Firmware watch for security research & hardware tools.
PenWare monitors official firmware releases for popular ESP32, Flipper Zero, RF, and multi-tool devices. It keeps a baseline of the last-seen version and raises an alert when a new release appears.
- Live app: https://penware.app
- Catalog (source of truth):
catalog.json
Official project links only. Only test systems you are authorized to test.
PenWare tracks firmware for security research and hardware testing tools. Many of these devices can transmit, jam, spoof, capture or interfere with wireless signals and other people's equipment. Using them is your responsibility.
- Only test systems, networks and devices you own or have explicit written permission to test.
- Follow the laws where you are. Radio transmission, signal jamming, intercepting communications, cloning access cards and accessing networks without permission are illegal in many places, even "just to try it."
- Respect other people's privacy. Don't collect, keep or share data that isn't yours.
- Use official firmware from official sources. PenWare links only to each project's own releases and flashers. Check checksums where they're provided.
- Back up before you flash. Firmware updates can fail. You're responsible for your own hardware.
PenWare is an independent project. It isn't affiliated with or endorsed by any of the device makers or firmware projects it lists. Firmware remains the property of its authors. PenWare is provided as-is, with no warranty, and its authors aren't responsible for how the tools it tracks are used.
| Device | Notes |
|---|---|
| Banshee | Wired Hatters dual-SoC (GhostESP) |
| Biscuit Pro | Dual-chip ESP32-C5 + WROOM |
| Biscuit Ultra | Pro radios + SD + external antennas |
| Biscuit Crumb | Single ESP32-C5, smallest Biscuit |
| Flipper Zero | Official, Momentum, Unleashed, RogueMaster |
| FREE-WILi 2 | RP2350B multitool |
| HackRF Pro H4M | Mayhem firmware |
| HaleHound | CYD 2.8"/3.5" and ESP32-DIV (HaleHound firmware) |
| Marauder V8 | ESP32 Marauder (ESP32-C5) – stable + nightly |
| NM-CYD-C5 | RockBase 2.8" CYD on ESP32-C5, running SquachWatch-CYD |
| Phantom | Rabbit Labs Phantom (CYD Marauder build) |
| T-Embed | LilyGO T-Embed / T-Embed CC1101 (Bruce) |
| WiFi Pineapple Pager | Hak5 official firmware only |
Each device entry in catalog.json includes:
- Firmware feeds (stable / beta / nightly where available)
- Install steps
- Recovery instructions
- Official links only
The raw catalog is always available at:
https://raw.githubusercontent.com/mmcoms/PenWare/main/catalog.json
The live app loads this file. Keep the repository public so the app (and anyone else) can fetch it.
- First scan sets a baseline for each watched feed.
- Later scans compare the current release against the baseline.
- A newer version raises an alert in the app.
No accounts, no telemetry, no third-party firmware sources.
| Path | What it is |
|---|---|
src/components/penware/penware-app.tsx |
The whole app screen (fleet, device detail, add device, Backup) |
src/lib/penware/check.ts |
Server functions: checkFeeds (GitHub, Biscuit, Hak5 lookups) and pullCatalog |
src/components/penware/device-backup.tsx |
"Back up before you update" panel (USB flash backup for ESP32 devices) |
src/lib/penware/store.ts |
Saved settings, baselines and watch list (kept in the browser) |
catalog.json |
The device list. Read by the app, the firmware watch and the backup panel |
scripts/watch.mjs, .github/workflows/watch.yml |
Background firmware watch (every 6 hours, opens an issue on new releases) |
Built with TanStack Start, React, Tailwind and Vite. Hosted on Vercel.
npm install
npm run dev
Vercel builds every push to main automatically (npm run build produces .vercel/output).
catalog.json is the only place devices are defined. The app, the background firmware watch and the backup panel all read it, so a device added here appears everywhere after the next deploy (about 2 minutes).
Quickest path
- Open an issue with the New device form (Issues → New issue → New device) and fill in what you know.
- Turn it into a
catalog.jsonentry: copy the closest existing device, change the fields below, and commit (GitHub: opencatalog.json→ pencil icon → edit → Commit changes).
Fields
| Field | What to put |
|---|---|
id |
short, lowercase, unique: t-embed, marauder-v8 |
name, blurb |
display name and one-line description |
github |
official firmware repo URL |
links |
official docs / flasher links (max 8) |
companion |
official live UI or emulator, or null |
feeds |
one per channel to watch (see below) |
install, recovery |
steps as { "title": "...", "detail": "..." }; recoveryTitle heads the recovery list |
backup |
{ "kind": "esp32", "chips": "ESP32-S3" } for USB backup, or { "kind": "checklist", "items": ["..."] } |
Feeds (each needs a unique id and a label; watchDefault: true means watched by default and checked by the email watch):
{ "id": "mydevice-stable", "label": "Stable", "watchDefault": true,
"spec": { "kind": "github-release", "owner": "owner", "repo": "repo",
"channel": "stable", "assetIncludes": "_myboard.bin" } }channel is stable or prerelease. assetIncludes is optional and picks the file for your exact board. Firmware that isn't published as GitHub releases needs a new feed kind in src/lib/penware/check.ts and scripts/watch.mjs.
Official sources only, please.
This project is provided as-is for personal and educational use. Firmware itself remains the property of the respective project authors.