EVIL-GOTCHI started as a tiny WPA2 research tool with two components, four wires and one job. Three days later, it has five jobs and a soul made of slime.
The hardware has not changed. It is still the same ESP32 Dev Module and 128 by 64 OLED sitting on a breadboard. The firmware is where things got out of hand. Active and passive WiFi capture now sit beside probe observation, disconnect-frame warnings and Bluetooth tracker sightings. A short press moves between screens. Holding the button for 1.5 seconds changes the selected mode or starts the local download page, depending on which screen is open.
I wanted the new version to do more than collect. It should also be able to listen quietly, warn me when the same disruptive traffic appears nearby and give me a rough heads-up when a tracker-type Bluetooth device is in range.
Five modes, one button
The mode selector now cycles through five separate radio jobs. They share the display and controls, but they do not all behave in the same way.
Active
Runs the original owned-lab capture routine, including deliberate reconnect tests. This is the disruptive mode and stays on my own network.
Passive
Listens for normal connections and saves handshakes it happens to hear. It does not send disconnect frames.
Probe
Records named WiFi networks requested by my test devices so I can study what those requests reveal.
Detect
Counts nearby deauthentication and disassociation frames, then raises a warning when they arrive in a burst.
Tracker
Switches the shared radio over to Bluetooth Low Energy and looks for advertisements that resemble supported tracker families.
The selected mode is stored in NVS, the ESP32’s small non-volatile settings area, along with the handshake count. Power it off and it remembers where it was.
Passive mode was the important addition
The first version could wait for a natural WPA2 handshake, but active reconnect testing was still baked into the normal hunt. Splitting those behaviours into clear modes makes the boundary much harder to miss.
Passive mode still hops across channels 1, 6 and 11. It still identifies beacons, watches for EAPOL key exchanges and passes useful frames through the 24-slot ring buffer to LittleFS. The difference is simple: it never queues the active reconnect step.
That makes it better for long-running observation inside my lab. Devices naturally reconnect when they wake, reboot or move back into range. EVIL-GOTCHI can learn from those ordinary events without causing one.
What phones say while looking for WiFi
Probe mode watches for directed probe requests. These are requests where a device asks for a network by name instead of sending a general “what is nearby?” query. Seeing one can reveal a remembered network name, which is a useful privacy lesson.
The firmware keeps up to 40 unique names in memory and can include the list on its local download page. I only test this with my own devices. A network name can contain a person’s name, workplace, hotel or other identifying clue, so collecting other people’s probe history for curiosity would cross the line quickly. The public post does not include captured names or third-party identifiers.
It is also not a complete record of every network a phone remembers. Modern devices use several privacy protections, and many requests are wildcard probes with no network name at all. EVIL-GOTCHI skips those empty requests.
The hunter learned to recognise the noise
Detect mode turns the original idea around. Instead of transmitting disconnect frames, it watches for deauthentication and disassociation management frames already in the air.
The current rule is deliberately small and understandable: three or more matching frames within one second turns on the warning for four seconds. The title bar changes to ! ATTACK ! and the slime pulls its alarmed face.
That warning means EVIL-GOTCHI saw a burst, not that it identified an attacker. Legitimate network maintenance, a struggling client or a noisy test bench can produce similar traffic. Protected Management Frames can also change what is useful to observe. The alert is a reason to inspect the network, not a verdict.
A nearby tracker is not automatically following you
Tracker mode hands the radio to NimBLE and scans Bluetooth Low Energy advertisements. The prototype checks a small set of manufacturer data and service identifiers associated with Apple Find My, Tile and Samsung SmartTag devices. A sighting stays in memory for 30 seconds, and the screen shows the strongest recent signal.
Signal strength is only a rough distance hint. Walls, pockets, body position, antenna angle and other radios can move the number around. Bluetooth addresses can rotate too, so the same physical tag may not keep one long-term identity.
If I felt unsafe, I would treat EVIL-GOTCHI’s screen as a prompt to check with those proper tools, move to a safe public place and contact someone I trust or the police if needed. The slime is an extra pair of electronic eyes. It is not evidence by itself.
A new face for every state
The old 16 by 16 face has been replaced by a procedurally drawn slime that uses most of the display. It breathes while idle, blinks every four seconds and gives a small hop every ten. A capture triggers the laughing bounce. Active work gets a focused squint, full storage gets a worried frown, and either defensive alert gets the alarmed expression.
The title strip became a live ticker at the same time. It normally shows the latest network name heard from my test bench, then changes for a capture, storage warning, disconnect burst or tracker sighting. The information screen remains available with a short tap when I want numbers instead of personality.
Rotating the download identity
The local download service still pauses capture, flushes queued frames and starts a password-protected access point hosted by the ESP32. It now creates a fresh locally administered MAC address and generic temporary network name each time it starts.
That rotation reduces easy correlation between separate sessions. It does not make the device invisible. A radio transmission can still be detected and located, and traffic patterns may remain distinctive. This is a privacy experiment, not a claim of anonymity.
One job remains on my list: the prototype still uses a fixed local access password. I am keeping that credential out of the article, but rotating the visible identity while retaining one password is unfinished work. A per-session password shown on the OLED would be the better design before this leaves the bench.
Bluetooth ate the flash budget
NimBLE added enough code to push the firmware beyond the normal application partition. The board now uses the Huge APP partition layout, which gives the application 3 MB and leaves 1 MB for the flash filesystem. The trade-off is no over-the-air update slot.
The source has grown to just over 1,400 lines. That now covers WiFi capture, BLE scanning, the ring buffer, PCAP writing, persistent settings, four interface screens, the local web server and one surprisingly emotional blob. I am not embedding the full attack-capable firmware here. The interesting part of this update is how the modes share one small device, not a copy-and-run disruption routine.
More capable, with clearer boundaries
EVIL-GOTCHI can still do the job it started with, but active capture is no longer the whole personality. Passive mode gives it a quiet default. Detect mode lets it recognise the sort of traffic it can produce. Tracker mode adds a cautious second opinion alongside the proper protections already in modern phones.
The best upgrade might still be the mode screen. One long hold now makes the device’s intent explicit before the radio does anything. On a security tool, that little pause is useful.
The slime helps too.
Zombie