svg>
+                    </button>
+                    <button title="next error" aria-label="next error" onclick={next_error}>
+                        <svg
+                            aria-hidden="true"
+                            width="24"
+                            height="24"
+                            fill="none"
+                            viewBox="0 0 24 24"
+                        >
+                            <path
+                                stroke="currentColor"
+                                stroke-linecap="round"
+                                stroke-linejoin="round"
+                                stroke-width="2"
+                                d="m 8.5000207,5.4999793 7.0000003,6.9999997 -7.0000003,7"
+                            />
+                        </svg>
+                    </button>
+                {/if}
+                <button title="clear errors" aria-label="clear errors" onclick={clear_errors}>
+                    <svg style="width:24px;height:24px" viewBox="0 0 24 24">
+                        <path
+                            d="M19,4H15.5L14.5,3H9.5L8.5,4H5V6H19M6,19A2,2 0 0,0 8,21H16A2,2 0 0,0 18,19V7H6V19Z"
+                        />
+                    </svg>
+                </button>
+            </div>
+        </div>
+        <span>{current_error.message}</span>
+        {#if current_error.cause}
+            <details>
+                <summary>Details</summary>
+                <code>{current_error.cause}</code>
+            </details>
+        {/if}
+    </div>
+{/if}

daemon/web/src/lib/components/AnalysisStatus.svelte

@@ -35,15 +35,43 @@
         return finished && report_available;
     });
 
-    let button_class = $derived(ready ? 'text-blue-600 border rounded-full px-2' : '');
+    let button_class = $derived.by(() => {
+        if (!ready) {
+            return 'text-gray-700';
+        } else if ((entry.get_num_warnings() || 0) < 1) {
+            return 'text-green-700 border-green-500 bg-green-200 text-blue-600 border rounded-full px-2';
+        } else {
+            return 'text-red-700 border-red-500 bg-red-200 text-blue-600 border rounded-full px-2';
+        }
+    });
 </script>
 
 <button class="flex flex-row gap-1 lg:gap-2" disabled={!ready} {onclick}>
-    <span
-        class="{button_class} {(entry.get_num_warnings() || 0) < 1
-            ? 'text-green-700 border-green-500 bg-green-200'
-            : 'text-red-700 border-red-500 bg-red-200'}">{summary}</span
-    >
+    <span class="flex flex-row items-center gap-1">
+        {#if entry.analysis_status === AnalysisStatus.Queued || entry.analysis_status === AnalysisStatus.Running || (entry.analysis_status === AnalysisStatus.Finished && entry.analysis_report === undefined)}
+            <svg
+                class="animate-spin h-4 w-4 text-blue-600"
+                xmlns="http://www.w3.org/2000/svg"
+                fill="none"
+                viewBox="0 0 24 24"
+            >
+                <circle
+                    class="opacity-25"
+                    cx="12"
+                    cy="12"
+                    r="10"
+                    stroke="currentColor"
+                    stroke-width="4"
+                ></circle>
+                <path
+                    class="opacity-75"
+                    fill="currentColor"
+                    d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+                ></path>
+            </svg>
+        {/if}
+        <span class={button_class}>{summary}</span>
+    </span>
     <svg
         class="w-6 h-6 text-gray-800 transition-transform {analysis_visible ? 'rotate-180' : ''}"
         aria-hidden="true"

daemon/web/src/lib/components/AnalysisTable.svelte

@@ -1,5 +1,5 @@
 <script lang="ts">
-    import { AnalysisRowType, EventType, type AnalysisReport } from '$lib/analysis.svelte';
+    import { AnalysisRowType, type AnalysisReport } from '$lib/analysis.svelte';
     let {
         report,
     }: {
@@ -33,7 +33,7 @@
     {#if report.statistics.num_warnings === 0 && report.statistics.num_informational_logs === 0}
         <p>Nothing to show!</p>
     {:else}
-        <div class="overflow-x-scroll">
+        <div class="overflow-x-auto">
             <table class="table-auto text-left">
                 <thead class="p-2">
                     <tr class="bg-gray-300">
@@ -47,29 +47,24 @@
                     {#each report.rows as row}
                         {#if row.type === AnalysisRowType.Analysis}
                             {@const parsed_date = new Date(row.packet_timestamp)}
-                            {#each row.events.filter((e) => e !== null) as event, i}
-                                {@const analyzer = analyzers[i]}
-                                <tr class="even:bg-gray-200 odd:bg-white">
-                                    {#if event.type === EventType.Warning}
-                                        {@const severity = ['Low', 'Medium', 'High'][
-                                            event.severity
-                                        ]}
-                                        {@const severity_class = [
-                                            'bg-red-200',
-                                            'bg-red-400',
-                                            'bg-red-600',
-                                        ][event.severity]}
+                            {#each row.events as event, analyzerIndex}
+                                {#if event !== null}
+                                    {@const analyzer = analyzers[analyzerIndex]}
+                                    {@const event_type_class = {
+                                        Informational: '',
+                                        Low: 'bg-yellow-200',
+                                        Medium: 'bg-orange-400',
+                                        High: 'bg-red-600',
+                                    }[event.event_type]}
+                                    <tr class="even:bg-gray-200 odd:bg-white">
                                         <td class="p-2">{date_formatter.format(parsed_date)}</td>
                                         <td class="p-2">{analyzer.name} v{analyzer.version}</td>
                                         <td class="p-2">{event.message}</td>
-                                        <td class="p-2 {severity_class} text-center">{severity}</td>
-                                    {:else if event.type === EventType.Informational}
-                                        <td class="p-2">{date_formatter.format(parsed_date)}</td>
-                                        <td class="p-2">{analyzer.name} v{analyzer.version}</td>
-                                        <td class="p-2">{event.message}</td>
-                                        <td class="p-2">Info</td>
-                                    {/if}
-                                </tr>
+                                        <td class="p-2 {event_type_class} text-center"
+                                            >{event.event_type}</td
+                                        >
+                                    </tr>
+                                {/if}
                             {/each}
                         {/if}
                     {/each}
@@ -82,10 +77,11 @@
     <div>
         <p class="text-lg underline">Unparsed Messages</p>
         <p>
-            These are due to a limitation or bug in Rayhunter's parser, and aren't ususally a
-            problem.
+            These are due to a limitation or bug in Rayhunter's parser, and aren't usually a
+            problem. We'll not accept bug reports about them unless something else is going wrong
+            (such as false-positives or definite false-negatives)
         </p>
-        <div class="overflow-x-scroll">
+        <div class="overflow-x-auto">
             <table class="table-auto text-left">
                 <thead class="p-2">
                     <tr class="bg-gray-300">

daemon/web/src/lib/components/AnalysisView.svelte

@@ -1,11 +1,17 @@
 <script lang="ts">
     import { type ReportMetadata } from '$lib/analysis.svelte';
     import type { ManifestEntry } from '$lib/manifest.svelte';
+    import { AnalysisManager } from '$lib/analysisManager.svelte';
     import AnalysisTable from './AnalysisTable.svelte';
+    import ReAnalyzeButton from './ReAnalyzeButton.svelte';
     let {
         entry,
+        manager,
+        current,
     }: {
         entry: ManifestEntry;
+        manager: AnalysisManager;
+        current: boolean;
     } = $props();
 </script>
 
@@ -17,6 +23,11 @@
     {:else}
         {@const metadata: ReportMetadata = entry.analysis_report.metadata}
         <div class="flex flex-col gap-2">
+            {#if !current}
+                <div class="flex flex-row justify-end items-center">
+                    <ReAnalyzeButton {entry} {manager} />
+                </div>
+            {/if}
             {#if entry.analysis_report.rows.length > 0}
                 <AnalysisTable report={entry.analysis_report} />
             {:else}

daemon/web/src/lib/components/ApiRequestButton.svelte

@@ -0,0 +1,100 @@
+<script lang="ts">
+    import { user_action_req } from '$lib/utils.svelte';
+
+    let {
+        url,
+        method = 'POST',
+        label,
+        loadingLabel,
+        disabled = false,
+        variant = 'blue',
+        icon,
+        onclick,
+        ariaLabel,
+        errorMessage,
+        jsonBody,
+    }: {
+        url: string;
+        method?: string;
+        label: string;
+        loadingLabel?: string;
+        disabled?: boolean;
+        variant?: 'blue' | 'red' | 'green';
+        icon?: any; // Svelte snippet
+        onclick?: () => void | Promise<void>;
+        ariaLabel?: string;
+        errorMessage?: string;
+        jsonBody?: unknown;
+    } = $props();
+
+    let is_requesting = $state(false);
+    let is_disabled = $derived(disabled || is_requesting);
+
+    const variantClasses = {
+        blue: {
+            enabled: 'bg-blue-500 hover:bg-blue-700',
+            disabled: 'bg-blue-500 opacity-50 cursor-not-allowed',
+        },
+        red: {
+            enabled: 'bg-red-500 hover:bg-red-700',
+            disabled: 'bg-red-500 opacity-50 cursor-not-allowed',
+        },
+        green: {
+            enabled: 'bg-green-500 hover:bg-green-700',
+            disabled: 'bg-green-500 opacity-50 cursor-not-allowed',
+        },
+    };
+
+    async function handle_click() {
+        if (is_disabled) return;
+
+        is_requesting = true;
+        try {
+            await user_action_req(
+                method,
+                url,
+                errorMessage ? errorMessage : 'Error performing action',
+                jsonBody
+            );
+            if (onclick) {
+                await onclick();
+            }
+        } catch (err) {
+            console.error(`Failed to ${method} ${url}:`, err);
+            alert(`Request failed. Please try again.`);
+        } finally {
+            is_requesting = false;
+        }
+    }
+
+    let buttonClasses = $derived(
+        is_disabled ? variantClasses[variant].disabled : variantClasses[variant].enabled
+    );
+</script>
+
+<button
+    class="text-white font-bold py-2 px-2 sm:px-4 rounded-md flex flex-row items-center gap-1 {buttonClasses}"
+    onclick={handle_click}
+    disabled={is_disabled}
+    aria-label={ariaLabel || label}
+>
+    <span>{is_requesting && loadingLabel ? loadingLabel : label}</span>
+    {#if is_requesting}
+        <svg
+            class="w-4 h-4 text-white animate-spin"
+            xmlns="http://www.w3.org/2000/svg"
+            fill="none"
+            viewBox="0 0 24 24"
+        >
+            <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"
+            ></circle>
+            <path
+                class="opacity-75"
+                fill="currentColor"
+                d="m4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
+            ></path>
+        </svg>
+    {:else if icon}
+        {@render icon()}
+    {/if}
+</button>

daemon/web/src/lib/components/ClockDriftAlert.svelte

@@ -0,0 +1,121 @@
+<script lang="ts">
+    import { get_daemon_time } from '$lib/utils.svelte';
+    import ApiRequestButton from './ApiRequestButton.svelte';
+
+    let show_alert = $state(false);
+    let device_system_time = $state('');
+    let device_adjusted_time = $state('');
+    let browser_time = $state('');
+    let has_offset = $state(false);
+    let computed_offset = $state(0);
+    let dismissed = $state(false);
+    let check_completed = $state(false);
+
+    const DRIFT_THRESHOLD_SECONDS = 30;
+
+    function format_time(date: Date): string {
+        return date.toLocaleString();
+    }
+
+    async function check_clock_drift() {
+        if (check_completed) return;
+
+        try {
+            const daemon_time_response = await get_daemon_time();
+            const browser_now = new Date();
+            const daemon_system_ms = new Date(daemon_time_response.system_time).getTime();
+            const device_adjusted_ms = new Date(daemon_time_response.adjusted_time).getTime();
+            const drift_seconds = Math.round((browser_now.getTime() - device_adjusted_ms) / 1000);
+
+            if (Math.abs(drift_seconds) > DRIFT_THRESHOLD_SECONDS && !dismissed) {
+                device_system_time = format_time(new Date(daemon_time_response.system_time));
+                device_adjusted_time = format_time(new Date(daemon_time_response.adjusted_time));
+                browser_time = format_time(browser_now);
+                has_offset = daemon_time_response.offset_seconds !== 0;
+                // Calculate offset needed: browser_time - daemon_system_time
+                computed_offset = Math.round((browser_now.getTime() - daemon_system_ms) / 1000);
+                show_alert = true;
+            }
+        } catch (err) {
+            console.error('Failed to check clock drift:', err);
+        }
+        check_completed = true;
+    }
+
+    function dismiss() {
+        show_alert = false;
+        dismissed = true;
+    }
+
+    // Check clock drift on component mount
+    $effect(() => {
+        check_clock_drift();
+    });
+</script>
+
+{#if show_alert}
+    <div
+        class="bg-yellow-100 border-yellow-400 drop-shadow p-4 flex flex-col gap-2 border rounded-md"
+    >
+        <span class="text-xl font-bold flex flex-row items-center gap-2 text-yellow-700">
+            <svg
+                class="w-6 h-6 text-yellow-600"
+                aria-hidden="true"
+                xmlns="http://www.w3.org/2000/svg"
+                width="24"
+                height="24"
+                fill="currentColor"
+                viewBox="0 0 24 24"
+            >
+                <path
+                    fill-rule="evenodd"
+                    d="M2 12C2 6.477 6.477 2 12 2s10 4.477 10 10-4.477 10-10 10S2 17.523 2 12Zm11-4a1 1 0 1 0-2 0v4a1 1 0 0 0 .293.707l3 3a1 1 0 0 0 1.414-1.414L13 11.586V8Z"
+                    clip-rule="evenodd"
+                />
+            </svg>
+            Clock Mismatch Detected
+        </span>
+        <p>
+            Rayhunter's clock doesn't match your browser's, and may be incorrect. This can happen if
+            Rayhunter is unable to get the correct time from the internet. Consider synchronizing
+            your browser's clock with the button below, or using another SIM card for better
+            results.
+        </p>
+        <table class="w-fit">
+            <tbody>
+                <tr>
+                    <td class="pr-2">Rayhunter clock (system):</td>
+                    <td class="font-mono">{device_system_time}</td>
+                </tr>
+                {#if has_offset}
+                    <tr>
+                        <td class="pr-2">Rayhunter clock (adjusted):</td>
+                        <td class="font-mono">{device_adjusted_time}</td>
+                    </tr>
+                {/if}
+                <tr>
+                    <td class="pr-2">Browser clock:</td>
+                    <td class="font-mono">{browser_time}</td>
+                </tr>
+            </tbody>
+        </table>
+        <p>Copy browser clock to device?</p>
+        <div class="flex flex-row gap-2 justify-end">
+            <button
+                class="font-medium py-2 px-4 rounded-md border border-gray-400 hover:bg-yellow-200"
+                onclick={dismiss}
+            >
+                Dismiss
+            </button>
+            <ApiRequestButton
+                url="/api/time-offset"
+                label="Sync Clock"
+                loadingLabel="Syncing..."
+                variant="green"
+                jsonBody={{ offset_seconds: computed_offset }}
+                onclick={dismiss}
+                errorMessage="Error syncing clock"
+            />
+        </div>
+    </div>
+{/if}

daemon/web/src/lib/components/ConfigForm.svelte

@@ -1,15 +1,18 @@
 <script lang="ts">
-    import { get_config, set_config, type Config } from '../utils.svelte';
+    import { get_config, set_config, test_notification, type Config } from '../utils.svelte';
 
     let config = $state<Config | null>(null);
 
     let loading = $state(false);
     let saving = $state(false);
+    let testingNotification = $state(false);
     let message = $state('');
     let messageType = $state<'success' | 'error' | null>(null);
+    let testMessage = $state('');
+    let testMessageType = $state<'success' | 'error' | null>(null);
     let showConfig = $state(false);
 
-    async function loadConfig() {
+    async function load_config() {
         try {
             loading = true;
             config = await get_config();
@@ -23,7 +26,7 @@
         }
     }
 
-    async function saveConfig() {
+    async function save_config() {
         if (!config) return;
 
         try {
@@ -40,10 +43,25 @@
         }
     }
 
-    // Load config when first shown
+    async function send_test_notification() {
+        try {
+            testingNotification = true;
+            testMessage = '';
+            testMessageType = null;
+            await test_notification();
+            testMessage = 'Test notification sent successfully!';
+            testMessageType = 'success';
+        } catch (error) {
+            testMessage = `${error}`;
+            testMessageType = 'error';
+        } finally {
+            testingNotification = false;
+        }
+    }
+
     $effect(() => {
         if (showConfig && !config) {
-            loadConfig();
+            load_config();
         }
     });
 </script>
@@ -73,7 +91,7 @@
                 class="space-y-4"
                 onsubmit={(e) => {
                     e.preventDefault();
-                    saveConfig();
+                    save_config();
                 }}
             >
                 <div>
@@ -89,7 +107,12 @@
                         <option value={1}>1 - Subtle mode (colored line)</option>
                         <option value={2}>2 - Demo mode (orca gif)</option>
                         <option value={3}>3 - EFF logo</option>
+                        <option value={4}>4 - High visibility (full screen color)</option>
                     </select>
+                    <p class="text-xs text-gray-500 mt-1">
+                        Note: Rayhunter draws over the device's native UI, so some flickering is
+                        expected
+                    </p>
                 </div>
 
                 <div>
@@ -125,6 +148,99 @@
                     </div>
                 </div>
 
+                <div class="border-t pt-4 mt-6 space-y-3">
+                    <h3 class="text-lg font-semibold text-gray-800 mb-4">Notification Settings</h3>
+                    <div>
+                        <label for="ntfy_url" class="block text-sm font-medium text-gray-700 mb-1">
+                            ntfy URL for Sending Notifications (if unset you will not receive
+                            notifications)
+                        </label>
+                        <input
+                            id="ntfy_url"
+                            type="url"
+                            bind:value={config.ntfy_url}
+                            class="w-full px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-rayhunter-blue"
+                        />
+                        <p class="text-xs text-gray-500 mt-1">
+                            Test button below uses the saved configuration URL, not the input above
+                        </p>
+                    </div>
+
+                    <div>
+                        <button
+                            type="button"
+                            onclick={send_test_notification}
+                            disabled={testingNotification}
+                            class="bg-rayhunter-blue hover:bg-rayhunter-dark-blue disabled:opacity-50 disabled:cursor-not-allowed text-white font-bold py-2 px-4 rounded-md flex flex-row gap-1 items-center"
+                        >
+                            {#if testingNotification}
+                                <div
+                                    class="w-4 h-4 border-2 border-white border-t-transparent rounded-full animate-spin"
+                                ></div>
+                                Sending...
+                            {:else}
+                                <svg
+                                    class="w-4 h-4"
+                                    fill="none"
+                                    stroke="currentColor"
+                                    viewBox="0 0 24 24"
+                                >
+                                    <path
+                                        stroke-linecap="round"
+                                        stroke-linejoin="round"
+                                        stroke-width="2"
+                                        d="M12 19l9 2-9-18-9 18 9-2zm0 0v-8"
+                                    ></path>
+                                </svg>
+                                Send Test Notification
+                            {/if}
+                        </button>
+                        {#if testMessage}
+                            <div
+                                class="mt-2 p-2 rounded text-sm {testMessageType === 'error'
+                                    ? 'bg-red-100 text-red-700'
+                                    : 'bg-green-100 text-green-700'}"
+                            >
+                                {testMessage}
+                            </div>
+                        {/if}
+                    </div>
+
+                    <div class="space-y-2">
+                        <div class="block text-sm font-medium text-gray-700 mb-1">
+                            Enabled Notification Types
+                        </div>
+                        <div class="flex items-center">
+                            <input
+                                type="checkbox"
+                                id="enable_warning_notifications"
+                                value="Warning"
+                                bind:group={config.enabled_notifications}
+                            />
+                            <label
+                                for="enable_warning_notifications"
+                                class="ml-2 block text-sm text-gray-700"
+                            >
+                                Warnings
+                            </label>
+                        </div>
+                        <div class="flex items-center">
+                            <input
+                                type="checkbox"
+                                id="enable_lowbattery_notifications"
+                                value="LowBattery"
+                                bind:group={config.enabled_notifications}
+                            />
+                            <label
+                                for="enable_lowbattery_notifications"
+                                class="ml-2 block text-sm text-gray-700"
+                            >
+                                Low Battery
+                            </label>
+                        </div>
+                    </div>
+                </div>
+
                 <div class="border-t pt-4 mt-6">
                     <h3 class="text-lg font-semibold text-gray-800 mb-4">
                         Analyzer Heuristic Settings
@@ -203,10 +319,22 @@
                                 bind:checked={config.analyzers.incomplete_sib}
                                 class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded"
                             />
-                            <label for="nas_null_cipher" class="ml-2 block text-sm text-gray-700">
+                            <label for="incomplete_sib" class="ml-2 block text-sm text-gray-700">
                                 Incomplete SIB Heuristic
                             </label>
                         </div>
+
+                        <div class="flex items-center">
+                            <input
+                                id="test_analyzer"
+                                type="checkbox"
+                                bind:checked={config.analyzers.test_analyzer}
+                                class="h-4 w-4 text-rayhunter-blue focus:ring-rayhunter-blue border-gray-300 rounded"
+                            />
+                            <label for="test_analyzer" class="ml-2 block text-sm text-gray-700">
+                                Test Heuristic (noisy!)
+                            </label>
+                        </div>
                     </div>
                 </div>
 

daemon/web/src/lib/components/DeleteAllButton.svelte

@@ -7,5 +7,6 @@
         text="Delete ALL Recordings"
         prompt={`Are you sure you want to delete ALL recordings?`}
         url={`/api/delete-all-recordings`}
+        name="all recodings"
     />
 </div>

daemon/web/src/lib/components/DeleteButton.svelte

@@ -1,25 +1,27 @@
 <script lang="ts">
-    import { req } from '$lib/utils.svelte';
+    import { user_action_req } from '$lib/utils.svelte';
     let {
         text,
         url,
         prompt,
+        name,
     }: {
         text?: string;
         url: string;
         prompt: string;
+        name: string;
     } = $props();
 
-    function confirmDelete() {
+    function confirm_delete() {
         if (window.confirm(prompt)) {
-            req('POST', url);
+            user_action_req('POST', url, 'Unable to delete recording ' + name);
         }
     }
 </script>
 
 <button
     class="bg-red-500 hover:bg-red-700 text-white font-bold py-2 px-2 sm:px-4 rounded-md flex flex-row"
-    onclick={confirmDelete}
+    onclick={confirm_delete}
     aria-label="delete"
 >
     <p>{text}</p>

daemon/web/src/lib/components/DownloadLink.svelte

@@ -8,20 +8,16 @@
         text: string;
         full_button?: boolean;
     } = $props();
-
-    function download() {
-        window.location.href = url;
-    }
 </script>
 
-<button
+<a
+    href={url}
     class="flex flex-row {full_button
         ? 'bg-blue-500 hover:bg-blue-700 text-white font-bold py-2 px-2 sm:px-4 rounded-md'
         : 'text-blue-600 underline'}"
-    onclick={download}
 >
     {text}
     <svg class="fill-current w-4 h-4 m-1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20">
         <path d="M13 8V2H7v6H2l8 8 8-8h-5zM0 18h20v2H0v-2z" />
     </svg>
-</button>
+</a>

daemon/web/src/lib/components/IPRouteAlert.svelte

@@ -0,0 +1,52 @@
+<script lang="ts">
+    import { get_route_status } from '$lib/utils.svelte';
+    import WarningIcon from './WarningIcon.svelte';
+
+    let show_alert = $state(false);
+    let check_completed = $state(false);
+
+    async function check_route() {
+        if (check_completed) return;
+
+        try {
+            const status = await get_route_status();
+            if (!status.has_default_route) {
+                show_alert = true;
+            }
+        } catch (err) {
+            console.error('Failed to check route status:', err);
+        }
+        check_completed = true;
+    }
+
+    function dismiss() {
+        show_alert = false;
+    }
+
+    $effect(() => {
+        check_route();
+    });
+</script>
+
+{#if show_alert}
+    <div
+        class="bg-yellow-100 border-yellow-400 drop-shadow p-4 flex flex-col gap-2 border rounded-md"
+    >
+        <span class="text-xl font-bold flex flex-row items-center gap-2 text-yellow-700">
+            <WarningIcon class="w-6 h-6 text-yellow-600" />
+            No Default Route Detected
+        </span>
+        <p>
+            This device didn't get an IP address from the network operator. Presumably the SIM card
+            is not inserted or very old. Try a different SIM card.
+        </p>
+        <div class="flex flex-row gap-2 justify-end">
+            <button
+                class="font-medium py-2 px-4 rounded-md border border-gray-400 hover:bg-yellow-200"
+                onclick={dismiss}
+            >
+                Dismiss
+            </button>
+        </div>
+    </div>
+{/if}

daemon/web/src/lib/components/LogView.svelte

@@ -0,0 +1,74 @@
+<script lang="ts">
+    import { get_logs } from '$lib/utils.svelte';
+    import { onMount } from 'svelte';
+
+    let { shown = $bindable() }: { shown: boolean } = $props();
+    let content: string | undefined = $state(undefined);
+
+    onMount(() => {
+        // Used by LogView modal
+        window.addEventListener('scroll', () => {
+            document.documentElement.style.setProperty('--scroll-y', `${window.scrollY}px`);
+        });
+    });
+
+    $effect(() => {
+        if (shown) {
+            const scrollY = document.documentElement.style.getPropertyValue('--scroll-y');
+            const body = document.body;
+            body.style.position = 'fixed';
+            body.style.top = `-${scrollY}`;
+        } else {
+            const body = document.body;
+            const scrollY = body.style.top;
+            body.style.position = '';
+            body.style.top = '';
+            window.scrollTo(0, parseInt(scrollY || '0') * -1);
+        }
+
+        const interval = setInterval(async () => {
+            try {
+                // Don't update UI if browser tab isn't visible
+                if (content !== undefined && (document.hidden || !shown)) {
+                    return;
+                }
+                content = await get_logs();
+            } catch (error) {
+                console.log(error);
+            }
+        }, 1000);
+
+        return () => clearInterval(interval);
+    });
+</script>
+
+{#if shown}
+    <div
+        class="fixed left-5 right-5 top-5 bottom-5 z-50 bg-white border border-white rounded-md
+		flex flex-col p-2 drop-shadow"
+    >
+        <div class="flex h-20 justify-between items-center p-1">
+            <span class="text-2xl mb-2">Log</span>
+            <button onclick={() => (shown = false)} aria-label="close">
+                <svg
+                    xmlns="http://www.w3.org/2000/svg"
+                    aria-hidden="true"
+                    width="24"
+                    height="24"
+                    fill="currentColor"
+                    viewBox="0 0 24 24"
+                >
+                    <path
+                        fill-rule="evenodd"
+                        clip-rule="evenodd"
+                        d="M5.29289 5.29289C5.68342 4.90237 6.31658 4.90237 6.70711 5.29289L12 10.5858L17.2929 5.29289C17.6834 4.90237 18.3166 4.90237 18.7071 5.29289C19.0976 5.68342 19.0976 6.31658 18.7071 6.70711L13.4142 12L18.7071 17.2929C19.0976 17.6834 19.0976 18.3166 18.7071 18.7071C18.3166 19.0976 17.6834 19.0976 17.2929 18.7071L12 13.4142L6.70711 18.7071C6.31658 19.0976 5.68342 19.0976 5.29289 18.7071C4.90237 18.3166 4.90237 17.6834 5.29289 17.2929L10.5858 12L5.29289 6.70711C4.90237 6.31658 4.90237 5.68342 5.29289 5.29289Z"
+                        fill="#0F1729"
+                    />
+                </svg>
+            </button>
+        </div>
+        <div class="bg-gray-100 border border-gray-100 rounded-md overflow-scroll">
+            <pre class="m-2">{content}</pre>
+        </div>
+    </div>
+{/if}

daemon/web/src/lib/components/ManifestCard.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
     import { ManifestEntry } from '$lib/manifest.svelte';
+    import { AnalysisManager } from '$lib/analysisManager.svelte';
     import DownloadLink from '$lib/components/DownloadLink.svelte';
     import DeleteButton from '$lib/components/DeleteButton.svelte';
     import AnalysisStatus from './AnalysisStatus.svelte';
@@ -9,10 +10,12 @@
         entry,
         current,
         server_is_recording,
+        manager,
     }: {
         entry: ManifestEntry;
         current: boolean;
         server_is_recording: boolean;
+        manager: AnalysisManager;
     } = $props();
 
     // passing `undefined` as the locale uses the browser default
@@ -41,7 +44,7 @@
 </script>
 
 <div
-    class="{status_row_color} {status_border_color} drop-shadow p-4 flex flex-col gap-2 border rounded-md flex-1 overflow-x-scroll overflow-y-hidden"
+    class="{status_row_color} {status_border_color} drop-shadow p-4 flex flex-col gap-2 border rounded-md flex-1 overflow-x-auto overflow-y-hidden"
 >
     {#if current}
         <div class="flex flex-row justify-between gap-2">
@@ -78,7 +81,7 @@
                 'N/A'}</span
         >
     </div>
-    <div class="flex flex-row justify-between lg:justify-end gap-1 mt-2 overflow-x-scroll">
+    <div class="flex flex-row justify-between lg:justify-end gap-1 mt-2 overflow-x-auto">
         <DownloadLink url={entry.get_pcap_url()} text="pcap" full_button />
         <DownloadLink url={entry.get_qmdl_url()} text="qmdl" full_button />
         <DownloadLink url={entry.get_zip_url()} text="zip" full_button />
@@ -88,10 +91,11 @@
             <DeleteButton
                 prompt={`Are you sure you want to delete entry ${entry.name}?`}
                 url={entry.get_delete_url()}
+                name={entry.name}
             />
         {/if}
     </div>
     <div class="border-b {analysis_visible ? '' : 'hidden'}">
-        <AnalysisView {entry} />
+        <AnalysisView {entry} {manager} {current} />
     </div>
 </div>

daemon/web/src/lib/components/ManifestTable.svelte

@@ -1,38 +1,42 @@
 <script lang="ts">
     import { ManifestEntry } from '$lib/manifest.svelte';
+    import { AnalysisManager } from '$lib/analysisManager.svelte';
+    import { screenIsLgUp } from '$lib/stores/breakpoint';
     import TableRow from './ManifestTableRow.svelte';
     import Card from './ManifestCard.svelte';
     interface Props {
         entries: ManifestEntry[];
         server_is_recording: boolean;
+        manager: AnalysisManager;
     }
-    let { entries, server_is_recording }: Props = $props();
+    let { entries, server_is_recording, manager }: Props = $props();
 </script>
 
 <!--For larger screens we use a table-->
-<table class="hidden table-auto text-left lg:table">
-    <thead>
-        <tr class="bg-gray-100 drop-shadow">
-            <th class="p-2" scope="col">ID</th>
-            <th class="p-2" scope="col">Started</th>
-            <th class="p-2" scope="col">Last Message</th>
-            <th class="p-2" scope="col">Size</th>
-            <th class="p-2" scope="col">PCAP</th>
-            <th class="p-2" scope="col">QMDL</th>
-            <th class="p-2" scope="col">ZIP</th>
-            <th class="p-2" scope="col">Analysis</th>
-            <th class="p-2" scope="col"></th>
-        </tr>
-    </thead>
-    <tbody>
-        {#each entries as entry, i}
-            <TableRow {entry} current={false} {i} />
+{#if $screenIsLgUp}
+    <table class="table-auto text-left table">
+        <thead>
+            <tr class="bg-gray-100 drop-shadow">
+                <th class="p-2" scope="col">ID</th>
+                <th class="p-2" scope="col">Started</th>
+                <th class="p-2" scope="col">Last Message</th>
+                <th class="p-2" scope="col">Size</th>
+                <th class="p-2" scope="col">Download</th>
+                <th class="p-2" scope="col">Analysis</th>
+                <th class="p-2" scope="col"></th>
+            </tr>
+        </thead>
+        <tbody>
+            {#each entries as entry, i}
+                <TableRow {entry} current={false} {i} {manager} />
+            {/each}
+        </tbody>
+    </table>
+{:else}
+    <!--For smaller screens we use cards-->
+    <div class="flex flex-col gap-4">
+        {#each entries as entry}
+            <Card {entry} current={false} {server_is_recording} {manager} />
         {/each}
-    </tbody>
-</table>
-<!--For smaller screens we use cards-->
-<div class="lg:hidden flex flex-col gap-4">
-    {#each entries as entry}
-        <Card {entry} current={false} {server_is_recording} />
-    {/each}
-</div>
+    </div>
+{/if}

daemon/web/src/lib/components/ManifestTableRow.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
     import { ManifestEntry } from '$lib/manifest.svelte';
+    import { AnalysisManager } from '$lib/analysisManager.svelte';
     import DownloadLink from '$lib/components/DownloadLink.svelte';
     import DeleteButton from '$lib/components/DeleteButton.svelte';
     import AnalysisStatus from './AnalysisStatus.svelte';
@@ -8,10 +9,12 @@
         entry,
         current,
         i,
+        manager,
     }: {
         entry: ManifestEntry;
         current: boolean;
         i: number;
+        manager: AnalysisManager;
     } = $props();
 
     // passing `undefined` as the locale uses the browser default
@@ -40,9 +43,13 @@
         >{(entry.last_message_time && date_formatter.format(entry.last_message_time)) || 'N/A'}</td
     >
     <td class="p-2">{entry.get_readable_qmdl_size()}</td>
-    <td class="p-2"><DownloadLink url={entry.get_pcap_url()} text="pcap" /></td>
-    <td class="p-2"><DownloadLink url={entry.get_qmdl_url()} text="qmdl" /></td>
-    <td class="p-2"><DownloadLink url={entry.get_zip_url()} text="zip" /></td>
+    <td class="p-2">
+        <div class="flex flex-row gap-2">
+            <DownloadLink url={entry.get_pcap_url()} text="pcap" />
+            <DownloadLink url={entry.get_qmdl_url()} text="qmdl" />
+            <DownloadLink url={entry.get_zip_url()} text="zip" />
+        </div>
+    </td>
     <td class="p-2"
         ><AnalysisStatus onclick={toggle_analysis_visibility} {entry} {analysis_visible} /></td
     >
@@ -53,12 +60,13 @@
             <DeleteButton
                 prompt={`Are you sure you want to delete entry ${entry.name}?`}
                 url={entry.get_delete_url()}
+                name={entry.name}
             />
         </td>
     {/if}
 </tr>
 <tr class="{alternating_row_color} border-b {analysis_visible ? '' : 'hidden'}">
     <td class="border-t border-dashed p-2" colspan="9">
-        <AnalysisView {entry} />
+        <AnalysisView {entry} {manager} {current} />
     </td>
 </tr>

daemon/web/src/lib/components/ReAnalyzeButton.svelte

@@ -0,0 +1,48 @@
+<script lang="ts">
+    import ApiRequestButton from './ApiRequestButton.svelte';
+    import { AnalysisStatus, AnalysisManager } from '$lib/analysisManager.svelte';
+    import type { ManifestEntry } from '$lib/manifest.svelte';
+
+    let {
+        entry,
+        manager,
+    }: {
+        entry: ManifestEntry;
+        manager: AnalysisManager;
+    } = $props();
+
+    let url = $derived(entry.get_reanalyze_url());
+    let entry_name = $derived(entry.name);
+    let analysis_status = $derived(entry.analysis_status);
+
+    let is_processing = $derived(
+        analysis_status === AnalysisStatus.Queued || analysis_status === AnalysisStatus.Running
+    );
+
+    async function handle_re_analyze() {
+        // Update the entry directly for immediate UI feedback
+        entry.analysis_status = AnalysisStatus.Queued;
+        entry.analysis_report = undefined;
+        manager.set_queued_status(entry_name);
+    }
+</script>
+
+<ApiRequestButton
+    {url}
+    label="Re-analyze"
+    loadingLabel="Analyzing..."
+    disabled={is_processing}
+    variant="blue"
+    onclick={handle_re_analyze}
+    ariaLabel="re-analyze"
+    errorMessage="Error re-analyzing recoding"
+>
+    {#snippet icon()}
+        <svg style="width:20px;height:20px" viewBox="0 0 24 24">
+            <path
+                fill="white"
+                d="M12,18A6,6 0 0,1 6,12C6,11 6.25,10.03 6.7,9.2L5.24,7.74C4.46,8.97 4,10.43 4,12A8,8 0 0,0 12,20V23L16,19L12,15M12,4V1L8,5L12,9V6A6,6 0 0,1 18,12C18,13 17.75,13.97 17.3,14.8L18.76,16.26C19.54,15.03 20,13.57 20,12A8,8 0 0,0 12,4Z"
+            />
+        </svg>
+    {/snippet}
+</ApiRequestButton>

daemon/web/src/lib/components/RecordingControls.svelte

@@ -1,100 +1,60 @@
 <script lang="ts">
-    import { req } from '$lib/utils.svelte';
+    import ApiRequestButton from './ApiRequestButton.svelte';
     let {
         server_is_recording,
     }: {
         server_is_recording: boolean;
     } = $props();
-
-    let client_set_recording = $state(server_is_recording);
-    let waiting_for_server = $derived(client_set_recording !== server_is_recording);
-
-    async function start_recording() {
-        await req('POST', '/api/start-recording');
-        client_set_recording = true;
-    }
-
-    async function stop_recording() {
-        await req('POST', '/api/stop-recording');
-        client_set_recording = false;
-    }
-
-    const recording_button_classes =
-        'text-white font-bold py-2 px-2 sm:px-4 rounded-md flex flex-row gap-1';
-    const stop_recording_classes = `${recording_button_classes} bg-red-500 opacity-50 cursor-not-allowed`;
-    const start_recording_classes = `${recording_button_classes} bg-blue-500 opacity-50 cursor-not-allowed`;
 </script>
 
 <div>
-    {#if waiting_for_server}
-        <button
-            class={server_is_recording ? stop_recording_classes : start_recording_classes}
-            disabled
+    {#if server_is_recording}
+        <ApiRequestButton
+            url="/api/stop-recording"
+            label="Stop"
+            variant="red"
+            errorMessage="Error stoppping recording"
         >
-            <span>{server_is_recording ? 'Stopping...' : 'Starting...'}</span>
-            <svg
-                class="w-4 h-4 text-white animate-spin"
-                xmlns="http://www.w3.org/2000/svg"
-                fill="none"
-                viewBox="0 0 24 24"
-            >
-                <circle
-                    class="opacity-25"
-                    cx="12"
-                    cy="12"
-                    r="10"
-                    stroke="currentColor"
-                    stroke-width="4"
-                ></circle>
-                <path
-                    class="opacity-75"
+            {#snippet icon()}
+                <svg
+                    class="w-6 h-6 text-white"
+                    aria-hidden="true"
+                    xmlns="http://www.w3.org/2000/svg"
+                    width="24"
+                    height="24"
                     fill="currentColor"
-                    d="m4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
-                ></path>
-            </svg>
-        </button>
-    {:else if server_is_recording}
-        <button
-            class="{recording_button_classes} bg-red-500 hover:bg-red-700"
-            onclick={stop_recording}
-        >
-            <span>Stop</span>
-            <svg
-                class="w-6 h-6 text-white"
-                aria-hidden="true"
-                xmlns="http://www.w3.org/2000/svg"
-                width="24"
-                height="24"
-                fill="currentColor"
-                viewBox="0 0 24 24"
-            >
-                <path d="M7 5a2 2 0 0 0-2 2v10a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V7a2 2 0 0 0-2-2H7Z" />
-            </svg>
-        </button>
+                    viewBox="0 0 24 24"
+                >
+                    <path
+                        d="M7 5a2 2 0 0 0-2 2v10a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V7a2 2 0 0 0-2-2H7Z"
+                    />
+                </svg>
+            {/snippet}
+        </ApiRequestButton>
     {:else}
-        <button
-            class="{recording_button_classes} bg-blue-500 hover:bg-blue-700"
-            onclick={start_recording}
+        <ApiRequestButton
+            url="/api/start-recording"
+            label="Start"
+            variant="blue"
+            errorMessage="Error starting recording"
         >
-            <span>Start</span>
-            <svg
-                class="w-6 h-6 text-white"
-                aria-hidden="true"
-                xmlns="http://www.w3.org/2000/svg"
-                width="24"
-                height="24"
-                fill="currentColor"
-                viewBox="0 0 24 24"
-            >
-                <path
-                    fill-rule="evenodd"
-                    d="M8.6 5.2A1 1 0 0 0 7 6v12a1 1 0 0 0 1.6.8l8-6a1 1 0 0 0 0-1.6l-8-6Z"
-                    clip-rule="evenodd"
-                />
-            </svg>
-        </button>
+            {#snippet icon()}
+                <svg
+                    class="w-6 h-6 text-white"
+                    aria-hidden="true"
+                    xmlns="http://www.w3.org/2000/svg"
+                    width="24"
+                    height="24"
+                    fill="currentColor"
+                    viewBox="0 0 24 24"
+                >
+                    <path
+                        fill-rule="evenodd"
+                        d="M8.6 5.2A1 1 0 0 0 7 6v12a1 1 0 0 0 1.6.8l8-6a1 1 0 0 0 0-1.6l-8-6Z"
+                        clip-rule="evenodd"
+                    />
+                </svg>
+            {/snippet}
+        </ApiRequestButton>
     {/if}
 </div>
-
-<style>
-</style>

daemon/web/src/lib/components/SystemStatsTable.svelte

@@ -7,6 +7,32 @@
     } = $props();
 
     const table_cell_classes = 'border p-1 lg:p-2';
+
+    let battery_level = $derived(stats.battery_status ? stats.battery_status.level : 0);
+    let bar_color = $derived.by(() => {
+        if (stats.battery_status === undefined) {
+            return '';
+        }
+        if (battery_level <= 10) {
+            return 'fill-red-500';
+        }
+        if (battery_level <= 25) {
+            return 'fill-yellow-300';
+        }
+        return 'fill-green-500';
+    });
+    let title_text = $derived.by(() => {
+        if (stats.battery_status === undefined) {
+            return 'Rayhunter does not yet support displaying the battery level for this device.';
+        }
+
+        let text = `Battery is ${stats.battery_status.level}% full`;
+
+        if (stats.battery_status.is_plugged_in) {
+            text += ' and plugged in';
+        }
+        return text;
+    });
 </script>
 
 <div
@@ -32,6 +58,64 @@
                     Free: {stats.memory_stats.free}, Used: {stats.memory_stats.used}
                 </td>
             </tr>
+            <tr class="border-b">
+                <th class={table_cell_classes}> Battery </th>
+                <td class={table_cell_classes}>
+                    <svg
+                        width="80"
+                        height="30"
+                        viewBox="0 0 80 30"
+                        role="img"
+                        xmlns="http://www.w3.org/2000/svg"
+                        class="battery-icon"
+                    >
+                        <title>{title_text}</title>
+                        <!-- Battery body -->
+                        <rect
+                            class="fill-none stroke-neutral-800 stroke-2"
+                            width="70"
+                            height="30"
+                            rx="3"
+                            ry="3"
+                        />
+                        <!-- Battery terminal -->
+                        <rect
+                            class="fill-neutral-800"
+                            x="70"
+                            y="7"
+                            width="8"
+                            height="16"
+                            rx="2"
+                            ry="2"
+                        />
+                        <!-- Battery charge bar -->
+                        <rect
+                            class={bar_color}
+                            x="2"
+                            y="2"
+                            height="26"
+                            rx="2"
+                            ry="2"
+                            style="width: {battery_level * 0.66}px;"
+                        />
+                        {#if stats.battery_status && stats.battery_status.is_plugged_in}
+                            <!-- Lightning bolt icon -->
+                            <path
+                                class="fill-yellow-300 stroke-neutral-800 stroke-1"
+                                d="M38 3 L28 17 L34 17 L30 27 L40 13 L34 13 Z"
+                            />
+                        {/if}
+                        {#if !stats.battery_status}
+                            <!-- Question mark icon -->
+                            <text
+                                class="fill-neutral-500 text-[20px] font-bold [text-anchor:middle] [dominant-baseline:central]"
+                                x="35"
+                                y="15">?</text
+                            >
+                        {/if}
+                    </svg>
+                </td>
+            </tr>
         </tbody>
     </table>
 </div>

daemon/web/src/lib/components/WarningIcon.svelte

@@ -0,0 +1,19 @@
+<script lang="ts">
+    let { class: className = 'w-6 h-6' }: { class?: string } = $props();
+</script>
+
+<svg
+    class={className}
+    aria-hidden="true"
+    xmlns="http://www.w3.org/2000/svg"
+    width="24"
+    height="24"
+    fill="currentColor"
+    viewBox="0 0 24 24"
+>
+    <path
+        fill-rule="evenodd"
+        d="M2 12C2 6.477 6.477 2 12 2s10 4.477 10 10-4.477 10-10 10S2 17.523 2 12Zm11-4a1 1 0 1 0-2 0v5a1 1 0 1 0 2 0V8Zm-1 7a1 1 0 1 0 0 2h.01a1 1 0 1 0 0-2H12Z"
+        clip-rule="evenodd"
+    />
+</svg>

daemon/web/src/lib/manifest.svelte.ts

@@ -102,4 +102,8 @@ export class ManifestEntry {
     get_delete_url(): string {
         return `/api/delete-recording/${this.name}`;
     }
+
+    get_reanalyze_url(): string {
+        return `/api/analysis/${this.name}`;
+    }
 }

daemon/web/src/lib/stores/breakpoint.ts

@@ -0,0 +1,29 @@
+// stores/breakpoint.ts
+import { readable, type Readable } from 'svelte/store';
+import { breakpoints } from '../../theme';
+
+type Breakpoint = keyof typeof breakpoints;
+
+// Store that tracks if a specific breakpoint matches
+export function create_breakpoint_store(breakpoint: Breakpoint): Readable<boolean> {
+    return readable<boolean>(false, (set) => {
+        const width = breakpoints[breakpoint];
+        const mediaQuery = window.matchMedia(`(min-width: ${width})`);
+
+        // Set initial value
+        set(mediaQuery.matches);
+
+        // Update on change
+        const handler = (e: MediaQueryListEvent) => set(e.matches);
+        mediaQuery.addEventListener('change', handler);
+
+        // Cleanup
+        return () => mediaQuery.removeEventListener('change', handler);
+    });
+}
+
+// Create stores for each breakpoint
+export const screenIsSmUp: Readable<boolean> = create_breakpoint_store('sm');
+export const screenIsMdUp: Readable<boolean> = create_breakpoint_store('md');
+export const screenIsLgUp: Readable<boolean> = create_breakpoint_store('lg');
+export const screenIsXlUp: Readable<boolean> = create_breakpoint_store('xl');

daemon/web/src/lib/systemStats.ts

@@ -2,6 +2,7 @@ export interface SystemStats {
     disk_stats: DiskStats;
     memory_stats: MemoryStats;
     runtime_metadata: RuntimeMetadata;
+    battery_status?: BatteryStatus;
 }
 
 export interface RuntimeMetadata {
@@ -24,3 +25,8 @@ export interface MemoryStats {
     used: string;
     free: string;
 }
+
+export interface BatteryStatus {
+    level: number;
+    is_plugged_in: boolean;
+}

daemon/web/src/lib/utils.svelte.ts

@@ -1,3 +1,4 @@
+import { add_error } from './action_errors.svelte';
 import { Manifest } from './manifest.svelte';
 import type { SystemStats } from './systemStats';
 
@@ -8,24 +9,52 @@ export interface AnalyzerConfig {
     null_cipher: boolean;
     nas_null_cipher: boolean;
     incomplete_sib: boolean;
+    test_analyzer: boolean;
+}
+
+export enum enabled_notifications {
+    Warning = 'Warning',
+    LowBattery = 'LowBattery',
 }
 
 export interface Config {
     ui_level: number;
     colorblind_mode: boolean;
     key_input_mode: number;
+    ntfy_url: string;
+    enabled_notifications: enabled_notifications[];
     analyzers: AnalyzerConfig;
 }
 
-export async function req(method: string, url: string): Promise<string> {
-    const response = await fetch(url, {
-        method: method,
-    });
-    const body = await response.text();
+export async function req(method: string, url: string, json_body?: unknown): Promise<string> {
+    const options: RequestInit = { method };
+    if (json_body !== undefined) {
+        options.body = JSON.stringify(json_body);
+        options.headers = { 'Content-Type': 'application/json' };
+    }
+    const response = await fetch(url, options);
+    const responseBody = await response.text();
     if (response.status >= 200 && response.status < 300) {
-        return body;
+        return responseBody;
     } else {
-        throw new Error(body);
+        throw new Error(responseBody);
+    }
+}
+
+// A wrapper around req that reports errors to the UI
+export async function user_action_req(
+    method: string,
+    url: string,
+    error_msg: string,
+    json_body?: unknown
+): Promise<string | undefined> {
+    try {
+        return await req(method, url, json_body);
+    } catch (error) {
+        if (error instanceof Error) {
+            add_error(error, error_msg);
+        }
+        return undefined;
     }
 }
 
@@ -38,6 +67,10 @@ export async function get_system_stats(): Promise<SystemStats> {
     return JSON.parse(await req('GET', '/api/system-stats'));
 }
 
+export async function get_logs(): Promise<string> {
+    return await req('GET', '/api/log');
+}
+
 export async function get_config(): Promise<Config> {
     return JSON.parse(await req('GET', '/api/config'));
 }
@@ -56,3 +89,32 @@ export async function set_config(config: Config): Promise<void> {
         throw new Error(error);
     }
 }
+
+export async function test_notification(): Promise<void> {
+    const response = await fetch('/api/test-notification', {
+        method: 'POST',
+    });
+
+    if (!response.ok) {
+        const error = await response.text();
+        throw new Error(error);
+    }
+}
+
+export interface RouteStatus {
+    has_default_route: boolean;
+}
+
+export async function get_route_status(): Promise<RouteStatus> {
+    return JSON.parse(await req('GET', '/api/route-status'));
+}
+
+export interface TimeResponse {
+    system_time: string;
+    adjusted_time: string;
+    offset_seconds: number;
+}
+
+export async function get_daemon_time(): Promise<TimeResponse> {
+    return JSON.parse(await req('GET', '/api/time'));
+}

daemon/web/src/routes/+page.svelte

@@ -7,34 +7,105 @@
     import { AnalysisManager } from '$lib/analysisManager.svelte';
     import SystemStatsTable from '$lib/components/SystemStatsTable.svelte';
     import DeleteAllButton from '$lib/components/DeleteAllButton.svelte';
-    import RecordingControls from '$lib/components//RecordingControls.svelte';
+    import RecordingControls from '$lib/components/RecordingControls.svelte';
     import ConfigForm from '$lib/components/ConfigForm.svelte';
+    import ActionErrors from '$lib/components/ActionErrors.svelte';
+    import IPRouteAlert from '$lib/components/IPRouteAlert.svelte';
+    import ClockDriftAlert from '$lib/components/ClockDriftAlert.svelte';
+    import LogView from '$lib/components/LogView.svelte';
+    import WarningIcon from '$lib/components/WarningIcon.svelte';
 
     let manager: AnalysisManager = new AnalysisManager();
     let loaded = $state(false);
+    let filter_threshold: boolean = $state(false);
     let entries: ManifestEntry[] = $state([]);
     let current_entry: ManifestEntry | undefined = $state(undefined);
     let system_stats: SystemStats | undefined = $state(undefined);
+    let update_error: string | undefined = $state(undefined);
+    let logview_shown: boolean = $state(false);
     $effect(() => {
         const interval = setInterval(async () => {
-            await manager.update();
-            let new_manifest = await get_manifest();
-            await new_manifest.set_analysis_status(manager);
-            entries = new_manifest.entries;
-            current_entry = new_manifest.current_entry;
+            try {
+                // Don't update UI if browser tab isn't visible
+                if (document.hidden) {
+                    return;
+                }
 
-            system_stats = await get_system_stats();
-            loaded = true;
+                await manager.update();
+                let new_manifest = await get_manifest();
+                await new_manifest.set_analysis_status(manager);
+                entries = filter_threshold
+                    ? new_manifest.entries.filter((e) => e.get_num_warnings())
+                    : new_manifest.entries;
+
+                current_entry = new_manifest.current_entry;
+
+                system_stats = await get_system_stats();
+                update_error = undefined;
+                loaded = true;
+            } catch (error) {
+                if (error instanceof Error) {
+                    update_error = error.message;
+                } else {
+                    update_error = '';
+                }
+            }
         }, 1000);
 
         return () => clearInterval(interval);
     });
 </script>
 
+<LogView bind:shown={logview_shown} />
 <div class="p-4 xl:px-8 bg-rayhunter-blue drop-shadow flex flex-row justify-between items-center">
     <!-- https://www.w3.org/WAI/tutorials/images/decorative/ -->
     <img src="/rayhunter_text.png" alt="" class="h-10 xl:h-12" />
     <div class="flex flex-row gap-4">
+        <button onclick={() => (logview_shown = true)} class="flex flex-row gap-1 group">
+            <span class="hidden text-white group-hover:text-gray-400 lg:flex">Logs</span>
+            <svg
+                class="w-6 h-6 text-white group-hover:text-gray-400"
+                aria-hidden="true"
+                xmlns="http://www.w3.org/2000/svg"
+                width="24"
+                height="24"
+                fill="currentColor"
+                viewBox="0 0 24 24"
+            >
+                <path
+                    d="M10 14H3"
+                    stroke="currentColor"
+                    stroke-width="1.5"
+                    stroke-linecap="round"
+                />
+                <path
+                    d="M10 18H3"
+                    stroke="currentColor"
+                    stroke-width="1.5"
+                    stroke-linecap="round"
+                />
+                <path
+                    d="M14 15L17.5 18L21 15"
+                    stroke="currentColor"
+                    stroke-width="1.5"
+                    stroke-linecap="round"
+                    stroke-linejoin="round"
+                />
+                <path
+                    d="M3 6L13.5 6M20 6L17.75 6"
+                    stroke="currentColor"
+                    stroke-width="1.5"
+                    stroke-linecap="round"
+                />
+                <path
+                    d="M20 10L9.5 10M3 10H5.25"
+                    stroke="currentColor"
+                    stroke-width="1.5"
+                    stroke-linecap="round"
+                />
+            </svg>
+        </button>
+        <div class="w-px bg-white/30 self-stretch"></div>
         <a
             class="flex flex-row gap-1 group"
             href="https://github.com/EFForg/rayhunter/issues"
@@ -81,13 +152,61 @@
                 />
             </svg>
         </a>
+        <a
+            class="flex flex-row gap-1 group"
+            href="https://supporters.eff.org/donate"
+            target="_blank"
+        >
+            <span class="hidden text-white group-hover:text-gray-400 lg:flex">Donate</span>
+            <svg
+                class="w-6 h-6 text-white group-hover:text-gray-400"
+                aria-hidden="true"
+                xmlns="http://www.w3.org/2000/svg"
+                width="24"
+                height="24"
+                fill="currentColor"
+                viewBox="0 0 24 24"
+            >
+                <path
+                    d="m12.75 20.66 6.184-7.098c2.677-2.884 2.559-6.506.754-8.705-.898-1.095-2.206-1.816-3.72-1.855-1.293-.034-2.652.43-3.963 1.537-1.31-1.108-2.67-1.571-3.962-1.537-1.515.04-2.823.76-3.72 1.855-1.806 2.2-1.924 5.821.753 8.705l6.184 7.098.245.281a.75.75 0 0 0 1.09 0l.246-.281Z"
+                />
+            </svg>
+        </a>
     </div>
 </div>
 <div class="m-4 xl:mx-8 flex flex-col gap-4">
+    {#if update_error !== undefined}
+        <div
+            class="bg-red-100 border-red-100 drop-shadow p-4 flex flex-col gap-2 border rounded-md flex-1 justify-between"
+        >
+            <span class="text-2xl font-bold mb-2 flex flex-row items-center gap-2 text-red-600">
+                <WarningIcon class="w-8 h-8 text-red-600" />
+                Connection Error
+            </span>
+            <span
+                >This webpage is not currently receiving updates from your Rayhunter device. This
+                could be do loss of connection or some issue with your device.</span
+            >
+            {#if update_error}
+                <details>
+                    <summary>Error</summary>
+                    <code>{update_error}</code>
+                </details>
+            {/if}
+        </div>
+    {/if}
+    <ActionErrors />
+    <IPRouteAlert />
+    <ClockDriftAlert />
     {#if loaded}
         <div class="flex flex-col lg:flex-row gap-4">
             {#if current_entry}
-                <Card entry={current_entry} current={true} server_is_recording={!!current_entry} />
+                <Card
+                    entry={current_entry}
+                    current={true}
+                    server_is_recording={!!current_entry}
+                    {manager}
+                />
             {:else}
                 <div
                     class="bg-red-100 border-red-100 drop-shadow p-4 flex flex-col gap-2 border rounded-md flex-1 justify-between"
@@ -95,26 +214,12 @@
                     <span
                         class="text-2xl font-bold mb-2 flex flex-row items-center gap-2 text-red-600"
                     >
-                        <svg
-                            class="w-8 h-8 text-red-600"
-                            aria-hidden="true"
-                            xmlns="http://www.w3.org/2000/svg"
-                            width="24"
-                            height="24"
-                            fill="currentColor"
-                            viewBox="0 0 24 24"
-                        >
-                            <path
-                                fill-rule="evenodd"
-                                d="M2 12C2 6.477 6.477 2 12 2s10 4.477 10 10-4.477 10-10 10S2 17.523 2 12Zm11-4a1 1 0 1 0-2 0v5a1 1 0 1 0 2 0V8Zm-1 7a1 1 0 1 0 0 2h.01a1 1 0 1 0 0-2H12Z"
-                                clip-rule="evenodd"
-                            />
-                        </svg>
+                        <WarningIcon class="w-8 h-8 text-red-600" />
                         WARNING: Not Running
                     </span>
-                    <span
-                        >Rayhunter is not currently running and will not detect abnormal behavior!</span
-                    >
+                    <span>
+                        Rayhunter is not currently running and will not detect abnormal behavior!
+                    </span>
                     <div class="flex flex-row justify-end mt-2">
                         <RecordingControls server_is_recording={!!current_entry} />
                     </div>
@@ -123,8 +228,24 @@
             <SystemStatsTable stats={system_stats!} />
         </div>
         <div class="flex flex-col gap-2">
-            <span class="text-xl">History</span>
-            <ManifestTable {entries} server_is_recording={!!current_entry} />
+            <div class="flex flex-row gap-2">
+                <div class="text-xl flex-1">History</div>
+                <div class="flex flex-row items-center gap-2 px-3">
+                    <label
+                        for="filter_threshold"
+                        class="block text-md font-medium text-gray-700 mb-1"
+                    >
+                        Filter for Warnings
+                    </label>
+                    <input
+                        type="checkbox"
+                        id="filter_threshold"
+                        bind:checked={filter_threshold}
+                        class="px-3 py-2 border border-gray-300 rounded-md focus:outline-none focus:ring-2 focus:ring-rayhunter-blue"
+                    />
+                </div>
+            </div>
+            <ManifestTable {entries} server_is_recording={!!current_entry} {manager} />
         </div>
         <DeleteAllButton />
         <ConfigForm />

daemon/web/src/theme.ts

@@ -0,0 +1,11 @@
+/** These are the default Tailwind CSS breakpoints.
+ * We're defining them here so they can be referenced
+ * programmatically in other parts of the application.
+ */
+export const breakpoints = {
+    sm: '640px',
+    md: '768px',
+    lg: '1024px',
+    xl: '1280px',
+    '2xl': '1536px',
+} as const;

daemon/web/tailwind.config.ts

@@ -1,4 +1,5 @@
 import type { Config } from 'tailwindcss';
+import { breakpoints } from './src/theme';
 
 export default {
     content: ['./src/**/*.{html,js,svelte,ts}'],
@@ -10,6 +11,7 @@ export default {
                 'rayhunter-dark-blue': '#3f3da0',
                 'rayhunter-green': '#94ea18',
             },
+            screens: breakpoints,
         },
     },
 

daemon/web/vite.config.ts

@@ -5,7 +5,7 @@ export default defineConfig({
     server: {
         proxy: {
             '/api': {
-                target: 'http://localhost:8080',
+                target: process.env.API_TARGET || 'http://localhost:8080',
                 changeOrigin: true,
                 secure: false,
                 configure: (proxy, _options) => {

dist/config.toml.in

@@ -12,6 +12,7 @@ colorblind_mode = false
 # 1 = Subtle mode, display a colored line at the top of the screen when rayhunter is running (green=running, white=paused, red=warnings)
 # 2 = Demo Mode, display a fun orca gif
 # 3 = display the EFF logo
+# 4 = High Visibility mode, fill the entire screen with the status color (green=running, white=paused, red=warnings)
 #
 # TP-Link with one-bit display:
 # 0 = invisible mode
@@ -22,6 +23,11 @@ ui_level = 1
 # 1 = double-tapping the power button starts/stops recordings
 key_input_mode = 0
 
+# If set, attempts to send a notification to the url when a new warning is triggered
+ntfy_url = ""
+# What notification types to enable. Does nothing if the above ntfy_url is not set.
+enabled_notifications = ["Warning", "LowBattery"]
+
 # Analyzer Configuration
 # Enable/disable specific IMSI catcher detection heuristics
 # See https://github.com/EFForg/rayhunter/blob/main/doc/heuristics.md for details
@@ -29,6 +35,7 @@ key_input_mode = 0
 imsi_requested = true
 connection_redirect_2g_downgrade = true
 lte_sib6_and_7_downgrade = true
-null_cipher = true 
+null_cipher = true
 nas_null_cipher = true
 incomplete_sib = true
+test_analyzer = false

doc/SUMMARY.md

@@ -1,22 +1,24 @@
 # Summary
 
 [Introduction](./introduction.md)
+- [Support, feedback, and community](./support-feedback-community.md)
+- [Frequently Asked Questions](./faq.md)
 - [Installation](./installation.md)
   - [Installing from the latest release](./installing-from-release.md)
-    - [Installing from the latest release (Windows)](./installing-from-release-windows.md)
   - [Installing from source](./installing-from-source.md)
   - [Updating Rayhunter](./updating-rayhunter.md)
 - [Configuration](./configuration.md)
 - [Uninstalling](./uninstalling.md)
 - [Using Rayhunter](./using-rayhunter.md)
   - [Rayhunter's heuristics](./heuristics.md)
+  - [Re-analyzing recordings](./reanalyzing.md)
   - [How we analyze a capture](./analyzing-a-capture.md)
 - [Supported devices](./supported-devices.md)
-  - [Orbic RC400L](./orbic.md)
+  - [Orbic/Kajeet RC400L](./orbic.md)
   - [TP-Link M7350](./tplink-m7350.md)
   - [TP-Link M7310](./tplink-m7310.md)
   - [Tmobile TMOHS1](./tmobile-tmohs1.md)
+  - [UZ801](./uz801.md)
   - [Wingtech CT2MHS01](./wingtech-ct2mhs01.md)
   - [PinePhone and PinePhone Pro](./pinephone.md)
-- [Support, feedback, and community](./support-feedback-community.md)
-  - [Frequently Asked Questions](./faq.md)
+  - [Moxee Hotspot](./moxee.md)

doc/analyzing-a-capture.md

@@ -1,3 +1,3 @@
 # How we analyze a capture
 
-TODO
+Teams of highly trained squirrels. Video coming soon!

doc/configuration.md

@@ -7,13 +7,18 @@ Rayhunter can be configured through web user interface or by editing `/data/rayh
 Through web UI you can set:
 - **Device UI Level**, which defines what Rayhunter shows on device's built-in screen. *Device UI Level* could be:
   - *Invisible mode*: Rayhunter does not show anything on the built-in screen
-  - *Subtle mode (colored line)*: Rayhunter shows green line if there are no warnings, red line if there are warnings (warnings could be checked through web UI) and white line if Rayhunter is not recording
-  - *Demo mode (orca gif)*, which shows image of orca fish *and* colored line
-  - *EFF logo*, which shows EFF logo and *and* colored line.
-- **Device Input Mode**, which defines behaviour of built-in power button of the device. *Device Input Mode* could be:
-  - *Disable button control*: built-in power button of the device is not used by Rayhunter;
-  - *Double-tap power button to start/stop recording*: double clicking on a built-in power button of the device stops and immediatelly restarts the recording. This could be useful if Rayhunter's heuristichs is triggered and you get the red line, and you want to "reset" the past warnings. Normally you can do that through web UI, but sometimes it is easier to double tap on power button.
+  - *Subtle mode (colored line)*: Rayhunter shows green line if there are no warnings, red line if there are warnings (warnings could be checked through web UI) and white line if Rayhunter is not recording.
+  - *Demo mode (orca gif)*, which shows image of orcas *and* colored line.
+  - *EFF logo*, which shows EFF logo *and* colored line.
+  - *High visibility (full screen color)*: fills the entire screen with the status color (green for recording, red for warnings, white for paused).
+- **Device Input Mode**, which defines behavior of built-in power button of the device. *Device Input Mode* could be:
+  - *Disable button control*: built-in power button of the device is not used by Rayhunter.
+  - *Double-tap power button to start/stop recording*: double clicking on a built-in power button of the device stops and immediately restarts the recording. This could be useful if Rayhunter's heuristics is triggered and you get the red line, and you want to "reset" the past warnings. Normally you can do that through web UI, but sometimes it is easier to double tap on power button.
 - **Colorblind Mode** enables color blind mode (blue line is shown instead of green line, red line remains red). Please note that this does not cover all types of color blindness, but switching green to blue should be about enough to differentiate the color change for most types of color blindness.
-- With **Analyzer Heuristic Settings** you can switch on or off built-in [Rayhunter heuristics](heuristics.md). Some heuristics are experimental or can trigger a lot of false positive warnings in some networks (our tests have shown that some heuristics have different behaviour in US or European networks). In that case you can decide whether you would like to have the heuristics that trigger a lot of false positives on or off. Please note that we are constantly improving and adding new heuristics, so new release may reduce false positives in existing heuristics as well.
+- **ntfy URL**, which allows setting a [ntfy](https://ntfy.sh/) URL to which notifications of new detections will be sent. The topic should be unique to your device, e.g., `https://ntfy.sh/rayhunter_notifications_ba9di7ie` or `https://myserver.example.com/rayhunter_notifications_ba9di7ie`. The ntfy Android and iOS apps can then be used to receive notifications. More information can be found in the [ntfy docs](https://docs.ntfy.sh/).
+- **Enabled Notification Types** allows enabling or disabling the following types of notifications:
+  - *Warnings*, which will alert when a heuristic is triggered. Alerts will be sent at most once every five minutes.
+  - *Low Battery*, which will alert when the device's battery is low. Notifications may not be supported for all devices—you can check if your device is supported by looking at whether the battery level indicator is functioning on the System Information section of the Rayhunter UI.
+- With **Analyzer Heuristic Settings** you can switch on or off built-in [Rayhunter heuristics](heuristics.md). Some heuristics are experimental or can trigger a lot of false positive warnings in some networks (our tests have shown that some heuristics have different behavior in US or European networks). In that case you can decide whether you would like to have the heuristics that trigger a lot of false positives on or off. Please note that we are constantly improving and adding new heuristics, so a new release may reduce false positives in existing heuristics as well.
 
-If you prefer editing `config.toml` file, you need to obtain a shell on your [Orbic](./orbic.md#obtaining-a-shell) or [TP-Link](./tplink-m7350.md#obtaining-a-shell) device and edit the file manually. You can view the [default configuration file on a GitHub](https://github.com/EFForg/rayhunter/blob/main/dist/config.toml.in).
+If you prefer editing `config.toml` file, you need to obtain a shell on your [Orbic](./orbic.md#obtaining-a-shell) or [TP-Link](./tplink-m7350.md#obtaining-a-shell) device and edit the file manually. You can view the [default configuration file on GitHub](https://github.com/EFForg/rayhunter/blob/main/dist/config.toml.in).

doc/faq.md

@@ -2,38 +2,49 @@
 
 ### Do I need an active SIM card to use Rayhunter?
 
-**It Depends**. Operation of Rayhunter does require the insertion of a SIM card into the device, but whether that SIM card has to be currently active for our tests to work is still under investigation. If you want to use the device as a hotspot in addition to a research device an active plan would of course be necessary, however we have not done enough testing yet to know whether an active subscription is required for detection. If you want to test the device with an inactive SIM card, we would certainly be interested in seeing any data you collect, and especially any runs that trigger an alert!
+**It Depends**. Operation of Rayhunter does require the insertion of a SIM card into the device, but that sim card does not have to be actively registered with a service plan. If you want to use the device as a hotspot in addition to a research device, or get [notifications](./configuration.md), an active plan would of course be necessary.
+
+### How can I test that my device is working?
+You can enable the `Test Heuristic` under `Analyzer Heuristic Settings` in the config section on your web dashboard. This will cause an alert to trigger every time your device sees a cell tower, you might need to reboot your device or move around a bit to get this one to trigger, but it will be very noisy once it does. People have also tested it by building IMSI catchers at home, but we don't recommend that, since it violates FCC regulations and will probably upset your neighbors.
 
 <a name="red"></a>
 
-### Help, Rayhunter's line is red! What should I do?
+### Help, Rayhunter's line is red/orange/yellow/dotted/dashed! What should I do?
 
-Unfortunately, the circumstances that might lead to a positive cell site simulator (CSS) signal are quite varied, so we don't have a universal recommendation for how to deal with the a positive signal. Depending on your circumstances and threat model, you may want to turn off your phone until you are out of the area (or put it on airplane mode) and tell your friends to do the same!
+Unfortunately, the circumstances that might lead to a positive cell site simulator (CSS) signal are quite varied, so we don't have a universal recommendation for how to deal with the a positive signal. Depending on your circumstances and threat model, you may want to turn off your phone until you are out of the area and tell your friends to do the same!
 
-If you've received a Rayhunter warning and would like to help us with our research, please send your Rayhunter data captures (QMDL and PCAP logs) to us at our [Signal](https://signal.org/) username [**ElectronicFrontierFoundation.90**](https://signal.me/#eu/HZbPPED5LyMkbTxJsG2PtWc2TXxPUR1OxBMcJGLOPeeCDGPuaTpOi5cfGRY6RrGf) with the following information: capture date, capture location, device, device model, and Rayhunter version. If you're unfamiliar with Signal, feel free to check out our [Security Self Defense guide on it](https://ssd.eff.org/module/how-to-use-signal).
+If you've received a Rayhunter warning and would like to help us with our research, please send your Rayhunter data captures (Zip file downloaded from the web interface) to us at our [Signal](https://signal.org/) username [**ElectronicFrontierFoundation.90**](https://signal.me/#eu/HZbPPED5LyMkbTxJsG2PtWc2TXxPUR1OxBMcJGLOPeeCDGPuaTpOi5cfGRY6RrGf) with the following information: capture date, capture location, device, device model, and Rayhunter version. If you're unfamiliar with Signal, feel free to check out our [Security Self Defense guide on it](https://ssd.eff.org/module/how-to-use-signal).
 
 Please note that this file may contain sensitive information such as your IMSI and the unique IDs of cell towers you were near which could be used to ascertain your location at the time.
 
 
 ### Should I get a locked or unlocked orbic device? What is the difference?
 
-If you want to use a non-Verizon SIM card you will probably need an unlocked device. But it's not clear how locked the locked devices are nor how to unlock them, we welcome any experimentation and information regarding the use of unlocked devices.
-
+If you want to use a non-Verizon SIM card you will probably need an unlocked device. But it's not clear which devices are locked nor how to unlock them, we welcome any experimentation and information regarding the use of unlocked devices. So far most verizon branded orbic devices we have encountered are actually unlocked.
 
 ### How do I re-enable USB tethering after installing Rayhunter?
 
-Make sure USB tethering is also enabled in the Orbic's UI, and then run the following commands:
+If you have installed with `./installer orbic-usb`, you might find that USB
+tethering is now disabled. If you have run `./installer orbic`, this section is not
+relevant as it does not use or touch USB.
+
+[First obtain a shell](./orbic.md#shell), then:
+
 
 ```sh
-./installer util shell "echo 9 > /usrdata/mode.cfg"
-./installer util shell reboot
+# inside of Orbic's shell:
+echo 9 > /usrdata/mode.cfg
+reboot
 ```
 
+Make sure USB tethering is also enabled in the Orbic's UI.
+
 To disable tethering again:
 
 ```sh
-./installer util shell "echo 3 > /usrdata/mode.cfg"
-./installer util shell reboot
+# inside of Orbic's shell:
+echo 3 > /usrdata/mode.cfg
+reboot
 ```
 
 See `/data/usb/boot_hsusb_composition` for a list of USB modes and Android USB gadget settings.
@@ -41,16 +52,16 @@ See `/data/usb/boot_hsusb_composition` for a list of USB modes and Android USB g
 
 ### How do I disable the WiFi hotspot on the Orbic RC400L?
 
-To disable both WiFi bands:
+To disable both WiFi bands, [first obtain a shell](./orbic.md#shell), then:
 
 ```sh
-adb shell
-/bin/rootshell -c "sed -i 's/<wlan><Feature><state>1<\/state>/<wlan><Feature><state>0<\/state>/g' /usrdata/data/usr/wlan/wlan_conf_6174.xml && reboot"
+# inside of Orbic's shell:
+sed -i 's/<wlan><Feature><state>1<\/state>/<wlan><Feature><state>0<\/state>/g' /usrdata/data/usr/wlan/wlan_conf_6174.xml && reboot
 ```
 
 To re-enable WiFi:
 
 ```sh
-adb shell
-/bin/rootshell -c "sed -i 's/<wlan><Feature><state>0<\/state>/<wlan><Feature><state>1<\/state>/g' /usrdata/data/usr/wlan/wlan_conf_6174.xml && reboot"
+# inside of Orbic's shell:
+sed -i 's/<wlan><Feature><state>0<\/state>/<wlan><Feature><state>1<\/state>/g' /usrdata/data/usr/wlan/wlan_conf_6174.xml && reboot
 ```

doc/heuristics.md

@@ -4,9 +4,75 @@ Rayhunter includes several analyzers to detect potential IMSI catcher activity.
 
 ## Available Analyzers
 
-- **IMSI Requested**: Tests whether the eNodeB sends an IMSI Identity Request NAS message. This can sometimes happen under normal circumstances when the network doesn't already have a TMSI (Temporary Mobile Subscriber ID or GUTI in 5G terminology) for your device. This most often happens when you first turn the device on, especially after it has been off for a long time or if you are in an area where there is absolutely no connection to your service provider. This can also happen if you leave your device on while on an airplane and it suddenly connects to a new tower after being disconnected for a long time. However, if you get this warning at a time when you have been steadily connected to towers and the device has been on for a while it can be treated as suspcious.
-- **Connection Release/Redirected Carrier 2G Downgrade**: Tests if a cell releases our connection and redirects us to a 2G cell. This heuristic mostly makes sense in the US or other countries where there are no more operating 2G base stations. In countries where 2G is still in service (such as most of EU), this heuristics may trigger a lot of false positives, so you may want to disable it. However it should be noted that many IMSI Catchers operate in a such way that they downgrade connection to 2G and also that this heuristics has been vastly improved to reduce false positive warnings. See [Wikipedia page on past 2G networks](https://en.wikipedia.org/wiki/2G#Past_2G_networks) for information about your country. 
-- **LTE SIB6/7 Downgrade**: Tests for LTE cells broadcasting a SIB type 6 and 7 messages which include 2G/3G frequencies with higher priorities.
-- **Null Cipher**: Tests whether the cell suggests using a null cipher (EEA0) in the RRC layer (that means that encryption between your mobile device and base staation is turned off).
-- **NAS Null Cipher**: Tests whether the security mode command at the NAS layer suggests using a null cipher (EEA0). This would usually only happen after a UE has successfully authenticated with the MME but still it shouldn't happen at all. This could be indicative of an attack though using SS7 to get key material from the HLR of the UE for a succesful authentication. It could also indicate an IMSI catcher which is connected to the mobile network MME and HLR through cooperation between government and telecom provider. Or it could be a false positive if the telecom provider is intending to use null ciphers (if encryption is illegal or they have some misconfiguration of the network), however this should be very rare case.
-- **Incomplete SIB**: Tests whether the SIB1 message contains a complete SIB chain (SIB3, SIB5, etc.) A legitimate SIB1 mesage should contain timing information for at least 2 additional sibs (sib3, 4, and 5 being the most common) but a fake base station will often not bother to send additional SIBs beyond 1 and 2. On its own this might just be a misconfigured base station (though we have only seen it in the wild under suspicious circumstances) but combined with other heuristics such as **ISMI Requested** detection it should be considered a strong indicator of malicious activity.
+### IMSI Requested (v3)
+
+This analyzer tests whether the eNodeB sends an IMSI or IMEI Identity Request NAS message under suspicious .
+
+Mobile networks primarily request IMSI or IMEI from a mobile device during initial network attachment or when the network cannot identify the mobile device by its temporary identification (TMSI - *Temporary Mobile Subscriber Identity* or GUTI - *Globally Unique Temporary Identifier* in 4G/5G terminology).
+
+IMSI request therefore usually happens when you first turn the device on especially after it has been off for a long time. Another possibility is, that you reboot your mobile device and your temporary ID expired. Sometimes temporary identification can expire if you have been in an area where there is absolutely no connection to your service provider or after you left your device on an airplane mode and then reconnect to the network (especially being disconnected for a long time). IMSI could also be requested when you connect to a new network (for instance for roaming), when you swap she SIM card or when your device moves to a new *Tracking Area* or *Location Area* and the network can not map the temporary identification to your device. IMSI number can also be requested after core network reboot.
+
+It should also be noted that the network periodically reassigns your device new temporary identification to enhance security and avoid tracking, but in that cases usually does not request IMSI.
+
+During these events the phone will typically go on to authenticate that the network is legitimate and then establish service with the network it is connected to. 
+
+What we consider suspicious is the following chain of events:
+
+* Phone connects to a new tower. 
+* Tower asks for phones identity (IMEI or IMSI.)
+* Authentication does *NOT* happen. 
+* Tower requests phone to disconnect. 
+
+Looking for this chain of events is much less prone to false positives than naively looking for any time the IMSI/IMEI is sent. We do still sometimes get false positives when users are in an airplane that is coming in for a landing however. This is likely due to having been disconnected for a while and then being over towers that are not able to route to your home network, but we are still researching.
+
+This is the attack used by commercial IMSI catchers used by law enforcement. 
+
+This heuristic will also alert you if any of the following happen:
+* Identity is requested after authentication.
+* Identity is requested without your phone connecting to the tower. 
+* Identity is requested and then authentication doesn't happen shortly thereafter. 
+
+This heuristic will also issue a notification every time your identity is sent to the network under non suspicious circumstances. This is for diagnostic purposes. 
+
+### Connection Release/Redirected Carrier 2G Downgrade
+
+This analyzer tests if a base station releases your device's connection and redirects your device to a 2G base station. This heuristic is useful, because some IMSI catchers may operate in a such way that they downgrade connection to 2G where they can intercept the communication (by performing man-in-the-middle attack).
+
+
+### LTE SIB6/7 Downgrade (v2)
+
+This analyzer tests if LTE base station is broadcasting a SIB type 6 and 7 messages which include 2G/3G frequencies with higher priorities.
+
+SIB (*System Information Block*) Type 6 and 7 are specific types of broadcast messages sent by the base station (eNodeB in 4G networks) to mobile devices. They contain essential radio-related configuration parameters to help mobile device perform cell reselection.
+
+This attack exploits the fact that SIB broadcast messages are not encrypted or authenticated. This allows them to pretend to be a legitimate cell by broadcasting fake system information in order to force mobile devices to downgrade from more secure 4G (LTE) to less secure 2G (GSM) network and then steal IMSI and/or perform man-in-the-middle attack. That is why this is also called a downgrade attack.
+
+SIB6 is used for cell reselection to CDMA2000 systems which are not supported by many modern mobile phones, and SIB7 Provides the mobile device with information to perform cell reselection to GSM/EDGE networks. Therefore SIB6 messages are quite rare, while malformed SIB7 messages are much more frequent in practice. 
+
+This heuristic is useful even in countries where 2g is still prevalent. A well behaved tower should always advertise its other 4g neighbors at a higher priority than 2g/3g neighbors. (Older versions of this heuristic were prone to false positives.)
+
+### Null Cipher
+
+This analyzer tests whether the cell suggests using a null cipher (EEA0) in the RRC layer. That means that encryption between your mobile device and base station is turned off.
+
+Normally this should never happen, because null cipher is used almost exclusively for testing and debugging in labs or in controlled environments. Sometimes null cipher is used if encryption negotiation fails or isn’t supported (however in most networks this should not be the case). Also, some regulations allow unencrypted communications in **specific** emergency cases.
+
+The general rule is that null cipher should never be used in commercial deployments, except in very controlled conditions (e.g., test labs) or in a very specific regulatory-approved use cases.
+
+On the other hand, IMSI catchers often use null cipher to avoid setting up secure contexts (because they lack valid keys) and/or to trick mobile device into using unencrypted links (which makes eavesdropping easier).
+
+### NAS Null Cipher
+
+This analyzer tests whether the security mode command at the NAS layer suggests using a null cipher (EEA0). This would usually only happen after a mobile device has successfully authenticated with the MME (*Mobility Management Entity* - core network component that handles signaling and control) but still it shouldn't happen at all. This could be indicative of an attack though using SS7 (*Signaling System 7* - a set of telecommunication protocols used to set up and manage calls and other services) to get key material from the HLR (*Home Location Register* - a database in mobile telecommunications networks that stores subscriber information) of the mobile phone for a successful authentication.
+
+It could also indicate an IMSI catcher which is connected to the mobile network MME and HLR through cooperation between government and telecom provider. Or it could be a false positive if the telecom provider is intending to use null ciphers (if encryption is illegal in some country, or they have some misconfiguration of the network), however this should be very rare case.
+
+### Incomplete SIB
+
+This analyzer tests whether the SIB1 message contains a complete SIB chain (SIB3, SIB5, etc.). A legitimate SIB1 message should contain timing information for at least 2 additional SIBs (SIB3, 4, and 5 being the most common) but a fake base station will often not bother to send additional SIBs beyond 1 and 2 (i. e. some IMSI catchers send just SIB1 and *one additional* SIB).
+
+On its own this might just be a misconfigured base station (though we have only seen it in the wild under suspicious circumstances) but combined with other heuristics such as **IMSI Requested** detection it should be considered as a strong indicator of malicious activity.
+
+### Test Analyzer
+
+This analyzer is great for testing if your Rayhunter installation works. It will alert every time a new tower is seen (specifically every time a tower broadcasts a SIB1 message.) It is designed to be very noisy so we do not recommend leaving it on but if this alerts it means your Rayhunter device is working! 

doc/installation.md

@@ -3,5 +3,8 @@
 So, you've got one of the [supported devices](./supported-devices.md), and are ready to start catching IMSI catchers. You have two options for installing Rayhunter:
 
 * [installing from a release (recommended)](./installing-from-release.md)
-  * [installing from a release on Windows](./installing-from-release-windows.md)
 * [installing from source](./installing-from-source.md)
+
+Already have Rayhunter installed but looking to update?
+
+* [Updating Rayhunter](./updating-rayhunter.md)

doc/installing-from-release-windows.md

@@ -1,32 +0,0 @@
-# Installing from the latest release (Windows)
-
-Windows support in Rayhunter's installer is a work-in-progress. Depending on the device, the installation instructions differ.
-
-## TP-Link
-
-1. Connect the device via WiFi or USB Tethering -- you should be able to view the TP-Link admin page on <http://192.168.0.1>.
-2. Download the latest release (must be at least 0.3.0) for windows-x86_64, and unpack the zipfile.
-3. Open PowerShell or CMD in that extracted folder, the installer: `./installer tplink`
-4. Follow the instructions on the screen, if there are any.
-
-## Orbic
-
-1. Connect the device to your computer using the provided USB cable.
-1. Install the [Zadig WinUSB driver installer](https://zadig.akeo.ie/).
-1. Open Zadig, click options->show all devices 
-
-    ![Zadig](./zadig2.png)
-
-1. Select 'RNDIS (Interface 0)'
-
-    ![Zadig](./zadig.png)
-
-1. Click 'install driver' and wait for it to finish. 
-2. Download the latest `rayhunter-vX.X.X-windows-x86_64.zip` from the [Rayhunter releases page](https://github.com/EFForg/rayhunter/releases). The version you download will have numbers instead of X
-3. Unzip `rayhunter-vX.X.X-windows-x86_64` .
-1. Open a powershell terminal by pressing Win+R and typing `powershell` and hitting enter. 
-5. Type `cd ~\Downloads\rayhunter-v<x.x.x>-windows-x86_64` (**Replace <x.x.x> with the Rayhunter version you just unzipped**) and hit enter.
-5. Run the install script: `.\installer.exe orbic` and hit enter.
-    - The device will restart multiple times over the next few minutes.
-    - You will know it is done when you see terminal output that says `checking for rayhunter server...success!`
-6. Rayhunter should now be running! You can verify this by following the instructions below to [view the web UI](./using-rayhunter.md#the-web-ui). You should also see a green line flash along the top of top the display on the device.

doc/installing-from-release.md

@@ -2,7 +2,8 @@
 
 Make sure you've got one of Rayhunter's [supported devices](./supported-devices.md). These instructions have only been tested on macOS and Ubuntu 24.04. If they fail, you will need to [install Rayhunter from source](./installing-from-source.md).
 
-1. Download the latest `rayhunter-vX.X.X-PLATFORM.zip` from the [Rayhunter releases page](https://github.com/EFForg/rayhunter/releases) for your platform:
+1. **For the TP-Link only,** insert a FAT-formatted SD card. This will be used to store all recordings.
+2. Download the latest `rayhunter-vX.X.X-PLATFORM.zip` from the [Rayhunter releases page](https://github.com/EFForg/rayhunter/releases) for your platform:
     - for Linux on x64 architecture: `linux-x64`
     - for Linux on ARM64 architecture: `linux-aarch64`
     - for Linux on armv7/v8 (32-bit) architecture: `linux-armv7`
@@ -10,39 +11,68 @@ Make sure you've got one of Rayhunter's [supported devices](./supported-devices.
     - for MacOS on ARM (M1/M2 etc.) architecture: `macos-arm`
     - for Windows: `windows-x86_64`
 
-2. Decompress the `rayhunter-vX.X.X-PLATFORM.zip` archive. Open the terminal and navigate to the folder. (Be sure to replace X.X.X with the correct version number!)
+3. Decompress the `rayhunter-vX.X.X-PLATFORM.zip` archive. Open the terminal and navigate to the folder. (Be sure to replace X.X.X with the correct version number!)
 
     ```bash
     unzip ~/Downloads/rayhunter-vX.X.X-PLATFORM.zip
     cd ~/Downloads/rayhunter-vX.X.X-PLATFORM
     ```
 
-3. Turn on your device by holding the power button on the front.
+   On Windows you can decompress using the file browser, then navigate to the
+   folder that contains `installer.exe`, **hold Shift**, Right-Click inside the
+   folder, then click "Open in PowerShell".
 
-   * For the Orbic, connect the device using a USB-C cable.
-   * For TP-Link, connect to its network using either WiFi or USB Tethering.
+4. **Connect to your device.**
 
-4. Run the installer:
+   First turn on your device by holding the power button on the front.
 
-    ```bash
-    # On MacOS, you must first remove the quarantine bit
-    xattr -d com.apple.quarantine installer
-    ```
-    Then run the installer:
-    ```bash
-    ./installer orbic
-    # or: ./installer tplink
-    # or: ./installer wingtech
-    ```
+   Then connect to the device using either WiFi or USB tethering.
 
-    The device will restart multiple times over the next few minutes.
+   You know you are in the right network when you can access
+   <http://192.168.1.1> (Orbic) or <http://192.168.0.1> (TP-Link) and see the
+   hardware's own admin menu.
 
-    You will know it is done when you see terminal output that says `Testing Rayhunter... done`
+5. **On MacOS only**, you have to run `xattr -d
+   com.apple.quarantine installer` to allow execution of
+   the binary.
 
-5. Rayhunter should now be running! You can verify this by [viewing Rayhunter's web UI](./using-rayhunter.md). You should also see a green line flash along the top of top the display on the device.
+6. **Run the installer.**
+
+   ```bash
+   # For Orbic:
+   ./installer orbic --admin-password 'mypassword'
+   # Note: the arguments --admin-username 'myusername' and --admin-ip 'mydeviceip'
+   #       may be required if different from the default.
+
+   # Or install over USB if you want ADB and a root shell (not recommended for most users)
+   ./installer orbic-usb
+
+   # For TP-Link:
+   ./installer tplink
+   ```
+
+   * On Verizon Orbic, the password is the one used to login to the device's admin menu, and the default is the WiFi password.
+     * ***Note:*** If you have changed the device username, password, or IP address from their default values, these must be provided as arguments to the installer command above.
+   * On Kajeet/Smartspot devices, the default password is `$m@rt$p0tc0nf!g`
+   * On Moxee-brand devices, check under the battery for the password.
+   * You can reset the password by pressing the button under the back case until the unit restarts.
+
+   TP-Link does not require an `--admin-password` parameter.
+
+   For other devices, check `./installer --help` or the
+   respective page in the sidebar under "Supported
+   Devices."
+
+7. The installer will eventually tell you it's done, and the device will reboot.
+
+8. Rayhunter should now be running! You can verify this by [viewing Rayhunter's web UI](./using-rayhunter.md). You should also see a green line flash along the top of top the display on the device.
 
 ## Troubleshooting
 
+* If you are having trouble installing Rayhunter and you're connecting to your device over USB, try using a different USB cable to connect the device to your computer. If you are using a USB hub, try using a different one or directly connecting the device to a USB port on your computer. A faulty USB connection can cause the Rayhunter installer to fail.
+
+* You can test your device by enabling the test heuristic. This will be very noisy and fire an alert every time you see a new tower. Be sure to turn it off when you are done testing.  
+
 * On MacOS if you encounter an error that says "No Orbic device found," it may because you have the "Allow accessories to connect" security setting set to "Ask for approval." You may need to temporarily change it to "Always" for the script to run. Make sure to change it back to a more secure setting when you're done.
 
 ```bash

doc/installing-from-source.md

@@ -36,17 +36,28 @@ rustup target add x86_64-pc-windows-gnu
 Now you can root your device and install Rayhunter by running:
 
 ```sh
-cargo build --bin rayhunter-daemon --target armv7-unknown-linux-musleabihf --profile firmware --no-default-features --features orbic
+# Build the daemon binary for local development (rustcrypto TLS backend, fast compilation)
+# WARNING: The rustcrypto library, though not known to be insecure, is less well
+# tested than its counterpart and could potentially have severe issues in
+# its cryptographic implementation. We therefore recommend using ring-tls in
+# production builds (see below)
+cargo build-daemon-firmware-devel
 
-cargo build --bin rootshell --target armv7-unknown-linux-musleabihf --profile firmware
+# To build it exactly like in CI (more mature ring TLS backend, slower compilation)
+# CC_armv7_unknown_linux_musleabihf=arm-linux-gnueabihf-gcc cargo build-daemon-firmware
 
-cargo run --bin installer orbic
+# Build rootshell
+cargo build-rootshell-firmware-devel
+
+# Replace 'orbic' with your device type if different.
+# A list of possible values can be found with 'cargo run --bin installer help'.
+FIRMWARE_PROFILE=firmware-devel cargo run -p installer --bin installer orbic
 ```
 
 ### If you're on Windows or can't run the install scripts
 
 * Root your device on Windows using the instructions here: <https://xdaforums.com/t/resetting-verizon-orbic-speed-rc400l-firmware-flash-kajeet.4334899/#post-87855183>
-* Build the web UI using `cd bin/web && npm install && npm run build`
+* Build the web UI using `cd daemon/web && npm install && npm run build`
 * Push the scripts in `scripts/` to `/etc/init.d` on device and make a directory called `/data/rayhunter` using `adb shell` (and sshell for your root shell if you followed the steps above)
 * You also need to copy `config.toml.in` to `/data/rayhunter/config.toml`. Uncomment the `device` line and set the value to your device type if necessary.
 * Then run `./make.sh`, which will build the binary, push it over adb, and restart the device. Once it's restarted, Rayhunter should be running!

doc/introduction.md

@@ -2,11 +2,14 @@
 
 <img style="display: block; margin: 0 auto" alt="Rayhunter Logo - An Orca taking a bite out of a cellular signal bar" src="https://www.eff.org/files/styles/media_browser_preview/public/banner_library/rayhunter-banner.png" />
 
-Rayhunter is a project for detecting IMSI catchers, also known as cell-site simulators or stingrays. It's designed to run on a cheap mobile hotspot called the Orbic RC400L, but thanks to community efforts can [support some other devices as well](./supported-devices.md).
-
+Rayhunter is a project for detecting IMSI catchers, also known as cell-site simulators or stingrays. It was first designed to run on a cheap mobile hotspot called the Orbic RC400L, but thanks to community efforts can [support some other devices as well](./supported-devices.md).
 It's also designed to be as easy to install and use as possible, regardless of your level of technical skills. This guide should provide you all you need to acquire a compatible device, install Rayhunter, and start catching IMSI catchers.
 
-To learn more about the aim of the project, and about IMSI catchers in general, please check out our [introductory blog post](https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying). Otherwise, check out the [installation guide](./installation.md) to get started.
+&rarr;  Check out the [installation guide](./installation.md) to get started.
+
+&rarr; To learn more about the aim of the project, and about IMSI catchers in general, please check out our [introductory blog post](https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying). 
+
+&rarr; For discussion, help, or to join the mattermost channel and get involved with the project and community check out the [many ways listed here](./support-feedback-community.md)!
 
 **LEGAL DISCLAIMER:** Use this program at your own risk. We believe running this program does not currently violate any laws or regulations in the United States. However, we are not responsible for civil or criminal liability resulting from the use of this software. If you are located outside of the US please consult with an attorney in your country to help you assess the legal risks of running this program.
 

doc/moxee.md

@@ -0,0 +1,42 @@
+# KonnectONE Moxee Hotspot (K779HSDL)
+
+Supported in Rayhunter since version 0.6.0.
+
+The Moxee Hotspot is a device very similar to the Orbic RC400L. It seems to be
+primarily for the US market.
+
+- [KonnectONE product page](https://www.konnectone.com/specs-hotspot)
+- [Moxee product page](https://www.moxee.com/hotspot)
+
+## Supported bands
+
+According to [FCC ID 2APQU-K779HSDL](https://fcc.report/FCC-ID/2APQU-K779HSDL), the device supports the following LTE bands:
+
+| Band | Frequency               |
+|------|-------------------------|
+| 2    | 1900 MHz (PCS)          |
+| 4    | 1700/2100 MHz (AWS-1)   |
+| 5    | 850 MHz (CLR)           |
+| 12   | 700 MHz (Lower SMH)     |
+| 13   | 700 MHz (Upper SMH)     |
+| 25   | 1900 MHz (Extended PCS) |
+| 26   | 850 MHz (Extended)      |
+| 41   | 2500 MHz (TDD)          |
+| 66   | 1700/2100 MHz (E-AWS)   |
+| 71   | 600 MHz                 |
+
+## Installation
+
+Connect to the hotspot's network using WiFi or USB tethering and run:
+
+```sh
+./installer orbic --admin-password 'mypassword'
+```
+
+The password (in place of `mypassword`) is under the battery.
+
+## Obtaining a shell
+
+```sh
+./installer util orbic-shell
+```

doc/orbic.md

@@ -1,10 +1,13 @@
-# Orbic RC400L
+# Orbic/Kajeet RC400L
 
 The Orbic RC400L is an inexpensive LTE modem primarily designed for the US market, and the original device for which Rayhunter is developed.
 
+It is also sometimes sold under the brand Kajeet RC400L. This is the exact same hardware and can be treated the same. 
+
 You can buy an Orbic [using bezos
 bucks](https://www.amazon.com/Orbic-Verizon-Hotspot-Connect-Enabled/dp/B08N3CHC4Y),
-or on [eBay](https://www.ebay.com/sch/i.html?_nkw=orbic+rc400l).
+or on [eBay](https://www.ebay.com/sch/i.html?_nkw=orbic+rc400l). You should not
+pay more than 30 USD for such a device (without shipping).
 
 [Please check whether the Orbic works in your country](https://www.frequencycheck.com/countries/), and whether the Orbic RC400L supports the right frequency bands for your purpose before buying.
 
@@ -19,8 +22,28 @@ or on [eBay](https://www.ebay.com/sch/i.html?_nkw=orbic+rc400l).
 | Wifi 5Ghz | a/ac/ax |
 | Wifi 6 | 🮱 |
 
+## Two kinds of installers
+
+The orbic's installation routine underwent many different changes:
+
+1. The ADB-based shellscript prior to version 0.3.0
+2. The Rust-based, ADB-based installer since version 0.3.0
+3. Then, starting with 0.6.0, an alternative installer `./installer
+   orbic-network` that is supposed to work more reliably, can run over the
+   Orbic's WiFi connection and without the need to manually install USB drivers
+   on Windows.
+4. Starting with 0.8.0, `orbic-network` has been renamed to `orbic`, and the
+   old `./installer orbic` is now called `./installer orbic-usb`.
+   
+It's possible that many tutorials out there still refer to some of the old
+installation routines.
+
+<a name=shell></a>
 ## Obtaining a shell
 
-After running through the installation procedure, you can obtain a root shell
-by running `adb shell` or `./installer util shell`. Then, inside of that shell
-you can run `/bin/rootshell` to obtain "fakeroot."
+After running the installer, there will not be a rootshell and ADB will not be
+enabled. Instead you can use `./installer util orbic-shell`.
+
+If you are using an installer prior to 0.7.0 or `orbic-usb` explicitly, you can
+obtain a root shell by running `adb shell` or `./installer util shell`. Then,
+inside of that shell you can run `/bin/rootshell` to obtain "fakeroot."

doc/reanalyzing.md

@@ -0,0 +1,45 @@
+# Re-analyzing recordings
+
+Every once in a while, Rayhunter refines its heuristics to detect more kinds of
+suspicious behavior, and to reduce noise from incorrect alerts.
+
+This means that your old green recordings may actually contain data that is now
+deemed suspicious, and also old red recordings may become green.
+
+You can re-analyze any old recording inside of Rayhunter by clicking on "N
+warnings" to expand details, then clicking the "re-analyze" button.
+
+## Analyzing recordings on Desktop
+
+If you have a PCAP or QMDL file but no rayhunter, you can analyze it on desktop
+using the `rayhunter-check` CLI tool. That tool contains the same heuristics as
+Rayhunter and will also work on traffic data captured with other tools, such as
+QCSuper.
+
+Since 0.6.1, `rayhunter-check` is included in the release zipfile.
+
+You can build `rayhunter-check` from source with the following command:
+`cargo build --bin rayhunter-check` 
+
+## Usage
+```sh
+rayhunter-check [OPTIONS] --path <PATH>
+
+Options:
+  -p, --path <PATH>   Path to the PCAP, or QMDL file. If given a directory will 
+                        recursively scan all pcap, qmdl, and subdirectories 
+  -P, --pcapify       Turn QMDL file into PCAP     
+      --show-skipped  Show skipped messages
+  -q, --quiet         Print only warnings
+  -d, --debug         Print debug info 
+  -h, --help          Print help
+  -V, --version       Print version
+```
+### Examples 
+`rayhunter-check -p ~/Downloads/myfile.qmdl`
+
+`rayhunter-check -p ~/Downloads/myfile.pcap`
+
+`rayhunter-check -p ~/Downloads #Check all files in downloads`
+
+`rayhunter-check -d -p ~/Downloads/myfile.qmdl #run in debug mode`

doc/support-feedback-community.md

@@ -2,7 +2,15 @@
 
 If you're using Rayhunter (or trying to), we'd love to hear from you! Check out one of the following forums for contacting the Rayhunter developers and community:
 
-* If you've received a Rayhunter warning and would like to help us with our research, please send your Rayhunter data captures (QMDL and PCAP logs) to us at our [Signal](https://signal.org/) username [**ElectronicFrontierFoundation.90**](https://signal.me/#eu/HZbPPED5LyMkbTxJsG2PtWc2TXxPUR1OxBMcJGLOPeeCDGPuaTpOi5cfGRY6RrGf) with the following information: capture date, capture location, device, device model, and Rayhunter version. If you're unfamiliar with Signal, feel free to check out our [Security Self Defense guide on it](https://ssd.eff.org/module/how-to-use-signal).
-* If you're having issues installing or using Rayhunter, please [open an issue](https://github.com/EFForg/rayhunter/issues) on our Github repo.
+* If you've received a Rayhunter warning, please send your Rayhunter data captures (the ZIP file) to us at our [Signal](https://signal.org/) username [**ElectronicFrontierFoundation.90**](https://signal.me/#eu/HZbPPED5LyMkbTxJsG2PtWc2TXxPUR1OxBMcJGLOPeeCDGPuaTpOi5cfGRY6RrGf) with the following information: capture date, capture location, device, device model, and Rayhunter version. 
+
+  Note that the recording files are sensitive data and contain location
+  information, so we strongly recommend against posting them to publicly.
+
+  If you're unfamiliar with Signal, feel free to check out our [Security Self
+  Defense guide on it](https://ssd.eff.org/module/how-to-use-signal).
+
+* If you're having issues installing or using Rayhunter, consider checking the [Frequently Asked Questions](./faq.md) page for answers to common questions.
+* If your question isn't answered there, please [open an issue](https://github.com/EFForg/rayhunter/issues) on our Github repo.
 * If you'd like to propose a feature, heuristic, or device for Rayhunter, [start a discussion](https://github.com/EFForg/rayhunter/discussions) in our Github repo
 * For anything else, join us in the `#rayhunter` or `#rayhunter-developers` channel of [EFF's Mattermost](https://opensource.eff.org/signup_user_complete/?id=r1b6cnta9bysxk6im3kuabiu1y&md=link&sbr=su) instance to chat!

doc/supported-devices.md

@@ -7,7 +7,7 @@ These devices have been extensively tested by the core developers and are widely
 
 | Device | Recommended region |
 | ------ | ------ |
-| [Orbic RC400L](./orbic.md) | Americas |
+| [Orbic RC400L](./orbic.md) Sometimes also branded Kajeet RC400L | Americas |
 | [TP-Link M7350](./tplink-m7350.md) | Africa, Europe, Middle East |
 
 The TP-Link M7350 also works in the Americas but is usually more expensive.
@@ -24,6 +24,8 @@ Rayhunter is confirmed to work on these devices.
 | [Tmobile TMOHS1](./tmobile-tmohs1.md) | Americas |
 | [TP-Link M7310](./tplink-m7310.md) | Africa, Europe, Middle East |
 | [PinePhone and PinePhone Pro](./pinephone.md) | Global |
+| [FY UZ801](./uz801.md) | Asia, Europe |
+| [Moxee hotspot](./moxee.md) | Americas |
 
 ## Adding new devices
 Rayhunter was built and tested primarily on the Orbic RC400L mobile hotspot, but the community has been working hard at adding support for other devices. Theoretically, if a device runs a Qualcomm modem and exposes a `/dev/diag` interface, Rayhunter may work on it.

doc/tmobile-tmohs1.md

@@ -37,7 +37,7 @@ According to FCC ID 2APXW-TMOHS1 Test Report No. I20Z61602-WMD02 ([part 1](https
 |   71 | 600 MHz (USDD)   |
 
 ## Installing
-Connect to the TMOHS1's network over wifi or usb tethering.
+Connect to the TMOHS1's network over WiFi or USB tethering.
 
 The device will not accept web requests until after the default password is changed.
 If you have not previously logged in, log in using the default password printed under the battery and change the admin password.

doc/tplink-m7350.md

@@ -4,6 +4,16 @@ Supported in Rayhunter since version 0.3.0.
 
 The TP-Link M7350 supports many more frequency bands than Orbic and therefore works in Europe and also in some Asian and African countries.
 
+## Supported Bands
+
+| Technology | Bands |
+| ---------- | ----- |
+| 4G LTE | B1/B3/B7/B8/B20 (2100/1800/2600/900/800 MHz) |
+| 3G | B1/B8 (2100/900 MHz) |
+| 2G | 850/900/1800/1900 MHz |
+
+*Source: [TP-Link Official Product Page](https://www.tp-link.com/baltic/service-provider/lte-3g/m7350/)*
+
 ## Hardware versions
 
 The TP-Link comes in many different *hardware versions*. Support for installation varies:
@@ -23,8 +33,9 @@ When filing bug reports, particularly with the installer, please always specify
 You can get your TP-Link M7350 from:
 
 * First check for used offers on local sites, sometimes it's much cheaper there.
-* [Geizhals price comparison](https://geizhals.eu/?fs=tp-link+m7350)
-* [Ebay](https://www.ebay.com/sch/i.html?_nkw=tp-link+m7350&_sacat=0&_from=R40&_trksid=p4432023.m570.l1313)
+* [Geizhals price comparison](https://geizhals.eu/?fs=tp-link+m7350).
+* [Ebay](https://www.ebay.com/sch/i.html?_nkw=tp-link+m7350&_sacat=0&_from=R40&_trksid=p4432023.m570.l1313).
+* Can also be found sold as the 'Vodafone Pocket Wifi 5' in Australia 
 
 ## Installation & Usage
 
@@ -32,11 +43,10 @@ Follow the [release installation guide](./installing-from-release.md). Substitut
 
 ## Obtaining a shell
 
-Unlike on Orbic, the installer will not enable ADB. Instead, you can obtain a root shell with the following command:
+You can obtain a root shell with the following command:
 
 ```sh
-./installer util tplink-start-telnet
-telnet 192.168.0.1
+./installer util tplink-shell
 ```
 
 ## Display states
@@ -52,7 +62,7 @@ If your device has a one-bit (black-and-white) display, Rayhunter will instead s
 ## Power-saving mode/sleep
 
 By default the device will go to sleep after N minutes of no devices being connected. In that mode it will also turn off connections to cell phone towers.
-In order for Rayhunter to record continuously, you have to turn off this sleep mode in TP-Link's admin panel (go to **Advanced** - **Power Saving**) or keep e.g. your phone connectd on the TP-Link's WiFi.
+In order for Rayhunter to record continuously, you have to turn off this sleep mode in TP-Link's admin panel (go to **Advanced** - **Power Saving**) or keep e.g. your phone connected on the TP-Link's WiFi.
 
 ## Port triggers
 
@@ -60,7 +70,7 @@ On hardware revisions starting with v4.0, the installer will modify settings to
 add two port triggers. You can look at `Settings > NAT Settings > Port
 Triggers` in TP-Link's admin UI to see them.
 
-1. One port trigger "rayhunter-root" to launch the telnet shell. This is only needed for installation, and can be removed after upgrade. You can reinstall it using `./installer util tplink-start-telnet`.
+1. One port trigger "rayhunter-root" to launch the telnet shell. This is only needed for installation, and can be removed after upgrade. You can reinstall it using `./installer util tplink-shell`.
 2. One port trigger "rayhunter-daemon" to auto-start Rayhunter on boot. If you remove this, Rayhunter will have to be started manually from shell.
 
 ## Other links

doc/uninstalling.md

@@ -1,24 +1,41 @@
 # Uninstalling
 
+There is no automated uninstallation routine, so this page documents the routine for some devices.
+
 ## Orbic
 
-To uninstall Rayhunter, power on your Orbic device and connect to it via USB. Then, start a rootshell on it by running `adb shell`, followed by `rootshell`.
+Run `./installer util orbic-shell --admin-password mypassword`. Refer to the
+installation instructions for how to find out the admin password.
 
-Once in a rootshell, run:
+Inside, run:
 
 ```shell
-echo 3 > /usrdata/mode.cfg
-rm -rf /data/rayhunter /etc/init.d/rayhunter-daemon /bin/rootshell.sh
+echo 3 > /usrdata/mode.cfg  # only relevant if you previously installed via ADB installer
+rm -rf /data/rayhunter /etc/init.d/rayhunter_daemon /bin/rootshell
 reboot
 ```
 
-Your device is now Rayhunter-free, and should no longer be in a rooted ADB-enabled mode.
+Your device is now Rayhunter-free, and should no longer be rooted.
 
 ## TPLink
 
-1. Run `./installer util tplink-start-telnet`
-2. Telnet into the device `telnet 192.168.0.1`
+1. Run `./installer util tplink-shell` to obtain rootshell on the device.
 3. `rm /data/rayhunter /etc/init.d/rayhunter_daemon`
 4. `update-rc.d rayhunter_daemon remove`
 5. (hardware revision v4.0+ only) In `Settings > NAT Settings > Port Triggers` in TP-Link's admin UI, remove any leftover port triggers.
 
+## UZ801
+
+0. (Optional): Back up the qmdl folder with all of the captures:
+`adb pull /data/rayhunter/qmdl .`
+1. Run `adb shell` to get a root shell on the device
+2. Delete the /data/rayhunter folder: `rm -rf /data/rayhunter`
+3. Modify the initmifiservice.sh script to remove the rayhunter 
+startup line:
+```sh
+mount -o remount,rw /system
+busybox vi /system/bin/initmifiservice.sh
+```
+Then type 999G (shift+g), then type dd. Then press the colon key (:) and type wq. Finally, press Enter.
+4. Lastly, run `setprop persist.sys.usb.config rndis`.
+5. Type `reboot` to reboot the device.

doc/using-rayhunter.md

@@ -1,6 +1,6 @@
 # Using Rayhunter
 
-Once installed, Rayhunter will run automatically whenever your device is running. You'll see a green line on top of the device's display to indicate that it's running and recording. [The line will turn red](./faq.md#red) once a potential IMSI catcher has been found, until the device is rebooted or a new recording is started through the web UI.
+Once installed, Rayhunter will run automatically whenever your device is running. You'll see a green line on top of the device's display to indicate that it's running and recording. [The line will turn yellow dots, orange dashes, or solid red](./faq.md#red) once a potential IMSI catcher has been found, depending on the severity of the alert, until the device is rebooted or a new recording is started through the web UI.
 
 ![Rayhunter_0 5 0](./Rayhunter_0.5.0.png)
 
@@ -14,7 +14,7 @@ You can access this UI in one of two ways:
   network and visit <http://192.168.1.1:8080> (orbic)
   or <http://192.168.0.1:8080> (tplink).
 
-  Click past your browser warning you about the connection not being secure, Rayhunter doesn't have HTTPS yet.
+  Click past your browser warning you about the connection not being secure; Rayhunter doesn't have HTTPS yet.
 
   On the **Orbic**, you can find the WiFi network password by going to the Orbic's menu > 2.4 GHz WIFI Info > Enter > find the 8-character password next to the lock 🔒 icon.
   On the **TP-Link**, you can find the WiFi network password by going to the TP-Link's menu > Advanced > Wireless > Basic Settings.
@@ -28,4 +28,4 @@ You can access this UI in one of two ways:
 
 ## Key shortcuts
 
-As of Rayhunter verion 0.3.3, you can start a new recording by double-tapping the power button. Any current recording will be stopped and a new recording will be started, resetting the red line as well. This feature is disabled by default since Rayhunter version 0.4.0 and needs to be enabled through [configuration](./configuration.md).
+As of Rayhunter version 0.3.3, you can start a new recording by double-tapping the power button. Any current recording will be stopped and a new recording will be started, resetting the red line as well. This feature is disabled by default since Rayhunter version 0.4.0 and needs to be enabled through [configuration](./configuration.md).

doc/uz801.md

@@ -0,0 +1,67 @@
+# UZ801
+
+The UZ801 is a 4G/LTE USB modem which is built on top of a Qualcomm Snapdragon 410 (MSM8916, with MDM8916 modem.) It does not have a screen, but it does have LEDs which can be used to signal the same status as the green/red bar on the Orbic hotspot. It uses a custom Android-based firmware with limited coreutils. More information about this device can be found [here](https://github.com/AlienWolfX/UZ801-USB_MODEM/wiki/Overview)
+
+It is worth noting that even though the Snapdragon 410 is a quad-core SoC, the CPU has only 2 of the cores enabled on the stock Android-based firmware, probably to avoid overheating as they did not exactly engineer any cooling solution. Regardless, even with 2 disabled cores there is plenty of compute overhead. There are 384MB of RAM on the SoC, and 4GB of eMMC in the form of an SK Hynix NAND flash chip located external to the SoC.
+
+Rayhunter has been tested on UZ801 devices with firmware supporting USB debugging backdoor access. It is not certain whether all of the sticks that use this board will be compatible with the automated installer, or even with any alternative manual installation method. Please consider sharing your device's firmware version and hardware information [here](https://github.com/EFForg/rayhunter/discussions/479) to help improve compatibility.
+
+## Where to purchase
+
+There are several option to purchase this device:
+1. AliExpress:
+- [1](https://www.aliexpress.us/item/3256808999940005.html)
+- [2](https://www.aliexpress.us/item/3256809191207903.html)
+- [3](https://www.aliexpress.us/item/3256809191207903.html)
+2. eBay:
+- [1](https://www.ebay.com/itm/394512588226)
+- [2](https://www.ebay.com/itm/195655408253)
+- [3](https://www.ebay.com/itm/116678550086)
+3. Amazon:
+- [1](https://www.amazon.com/150Mbps-Adapter-Network-Lightweight-Portable/dp/B0DQC64ZFS)
+- [2](https://www.amazon.com/Heayzoki-Network-Adapter-Wireless-Connection/dp/B0CG4W31M4)
+## Supported bands
+
+The UZ801 supports various LTE bands depending on the specific hardware revision and carrier customization. Check your device specifications for the exact band support.
+
+The most frequent bands found on these devices are LTE bands 1/3/5/8/20. In the US, this means that Verizon's band 5 towers are the only towers that this device could communicate with in its normal usage as an LTE modem. Research on whether Qualcomm diagnostic tools can be used to write new band support into the NVRAM is pending.
+
+## Installing
+
+With the device fully booted (i.e. beaming a WiFi network, blue LED, etc.) and plugged into the computer that is performing the installation, run:
+
+```sh
+./installer uz801
+```
+
+Note: The default IP for UZ801 is typically `192.168.100.1`; if yours differs, use the `--admin-ip` argument to specify it.
+
+## LED modes
+| Rayhunter state  | LED indicator       |
+| ---------------- | ------------------- |
+| Recording        | Green LED solid on  |
+| Paused           | WiFi (blue) LED solid on |
+| Warning Detected | Red LED solid on    |
+
+Note: Unlike the TMOHS1, the UZ801 uses solid LED indicators instead of blinking patterns.
+
+## Obtaining a shell
+The UZ801 supports ADB access after the USB debugging backdoor is activated.
+
+```sh
+adb shell
+```
+
+## Device-specific notes
+
+The UZ801 uses a unique installation process that activates a hidden USB debugging backdoor.
+
+The installation process works as follows:
+1. Activates the USB debugging backdoor via HTTP AJAX request
+2. Waits for device reboot and ADB availability
+3. Uses ADB to install rayhunter files and modify the startup script
+4. Launches rayhunter daemon automatically
+
+- The UZ801 does not symlink busybox for some core system utils, for some reason. Please use `busybox <utility_name>`, e.g. `busybox df -h`.
+- USB debugging must be activated via the web backdoor before ADB access is possible (this is required only once.) The installer does this already.
+- The device uses `/system/bin/initmifiservice.sh` as the main startup script.