[ Hardware: Guides | HOW TOs ]

Raspberry Pi Hacking. This paper outlines Raspberry Pi hacking, GPIO headers and
how to interface them. Along with various programming language libraries and
example code for controlling the GPIO pins and various applications they can
be used for.

Also covered will be performance tweaks and enhancements you can do to
improve the performance of RAM, CPU and DISK I/O of the Raspberry Pi.

Languages covered for controlling the Raspberry Pi GPIO pins: C, C#,
Java, Perl, Python, Ruby, Shell Scripting and the wiringPi library.

In this document interfacing with a Teensy Kit is covered
and interfacing the Raspberry Pi with a HD 44780 LCD display,
using the RPi.GPIO

Recently added: Using a 16bit MCP23017 I2C I/O Expander with Raspberry Pi

More Raspberry Pi Hacking... Extending a bit upon the last guide published by
Hakin 9.

This guide will add several things to the Raspberry Pi, LCD with buttons
and a python script to drive everything.

Flashing the ATMega16u2 chip on Arduino UNO so it can act as a
HID device. Similar to Teensy Kits

Companion HID sketches (AddAdminUser / LinuxReverseShell / osx-DownloadandExec)
were originally hosted under ArduinoHIDSketches/; source archives lost to bitrot,
the techniques are preserved in the main writeup above.

Tutorial on using an Arduino UNO as an ISP with an AVR ISP Shield to program atmega
microcontrollers. With and without the need to flash a bootloader onto the target
MCU.

Source archive lost: project listed for historical reference only.

Tutorial on configuring Notepad++ to support syntax highlighting, Arduino IDE
launching along with function completion and parameter suggestions for writing
Arduino sketches.

Tutorial on how to control a 7 segment LED from an Arduino UNO R3.

Source archive lost: project listed for historical reference only.

Small project to control a 120VAC socket from an Arduino UNO R3 via web interface.

Using an 8 relay 5VDC breakout board.

Source Code: https://pastebin.com/Hf34AKEh

Local project files lost; source still mirrored on Pastebin (link above).

Small project working on a RC type robot controlled by Arduino..

Uses ping sonar and motion sensors. With a few servos for turret control...

Source archive lost: project listed for historical reference only.

Open-source firmware for a handheld multi-radio field tool on the cheap yellow
display (ESP32-2432S028R): a CC1101 for sub-GHz, an NRF24 for 2.4 GHz, a PN532
for NFC and an ATGM336H for GPS, all sharing one SPI bus with the screen and SD
card. A fork of CiferTech's ESP32-DIV, reworked around the pin conflicts, the
bus arbitration, and the driver bugs that only surface when five devices share
a bus. Covers the pin map, why the GPS lands on GPIO 1, and building it.

Read the guide →   User guide →

Using Pueo's passive Surveillance and Hunt screens to answer "is something
tracking me?" Surveillance watches for trackers that announce themselves and
raises a dwell alarm once one has stayed with you ten minutes. Separate a tag
riding along from a fixed beacon by walking somewhere it cannot follow, then
Hunt walks you in on a smoothed WARMER / COLDER gauge — signal strength, not
distance. Honest about the gaps: a quiet screen means nothing that announces
itself is here, not that nothing is. Paired AirTags, cellular-only tags, a
dead tag, 5 GHz-only kit and wired recorders all stay invisible.

Read the guide →

Design input for a carrier board that turns the hand-wired Pueo into one
documented connector: why it cannot be a CYD shield, the J1 pinout, the power
tree and current budget, SPI signal integrity, and the module placements the
enclosure already fixes.

Read the notes →

A short getting-started for the ESP32-WROOM-32, the dual-core Wi-Fi + Bluetooth
module on the classic 38-pin DevKit (and the part behind the other ESP32 builds
here). Covers the datasheet specs, the three ways to power it, flashing over USB
(Arduino / PlatformIO / ESP-IDF / ESPHome), the GPIO gotchas that bite everyone
(3.3 V logic, input-only and flash-wired and strapping pins), a first blink
sketch, and a 3D-printable dev-board case with STLs.

Read the guide →

The software companion to the board guide: how to actually develop on the
ESP32. Compares the four toolchains (Arduino core, PlatformIO, ESP-IDF,
ESPHome) and walks the Arduino and PlatformIO setups, then the build → flash
→ monitor loop that every one of them runs, what esptool does underneath,
managing libraries, flash-size and partition schemes, OTA updates over Wi-Fi,
and a ranked list of why uploads fail and how to fix them.

Read the guide →

Flash demo firmware onto an ESP32 straight from the browser over USB: no IDE,
no toolchain. Self-hosted ESP Web Tools talking to the board over the Web Serial
API. Three one-click demos (blink, a Wi-Fi scanner, a BLE scanner), each
auto-detecting ESP32 / S3 / C3 and flashing the right build. Desktop Chrome,
Edge, or Opera only; the sketch source is viewable inline. Pairs with the
getting-started guide above.

Open the flasher →

A getting-started guide and honest capability tour for the pocket radio
multitool: the bands and buses it speaks (Sub-GHz, 125 kHz RFID, 13.56 MHz
NFC, infrared, iButton, GPIO, and USB BadUSB), choosing between official
and custom firmware (Momentum, Unleashed, RogueMaster), first-time setup with
qFlipper, the external ESP32 / CC1101 boards that extend it, and a straight look
at where it stops and where the law does. Built around the curated
FlipperZero_Stuff repo.

Read the guide →

The headline radio, in depth: the CC1101, reading on the right frequency, Read
vs Read RAW, the frequency analyzer, saving and organizing captures, an external
CC1101 for range, and why a fixed code replays but a rolling code does not.

Read the guide →

The Flipper as a USB keyboard that types a scripted payload. Ducky Script basics
with one benign demo, why keyboard layout matters, where payloads live, and how
to defend against it, framed for authorized testing on machines you own.

Read the guide →

The Flipper has no WiFi of its own; an external ESP32 board on the GPIO header
adds it. The boards and firmware (Marauder, Bruce), flashing them, the UART
wiring, and the authorized-use line on scanning versus active attacks.

Read the guide →

Turn an ESP32 into a capture-and-replay bridge for the two dialects most
household remotes speak: infrared (TV, AC, media) and 433 MHz (cheap
RF outlets, doorbells, blinds), using ESPHome's remote_receiver and
remote_transmitter. No firmware coding, just YAML: point a remote at
the receiver, copy what the dumper prints (decoded NEC / rc_switch, or a
raw pulse list) into a template button, and Home Assistant can fire it on
cue. Covers wiring (IR receiver + LED, 433 RX/TX modules), the receiver
and transmitter config, reading the dump output, and a full single-board
example config. Includes the rolling-code caveat: garage doors and car
fobs rotate their code every press, so replay can't (and shouldn't) touch
them.

A repeatable method for reverse-engineering a Bluetooth LE device's protocol
using an Android phone as the vantage point, then reimplementing it in your own
client. Enable the HCI snoop log, drive the vendor app, and decode the
btsnoop capture down to ATT frames; count writes and notifications by handle
to find the command and reply channels; read the framing (sequence id, opcode,
ASCII paths) off the bytes; then decompile the APK with jadx to confirm the
UUIDs, opcode constants, and the challenge-response auth handshake you can't
get from the capture alone. Worked end to end on the Puffco Peak Pro's
path-based LORAX protocol, with a Python btsnoop decoder and the checklist for
building your own client, the same method behind the browser Volcano
controller.

Read the guide →

How to build a Meshtastic LoRa node that actually reaches and survives. Covers
the board decision (low-power nRF52 vs Wi-Fi-capable ESP32), getting the
region/frequency right, the antenna details that decide your real range (SMA
vs RP-SMA, gain trade-offs, feedline loss), sizing battery and solar so a
remote relay rides out bad weather, choosing the correct mesh role instead of
flooding the network, weatherproofing an outdoor enclosure, and flashing the
firmware. Ends with a worked solar ridge-relay build, and pairs with the
coverage-planning guide below for siting.

Read the guide →

Complete walkthrough of the Meshtastic Site Planner, the terrain-aware
tool that predicts where a LoRa node's signal will actually reach. Explains
every transmitter, receiver, environment, simulation, and display setting, and
how the underlying Longley-Rice / ITM model uses each one. Includes a worked
island example (decoded from a real share link) and the maritime-climate gotcha
that quietly under-predicts coastal / island over-water range. Practical tips on
why antenna height beats power, matching receiver sensitivity to your LoRa
preset, and reading the reliability fractions.

Read the guide →

A look at the real Meshtastic mesh across the Hawaiian islands: local
RF meshes on Oʻahu, Maui and the Big Island, stitched together statewide over
MQTT rather than radio across the channels. Explains what the live mesh map
shows, how to tell a real RF link from an MQTT bridge (the most-misread thing on
any mesh map), and how to get your own node onto the mesh (US region, LongFast
preset, and the msh/US/HI MQTT bridge). Pairs with the node-build and
coverage-planning guides above.

Read the guide →

Take the mesh on the move: a group network for hiking, overlanding, events, or
comms-down, with no fixed infrastructure. Covers the mobile node picks, why a
moving node is never a ROUTER, power on the go, GPS and position privacy, vehicle
and handheld antennas, the temporary-high-relay trick that keeps a spread-out
group connected, a private group channel (pre-share the QR before you leave
coverage), and a pre-trip checklist. Links out to the build, coverage, and
security guides for the underlying details.

Read the guide →

The one tool the rest of the site keeps telling you to reach for. A beginner's
walkthrough of a cheap auto-ranging meter (an AstroAI DM130B): reading DC and AC
voltage, the continuity beep and resistance, the diode test, the handy 1.5V /
9V / 12V battery-test positions, measuring current in series without blowing the
fuse, and NCV. Covers the dial, the jacks, the two rules that keep the meter
alive, an across-vs-series diagram, and the mistakes everyone makes once. Pairs
with the Power guides, which assume exactly these checks.

Read the guide →

The second tool on any bench, and the one that saves boards. A benchtop DC
supply gives you two things a battery and a wall wart don't: a voltage you dial
to anything, and a current limit — a ceiling that clamps the current instead of
pouring unlimited amps into a short or a backwards part. Covers constant-voltage
vs constant-current mode (with a CV/CC characteristic diagram), setting both
knobs before you connect, the current limit as a safety net, reading the display,
the brownout sweep, measuring a device's draw, careful single-cell work, and
floating outputs. Pairs with the multimeter and the Power guides.

Read the guide →

Generating it, storing it, and living on it. Solar and battery builds, plus the
off-grid systems guide that ties power, water, and propane together.

The map for the whole thing. Off-grid life is three budgets that feed each
other, power (watt-hours), water (gallons), and propane, and this page frames
how they fit before linking out to the power builds below. Then it goes deep on
the system people always skimp on: a real hot shower from a reservoir, a
12V diaphragm pump, and a propane tankless heater, with the wiring, the
fusing, and the carbon-monoxide and propane safety the setup demands. A living
document that grows as more subsystems get documented.

Read the guide →

The groundwork for any off-grid build: what a panel's ratings mean
(Voc, Vmp, Isc, Imp), wiring and polarity, and the choice that trips
everyone up — wiring panels in series (volts add) versus parallel
(amps add), with a diagram of each. Then the component between panel and
battery: PWM vs MPPT charge controllers, why MPPT harvests 20–30% more,
sizing an array to the controller, and the cold-Voc trap that kills them.

Read the guide →

A browser calculator for designing a lithium pack before you spot-weld
anything. Pick a cell format (18650, 21700, 26650, 32700) and chemistry,
set the series and parallel count, and it returns pack voltage, capacity,
energy, usable energy at a depth of discharge, the current the cells can
actually deliver, a charge-current estimate, cell weight, and runtime at a
load you type in. The companion to the pack build guides below.

Open the calculator →

Three 18650 cells in series make a 12V pack for pocket change, and the BMS is
what keeps it from becoming an interesting evening. Covers what the board
actually protects, why it only switches the negative leg (and why wiring the
load to B− instead of P− gives you a pack that works perfectly and protects
nothing), picking the right board for your chemistry and port type, matching
cells, the balance-tap ladder and the connection order that kills boards when
you get it wrong, the four meter checks before you trust it, charging at 12.6V
CC/CV, and why a 20A BMS is not a fuse. Closes with going up in voltage: a
3S / 4S / 6S comparison, why cutting the current is the point, and the trap that
"24V pack" and "24V input" are not the same number.

Read the guide →

The roll-your-own counterpart to the tool-battery guide, and the big brother of
the 3S Daly build. Five 18650s and a 5S BMS (an HXYP-5S-B530) make a 20V pack
that is electrically a power-tool battery. Covers what 5S/20V means, the board
and its pads, the six-wire balance ladder and its bottom-up order, the full
wiring sequence with a 5S wiring diagram, charging to 21V CC/CV, and fusing. It
leans on the 3S guide for the shared fundamentals and focuses on what changes at
5S: two more cells, a six-wire ladder, and a 21V charger.

Read the guide →

A 20V DeWalt pack is a rugged 5S lithium-ion battery with its own protection
board and a charger you already own, which makes it a tempting power source for
anything portable. But it was designed to talk to a tool, not to you. Covers
what "20V MAX" really is (5S: 21V full, 18V nominal, 15V empty), finding B+ and
B− on the unlabelled terminals with a meter, the three ways to tap power,
whether the pack needs the tool to wake it, running 12V and USB loads through a
buck converter, the pack's own BMS versus the fuse you still need, the FlexVolt
trap, and how it stacks up against rolling your own 18650 pack.

Read the guide →

"Recommended: 190–230°C" on the spool is a range, not a setting. This walks
the calibration in the order that actually matters (temperature tower, flow /
extrusion multiplier, retraction, then pressure advance) and folds the result
into a reusable slicer profile. Worked through with a spool of SUNLU PLA+ 2.0,
with the OrcaSlicer built-in tests as the easy path.

Read the guide →

A parametric OpenSCAD enclosure for the RAK19007 + RAK4631 Meshtastic kit, the
one that houses the node from the build guide. One .scad file renders a base
tray and a choice of lids (snap, screw, or both), with every dimension tunable
from the top: board fit, wall and headroom clearances, USB-C and reset
cutouts, a battery shelf, lanyard loop, and a pigtail exit. Covers the render
targets, the print workflow, what to caliper-check first, and the PLA / PETG /
ASA call for indoor vs outdoor.

Read the guide →

A parametric OpenSCAD enclosure for the Heltec WiFi LoRa 32 V4
(ESP32-S3 + SX1262, on-board OLED), the same snap+screw architecture as the
WisBlock case, re-laid out for the V4's smaller board and its connector row.
One .scad file renders the base and a choice of lids, with an optional OLED
window, an SMA antenna hole, and M2 mounting. Covers the render targets,
verifying the connector positions (the make-or-break step), the OLED cover,
assembly, and the material call. Ships with pre-exported, print-ready STLs.

Read the guide →

Scan Key Code mappings for a 101 Key keyboard, including numpad and some special
keys.

Source archive lost: project listed for historical reference only.

Tutorial on analyzing, reversing and emulating firmware using tools like Binwalk,
Firmware modification Toolkit & Qemu.

Note: This will only work for devices that are of the following:

A. Under 12volts.
B. Support ONLY 10/100 speeds.

This will NOT work with gigabit devices as gigabit requires
all 8 pairs.

WARNING: This mod will FRY gigabit devices
(AT YOUR OWN RISK / Dangerous)

HOWTO on building your own parallel port to LCD interface, driven by lcdproc.

Tutorial on how to convert your Eagle Board Drawings into usable images for creating
your own PCB boards using the Toner Transfer Method.

Note: Assumes prior knowledge of eagle and prepared schematic and board drawing,
works best when the circuit does not use any SMD chips.