[Wake]

Flash Hale Hound on CYD ESP32

(Step-by-Step Guide)

🔐 loading encrypted image…

Written by Wake

🔐 loading encrypted image…

Disclaimer

This thread is intended as a quick-start guide to help users get Hale Hound running on their CYD ESP32 devices. It is a shorter, less detailed tutorial, designed to get you up and running so you can explore the firmware and test its features on your own.

For more in-depth guidance, including capturing and cracking WPA/WPA2 handshakes, refer to my original tutorial here which covers the full workflow in detail.

This thread is for informational and educational purpose only. I will not be responsible for any action performed by any reader.

Introduction

In this tutorial, I will walk you through step-by-step how to flash Hale Hound firmware onto a CYD ESP32, including all required tools and setup.

What will I need for this?

[+] MicroSD Card

[+] CYD ESP32 (Cheap Yellow Display)

[+] USB C Cable (data cable, not just charging)

[+] Hale Hound Firmware (compatible with CYD ESP32)

🔐 loading encrypted image…

What is a CYD ESP32?

A CYD ESP32 also known as Cheap Yellow Display Is a low-cost ESP32 development board. It features built-in Wi-Fi and Bluetooth connectivity, along with a TFT touch screen, making it ideal for portable projects and custom interfaces.


What is Hale Hound?

Hale Hound Is an open source firmware designed for the CYD ESP32 It was developed by Jesse Hale and Is designed to turn an inexpensive Cheap yellow display into a powerful handheld penetration testing and auditing tool.

Devices running Hale Hound (and similar firmware) are often nicknamed “budget Flipper Zero” alternatives due to their portability and wide range of features.

🔐 loading encrypted image…

How do I do this?

[+] First, we need a formatted MicroSD card. I recommend formatting it to FAT32, as it works best with the CYD ESP32.

[+] Next, head over to the Hale Hound GitHub releases page. This Is where we will download the needed files to flash Hale Hound onto our CYD ESP32

[+] For this tutorial, we will use version v3.5.5, which is the latest release at the time of writing. Always check the GitHub page for newer updates.

[+] Download only the following files (the others are not needed):

1. boot_app0.bin
   
   
   


2. bootloader.bin
   
   
   


3. HaleHound-CYD.bin
   
   
   


4. partitions.bin
   

[+] With these files downloaded we are going to head over to Spacehuhn's ESPWebTool that we can find here. This is a web app to flash our CYD ESP32 directly from your browser, It's very simple to use.

[+] Insert your formatted MicroSD card into your CYD ESP32 and plug your USB C cable into your machine (Remember this USB cable needs to be able to carry data as well as power)

[+] On the ESP Web Tool Press connect while holding the boot button on the back of your CYD ESP32 plug the device in, you will notice USB Serial popup click on it and click connect.
Spoiler (Click to View)

🔐 loading encrypted image…

[+] Now on this screen we need to upload the files we downloaded before but we need to enter some memory addresses written in hex also the easiest way Is to copy me.
Spoiler (Click to View)

🔐 loading encrypted image…

• 1000 bootloader.bin
  
  


• 8000 partitions.bin
  
  


• E000 boot_app0.bin
  
  


• 10000 HaleHound-CYD.bin
  

[+] Click Program to begin flashing.
This may take a few minutes — be patient and let it complete.

Once finished, you will see a message saying:
“To run the new firmware, please reset your device.”

Simply unplug and reconnect your CYD ESP32. You may be prompted to complete a touch calibration on first boot.
If not, you can manually calibrate it by going to:
Tools → Touch Calibration

🔐 loading encrypted image…

Finished Result

If everything was done correctly, your CYD ESP32 should now boot into the Hale Hound interface.
You should see the main menu appear on the screen, and the device will be ready to use.

You now have a fully functional Hale Hound device ready for testing and exploration.

The MicroSD card is used to store captured data, logs, and other files generated by Hale Hound, so make sure it remains inserted while using the device.

Hale Hound is actively updated. Be sure to check the GitHub page regularly for new versions, bug fixes, and added features.

If you run into any issues, feel free to reply and I’ll help out.

Thank you for taking the time to read this thread. If you enjoyed this please check out the rest of my tutorials and write-ups

[Stanley]

I'm Stanley HF's helper bot. The OP (original poster) of this thread wants everyone to see this page and has elected to bump it to the top of the showthread listing. Since HF doesn't want a ton of LQP (Low Quality Posts) this is the best method of bumping your content. There is a small βyte fee for each bump. Any OP can bump any of their threads on HF from the linked icon on the top of their first post.

If you haven't already read the first post of this thread we encourage you to do so.

Thanks,
Stanley

[CL1B]

Hmm, is this going to be a series now? ESP32 basics to advanced?

Even more tempted to get one, HerrWinston are you getting one?

I just want to know, "budget Flipper Zero" but could it for example do something like file transfer via bluetooth? Without user interaction/auth?

Curious, thanks for the good read again. You said it's because it is fairly simple, but 10/10 readability man.

[Wake]

Thank you for reading! As far as I am aware, there isn’t a feature that allows direct file transfer over BLE without user interaction. The closest method to this I can think of is the BLE Ducky feature included in some recent releases.

If a user pairs their device with yours—or if pairing is performed with physical access—the device becomes trusted. Once trusted, it may be possible for it to reconnect later and accept input sequences, such as opening applications or navigating to download and open files.

I also have one or two more ESP-related guides in the works, and I’m hoping the next one will really up the ante in demonstrating what these devices are capable of.

[CL1B]

Thank you for reading! As far as I am aware, there isn’t a feature that allows direct file transfer over BLE without user interaction. The closest method to this I can think of is the BLE Ducky feature included in some recent releases.

If a user pairs their device with yours—or if pairing is performed with physical access—the device becomes trusted. Once trusted, it may be possible for it to reconnect later and accept input sequences, such as opening applications or navigating to download and open files.

I also have one or two more ESP-related guides in the works, and I’m hoping the next one will really up the ante in demonstrating what these devices are capable of.

OkOk, Thanks. Keep it up man!

[Wake]

OkOk, Thanks. Keep it up man!

Thank you very much! Much appreciated.

[HerrWinston]

Hmm, is this going to be a series now? ESP32 basics to advanced?

Even more tempted to get one, HerrWinston are you getting one?

I just want to know, "budget Flipper Zero" but could it for example do something like file transfer via bluetooth? Without user interaction/auth?

Curious, thanks for the good read again. You said it's because it is fairly simple, but 10/10 readability man.

My friend I currently have 5 ESP32`s laying around :) If your into micro controllers or just want something you can actually put your hands on, try one!


Very good read, loved this! :)

[Wake]

My friend I currently have 5 ESP32`s laying around :) If your into micro controllers or just want something you can actually put your hands on, try one!


Very good read, loved this! :)

Building an army of ESP32's, some different ESP stuff coming from me soon thank you very much for reading!

[Pr0m3th3us]

Could this be used to execute commands to a Bluetooth Washing machine? I know it’s uses PayRange Inc as the software for the paywall. It’s app controlled also called “One Tap Away”

What size SD? 2gb fine?

[Wake]

Could this be used to execute commands to a Bluetooth Washing machine? I know it’s uses PayRange Inc as the software for the paywall. It’s app controlled also called “One Tap Away”

What size SD? 2gb fine?

Damn that whole system looks like it sucks to do your washing. I think you could do something to get around the paywall but from research looks like you need physical access to the machine. 2gb SD card was fine for me also not ran into any issues.