50338a6d5c
- Phase 2 (Observation): passive client mapping from data frame headers, ClientInfo array per slot (up to 8 clients), 5s observation window - Phase 3 (Targeting): unicast deauth burst to each discovered client instead of broadcast, reason code 7, 5 frames per client - Phase 4 (Capture): timeout + retry loop cycles back to observation to refresh stale client list (2 cycles within 30s channel timeout) - Fix EAPOL detection: compute LLC/SNAP offset from QoS vs non-QoS header length, verify AA-AA-03 SNAP prefix, skip protected frames - Concurrency: portMUX spinlock for callback/main-loop shared state, no dynamic alloc in callback, pre-allocated 4KB PCAP buffer per slot - Phase-aware LCD status display (mapping → capturing → EAPOL count) Made-with: Cursor
Handshake Capture - ESP32-C6 1.47" LCD
Automatic WiFi 4-way handshake capture for Waveshare ESP32-C6-LCD-1.47.
Features
- SD card storage: Saves
.pcapfiles to TF card (not SPIFFS) - Auto-deauth: Aggressive 150ms deauth interval to force handshakes
- Display: Networks in green = not captured, red = captured
- No web interface: Capture-only device
- WPA/WPA2 only: Skips Open/WEP networks
- BSSID cache: Captured networks stay red across rescans
Hardware
- Waveshare ESP32-C6-LCD-1.47 (non-touch, ST7789)
- TF card in onboard slot
Build & Flash
Requires LVGL and lv_conf from the ESP32-C6-LCD-1.47-Demo:
cd "/path/to/4 way handshake"
arduino-cli compile \
-b 'esp32:esp32:esp32c6:PartitionScheme=huge_app' \
--build-path /tmp/arduino-build-handshake-c6 \
--libraries "ESP32-C6-LCD-1.47-Demo/Arduino/libraries" \
handshake-capture-c6
arduino-cli upload \
-p /dev/cu.usbmodem* \
-b 'esp32:esp32:esp32c6:PartitionScheme=huge_app' \
--input-dir /tmp/arduino-build-handshake-c6
Use arduino-cli board list to find the correct port.
Flow
- Boot → scan → display networks (green)
- Pick first uncaptured WPA/WPA2 network
- Set channel, deauth every 150ms, capture EAPOL
- On full handshake → save to SD, mark red, next network
- When all done → rescan, repeat