Al-Anqa

Offensive security firmware for the LilyGo T-Deck — hacker CLI in your pocket.

Al-Anqa turns the LilyGo T-Deck into a pocket pentesting terminal. No menus, no GUI — just a blinking cursor, a physical keyboard, and a full suite of offensive security tools running on an ESP32-S3.

---

⚠️ Legal Disclaimer — For authorized security testing, CTF competitions, and educational use only. Always get written permission before testing.

---

Documentation

🚀 Start Here

• Getting Started — Flash, first boot, SD setup, first commands
• Keyboard Reference — Sym key, autocomplete, history, cursor editing, trackball
• Workflows — End-to-end examples: WPA2 capture, network recon, IDS, tracker detection
• T-Deck vs T-Deck Plus — The only hardware difference is GPS
• Troubleshooting — Upload failures, SD issues, WiFi, BLE, GPS, lock screen

---

📡 WiFi

• Scan & Connect — scanwifi · connectwifi
• WiFi Monitor — wifimon
• Wardrive — wardrive — WiFi + GPS → WiGLE CSV (Plus only)
• WiFi Credentials — wifipass · wp export · wp clear
• MAC Changer — macchanger
• WiFi Attacks
  • Deauth — deauth
  • Evil Twin — eviltwin
  • Hidden SSID — hiddenssid
  • WPA Sniff — wpasniff
  • PMKID Attack — pmkid
  • WGuard IDS — wguard
  • Beacon Flood — beaconflood
  • WPS — wps — recon + PIN gen + handshake capture
  • WPA3 Downgrade — wpa3down — [EXP] transition-mode downgrade to WPA2
  • Pwnagotchi Pet — pwn / pw — autonomous AI-adaptive roam (13ch; basic=1/6/11) + capture handshakes/PMKIDs (clientless solicit) + on-device crack (active/stealth/passive)

---

🌐 Network

• Net Discover — netdiscover
• Net Spy — netspy / ns — [EXP] passive client-isolation device recon (AirSnitch)
• Iso Scan — isoscan / is — [EXP] active isolation audit: GTK inject + capture (AirSnitch)
• Port Scan — portscan · ps top · banner grabber · OS fingerprint
• Ping — ping
• SSH Client — ssh — interactive colour terminal + scrollback
• ARP Spoof — arpspoof — L2 ARP cache poisoning + redirected-traffic log
• Responder — responder — [EXP] LLMNR/NBT-NS/mDNS poisoner + NetNTLM capture
• Default-Password Check — dpwo / dw — default creds on FTP/SSH/Telnet/HTTP/RTSP/Redis/MQTT/SNMP (custom ports too)
• Chromecast Control — cast / ca — discover Cast devices, rickroll, play URLs/saved content, share local SD photos/videos

---

🔵 Bluetooth

• Scan BLE — scanblue
• BLE Info — bleinfo
• Tracking Detection — trackme
• Fast Pair — fastpair
• BLE Spam — blespam
• Buddy — buddy
• BT Keyboard — btkbd
• BLE Monitor — bmon — passive advertisement sniffer (iBeacon/Eddystone)
• MAC Watch — macwatch — MAC watchlist + proximity alert

---

🔌 USB

• USB Mass Storage — usbmsc
• USB Keyboard — usbkbd
• BadUSB — usbexec
• Mouse Jiggler — jiggle

---

⚙️ System

• Help & Manual — help · man · show · clear · MATRIX
• Device Info — info
• Power Save — pwrsave · sleep
• Lock Screen — lock
• Undercover Mode — notes · undercover
• NES Emulator — game — play NES ROMs from the SD card
• Timezone — tz
• Audio & Notifications — volume · notif · test spk
• SD Commands — sdinfo · sdls · cd · cat · edit · rm · sdformat
• Diagnostics — gps on/off/test · test spk/mic/lora · i2cscan · csidetect
• SD Card Layout — file layout reference
• Custom Splash Screen — replace the boot image with your own PNG

---

Quick Start

Requirements: VSCode + PlatformIO extension

git clone https://github.com/abdallahnatsheh/AL-ANQA-FIRMWARE
# Open in VSCode → select env:T-Deck or env:T-Deck-Plus → click Upload

Can’t upload? Hold the trackball button, plug in USB, then try again — this forces download mode.

---

Hardware

Component	Details
Devices	LilyGo T-Deck · LilyGo T-Deck Plus
MCU	ESP32-S3 (16 MB flash, 8 MB PSRAM)
Display	320×240 ST7789 TFT
Input	Physical QWERTY keyboard + trackball
Radio	WiFi 2.4 GHz · Bluetooth 5 · LoRa SX1262
GPS	L76K / u-blox M10Q (T-Deck Plus only)