NOCSIF

A security testing multitool on the wrist

NocSif is a from-scratch firmware for the T-Watch Ultra that turns the watch into a wearable cybersecurity tool and signal finder.

GitHub ↗ Discord ↗ Buy me a coffee ↗ PayPal ↗

[ ok ] display · wifi · ble · usb-hid · sd [ ok ] watchdog · coredump · safe-mode [ .. ] nfc · haptics  # awaiting new hardware

↓ what it runs

Backstory

Why I built it.

I made this firmware for my T-Watch Ultra just to take advantage of the idea of having a wearable device that can do a bunch of penetration-testing and signal-monitoring things. I want to be very upfront: this whole firmware was a kind of fever-dream that I made in about a month and a half, because there frankly wasn't any firmware out there I liked. I used AI to code some of the firmware but most of it the AI wouldnt touch because it was cybersecurity related.

I've done dev work on the Flipper as well as some other devices in the past, and I work in cybersecurity, so this was a fun little project for me to have a chunky looking watch on my wrist. Three worlds, one rotating ring:

running today

What it does now.

Built & verified on-device. tap a line to open

Wi-Fi
  • Station — scan, join, saved networks, MAC randomize
  • Promiscuous monitor — channel hop / lock, per-type tallies, RSSI
  • Passive parse — AP / client lists, probe & SSID harvest
  • PCAP to microSD + live PCAP over USB (Wireshark)
  • Handshake & PMKID capture → hashcat-22000
  • Deauth / disassoc & duplicate-SSID / evil-twin detectors
  • Own-network ops — mgmt-frame TX, beacons, AP + captive portal
Bluetooth LE
  • Device scan — name / vendor / address-type + RSSI
  • Detect trackers (AirTag / Tile / SmartTag) & drones (Remote-ID)
  • GATT explore — connect, walk services, tap-to-read
  • Advertise / iBeacon; advert PCAP to SD
  • Phone companion — ANCS notifications + AMS media
  • BLE HID keyboard with DuckyScript over BLE
LoRa
  • P2P messaging — broadcast text frames, inbox, node id
  • Channel Activity — 902–928 MHz RSSI sweep + CAD detection
  • Band Survey — 52 × 500 kHz sweep, max-hold, hands a freq to Signal Hunt
GNSS
  • Live Fix — NMEA parse, sats, lat / lon / alt / HDOP / speed, UTC
  • GPX Log — power-loss-safe track logging to microSD
  • Wardrive — geotagged Wi-Fi survey to WiGLE CSV
  • Sync Clock — set the RTC from GNSS UTC with home-tz auto-DST
Signal Hunt
  • Live-RSSI proximity hunt with an IMU rotation-sweep bearing dial
  • Filled compass needle on a PSRAM canvas + eyes-free "warmer" audio cue
  • Hunt radio switchable across BLE / Wi-Fi-AP / LoRa
Sensors & audio
  • IMU (BHI260AP) — accel streaming, shake-to-wake, stillness tracking
  • Speaker (MAX98357A) — tones, named cues, WAV playback
  • Mic (PDM) — level meter + voice-memo recording to SD
  • microSD (FAT32 over SDSPI) with an access lock
  • Composite USB — Detached / CDC / HID / MSC mode picker
  • HID keyboard (US / GB / DE) + full DuckyScript engine, USB or BLE
Over-the-air update (OTA)
  • A/B partition scheme with rollback
  • On-watch microSD firmware installer — scan → validate → install
  • WDT-safe erase, DMA-safe SD reads under active radio load
The watch
  • CO5300 AMOLED + CST9217 touch; pipelined two-buffer DMA flush
  • LVGL v9 shell — grayscale + violet, rendered orrery background
  • Home — rotating category-planet carousel with edit mode & layouts
  • Watchface / peek + Control Center — radios, media, brightness, DND
  • Lock / PIN — passcode keypad, idle → sleep auto-lock
  • Theme / Wallpaper / Font — HSV accent wheel, type scale, 3 wallpapers
  • Apps — Notes, Files, Weather, Alert Center, GeoFence movie mode

Unfortunately my T-Watch Ultra came with broken NFC and haptics, so I'm currently unable to code features for those parts. That's coming as soon as I get a new watch in from LilyGo.

on the roadmap

Planned Features.

Five bodies on the horizon. tap a planet

NFCQUEUED

Contactless read, write & card emulation. NFC is broken on my current watch, so this lands on the replacement — the driver is already ported.

protocols
  • ISO 14443-A/B · ISO 15693 · FeliCa
  • MIFARE Classic / Ultralight / NTAG
  • DESFire APDU explorer
Wi-FiQUEUED

Turning the joined LAN into a surface — discovery, scanning, and routing.

what's queued
  • Host discovery — ping sweep + ARP + mDNS / NBNS / SSDP + OUI vendor
  • TCP port scan + banner grab on a chosen host
  • Adopt-a-profile — clone MAC + hostname on your own gear
  • APSTA NAT router — share / route your phone's internet
  • Pi-hole / DNS blocklist on the watch's own AP
  • WireGuard VPN — tunnel AP clients, auto-drop on home Wi-Fi
  • Flag nearby tools (Flipper-BLE / pwnagotchi / deauther / Pineapple)
  • Flock ALPR-camera detect & direction-find; ESP-NOW link
BluetoothQUEUED

Deeper BLE — testing, decoding, and anti-stalking.

what's queued
  • GATT write / subscribe-notify testing; custom GATT-server emulation
  • HID mouse / media / gamepad
  • Decode Continuity / Handoff / AirDrop & Fast Pair / Swift Pair
  • Card-skimmer detection
  • Anti-stalking "a tracker is following me" alert
  • BLE advertisement resilience test (authorized targets only)
LoRaQUEUED

Off-grid links and mesh over sub-GHz.

what's queued
  • Mesh telemetry, store-and-forward, repeater / router node
  • Traceroute + MQTT internet gateway
  • MeshCore and Reticulum / RNode stacks
  • Narrowband in-band FSK .sub subset
  • Cross-band BLE / web → LoRa bridge
  • GNSS-time-synced collision-avoiding mesh slots
  • Sub-GHz RF carrier / resilience test — own equipment, controlled
GeneralQUEUED

Everything that doesn't belong to one radio.

what's queued
  • Image / GIF viewer, QR display, bubble level / inclinometer
  • Audio tools — theremin, data-over-sound modem, dB meter, spectrum + tuner
  • USB host with peripheral class drivers; U2F / FIDO CTAP over HID
  • MicroPython drop-in script layer
  • Flipper-format parsers + an app / script manager
  • GPX route navigation & track-back; localization / i18n
  • Head-coupled 3D idle scene; the USB-C "Backpack" co-processor

Web Flasher

Flash from website.

  1. Plug the watch into the computer with USB-C.
  2. Press Flash NocSif to Watch and choose the watch’s port. (It may show up as “USB JTAG/serial debug unit”.)
  3. Keep it plugged in; when it finishes, press the watch’s RST button to boot.
Desktop Chrome or Edge, over USB.

It checks what’s on the watch and installs a quick app update if it’s already running NocSif, or a full install (bootloader & partition table) if it’s blank or running other firmware.

New here?

Getting Started.

Fresh off the flash? This walks you through setting up your watch and finding your way around.

→ Getting Started guide I recommend starting here!

Questions? Join the community Discord →

Desktop App

NocSif Bridge.

Desktop to watch bridge for NocSif firmware. Plug the watch in over USB-C and the app connects by itself: flash / provision / wipe it, run the hardware-defect check, manage the microSD, and drive the watch from the computer.

Windows only, currently.

↓ download NocSif Bridge Windows x64 · latest release