wadamesh beta_82

Test build. Stable stays beta_65.

Flash it at flasher.wadamesh.com (switch the toggle to Beta), or update on the device if you have "Get test builds (beta)" turned on.

ThinkNode M9 SD cards: Windows malware

Some ThinkNode M9 cards shipped with a Windows worm on them (Elecrow security advisory, September 2026). It cannot run on the radio, but it runs on the first Windows PC the card is plugged into, which is exactly where you take the card to copy map tiles onto it.

On the infected cards seen so far it is a hidden autorun.inf in the top folder of the card that launches a program called xlfqf.pif on open, explore and autoplay, with lines of random junk in between to throw off simple scanners. That matches the pattern of the long-known Sality worm, which disables antivirus software, steals credentials and infects other programs on the PC.

• New in the Store: SD Scan. It looks through the SD card for Windows programs, scripts, shortcuts and autorun files, shows what it found and why, and removes it after you confirm. A mesh radio never uses any of these files, and nothing else on the card is touched. A quick scan skips the deep map-tile folders; a full scan reads everything.
• SD Scan only removes files it recognises. If a card may be infected, the safest fix is to copy off what you need and format it completely: in Files, hold the SD card row.
• A startup warning. When a card with Windows malware in its top folder is in the radio at startup, or is inserted, wadamesh warns you and offers to open SD Scan.
• Already used the card in a Windows PC? Run a full virus scan on that PC as well.

For app authors

wada.sd.check(path) and wada.sd.remove(path) find and delete Windows malware on the card. What counts is decided in firmware (SdThreat.h): autorun.inf, Windows program, script and shortcut extensions, or a real Windows program header under any name. remove refuses everything else, so no app can use it to delete map tiles, backups or chat history. wada.sd.list(path, start, max) pages through big folders, and caps().sd_clean says whether a board has all three. Documented at wadamesh.com/sdk.html.

For testers

SD Scan and the removal are tested on a T-Deck. M9 owners: worth reporting whether the scan, the removal and the startup warning all work with the M9's keys.