A modular security-testing firmware for the LilyGo T-Watch Ultra (ESP32-S3).

✦ ˚ · ｡ NocSif — a wireless-testing multitool on the wrist ｡ · ˚ ✦

Hi! I coded this firmware for my T-watch Ultra just to kind of take advantage of the idea of having a wearable device that can do a bunch of penetration testing and signal monitoring things. Unfortunately my T-watch Ultra came with broken NFC and Haptics so I am currently unable to code features for those parts right now. Fortunately LilyGo was really nice and gave me a refund. As soon as they have more of the watch back in stock I will buy again and make the firmware capable for those 2 features as well.

I want to be very upfront this whole firmware started as kind of a fever dream vibe coded app that I made in about a month and a half and then made public and refined over the next month. I made this because there frankly wasn't any firmware out there that I liked. I have done dev work on the Flipper as well as some other devices and work in Cyber Security so this was a kind of fun little project for me to have a chunky looking hacker watch on my wrist.

NocSif is a solo hobby project if it's useful to you and you'd like to chip in, it's hugely appreciated. Thank you.

NocSif is built for AUTHORIZED SECURITY TESTING AND USE ONLY.

You can flash Nocsif Firmware to the watch with the click of a button using the Web Flasher here

1. Download the app — NocSif Desktop Bridge for Windows (one file, no installer; Windows will warn you about this as the build is unsigned you will have to click allow to run on your computer). On macOS or Linux, you gotta build it from source sorry I made it for windows only.
2. Plug the watch into your computer over USB-C. The app finds it on its own.
3. Click Flash new watch. It writes NocSif, creates the microSD folders NocSif expects, and reboots into the firmware. On a stock or used watch pick erase first; the app offers to back the watch up beforehand, so you can put it back exactly as it was whenever you like.

The same app can also run a hardware self-check, manages the microSD, mirror the watch's screen to your computer (mouse acts as touch), back the watch up and restore, or keeps NocSif up to date.

Already running NocSif? Update straight from the wrist — System › Update → Check → Download → Install all you need is an internet connection.

New to the watch? Once NocSif is flashed, the Getting Started guide walks you through waking it, moving between screens, and your first setup steps (Wi-Fi, phone, GPS, weather).

Signal Hunt - Hunt Bluetooth signals, Wifi signals, and Lora (902-915) Signals to their source

WiFi Handshake & PMKID Capture — Monitor-mode sniffing that grabs WPA handshakes/PMKID and writes .hc22000 straight to SD, ready for offline cracking.

Evil Portal / Captive Portal — Stand up a rogue AP with a custom landing page (drop your own HTML in nocsif/wifi/portals/), with live hit-logging.

Deauth / Disassoc — Emits management deauth/disassoc frames spoofing a target AP, plus a live deauth-rate analyzer that doubles as an attack detector.

Beacon Flood / Beacon TX — Broadcast a managed list of fake SSIDs.

Wardriving — WiFi + GPS logged to WiGLE-format CSV

BadUSB / DuckyScript — Plug into a computer and inject keystrokes from .txt DuckyScript macros in /sd/ducky/. Works over USB and BLE HID.

BLE Recon — Scan and sniff nearby BLE advertisements to .pcap, connect and explore GATT services, and broadcast your own adverts.

Sub-GHz (915 MHz ISM) — SX1262 band monitor that sweeps 902–928 MHz reading signal energy, plus TX self-test. (Note: this is monitor + test-TX today — not a Flipper-style capture-and-replay of arbitrary remotes. Spectrum monitor, not "clone your garage remote.")

Unlock Shopping carts with audio cart unlock

Trackers - locate trackers around you that may be following you

Customize the UI accent colors, choose from different icons, and choose from different ring menu types for personalized UI feel on both the watchface and the home screen

Bluetooth connection with phone for notifications, media control, and volume control

Bluetooth Phone - See your bluetooth connected phone alerts, pause and play music/change volume

Weather - off GPS location, sunset, and sunrise

Smart watch - Notes, Voice Memos, DND and location based modes

Card-skimmer detection

BLE Spam

Port Scan and other Nmap type items

Wifi sharing and disguising through Cloning Mac + hostname of another device on the network

pihole and wireguard vpn configuration

You can control the watch from your phone through a little webUI companion thing that lets you connect to the watches spawned wifi network and control it from there

Performance and Battery Life, NocSif over time associates GPS and Saved Wifi Data along with movement data to selectively turn off and on radios to lengthen battery life and increase performance

For a full list of Current Capabilities there is a current features document. Located Here: docs/CURRENT-FEATURES.md

NFC Read / Clone / Emulate — Read NFC-A tags (UID + type), clone access cards, and emulate saved cards from the wrist. (My Unit is dead and once LilyGo has it in stock I will add this in)

Camera Glasses detection

Flock Hunter

For a full list of planned Features there is a planned features document. Located Here: docs/PLANNED-FEATURES.md