Somebody can buy a tracker for £25 and drop it in your bag. GhostTag watches the Bluetooth advertising channels for the ones that are still with you twenty minutes later — and tells you, out loud, when one is.

Detecting a tracker is easy. There is one in nearly every bag on a train, and almost all of them are innocent. What matters is persistence: the tag that is in range at the station, still in range at the shops, and still in range outside your front door. That is the only thing GhostTag grades, and it is careful never to claim more than it measured.

Why isn't there an onboard-only detection mode? Because the radio cannot do it, and we checked rather than assumed — see the onboard radio below.

_{Every screenshot in this repository is captured off a real Flipper over the RPC protocol — there are no mockups here.}

This is the single most important thing on this page, so it is not buried in a footnote.

The official board is built around an ESP32-S2, and the ESP32-S2 has no Bluetooth radio of any kind — not BLE, not Classic. It is Wi-Fi only. No firmware can give it a radio it does not have. (This is also why the Marauder project greys out every Bluetooth menu item on that board.)

GhostTag's ESP32 sketch refuses to compile for an S2 rather than handing you a binary that flashes perfectly and then finds nothing forever.

Flipper-shaped add-on boards (clip straight onto the GPIO): ESP32 Marauder Add-On (Electronic Cats, S3) · WiFi ESP32 Marauder (Hacker Warehouse, S3) · Flipper Zero ESP32S3 v4 (Rabbit-Labs).

Plain dev boards wired to the GPIO also work: Seeed XIAO ESP32C3/S3, ESP32-C3-DevKitM-1, ESP32-S3-DevKitC-1, any ESP32-WROOM-32 board.

Note the TX ↔ RX cross-over. Power the ESP32 from its own USB while you are getting started — pin 9 is 3V3 and can run a small module, but the documented current budget for that rail is not something to guess at with a radio on it.

The Flipper's own Bluetooth is advertising-only. furi_hal_bt.h exposes a peripheral profile, advertising, and RF test mode — there is no GAP observer role and no way to hand an advertisement to an application. So the Flipper physically cannot see a tracker on its own. GhostTag splits the job: the ESP32 is the radio, the Flipper is the brain and the screen.

flowchart LR
    subgraph AIR["📡 Around you"]
      A["AirTag / Find My"]
      T["Tile"]
      S["Samsung SmartTag"]
    end
    A & T & S -- "BLE adverts" --> E

    subgraph BOARD["BLE-capable ESP32"]
      E["NimBLE scanner"] --> C["Classify vendor signature"]
      C --> P["GT1,mac,rssi,type,name"]
    end

    P -- "UART 115200 · pins 13/14" --> U

    subgraph FLIP["Flipper Zero — GhostTag.fap"]
      U["UART worker"] --> DB[("Tracker DB")]
      DB --> HEU{"Travelling<br/>with you?"}
      HEU -->|"dwell + sightings"| AL["🚨 Alert"]
      DB --> RAD["🛰️ Radar / List / Detail"]
    end

furi_hal_bt.h also exposes RF test mode, which looks like it should let the Flipper measure raw energy on a channel even though it cannot decode anything. That would not find trackers, but it would at least answer "how busy are the advertising channels right here" — useful context, since a tag that persists in an empty garage means far more than one in a crowded café.

It was built, and it does not work. On official firmware (API 87), tested on a real device:

A return of exactly 0 is how this stack reports a failed read, on both receive paths, for every sample. So an app gets no energy measurement at all.

The code is kept — it is correct as written and would start working the day a firmware hands an application a real RSSI — but it is compiled out (GHOSTTAG_ENABLE_AIR_CHECK in ghosttag_i.h) rather than shipped as a menu entry that can only ever read NO READING. If you are working on a firmware where this behaves differently, flip that define and please open an issue.

A record is promoted only when all three hold:

1. it is a known tracker type that could realistically be used to stalk someone;
2. it has been heard at least 4 times; and
3. it has been in range continuously for the whole dwell window you set.

"Continuously" is load-bearing. If a tag goes quiet for 30 seconds, its dwell clock restarts. Without that, a tag you passed twice ten minutes apart satisfies any dwell window up to ten minutes — and telling somebody they are being followed when a tag merely passed them twice is the worst thing this app could do.

Distance from the centre is real. It is the measured signal strength, mapped onto the range rings.

The angle is not a bearing. There is no compass and no antenna array in a Flipper Zero, so it cannot know which direction anything is in. The angle is a stable hash of the device address, so each tag keeps its own spot and you can watch it move in and out — and that is all it means. That is also why there is no crosshair: a cross through the middle reads as N/E/S/W.

A hollow pulsing ring is a tracker that has been promoted. A solid dot is a tracker that has not. A single pixel is ambient kit that is not a stalking risk at all.

Grab a build — download from Releases and copy to SD Card / apps / Bluetooth / with qFlipper.

Two builds are attached to every release, because a .fap's API version is baked in at compile time:

• ghosttag.fap — official firmware (API 87)
• ghosttag-fw-dev.fap — Momentum / Unleashed / RogueMaster (API 88)

Using the wrong one gives you APP:87 < FW:88 — This app might not work.

Or build it:

python3 -m pip install --upgrade ufbt
git clone https://github.com/at0m-b0mb/GhostTag-FlipperZero.git
cd GhostTag-FlipperZero
ufbt          # builds dist/ghosttag.fap
ufbt launch   # build, upload to a connected Flipper, and run it

Open Apps → Bluetooth → GhostTag. You can run Demo immediately — no hardware at all.

1. Arduino IDE + the ESP32 board package (esp32 by Espressif).
2. Library Manager → NimBLE-Arduino. Either 1.4.x or 2.x works; the sketch detects which and compiles against the right scan-callback API. (C6 needs 2.x.)
3. Open esp32/ghosttag_esp32/ghosttag_esp32.ino, pick your board, upload.

On boot it prints GTHELLO,2.0 and heartbeats GTALIVE every two seconds, so the Flipper can tell "the board is fine and the room is quiet" apart from "the board is dead" — which it could not do before v2.0.

Then: walk. A tracker that stays with you across a few minutes of real movement is the signal; one that is merely nearby is not. Pop back into Detections now and then — the dwell column is the one that matters.

Settings persist across restarts. That is a safety feature as much as a convenience: somebody who turns Sound off because they do not want a stalker to hear the alert should not have it switch itself back on.

Two deliberate decisions in there:

• The Find My length byte is the whole ballgame. The long form is the separated state — the tag has lost its owner and is broadcasting a rotating key for any passing phone to relay. That is the state a tag planted on somebody is in. The short form means the owner is standing right there, and is graded harmless.
• Samsung's company ID 0x0075 is deliberately not used. It is on every Samsung phone, watch, TV and pair of earbuds in the room. Matching it reported half a train carriage as SmartTags.

ESP32  → Flipper :  GT1,<mac12hex>,<rssi>,<typecode>,<name>
                    GTHELLO,<version>      on boot and in reply to PING
                    GTALIVE,<count>        heartbeat, every 2 s
Flipper → ESP32  :  START    STOP    PING

Plain ASCII on purpose — you can watch it in any serial monitor while debugging.

An anti-stalking tool that overstates itself is worse than none, so:

• It cannot tell you a direction. No compass, no antenna array. The radar angle is decorative and the app says so on its own help screen.
• It cannot prove intent. "Travelling with you" means in range across time, nothing more. A tag on a shelf you stood next to for ten minutes looks identical to one in your coat pocket. Walk, and re-check.
• Find My tags rotate their address roughly every 15 minutes, so a long tail may appear as several shorter records rather than one long one.
• A quiet result is not an all-clear. GhostTag hears BLE advertising. A tracker that is switched off, out of range, or not beaconing is invisible to it — as is anything that is not Bluetooth at all.

• "Make it chirp" for separated AirTags, to find one you have detected
• GPS devboard support, to confirm a follower against real movement
• Correlate rotating addresses by payload so one stalk is one record
• Native internal-BT backend if a firmware ever exposes BLE observer mode

Everything below runs on a laptop and is wired into CI, because three of these caught real bugs in the rewrite:

GhostTag is a defensive, anti-stalking privacy tool. Use it to find trackers placed on you or your property, or with the consent of everyone involved. Do not use it to harass or surveil anyone. You are responsible for the laws where you are.

Everything runs locally on your own hardware. No cloud, no account, nothing leaves the device.

Flipper Zero developer docs · NimBLE-Arduino · prior art that informed the approach: AirGuard, ESP32-AirTag-Scanner, ESP32Marauder

MIT © at0m-b0mb

_{Built for people who would rather know. 👻}