Home
CYM-NM28C5 is a pocket-sized WiFi 6 + BLE security toolkit and RF research platform, built from one shared firmware source tree that now runs on three boards: the NM-CYD-C5 (primary/preferred — with the optional NM-RF-HAT it covers sub-GHz, 2.4 GHz ISM, NFC/RFID, and infrared alongside its native dual-band WiFi 6 and Bluetooth 5), the Classic CYD (ESP32-2432S028R), and the new Waveshare ESP32-C5-Touch-LCD-2.8 (on par with NM-CYD-C5's core feature set). See Supported Hardware below.
CYM is not an official LAB5 project, but it is unofficially supported by the LAB5 community and has a dedicated thread on the LAB5 Discord for setup help, field tips, and development discussion.
| Board | Status | What you get |
|---|---|---|
| NM-CYD-C5 — optionally with the NM-RF-HAT | ⭐ Primary / preferred hardware for all features | Full feature set: WiFi 6 (2.4 + 5 GHz), BLE 5, 802.15.4, ESP-NOW, GPS wardriving — plus, with the NM-RF-HAT, CC1101 Sub-GHz, nRF24, PN532 NFC/RFID, and IR. New features land here first. |
| Classic CYD (ESP32-2432S028R) | ✅ Supported | WiFi 2.4 GHz only (original single-core ESP32, no WiFi 6/5 GHz), BLE, ESP-NOW, GPS wardriving. No 802.15.4. NM-RF-HAT reachable via an SD Card Shim — see Classic CYD Support. |
| Waveshare ESP32-C5-Touch-LCD-2.8 (WS-C5-28) | ✅ Supported — new | On par with NM-CYD-C5's core feature set (WiFi 6, BLE 5, 802.15.4, ESP-NOW, GPS wardriving), plus onboard IMU, temp/humidity, RTC, and audio codec that NM-CYD-C5 doesn't have. Many new features planned — see Waveshare WS-C5-28 Support. |
All three flash from the same web flasher and build from the same firmware source tree.
Headline: the Classic CYD and Waveshare WS-C5-28 join NM-CYD-C5 as fully supported boards. Nearly 100 commits since the last stable release — full changelog in the GitHub release notes. Highlights:
| Area | Change |
|---|---|
| Multi-board support | Classic CYD and Waveshare WS-C5-28 promoted from beta to fully supported. WS-C5-28 first-hardware-boot bring-up: fixed touch controller init, touch/LCD reset sequencing, and a Kconfig authoring bug that silently disabled color inversion on both WS-C5-28 and (previously unnoticed) Classic CYD. |
| OT Air Survey hardening | Fixed two separate all-zero-MAC counting bugs (802.15.4 and WiFi feeds), an obs.jsonl export path that could silently stop writing mid-survey, a WiFi/BLE radio-switch race that corrupted scan results, and wired up passive ESP-NOW detection (previously never actually enabled during a survey). |
| ESP-NOW detection fix | Frame detector was missing the Action-No-Ack (broadcast) 802.11 subtype — broadcast ESP-NOW traffic was invisible to both ESP-NOW Scout and OT Air Survey; unicast was unaffected. |
| New multi-board build discipline | Any change to shared firmware source must now build clean on every board that compiles it in the same session — codified after a shared-code change silently broke Classic CYD's build for several versions before anyone rebuilt that board. |
Legal notice: All techniques documented here are intended for use on networks, devices, and RF environments you own or have explicit written authorization to test. Unauthorized interception, injection, or jamming is illegal in most jurisdictions.
| Page | What it covers |
|---|---|
| Sub-GHz RF Research | CC1101: capture, replay, band scope, Z-Wave Scout, frequency scan |
| 2.4 GHz ISM Research | nRF24: channel scan, protocol sniffer, Futaba S-FHSS RC analysis |
| NFC & RFID Hub | Chameleon Ultra BLE: LF/HF read, full sector/page dump, Slot Manager, Clone to Slot, Load from SD; MIFARE key dictionary; PN532: card read, clone, emulate, key test |
| Infrared | RMT capture, replay, LED strip control |
| Page | What it covers |
|---|---|
| WiFi Security Research | Deauth, handshake capture, evil twin, ESP-NOW Scout, Chanalizer |
| Wardriving & Geolocation | Passive WiFi + BLE mapping, WiGLE / WDG Wars export |
| BLE & Bluetooth Research | GATT Walker, BT Lookout, device enumeration, drone detection |
| Drone Research | Drone Detector (passive Remote ID scanner) + Drone Spoof (synthetic F3411 beacon) |
| OT/IoT Air Survey | Passive multi-radio survey (WiFi/BLE/ESP-NOW/802.15.4), GPS-stamped device log, WirelessHART/Zigbee/Thread classification |
| Component | Spec |
|---|---|
| SoC | ESP32-C5 · RISC-V 240 MHz · WiFi 6 (2.4 + 5 GHz) · BT 5 |
| Display | 2.8″ ST7789 240×320 touch |
| Storage | MicroSD (FAT32) for all captures |
| Sub-GHz | CC1101 (300–928 MHz) via NM-RF-HAT DIP 1 |
| 2.4 GHz ISM | nRF24L01+ + AT2401C PA/LNA (+20 dBm) via DIP 2 |
| NFC/RFID | PN532 (ISO14443A/B, ISO18092) via DIP 3 |
| IR | 940 nm TX LED + 38 kHz demod RX via DIP 4 |
| 433 MHz OOK | T2-433M TX + R4A_433 superheterodyne RX via DIP 5 |
All captures save to /sdcard/lab/<feature>/ on the microSD card.
SD Asset Repository: Pre-built SD card assets (OUI vendor table, MIFARE key dictionary, and more) are available for download at github.com/JimGat/CYM-SD-Assets. Drop the files into /sdcard/lab/ after your first SD provision to enable OUI vendor lookup in BLE scan and extended MIFARE key coverage in card dumps.
| Page | What it covers |
|---|---|
| Getting Started | First-time setup — touch calibration, resistive touch + red dot, SD card layout, RF-HAT enablement, GPS wiring |
| Where To Get It | Board, RF-HAT, GPS, cases, web flasher, manual flash |
| Support & Community | LAB5 Discord, GitHub, contributing, credits |
| Page | What it covers |
|---|---|
| Use Cases | Master list of all real-world field scenarios — one page, every feature |
| Page | What it covers |
|---|---|
| Classic CYD Support | ESP32-2432S028R (CYD2USB) — what works, what's absent, buffer reductions, dual-core advantage, flash instructions |
| Waveshare WS-C5-28 Support | ESP32-C5-Touch-LCD-2.8 — hardware differences from NM-CYD-C5, CH32V003 IO expander, RF-HAT wiring, flash instructions |
| Page | What it covers |
|---|---|
| Haptic Feedback | ERM vibrator motor build, wiring, which features use it and how |
| Page | What it covers |
|---|---|
| Videos | Community reviews, showcases, and tutorials |
| Contributors | Everyone who helped build and improve CYM |
CYM Firmware Review (v2.12.0) — Valleytech Custom Solutions · Watch on YouTube ▶
