7wp81x/NRSuite 是一个托管在 GitHub 上的开源项目，主要使用 C++ 编写，采用 MIT License 许可证，目前获得 62 个 Star、11 次 Fork。
仓库全名
7wp81x/NRSuite
README 摘要
NRSuite Notice: Development has moved to the Android app. The Termux CLI version is no longer actively maintained. Check out NRSuite Android for the actively developed version. Turn a $3 ESP32 into a wireless research toolkit for Termux. No root required. NRSuite bypasses Android's locked-down radio APIs by offloading the radio layer to an ESP32 over USB OTG, turning a stock unrooted Android phone into a wireless…
NRSuite a wireless security testing toolkit for Android with no root required. Uses a $3 ESP32 over USB to add Wi-Fi packet capture, WPA2/PMKID handshake grabbing, BLE HID keyboard injection, USB mass storage, and BadUSB payloads to any Android phone through Termux.
Notice: Development has moved to the Android app. The Termux CLI version is no longer actively maintained.
Check out NRSuite Android for the actively developed version.
Turn a $3 ESP32 into a wireless research toolkit for Termux. No root required.
NRSuite bypasses Android’s locked-down radio APIs by offloading the radio layer to an ESP32 over USB OTG, turning a stock unrooted Android phone into a wireless research toolkit. The firmware and bridge protocol are modular by design, so new radio backends and capabilities slot in without touching the transport layer.
Authorized use only. Only use this on networks and devices you own or have explicit written permission to test. Unauthorized interception of network traffic is illegal in most jurisdictions.
Why this exists
Android has never exposed monitor mode, raw packet injection, or low-level radio control to user-space apps. The old way meant a rooted phone, a custom kernel like NetHunter, a supported external USB adapter, and a lot of luck matching hardware versions.
NRSuite sidesteps all of that:
The ESP32 handles everything radio-level: promiscuous capture, channel hopping, raw frame injection
Termux talks to it over USB CDC using termux-usb and libusb. No root, no kernel modules, no custom ROM
The Python bridge uses a compact framed binary protocol with flow control, not serial ASCII
The firmware and protocol are modular, so new radio backends slot in without touching the transport layer
Total hardware cost: under $5. Works on any Android phone with USB-C or micro-USB and an OTG cable.
Features
WiFi scan - active scan with SSID, BSSID, channel, RSSI, security type
Packet sniffing - fixed channel or channel-hopping promiscuous capture, .pcap output, live stream via FIFO
Deauthentication - standalone deauth, or combined with sniffing to trigger and capture a handshake
Captive portal / AP mode - start/stop/status, custom SSID + channel, custom HTML upload, optional auto EAPOL capture against a target BSSID
BLE HID (BadBLE) - advertise as a BLE keyboard, run a DuckyScript payload against a paired host
BLE HID (realtime keyboard) - live keystroke passthrough from your terminal to a paired BLE host
USB Mass Storage - expose onboard flash as a real USB drive; list/read/write/delete files over the bridge without entering MSC mode
BadUSB - run a DuckyScript payload over native USB HID, with optional simultaneous mass storage exposure
Heartbeat - uptime and free heap reported every 5 seconds
Beacon broadcasting - beacon spam with custom/hidden SSIDs (up to 32), fixed channel, optional stable or random BSSIDs
Multi-device select - nrsuite devices plus -d / --device when several boards are plugged in
BLE scanning, advertising, device discovery, BLE spam
Hardware expansion: IR, NRF24, CC1101 modules
BLE HID requires a chip with a Bluetooth radio (C3, S3, or classic ESP32). ESP32-S2 is supported and tested for WiFi/MSC/BadUSB but has no BLE radio, so BadBLE and keyboard are unavailable on S2.
USB Mass Storage and BadUSB require a chip with native USB-OTG (ESP32-S2 and ESP32-S3, both tested). ESP32-C3 and classic ESP32 devkits have no USB-OTG peripheral, so masstorage start and badusb are unavailable on those boards.
Quick Start (Termux)
Entirely on-device. No PC, no root, no PlatformIO.
Also install the Termux:API companion app from F-Droid. Not the Play Store version, that one’s outdated.
2. Clone the repo
git clone https://github.com/7wp81x/NRSuite
cd NRSuite
3. Flash the firmware
Pre-built binaries are on the Releases page. nrflash is a Termux-native no-root flasher that works entirely on-device.
pip install nrflash
# Auto-detects the chip
nrflash write --offset 0x0 nrsuite-*
# No stub? Try holding the boot button while plugging in
nrflash write --offset 0x0 nrsuite-* --no-stub
4. Connect and run
Plug the ESP32 into your phone via OTG cable. On first run Android shows a USB permission dialog. Tap OK.
chmod +x nrsuite
./nrsuite scan # auto-detects the board
./nrsuite devices # list boards if more than one is plugged in
./nrsuite -d 0 scan # pick by index
This tool is for authorized security research, penetration testing on your own infrastructure, and educational use only. The authors are not responsible for misuse.
Sending deauthentication frames disrupts connectivity for affected clients. Do not use on networks you do not own or manage. In many jurisdictions, unauthorized disruption of network communications is a criminal offense.
Related projects
ESP-Bridge - the USB transport library NRSuite is built on (pip install espbridge)
Termux-ESP-Flasher - flash ESP32 firmware from Termux, no root (pip install nrflash)
评论