v0.4.0 — native LCD console + JSON tool framework

Native LCD console + runtime JSON tool framework

czconsole now runs on the CardputerZero's own screen, and every tool is a JSON spec that drives both the on-device LCD and the phone web UI from one file.

Highlights

• Native LCD console (czconsole-lcd) — APPLaunch tile driving the tools on the CZ's LCD + keypad: per-tool config forms, live run view, results, and a run-history browser.
• Runtime JSON tool framework — tools are specs in /etc/czconsole/tools.d/ (no recompile to add one), privilege-separated behind cap-class systemd units. Ships nmap, gobuster, tcpdump, rtl_433 (live decode), and rtl_power (RF heatmap).
• Giant-image heatmap viewer — pan multi-MB rtl_power heatmaps on the LCD with bounded memory.
• Web console converged onto the same specs — Net Recon / Wireless tabs with per-tool pages; output read through the files-agent, so the network-facing worker never touches the operator's home.
• Wardrive GPS fix — kismet loads the gpsd source, so captures are geotagged.

Install (arm64 — Kali or stock RaspiOS / Debian Trixie)

sudo apt install ./czconsole_0.4.0_arm64.deb

Open http://<device>:8080, log in with the device account. Tools self-disable when their binary isn't present (kismet/gpsd are Recommends).

Verified end-to-end on a fresh Kali arm64 image.

czconsole v0.3.4

Changes

• wardrive: recover kismet REST password when adopting an orphaned session — stats now resume immediately after a czconsole restart while kismet is still capturing
• wardrive: channel hop speed increased to 10/sec; source_retry enabled to handle driver stalls
• sysinfo: added rtw88 in-kernel driver family (rtw88_8821au, rtw88_8822bu, etc.) and out-of-tree sysfs names (rtl88XXau, rtl88x2bu) to monitor/inject capability detection
• ui: GPS pill is now clickable on all module pages (wardrive, hdmi, sdr, files) with the same fix/satellite detail modal as the main dashboard

czconsole v0.3.3

Changes

• Wardrive module status detects presence of monitor-capable adapters — tile shows yellow ● no adapter when no monitor-capable WiFi adapter is present; uses the same static driver-capability table that powers the +mon tag in the dashboard, so only known-good adapters (ath9k, mt76x2u, rt2800usb, etc.) unlock the module. The onboard BCM43439 (brcmfmac, no nexmon) correctly shows as absent.
• Adding SDR Module functionality — two-card panel: RTL_POWER SWEEP and RTL_433 SCANNER, mutually exclusive via systemd Conflicts=. Fork-free RTL-SDR USB presence check (sysfs vendor/product IDs); yellow ● no device tile state when dongle not attached. Env-file IPC for dynamic sweep parameters. rfheatmap integration for spectrum PNG output. Polkit rules for unprivileged start/stop.

czconsole v0.2.0

The HDMI Desktop module plus live status across the dashboard. On the 512 MB
CM0, the HDMI desktop (lightdm — Xorg + pipewire + wireplumber) is the single
biggest RAM/CPU consumer; this release makes dropping it a one-tap toggle for a
long capture run, and surfaces module state at a glance.

New

• HDMI Desktop module. Start/stop and enable/disable lightdm from your
  phone to free RAM and CPU (e.g. for a long wardrive run) — the LCD (APPLaunch),
  this console, kismet and GPS keep running. Status light: 🟢 running /
  ⚪ stopped / 🔴 enabled-but-down. Privilege-separated like the kismet capture:
  the powerless web worker can't touch lightdm directly (its SysV init script
  makes enable/disable a root filesystem write that polkit can't grant), so
  two fixed-verb root one-shots (czconsole-hdmi-{enable,disable}.service) do
  the privileged work and the worker only triggers them via a narrow polkit
  rule.
• Live dashboard tiles. The HDMI and Wardrive tiles now show their run-state
  as a coloured dot — 🟢 running / ⚪ stopped (and 🔴 failed for HDMI) —
  refreshed on the existing poll. Read fork-free from the unit's cgroup, so it
  adds no load even under memory pressure.
• LCD mirror auto-refresh. The on-screen mirror updates every 10 s for
  hands-free glancing (~10 KB/frame), on top of tap-to-refresh.

Fixes

• Wardrive no longer false-reports "stopped." Status shelled out to
  systemctl is-active each poll; under memory pressure that fork stalls or
  fails and was read as "stopped" even while kismet was actively capturing. It
  now reads liveness fork-free from the unit's cgroup, and shows "stats catching
  up" when kismet's REST is slow rather than "stopped."
• postinstall restarts services on upgrade. It previously did enable --now, which doesn't restart an already-running service — so an upgrade kept
  the old binary running until a manual restart. It now restarts them.

Install (arm64 — Kali graft or stock Raspberry Pi OS)

sudo apt install ./czconsole_0.2.0_arm64.deb

Verify

sha256  ed84c5c30154f19ae4a9bee6d74da71fc06ccb5ab749f1950274a90df4b73abe

Built for the Kali graft and verified on-device (Pi Zero 2 W / CM0).

czconsole v0.1.1

OS-agnostic fixes found by running czconsole on the stock M5Stack Raspberry Pi
OS image (not just the Kali graft). Both were real packaging bugs.

Fixes

• LCD mirror auto-detects the framebuffer. It hardcoded /dev/fb0; on the
  stock image fb0 is the HDMI/vc4 KMS framebuffer and the st7789 LCD is fb1,
  so the mirror showed a blank screen. It now finds the LCD by driver name
  (st7789), working on both layouts (graft fb0, stock fb1).
• postinstall creates the kismet group. The worker's SupplementaryGroups
  lists it (for the wardrive module), but the group only exists once kismet is
  installed (Kali). On stock RaspiOS the missing group made the worker fail to
  start (systemd 216/GROUP) and silently broke the privsep group setup. The
  postinst now pre-creates it.

Also

• Binary built with -ldflags="-s -w" — package is ~2.8 MB (down from ~5.7 MB).

Install (arm64 — Kali graft or stock Raspberry Pi OS)

sudo apt install ./czconsole_0.1.1_arm64.deb

Verify

sha256  b3e82e2e49e4b3f159b2522b70cadd0487bb6cb27a20bf24a347262cd083c5c5

Tested on the stock M5 Raspberry Pi OS image (pi user) and built for the Kali graft.

czconsole v0.1.0

First packaged release of czconsole — the phone-served field console for the
M5 Cardputer Zero.

Install (arm64 — Kali graft or stock Raspberry Pi OS)

sudo apt install ./czconsole_0.1.0_arm64.deb

apt pulls the pamtester dependency automatically. The postinstall runs the
full privsep setup (dedicated worker user, group-scoped sockets, capabilities)
and starts the services. A login is required by default — sign in with a
device account; edit /etc/czconsole/czconsole.conf to change. Then open the
URL it prints (default http://<device-ip>:8080) from your phone.

What's inside

• Pure-Go, static, no cgo. OS-agnostic (RaspiOS + Kali).
• Dashboard, LCD mirror, sysinfo, adapter inventory; files and wardrive
  modules (sdr/netrecon are placeholders that grey out without their tools).
• Privilege separation: a powerless web worker, a files agent that runs as
  the operator, and a root PAM auth agent — the worker never holds privilege or
  reads /etc/shadow.
• PAM login via pamtester, HMAC session cookies, pam_faillock + a per-IP
  rate limit; shared-token and LAN-trusted modes also available.

Verify

sha256  a6eb2f1a1d13e5f0f7234936b3839cd1933646f97c221bfa50c1112d85dcf8c1

Built and install-tested on the Kali Cardputer Zero graft.