Features

Features & Board Modes

Each feature below is a screen in the app. Screens marked (companion) need the project's ESP32 companion firmware; in Marauder mode the app tells you explicitly what's missing rather than failing silently.

Board Mode

Set Board Mode in Settings to match your ESP32's firmware:

• Marauder — keep the board's existing Marauder firmware, no flashing required. Gives you Flock/ALPR Detect, NFC/RFID Audit, GPS, and Reports. The app scrapes MAC/SSID tokens from whatever Marauder prints over serial and applies the Flock filter on the Flipper side.
• Companion — the project's own firmware (esp32_companion/ in the repo), a clean line protocol instead of scraped text. Adds WiFi Audit, BLE/Tracker Scan, Net Guardian, Locator, passive deauth detection, and dual-band (Wi-Fi + BLE) Flock detection. Flash it in-app with ESP32 Firmware — see Installation.

Screens

Flock / ALPR Detect — the main camera hunt. Finds Flock Safety / ALPR cameras over Wi-Fi (and BLE, with the companion), geotags them if GPS is on, and lets you mark them for a report. Each row carries a confidence tag (below) and shows its source — probe, beacon, or BLE. A !DEAUTH ch<n> <bssid> banner appears while a deauth/disassoc flood is active. Alert on hit (Settings: off / Vibrate / Beep / both, default Vibrate) fires once per device on its first crossing to Likely or better — never for an OUI-only Possible lead.

Flock Map — a live map centered on your GPS position: you're at center, detected cameras are plotted by bearing and distance, dot size is confidence. Needs a GPS fix; ungeotagged cameras aren't plotted.

WiFi Audit (companion) — grades each nearby network worst-first (Open/WEP/WPA1/WPA2/WPA3, WPS, TKIP, hidden), flags evil-twin SSIDs (same name, different BSSIDs), and detects deauth/disassoc floods live. Marauder can't report encryption details over serial, so this screen needs the companion firmware.

BLE / Tracker Scan (companion) — detects AirTag / Tile / SmartTag / Google Find My trackers and Flock/Raven BLE devices. With GPS on, a tracker that stays with you across several waypoints is flagged !FOLLOWING — the anti-stalking case. Labels a Flock Raven (audio sensor) only when it sees the Raven's own Bluetooth services; it never guesses "camera" by elimination.

Net Guardian (companion) — an always-on watch face. Fuses Wi-Fi and BLE into a CLEAR / WATCHFUL / ELEVATED "am I being watched" score, with a haptic on the edge into ELEVATED. Counts Flock cameras, nearby Flipper Zeros, and active attacks (deauth/disassoc floods, evil-twin APs, attack-tool signatures). It only reaches ELEVATED when two independent radios agree.

Locator (companion) — hunt a marked device by live signal strength: a hot/cold meter, peak-hold, warmer/colder trend. Mark a target from any Flock/BLE/WiFi detection or the Guardian's Suspicious list. No compass arrow — direction-finding a transmitter needs a directional antenna, so you close in by walking.

NFC / RFID Audit — identifies a presented card's protocol and grades its security for access-control reviews. On a MIFARE Classic, a Deep check tries the Flipper's on-SD default-key dictionary against every sector and reports how many open (N/total = trivially cloneable). Audit only cards you own or are authorized to test.

ESP32 Firmware — backs up the board's current firmware to SD, then flashes a .bin (companion, Marauder, or a backup) straight from the Flipper. Talks to the bare ROM bootloader and MD5-verifies the write — you can't brick it, since the ROM bootloader always allows a re-flash. Back up before you flash.

Reports — writes Markdown, DeFlock-compatible GeoJSON, KML, plain CSV, and WiGLE CSV to apps_data/flipdeflock/reports/. Streams row-by-row to SD so a large scan doesn't run the Flipper out of memory.

Save hits (Settings, off by default) — keeps detections across app restarts in apps_data/flipdeflock/hits.csv. Restored hits show the age of the sighting instead of a live reading. Off by default on purpose: a hit log is a durable record of where you've been. Turning the setting back off deletes the file.

Share to DeFlock — renders a local QR code per marked, geotagged camera that opens DeFlock at that location on your phone, for submission through DeFlock's own review flow. The Flipper and ESP never touch a network.

Detection confidence

Flock-associated OUIs are generic vendor prefixes shared with other hardware, so a prefix match alone is weak evidence:

Signal	Confidence
OUI prefix only	Possible
OUI + phone-home probe request	Likely
SSID is Flock- + 6 hex, or contains test_flck	CONFIRMED
Unverified user IE fingerprint	Class? (candidate device-class, never Confirmed)

A benign name like Flock-Guest or Flock Freight does not Confirm — only the exact provisioning-AP name does; those drop to Likely.

Detection can be extended without a rebuild by dropping a signatures.json file into apps_data/flipdeflock/ — see docs/signatures.md in the repo. It's load-only and fail-safe: a missing or broken file falls back to the built-ins, and user entries can only add detections, never raise confidence past what the precision rules allow.