wallofairtag

📡 Wall of AirTags

A way to know if you are pisted by a Airtag/FindMy/Openhaystack devices!
A real‑time Apple FindMy / AirTag scanner and visualizer for Cardputer/M5Stack.
Displays discovered trackers, RSSI, trend, distance estimation, payloads, UUIDs,
and GAP names when available. Includes scrollable UI, spam frame viewer,
SD logging, and BLE event queue isolation for stability.

---

💡 What It Does

• Scans BLE traffic and identifies Apple FindMy‑type frames via Manufacturer Data.
• Maintains a table of up to 24 simultaneous AirTags / FindMy beacons.
• Per‑device tracking:
  • MAC address
  • RSSI (dBm)
  • Distance estimation
  • Trend (Stable / Closer / Farther)
  • Payload (hex) & UUID fallback
  • Name (if GAP name present)
  • Last‑seen timestamp
• Displays:
  • Scrollable device list
  • Header with total devices
  • Spam box showing last raw BLE frame
• Persists unique MACs to /evil/airtags.txt on the SD card.
• Uses a FreeRTOS queue to safely process BLE events outside the BLE task.

---

🚀 Quick Start (Device UI Flow)

1. Startup
   • Initializes BLE scan & event queue
   • Loads previous SD logs if present
   • Draws header, list area, and spam box
2. Main Screen shows:
   • MAC / Name
   • RSSI
   • Trend
   • Distance
   • Raw frame (bottom spam box)
3. Key Bindings

   Key	Action
   ;	Scroll up
   .	Scroll down
   i	Show details of selected AirTag
   Backspace	Exit
   Enter	Exit

---

🧩 Apple FindMy Detection

Detection is performed by parsing BLE Manufacturer Data:

Vendor ID: 0x4C 0x00 (Apple)
FindMy Frame: 0x12 0x19
Payload must not be blank

If matched, the device is considered part of the FindMy ecosystem (AirTag, AirPods, accessories, etc.).

---

🗂️ SD Card Layout

/evil/airtags.txt

• Each unique MAC is appended once.
• Format: MAC - RSSI: - Name: - UUID: (when available)
• Useful for tracking audits or forensic work.

---

🖥️ On‑Device UI

List Area

• Shows up to AT_VISIBLE entries at once
• Auto‑purges items unseen for >7.5 seconds
• Colors reflect trend:
  • Closer
  • Stable
  • Farther

Spam Frame Box

Displays the most recent BLE Manufacturer Data frame in HEX.

Header

Shows total devices and static title “Wall of AirTags”.

---

⚖️ Disclaimer

This tool does not bypass Apple security, does not decode encrypted FindMy payloads,
and does not identify owners. It only reveals broadcast metadata already public in BLE advertisements.
Use responsibly, legally, and ethically.