baitnswitch

baitnswitch is a Cardputer-Adv firmware for ESP-IDF 5.4.2 that re-implements the Fusée Gelée exploit. It browses payloads from the SD Card, watches for a Switch in RCM mode over USB host, runs preflight safety checks, and injects the selected payload.

Current Status

• Single-firmware ESP-IDF project targeting esp32s3
• SD card mount, directory browsing, file inspection, and streamed SHA-256 hashing
• USB host lifecycle management with descriptor capture and RCM device detection
• Switch RCM backend with descriptor-based interface claim and endpoint discovery
• Payload shaping, chunked upload, trigger flow, retry handling, and cancel support
• Two-step confirmation flow plus preflight gates for SD, file size, battery, heap, build policy, and USB target state
• ST7789 LCD rendering, external UART text output, keyboard input, logging, and diagnostics screens
• Runtime overrides loaded from /sdcard/baitnswitch.cfg
• Log export to /sdcard/baitnswitch-logs.txt by default

Known Limits

• Battery divider and offset defaults are configurable, but hardware calibration is not fully validated

Build

Use an ESP-IDF shell.

1. Install ESP-IDF 5.4.2
2. Open an ESP-IDF shell
3. Run idf.py set-target esp32s3
4. Run idf.py build

Useful defaults already checked into sdkconfig.defaults:

• esp32s3 target
• custom partitions.csv
• 8 MB flash
• ESP console disabled
• FATFS long filename support on heap

Runtime Flow

1. Browse payloads from /sdcard
2. Select a file and wait for hashing/preflight checks
3. Put the Switch into RCM mode and connect it
4. Confirm the target lock-in
5. Confirm the injection
6. Watch transfer progress or cancel with Esc

Controls

• Arrow keys: navigate
• Enter: select / confirm
• Esc: back / cancel
• P: open payload browser
• L: open logs
• D: open diagnostics

On the logs screen, Enter exports the in-memory log buffer to log_export_path if the SD card is mounted.

Runtime Config

Defaults are compiled in from main/Kconfig.projbuild and sdkconfig.defaults. Runtime overrides come from /sdcard/baitnswitch.cfg.

Supported keys:

• min_battery_mv
• min_free_heap_bytes
• min_largest_block_bytes
• max_session_file_bytes
• battery_sample_count
• battery_divider_numerator
• battery_divider_denominator
• battery_offset_mv
• allow_unknown_battery
• allow_sessions_in_this_build
• lcd_enabled
• lcd_swap_xy
• lcd_mirror_x
• lcd_mirror_y
• lcd_invert_colors
• lcd_gap_x
• lcd_gap_y
• log_export_path

Example:

# Preflight policy
min_battery_mv=3800
min_free_heap_bytes=163840
min_largest_block_bytes=32768
max_session_file_bytes=130392
allow_unknown_battery=false
allow_sessions_in_this_build=true

# Battery calibration
battery_sample_count=8
battery_divider_numerator=2
battery_divider_denominator=1
battery_offset_mv=0

# LCD tuning for Cardputer-Adv
lcd_enabled=true
lcd_swap_xy=true
lcd_mirror_x=true
lcd_mirror_y=false
lcd_invert_colors=true
lcd_gap_x=40
lcd_gap_y=53

# Log export
log_export_path=/sdcard/baitnswitch-logs.txt

Boolean values accept 1/0, true/false, yes/no, and on/off.

Upstream Attribution

• DavidBuchanan314/fusee-nano by David Buchanan, licensed under MIT.

Please retain these upstream attributions and review the upstream licenses before redistributing or relicensing derived portions of the RCM backend.