uConsole Wardriving without ESP32

[FusedStamen]

Really excited about this new project, I managed to get my uConsole with AIO v1 and AC1200 wifi card working via bridge script. I was hoping there was a better solution for native scanning to include bluetooth as well, possibly with bleak?

AC1200 (MT7921) on AIO v1 supports monitor mode but iw scan requires managed mode
Bridge script emulates ESP32 projectZero serial protocol over a PTY
Responds to scan_networks commands with CSV output matching network_manager.py format
One line patch to main.py needed to accept /tmp/ paths as serial device argument
Bridge Script Attached - wdg_wifi_bridge.py

Set up GPS to allow PiAware and WarDogsGo to use both via /dev/ttyS0
gpspipe -r | socat - PTY,link=/tmp/gps-pty,raw,echo=0 creates a clean NMEA PTY
WatchDogsGo reads from /tmp/gps-pty via WDG_GPS_DEVICE env var
Runs as a systemd service so it persists across reboots
PiAware continues using gpsd simultaneously with no conflicts

[FusedStamen]

Adding on to this for a more complete explanation:

The AC1200 connects internally via USB on the AIO board and shows up as wlan1 (the CM4's built-in BCM4345 is wlan0). First make sure it's actually enumerating:

bashlsusb | grep MediaTek
iw list | grep -A 5 "interface modes"

If it shows up but disappears after reboot, check if aiov2-rails-boot.service is enabled — it's designed for AIO v2 and will kill the USB power rail on AIO v1 hardware:

bashsystemctl status aiov2-rails-boot
sudo systemctl disable aiov2-rails-boot
sudo systemctl mask aiov2-rails-boot

It's important to note that there isn't Bluetooth support currently, I'm looking into Bleak since it's a dependency already. For WatchDogsGo scanning without an ESP32, I used the above mentioned/linked bridge script that emulates the ESP32 serial protocol using iw dev wlan1 scan. Run it with --no-monitor since iw scan needs managed mode:

bashsudo python3 wdg_wifi_bridge.py --iface wlan1 --no-monitor

Then launch the game pointing at the bridge PTY:
bashsudo ./run.sh /tmp/esp32-pty

[FusedStamen]

BLE Scanning Update - now working natively on uConsole!

Got BLE scanning working through the same bridge script using the uConsole's built-in Bluetooth (CM4 BCM4345 on hci1) alongside the AC1200's Bluetooth (MT7921 on hci0).

How it works:
The bridge script now responds to scan_bt commands from the game using bleak (already a project dependency) to run a passive BLE scan on hci1 for 8 seconds, then formats the results to match the serial output format WatchDogsGo expects and sends them back through the PTY.

Important note for bleak 3.x (which is what the venv installs): the API changed significantly from 2.x. RSSI is no longer an attribute on the device object — it's in the advertisement data.

You need return_adv=True when calling BleakScanner.discover() to get it:

pythonresults = await BleakScanner.discover(
    timeout=duration,
    adapter=bt_iface,
    return_adv=True,
)
for addr, (device, adv_data) in results.items():
    rssi = adv_data.rssi
    name = device.name or adv_data.local_name or ""

Updated bridge script attached — now accepts --bt-iface argument (default: hci1).

wdg_wifi_bridge.py

Run with:

bashsudo ~/python/WatchDogsGo/.venv/bin/python3 wdg_wifi_bridge.py --iface wlan1 --bt-iface hci1 --no-monitor

Testing showed 78-184 BLE devices per scan depending on location. WiFi and BLE both confirmed working simultaneously.

Now, to make it permanent — systemd setup
The bridge script needs to run as a service so it starts automatically on boot before the game launches. A few important notes from getting this working:

Use the venv Python, not system Python

bleak is installed in WatchDogsGo's virtualenv, not system Python. The service must use the venv interpreter or bleak won't be found:

/home/fusedstamen/python/WatchDogsGo/.venv/bin/python3
Create the systemd service

bashsudo nano /etc/systemd/system/wdg-wifi-bridge.service

[Unit]
Description=WatchDogsGo WiFi + BLE Bridge
After=network.target bluetooth.target

[Service]
ExecStart=/home/fusedstamen/python/WatchDogsGo/.venv/bin/python3 /home/fusedstamen/python/WatchDogsGo/wdg_wifi_bridge.py --iface wlan1 --bt-iface hci1 --no-monitor
Restart=always
RestartSec=3

[Install]
WantedBy=multi-user.target

bashsudo systemctl daemon-reload
sudo systemctl enable --now wdg-wifi-bridge

Patch __main__.py to accept /tmp/ paths

By default the game only accepts serial device paths starting with /dev/ or COM. One line patch to also accept /tmp/:

bashsed -i 's/if arg.startswith("\/dev\/") or arg.startswith("COM"):/if arg.startswith("\/dev\/") or arg.startswith("COM") or arg.startswith("\/tmp\/"):/' ~/python/WatchDogsGo/watchdogs/__main__.py

Fix the race condition in run.sh

The game launches faster than the bridge creates the PTY. Add a wait loop before the final exec line in run.sh:

# Wait for bridge PTY to be ready
for i in $(seq 1 10); do
    [ -e /tmp/esp32-pty ] && break
    sleep 0.5
done

exec sudo -E "$VENV_PYTHON" -m watchdogs "${@:-/tmp/esp32-pty}"

Launch the game

After all this, just run:
bashsudo ./run.sh

No manual bridge startup needed — the service handles everything automatically on boot!

Let me know if you have questions or require help. I'm in the discord under the same name. HAPPY HUNTING

[FusedStamen]

Troubleshooting: BLE scan error org.bluez.Error.InProgress
If BLE scanning stops working and the bridge logs show Operation already in progress, the Bluetooth adapter may be stuck in a bad state.

Check which adapter is having issues:

dmesg | grep -i "hci\|bluetooth" | tail -20

If you see urb failed to resubmit or Failed to apply iso setting (-110) on an adapter, that adapter is stuck and needs either a reboot or to be swapped out.
The uConsole has two BT adapters:

 - hci0 — AC1200 MT7921 Bluetooth (USB)
 - hci1 — CM4 built-in BCM4345 Bluetooth (UART)

If one is stuck, switch the bridge to the other by changing --bt-iface hci1 to --bt-iface hci0 (or vice versa) in the systemd service file:

sudo nano /etc/systemd/system/wdg-wifi-bridge.service
sudo systemctl daemon-reload
sudo systemctl restart wdg-wifi-bridge

A reboot will also clear the stuck adapter if you need both working again.

[LOCOSP]

Shipped the one-line patch in v0.9.7 — argv parsing is now done by _looks_like_serial(path) in watchdogs/__main__.py, which keeps the old /dev/* and COM* shortcuts and additionally accepts any existing character device. PTYs created by socat … PTY,link=/tmp/esp32-pty follow that test (the symlink resolves to /dev/pts/N), so this just works now:

sudo ./run.sh /tmp/esp32-pty

No more parsing it as a loot path, no more falling through to ESP32 auto-detect.

Behaviour matrix (verified in tests):

arg	before	after
/dev/ttyUSB0	serial	serial
COM3	serial	serial
/tmp/esp32-pty	loot	serial
/etc/hosts	loot	loot
/tmp (dir)	loot	loot
loot/data	loot	loot
/dev/null	serial	serial

Argv is supplied by whoever runs sudo ./run.sh, so this doesn't open any new attack surface — the same user already controlled /dev/ttyUSB0. Just git pull && sudo ./run.sh /tmp/esp32-pty after upgrading.

Thanks for the bridge script work — really nice writeup. I'm leaving this issue open as a community reference for the bridge approach itself; happy to land a sanitised version under extras/ if you want, but that needs a proper review pass on the script (sudo/iw scan, BLE adapter selection, etc.) so I'd open a separate PR for that.

[LOCOSP]

Closing — fix shipped in v0.9.7. Re-open if /tmp/esp32-pty still doesn't work after git pull, or if you'd like to discuss landing the bridge script under extras/ (separate PR with security review).