Nyan Box · Volume 1
Nyan Box Volume 1 — Overview, Education-First Positioning, and Decision Tree
What the nyanBOX is, where it sits in the lineup, vs Ruckus Game Over, the two capabilities nothing else covers, depth indices into Vols 2-12
Contents
1. About this volume
This is the overview volume of a twelve-volume engineer-grade deep dive into the nyanBOX by Nyan Devices — a compact, education-first multi-radio wireless toolkit. The hardware is conventional ESP32-pentest-handheld fare with one genuinely unusual twist (three NRF24 radios instead of one); the firmware is where the product’s identity lives — a menu-driven, no-coding-required interface with 40+ tools and a gamified XP-progression wrapper.
This volume’s job:
- Frame the product — what it is, what it’s for, who it’s for (§ 2, § 4)
- Locate it in tjscientist’s lineup — the two capabilities (drone RemoteID, hidden-camera detection) nothing else covers (§ 6)
- Make the buy decision tractable — the sibling comparison vs Ruckus Game Over (§ 7) and the decision tree (§ 8)
- Index the rest of the series — § 11 maps every topic to its volume
Spec provenance: hardware specs in this series are vendor-sourced — gathered from nyandevices.com’s product page and GitHub docs as of 2026-05-14. They’re more authoritative than a pure research stub, but they’re not bench-verified. tjscientist does not yet own the unit. Where the deep dive makes a claim that depends on bench measurement (current draw, antenna isolation, detection range), it’s flagged as estimate.
Visual content note (per deep-dive protocol §5.4): hardware photos are marked with FIGURE SLOT placeholders to be filled once the unit is acquired and Photo Helper is engaged. The ASCII block diagrams, comparison tables, decision trees, and signal-structure diagrams throughout carry the visual load until then.
2. What the nyanBOX is
The nyanBOX is a handheld 2.4 GHz wireless toolkit. Physically: a printed enclosure with a 0.96” OLED, four stub antennas, a USB-C port, and an arrow-key UI. Internally:
- ESP32-WROOM-32U — the brains; Wi-Fi 2.4 GHz + Bluetooth 5.0, U.FL antenna variant
- Three NRF24L01+ GTmini modules — three independent 2.4 GHz transceivers (the unusual part)
- 0.96” 128×64 OLED — the only display; menu-driven UI
- 2500 mAh LiPo — generous for the form factor
- EEPROM — persists settings + XP-progression state
- 4× 2.4 GHz antennas — one per radio (ESP32 + 3× NRF24)
nyanBOX — what's in the box
════════════════════════════
┌─────────────────────────────────────────┐
│ ▟▀▀▀▙ 0.96" OLED 128×64 │
│ ▜▄▄▄▛ menu-driven UI │
│ │
│ [↑] │
│ [↓] [←][→] arrow-key navigation │
│ [OK] + device-lock sequence │
│ │
│ ESP32-WROOM-32U ──┐ │
│ NRF24 #1 ─────────┤ 4× 2.4 GHz │
│ NRF24 #2 ─────────┤ antennas │
│ NRF24 #3 ─────────┘ (U.FL → stub) │
│ │
│ 2500 mAh LiPo USB-C EEPROM │
└─────────────────────────────────────────┘
Nyan Devices · jbohack & zr_crackiin
$220 assembled · education-firstThe product targets a specific niche: someone learning the wireless-security field, who wants a guided, menu-driven, no-coding-required tool rather than a bare firmware they have to RTFM their way through. The gamified XP system is the embodiment of that — each tool has progression context that scaffolds the learning curve.
Figure 1.1 — The assembled nyanBOX. Photo: Nyan Devices (nyandevices.com).
3. Hardware fast-facts panel
┌────────────────────────────────────────────────────────────────┐
│ nyanBOX — Nyan Devices │
├────────────────────────────────────────────────────────────────┤
│ MCU ESP32-WROOM-32U (dual-core 240 MHz Xtensa LX6) │
│ Wi-Fi 2.4 GHz b/g/n · Bluetooth 5.0 (BR/EDR + LE) │
│ U.FL external antenna connector variant │
│ Extra radio 3× NRF24L01+ GTmini — independent 2.4 GHz xcvrs │
│ 2.400-2.525 GHz · 126 channels · GFSK │
│ Display 0.96" OLED · 128×64 · monochrome (SSD1306-class) │
│ Storage EEPROM (settings + XP-progression persistence) │
│ Battery 2500 mAh LiPo · USB-C charge + data │
│ Antennas 4× 2.4 GHz stub (1× ESP32, 3× NRF24) │
│ Input Arrow-key cluster + OK · device-lock sequence │
│ Tools 40+ menu-driven · no coding required │
│ Unique Drone RemoteID detection · hidden-camera detection │
│ Firmware Stock (closed-source likely) · gamified XP system │
│ Alt FW ESP32 Marauder / Ghost ESP (fallback paths) │
│ Vendor Nyan Devices (jbohack & zr_crackiin) │
│ Price $220 USD assembled │
│ Status Aspirational — not yet owned (2026-05-14) │
└────────────────────────────────────────────────────────────────┘
For the schematic-block hardware walk: Vol 2.
For the triple-NRF24 subsystem deep dive: Vol 3.4. The education-first design philosophy
Most ESP32-pentest firmwares — Marauder, Bruce, Ghost ESP — assume the user already knows the field. They present a flat menu of tools and expect you to know what a deauth frame is, why you’d capture a PMKID, what an Evil Portal does. The nyanBOX inverts this.
4.1 The gamified XP system
The XP-progression wrapper is the differentiator:
- Each tool use earns XP
- Tools have progression context — the UI scaffolds why you’d use a tool, not just that it exists
- Some tools may be gated behind XP thresholds (so a learner doesn’t jump straight to disruptive tools without context)
- Progress persists in EEPROM across power cycles
The XP-progression model
════════════════════════
Tool use → XP earned → progression context unlocked
│
▼
┌──────────────────────┐
│ Tier 1: Passive scan │ Wi-Fi scan, BLE scan,
│ (always available) │ RemoteID watch, camera sweep
└──────────┬───────────┘
│ XP threshold
▼
┌──────────────────────┐
│ Tier 2: Active probe │ beacon work, BLE spoof,
│ │ NRF24 sniff
└──────────┬───────────┘
│ XP threshold
▼
┌──────────────────────┐
│ Tier 3: Disruptive │ jam, replay, deauth
│ (context required) │
└──────────────────────┘
(Exact gating model is vendor-defined; verify on the unit.
The point: learners are scaffolded toward disruptive tools,
not dropped in front of them.)4.2 Why this matters — and why it might not, for tjscientist
For a learner — a student, a new hire, someone exploring the field — the scaffolding is genuinely valuable. The XP system turns a flat tool list into a guided curriculum.
For tjscientist specifically (45+ years EE, deep RF background): the XP wrapper is more friction than feature. The underlying tools are real and useful; the gamification is a layer to potentially bypass (Vol 8 § 4 covers whether/how). The honest framing: tjscientist would buy the nyanBOX for the hardware (triple NRF24) and the two unique capabilities (RemoteID, camera detection), not for the educational wrapper — and might end up running alternative firmware (Vol 8 § 5) to skip the XP system entirely.
4.3 Device lock
The arrow-sequence device-lock feature (enter a sequence on the OLED to unlock) is a small but telling design choice — it’s there because the target user might hand the device around, lend it to students, carry it where curious hands reach. It’s not security-grade; it’s a “don’t let a kid trigger the jammer” guard.
5. Capability matrix — what it can and cannot do
5.1 Can do
| Domain | Capability | Notes |
|---|---|---|
| Wi-Fi 2.4 GHz | Network analysis, client detection, beacon work | ESP32 radio; see Vol 4 |
| Bluetooth | BLE scan, BT Classic scan, BLE spoof | ESP32 BT 5.0; see Vol 4 |
| 2.4 GHz general | Spectrum analysis, jam, sniff, replay | NRF24 radios; see Vol 5 |
| Multi-channel | 3 simultaneous NRF24 channels | The triple-radio advantage; see Vol 3 |
| Drone RemoteID | Passive detection of RemoteID-compliant drones | Unique in lineup; see Vol 6 |
| Hidden cameras | Signature-based detection, 20+ camera brands | Unique in lineup; see Vol 7 |
| Standalone | Full operation, no host PC | OLED + arrow-key UI |
| Education | Gamified XP-progression learning scaffold | The product’s identity |
5.2 Cannot do
| Limitation | Reason | Where to look instead |
|---|---|---|
| 5 GHz Wi-Fi | ESP32-WROOM-32U is 2.4 GHz only | AWOK ESP32 C5, Wired Hatters Banshee |
| Sub-GHz (315/433/868/915 MHz) | No sub-GHz radio | Flipper Zero, HackRF One, Ruckus Game Over (CC1101 daughter) |
| LF/HF RFID/NFC | No RFID front-end | Flipper Zero, Proxmark3 |
| Wideband SDR | Not an SDR | HackRF One |
| Wired protocol bring-up | No UART/I²C/SPI/JTAG bench tooling | Bus Pirate 6 |
| High-power TX | NRF24 is low-power (~0 dBm typical, +20 dBm with PA-LNA variants) | HackRF + amp |
| Deep custom development | Closed-source stock firmware (likely) | Run alt firmware (Vol 8 § 5) |
The hard boundary: the nyanBOX is a 2.4 GHz device, full stop. Everything it does happens between 2.400 and 2.525 GHz. That’s not a flaw — it’s a scope. But it means the nyanBOX complements tjscientist’s lineup; it doesn’t replace anything.
6. The two features nothing else in the lineup covers
This is the load-bearing section for the buy decision. The nyanBOX has two capabilities that nothing else tjscientist owns or has scaffolded covers natively:
6.1 Drone RemoteID detection
RemoteID is the FAA/EASA-mandated broadcast that compliant drones emit — a “license plate in the sky” containing the drone’s ID, position, operator position, and more. The nyanBOX passively detects these broadcasts.
Why nothing else covers it: RemoteID broadcasts over Wi-Fi (Beacon / NAN) or Bluetooth (BT4/BT5 Legacy/Long Range). A generic Wi-Fi scanner sees the frames but doesn’t decode them as RemoteID. The nyanBOX has a purpose-built RemoteID decode tool. Full deep dive: Vol 6.
6.2 Hidden camera detection
The nyanBOX has an RF-fingerprint database for 20+ hidden-camera brands — it compares 2.4 GHz emission patterns against known camera signatures.
Why nothing else covers it: detecting a hidden camera by its RF emissions requires (a) knowing what camera RF traffic looks like, and (b) a curated signature database. tjscientist’s other tools can see 2.4 GHz traffic, but none of them classify it as “this is probably a hidden camera”. Full deep dive: Vol 7.
6.3 The honest assessment
Are these two features worth $220? That depends entirely on whether tjscientist has a use for them:
- RemoteID detection: useful for situational awareness (is there a drone watching this site?), privacy audits, counter-surveillance. Niche but real.
- Hidden-camera detection: useful for travel (hotel / Airbnb sweeps), physical-security audits, counter-surveillance. Also niche but real.
Neither is a daily-driver feature. But neither is covered by anything else. If tjscientist values having a tool for each — even an imperfect one — the nyanBOX is the cheapest path. § 8’s decision tree formalizes this.
7. Nyan Box vs Ruckus Game Over — the sibling comparison
The nyanBOX’s closest sibling in tjscientist’s lineup is the Ruckus Game Over — also a multi-radio ESP32 + OLED + battery handheld. tjscientist owns the Game Over; the nyanBOX is aspirational. The comparison is the core of the buy decision.
| Dimension | nyanBOX | Ruckus Game Over |
|---|---|---|
| MCU | ESP32-WROOM-32U | ESP32-S3 |
| Extra radios | 3× NRF24L01+ (fixed) | 1× CC1101 or 1× NRF24 (swappable daughter card) |
| Sub-GHz | No | Yes (with CC1101 daughter) |
| Display | 0.96” OLED 128×64 | OLED + joystick |
| Storage | EEPROM | microSD |
| Battery | 2500 mAh | (smaller; see Game Over deep dive) |
| Firmware philosophy | Education-first, gamified XP | Pentest-depth, swappable hardware |
| RemoteID detection | Yes | No |
| Hidden-camera detection | Yes | No |
| Multi-channel NRF24 | Yes (3 simultaneous) | No (1 radio) |
| Host relationship | Standalone | Flipper Zero module (mounts on game-over-host) |
| Source | Closed (likely) | Closed (likely) |
| Status in lineup | Aspirational | Owned |
| Price | $220 assembled | (see Game Over project) |
7.1 The complementarity argument
These two devices are complementary, not redundant:
- Game Over is the device for someone who already knows what they want — swap in the CC1101 for sub-GHz, swap in the NRF24 for 2.4 GHz, drive it from a Flipper. It’s depth + flexibility.
- nyanBOX is the device to hand to someone learning the field — guided UX, scaffolded progression, the two unique detection features. It’s breadth + education.
If tjscientist buys the nyanBOX, it’s not replacing the Game Over — it’s covering different ground (RemoteID, camera detection, 3× NRF24, education/demo use).
7.2 The overlap that does exist
Both devices do 2.4 GHz NRF24 work. If tjscientist only wanted single-radio NRF24 sniffing, the Game Over (with NRF24 daughter) already covers it. The nyanBOX’s NRF24 advantage is specifically the three-radio parallel capability (Vol 3) — that’s the part the Game Over can’t match.
8. Decision tree — buy Nyan Box, buy Game Over, or skip
Considering an education / multi-radio 2.4 GHz handheld?
│
┌───────────────┴────────────────┐
│ │
Do you need RemoteID Do you need
OR hidden-camera sub-GHz (315/433/
detection? 868/915 MHz)?
│ │
┌────┴────┐ ┌─────┴─────┐
YES NO YES NO
│ │ │ │
▼ ▼ ▼ ▼
┌────────┐ ┌──────────────┐ ┌──────────┐ ┌─────────────┐
│ nyanBOX│ │ Do you need │ │ Game Over│ │ Do you want │
│ is the │ │ 3× parallel │ │ (CC1101 │ │ an education│
│ only │ │ NRF24? │ │ daughter)│ │ / demo unit?│
│ option │ └──────┬───────┘ │ — already│ └──────┬──────┘
│ in the │ │ │ owned │ │
│ lineup │ ┌────┴────┐ └──────────┘ ┌─────┴─────┐
└────────┘ YES NO YES NO
│ │ │ │
▼ ▼ ▼ ▼
┌────────┐ ┌────────────┐ ┌────────┐ ┌──────────┐
│ nyanBOX│ │ Game Over │ │ nyanBOX│ │ Skip — │
│ (3-NRF │ │ + NRF24 │ │ (the │ │ Game Over│
│ is its │ │ daughter │ │ XP UX │ │ + lineup │
│ niche) │ │ (already │ │ is its │ │ already │
└────────┘ │ owned) │ │ point) │ │ covers │
└────────────┘ └────────┘ │ 2.4 GHz) │
└──────────┘
Bottom line for tjscientist (2026-05-14):
The nyanBOX earns its place ONLY for (a) RemoteID detection,
(b) hidden-camera detection, (c) 3× parallel NRF24, or
(d) as an education/demo loaner. If none of those four apply,
the owned Game Over + the rest of the lineup already cover
2.4 GHz. If one or more applies, the nyanBOX is the cheapest
path to that capability.9. Comparison to the rest of the lineup
| Tool | Overlap with nyanBOX | nyanBOX wins when | Other tool wins when |
|---|---|---|---|
| Ruckus Game Over | Direct (2.4 GHz multi-radio) | RemoteID / camera / 3× NRF24 / education | Sub-GHz; swappable hardware; Flipper integration |
| Flipper Zero | Minimal (2.4 GHz only via devboard) | Standalone 2.4 GHz depth + the 2 unique features | RFID/NFC/sub-GHz/IR integrated multi-tool |
| AWOK Dual Touch V3 | 2.4 GHz Wi-Fi/BLE | RemoteID, camera, education UX | Dedicated Marauder wardriving + GPS |
| ESP32 Marauder Firmware | 2.4 GHz Wi-Fi/BLE attacks | Education UX + RemoteID + camera | Mature pentest-depth firmware |
| AWOK ESP32 C5 | 2.4 GHz (C5 adds 5 GHz) | 3× NRF24 + the 2 unique features | 5 GHz Wi-Fi coverage |
| HackRF One | 2.4 GHz is a sliver of HackRF’s range | Cheap, standalone, the 2 unique features | Wideband SDR everything |
| Wired Hatters Banshee | Multi-modal 2.4 GHz | Education UX, 3× NRF24, the 2 features | 5 GHz, dual-MCU, GhostESP depth |
nyanBOX’s niche in one sentence: the cheap standalone education-friendly 2.4 GHz handheld that happens to be the only thing in the lineup that natively does drone RemoteID and hidden-camera detection.
10. Status — tjscientist’s posture
As of 2026-05-14, the nyanBOX is Aspirational — not yet purchased.
- Confirmed: the product exists, ships assembled at $220 from nyandevices.com, made by Nyan Devices (jbohack & zr_crackiin)
- Vendor-sourced: hardware specs (ESP32-WROOM-32U, 3× NRF24L01+, OLED, 2500 mAh, EEPROM, 4 antennas) — from the vendor product page + GitHub docs
- Not bench-verified: current draw, battery runtime, antenna isolation, RemoteID detection range, camera-detection accuracy, the exact XP-gating model
- Open question: firmware source availability (likely closed; verify before assuming a fork is possible — Vol 8 § 2)
Decision gates before acquisition:
- Does tjscientist have a concrete use for RemoteID detection or hidden-camera detection? If yes → the nyanBOX is the cheapest path.
- Is the 3× NRF24 parallel capability interesting for a specific project? If yes → the nyanBOX is the only option.
- Is an education/demo loaner useful — a device to hand to someone learning the field? If yes → the XP UX is a genuine feature.
- If none of the above → the owned Ruckus Game Over + the rest of the lineup already cover 2.4 GHz; defer.
For now: research-only. This deep dive sets up the decision criteria and documents the device so the buy-or-skip call is informed.
11. Depth indices into Vols 2-12
Hardware
- ESP32-WROOM-32U + power + OLED + enclosure → Vol 2
- The triple-NRF24 subsystem (SPI bus sharing, parallel-channel theory, triangulation) → Vol 3
- Antenna layout + isolation → Vol 2 § 6, Vol 3 § 5
Tool catalog
- Wi-Fi tools → Vol 4 § 2
- BLE / BT Classic tools → Vol 4 § 3
- NRF24 / 2.4 GHz tools (spectrum, jam, sniff, replay) → Vol 5
- Drone RemoteID detection → Vol 6
- Hidden-camera detection → Vol 7
Firmware
- Stock vendor firmware + the XP system → Vol 8 § 2-4
- Alternative firmware (Marauder, Ghost ESP) → Vol 8 § 5
- Custom firmware development → Vol 9
Use + posture
- End-to-end recipes → Vol 10
- Regional rules, RF safety, legal/ethics → Vol 11
- Laminate-ready cheatsheet → Vol 12
12. Resources
Vendor
- Nyan Devices: https://nyandevices.com
- Vendor GitHub (docs, possibly firmware): linked from the vendor site
- Vendor Discord: linked from the vendor site
- Creators: jbohack & zr_crackiin
Datasheets
- ESP32-WROOM-32U: https://www.espressif.com/sites/default/files/documentation/esp32-wroom-32u_datasheet_en.pdf
- NRF24L01+: https://www.nordicsemi.com/Products/NRF24L01P
- SSD1306 OLED controller: Solomon Systech product page
Alternative firmware
- ESP32 Marauder: https://github.com/justcallmekoko/ESP32Marauder
- Ghost ESP: https://github.com/Spooks4576/Ghost_ESP (verify current repo)
RemoteID references (Vol 6 expands)
- FAA RemoteID rule: https://www.faa.gov/uas/getting_started/remote_id
- ASTM F3411 (the RemoteID broadcast standard): ASTM International
Sibling project
- Ruckus Game Over deep dive:
- Ruckus Game Over CLAUDE.md:
../../../Ruckus Game Over/CLAUDE.md
Cross-tool references
- Hack Tools comparison:
../../../_shared/comparison.md - Capability matrix:
../../../_shared/capability_matrix.html - Legal / ethics:
../../../_shared/legal_ethics.md
This is Volume 1 of a twelve-volume series. Next: Vol 2 walks the hardware — ESP32-WROOM-32U, the OLED, the power subsystem, the enclosure, and the four-antenna layout — at schematic-block depth, with FIGURE SLOTS for board photos.