Skip to content

Module Catalog

Authorized Use Only

Most modules are offensive. Use them only on devices and networks you own or are explicitly authorized in writing to test.

Modules are signed C payloads compiled and injected at runtime. Each is an ESPM module (#include "espm.h", the daemon + commands pattern): C3PO compiles the source for the target chip, signs it with the device key, and streams it onto the live agent. Nothing is written to flash. See writing a module and injection.

Current modules

Module Commands
mod_network ping, scan, arp_scan, arp_listen, dos_tcp, tun_start/tun_stop/tun_status
mod_recon wifi_scan
mod_ble ble_scan, ble_flood, ble_flood_stop, ble_airtag
mod_fakeap fakeap_start, fakeap_stop, fakeap_clients, fakeap_dns
mod_mitm arp_poison, arp_poison_stop
mod_redteam rt_deauth, rt_deauth_stop, rt_beacon, rt_beacon_stop, rt_status

For a minimal template to base your own module on, see mod_hello and the writing guide.

Planned for a future version

The following are in development and not available in the current version:

  • Camera streaming (mod_cam: cam_snap, cam_stream, cam_probe, cam_stop). The module source exists but depends on camera syscalls that are not yet part of the ESPM ABI, so it cannot be loaded yet. Camera support is targeted for a later release.
  • WiFi trilateration / multilateration (position estimation from access point signal strengths).

See also