_                                                   _
         .k$$$$$g,                                           ,g$$$$$k.
      .k$$$$$$$$$$$a.                                     .a$$$$$$$$$$$k.
    .J$$$$$?'   `?$?^?,                                 ,?^?$?`   `?$$$$$L.
   JS$$SI!a,  _.JS$   ?,                               ,?   $SL._  ,a$!IS$$SL
  k$$$SI!:?$$$$$$$$$xu$$j                              j$$ux$$$$$$$$$?:!IS$$$k
 :I$$SI:J$$?*"$$$$4^?*?:                               :?*?^4$$$$"*?$$L:iIS$$I:
 :IS$$SiJ?`  _.'$?`/'   ':                           :'    '/'?$'._  `?LiS$$SI:
  ?ISSik? _        ',    `                              .    ,'       _ ?kiSSI?
    ?i$?` _   k$        .                               :.        $k   _ `?$i?
      '?I:-?z$$I   _._.'                                  ._._   I$$z?-:I?'
     '*?- '?$$a louSxuS?                               ?xuSxuol a$$?' -?*'
           i$$$$$$$$$$$S                               S$$$$$$$$$$$i
              ?$$$?-                                       -?$$$?

     ██░ ██  ▄▄▄       ██▓    ▓█████  ██░ ██  ▒█████   █    ██  ███▄    █ ▓█████▄
    ▓██░ ██▒▒████▄    ▓██▒    ▓█   ▀ ▓██░ ██▒▒██▒  ██▒ ██  ▓██▒ ██ ▀█   █ ▒██▀ ██▌
    ▒██▀▀██░▒██  ▀█▄  ▒██░    ▒███   ▒██▀▀██░▒██░  ██▒▓██  ▒██░▓██  ▀█ ██▒░██   █▌
    ░▓█ ░██ ░██▄▄▄▄██ ▒██░    ▒▓█  ▄ ░▓█ ░██ ▒██   ██░▓▓█  ░██░▓██▒  ▐▌██▒░▓█▄   ▌
    ░▓█▒░██▓ ▓█   ▓██▒░██████▒░▒████▒░▓█▒░██▓░ ████▓▒░▒▒█████▓ ▒██░   ▓██░░▒████▓
     ▒ ░░▒░▒ ▒▒   ▓▒█░░ ▒░▓  ░░░ ▒░ ░ ▒ ░░▒░▒░ ▒░▒░▒░ ░▒▓▒ ▒ ▒ ░ ▒░   ▒ ▒  ▒▒▓  ▒
     ▒ ░▒░ ░  ▒   ▒▒ ░░ ░ ▒  ░ ░ ░  ░ ▒ ░▒░ ░  ░ ▒ ▒░ ░░▒░ ░ ░ ░ ░░   ░ ▒░ ░ ▒  ▒
     ░  ░░ ░  ░   ▒     ░ ░      ░    ░  ░░ ░░ ░ ░ ▒   ░░░ ░ ░    ░   ░ ░  ░ ░  ░
     ░  ░  ░      ░  ░    ░  ░   ░  ░ ░  ░  ░    ░ ░     ░              ░    ░

HaleHound™-CYD

Multi-protocol offensive security toolkit for the ESP32 Cheap Yellow Display

Version v4.0 | By JesseCHale | HaleHound.com

No install needed. Chrome or Edge on desktop. Plug in your board, pick it, flash. Done.

---

What Is This

40+ attack modules across WiFi, Bluetooth, SubGHz, 2.4GHz, and NFC — all running on a $7 touchscreen dev board. External CC1101, NRF24L01+PA+LNA, PN532, and GPS modules plug into the CYD's breakout pins. Everything is touch-driven. All radios transmit at maximum power. No training wheels.

---

Supported Boards

All UI scales automatically between 240x320 and 320x480. Pick your board, flash, done.

---

Hardware

Required

Also Required: Independent 3.3V Power for Ebyte Modules

The Ebyte PA modules (E07-433M20S and E01-2G4M27SX) draw too much current for the CYD's onboard 3.3V regulator. You must power them from a separate 5V→3.3V buck converter. Tap 5V from USB and step it down to 3.3V independently — do not share the CYD's 3.3V rail or you'll get brownouts, random resets, and failed radio init.

The signal wires (SPI, CS, CE, GDO0, GDO2, TX_EN, RX_EN) still connect directly to ESP32 GPIOs — only VCC gets the independent supply.

Optional

---

Menu Tree

HALEHOUND-CYD v4.0
│
├── WiFi
│   ├── Packet Monitor         Real-time 802.11 frame capture + graph
│   ├── Beacon Spammer         Flood fake SSIDs
│   ├── WiFi Deauther          Scan → tap → disconnect all clients
│   ├── Probe Sniffer          Capture probes → auto-spawn Evil Twin
│   ├── WiFi Scanner           Scan APs → tap to Deauth or Clone
│   ├── Captive Portal         GARMR Evil Twin credential harvester
│   ├── Station Scanner        Find connected clients + deauth handoff
│   └── Auth Flood             Flood AP with auth frames from random MACs
│
├── Bluetooth
│   ├── BLE Cinder             NRF24 carrier on BLE ad channels 37/38/39
│   ├── BLE Spoofer            Multi-platform BLE pairing spam
│   ├── BLE Beacon             Custom iBeacon / Eddystone broadcast
│   ├── BLE Predator           GATT recon → clone device → honeypot trap
│   ├── WhisperPair            CVE-2025-36911 — Fast Pair exploit
│   ├── Airoha RACE            CVE-2025-20700 — link key extraction
│   ├── Lunatic Fringe ──┐
│   │   ├── Tracker Scan  │    Multi-platform BLE tracker scanner
│   │   ├── AirTag Detect │    Apple FindMy tracker detection
│   │   ├── Phantom Flood │    Fake FindMy advertisement flood
│   │   ├── AirTag Replay │    Sniff + replay real AirTag identity
│   │   └── AirTag Scream │    Force nearby AirTags to play a sound
│   ├── SkeletonKey            BLE GATT enumerate + fuzz — smart-lock opener
│   └── KARR                   Detect + assess KARR/QT car alarms
│
├── 2.4GHz (NRF24)
│   ├── Scanner                Channel activity across 2400-2525 MHz
│   ├── Spectrum Analyzer      Visual RF spectrum + AP-locked zoom
│   ├── NRF Sniffer            Promiscuous packet capture (Goodspeed)
│   ├── MouseJack              Wireless keyboard keystroke injection
│   ├── WLAN Ember             Broadband 2.4GHz carrier
│   ├── NRF Tuning             Live carrier tuning: power/rate/dwell/bands
│   └── Proto Kill             Multi-protocol 2.4GHz attack suite
│
├── SubGHz (CC1101)
│   ├── Replay Attack          Target hunts, capture + replay (300-439 MHz)
│   ├── Brute Force            Automated code gen (Princeton/CAME/Nice/PT2262)
│   ├── SubGHz Scorch          Wideband SubGHz carrier
│   ├── Spectrum Analyzer      33-bar spectrum, peak-hold, band focus, noise-floor cal
│   ├── Saved Profile          Load saved signals from SD
│   ├── Tesla Charge           Open any Tesla charge port (US/EU/BOTH)
│   └── .Sub Read              Flipper .sub file browser + transmitter
│
├── RFID (PN-532 / Chameleon Ultra / ST25R3916 [stub])
│   ├── Card Scanner           Detect + identify NFC/RFID cards
│   ├── Card Reader            MIFARE sector data dump
│   ├── Card Clone             Clone UID to writable card
│   ├── Key Brute Force        MIFARE key A/B brute force
│   ├── Card Emulate           Replay captured card UID
│   └── NTAG Tools             NTAG213/215/216 read, dump, NDEF, write, lock, password
│
├── Jam Detect
│   ├── WiFi Guardian          Detect deauth floods
│   ├── SubGHz Sentinel        Detect SubGHz carrier jamming
│   ├── 2.4GHz Watchdog        Detect broadband 2.4GHz jamming
│   └── Full Spectrum          All bands simultaneously
│
├── SIGINT
│   ├── EAPOL Capture          WPA handshake + PMKID capture
│   ├── Karma Attack           Auto-respond to all probes → portal
│   ├── Wardriving             GPS-tagged AP scanning to SD
│   ├── IoT Recon              Automated LAN scanner + credential brute
│   ├── Loot                   Unified loot browser (5 categories)
│   └── Flock You              Flock Safety ALPR camera detector
│
├── Tools
│   ├── Serial Monitor         UART passthrough terminal
│   ├── Update Firmware        OTA flash from SD card
│   ├── Touch Calibrate        4-corner calibration tool
│   ├── GPS                    Live satellite view + NMEA data
│   └── Radio Test             Hardware verification + wiring diagrams
│
├── Settings
│   ├── Brightness             Backlight PWM (10-255)
│   ├── Screen Timeout         30s / 1m / 2m / 5m / 10m / Never
│   ├── Swap Colors            BGR ↔ RGB panel toggle
│   ├── Invert Display         Inverted color toggle
│   ├── Color Mode             Default / Colorblind / High Contrast
│   ├── Rotation               0° / 180° / 90° CW / 90° CCW
│   ├── Device Info            Heap, CPU, flash, board name
│   ├── Set PIN                4-digit boot lock
│   └── CC1101 Module          Standard HW-863 ↔ E07 PA module
│
├── About
│   └── Firmware info + armed module list
│
├── Drone
│   ├── Drone Detect           Dual-radio passive RID + BLE/WiFi fingerprint
│   ├── RID Spoof              Broadcast ASTM F3411 Remote ID (WiFi + BLE)
│   ├── Drone Jelly            Full-spectrum drone carrier + live equalizer
│   └── Drone Deauth           Targeted deauth of a drone control link
│
└── Skimmer
    └── Hunt                   Bluetooth card-skimmer hunter (BETA)

---

Feature Highlights

WiFi

All WiFi attacks use the ESP32's built-in radio — no external hardware. APSTA mode: STA scans, AP injects raw frames. Max TX at +20.5 dBm.

• Deauther — Scan, tap a target, flood deauth frames. WiFi Scanner has tap-to-deauth built in.
• Probe Sniffer → Evil Twin — Capture what devices are looking for, then become that network. Auto-spawns GARMR captive portal with the probed SSID.
• Auth Flood — Random MAC auth frame flood. Exhausts AP client tables. 85-bar equalizer shows attack rhythm.
• Captive Portal (GARMR) — Fake AP + DNS hijack + credential harvest page. Works standalone or chained from Probe Sniffer / WiFi Scanner.

Bluetooth

All BLE uses the ESP32's built-in Bluetooth. Proper WiFi↔BLE radio teardown handled automatically.

• BLE Predator — Three phases: SCAN (discover + threat classify), RECON (GATT enumerate all services/chars), HONEYPOT (clone as connectable server, capture credentials on WRITE). Loot saved to SD.
• Airoha RACE — CVE-2025-20700/20701/20702. Unauthenticated BLE GATT access to Airoha chipsets (Sony XM4/XM5/XM6, Marshall, JBL, Jabra, etc). Extracts Bluetooth link keys, BD_ADDR, firmware version, flash memory. No pairing required.
• WhisperPair — CVE-2025-36911. Probes Google Fast Pair devices for unauthorized pairing vulnerability.
• Lunatic Fringe — Hub for tracker detection and attacks. Scans for AirTags, Samsung SmartTags, Tile, Chipolo, Google FMDN. Phantom Flood spams fake FindMy trackers. AirTag Replay clones real AirTag identities. AirTag Scream forces nearby AirTags to play a sound.
• SkeletonKey — Connect to a BLE device, enumerate its full GATT table, and fire real commands. Recognizes LED-strip and smart-device profiles for one-tap control, or fuzz any writable characteristic. Chains straight from BLE Predator's recon.
• KARR — Scan for SouthWest Dealer Services BLE car alarms, then assess the unit. It works out which generation it is and whether it is exploitable, and reports a straight verdict without sending any commands.

2.4GHz (NRF24)

External NRF24L01+PA+LNA required. All modes at RF24_PA_MAX (+20 dBm with PA module).

• NRF Sniffer — Travis Goodspeed promiscuous mode. Captures raw packets from wireless keyboards, mice, drones. Tap a captured address → auto-populates MouseJack.
• MouseJack — Keystroke injection into Logitech Unifying, Dell, Microsoft wireless keyboards. HID++ packets, pre-built payloads (reverse shell, WiFi exfil, custom string).
• WLAN Ember / Proto Kill — Broadband 2.4GHz carrier output. Affects WiFi, BLE, Zigbee, wireless peripherals, drones.
• NRF Tuning — Dedicated control panel for the 2.4GHz tools: live drag-sliders and toggles for SPI clock, power (real dBm), data rate, dwell, channel step, and per-band channel selection — each explained in an on-SD guide, with every setting saved to the SD card.

SubGHz (CC1101)

External CC1101 required. All TX at setPA(12) max power. Optional E07-433M20S PA module for 20dBm amplified output.

• Replay Attack — Opens on a target picker with seven curated hunts, each carrying its own tuning and an on-device playbook. Band-locked capture, one-press KeeLoq read, color-coded state banner, and REPLAY/SAVE/CLEAR controls. Sixty-four saved signals on SD, plus raw OOK pulse dumps for offline reversing.
• Brute Force — Automated code generation with de Bruijn sequences. Princeton, CAME, Nice FLO, PT2262.
• Tesla Charge — Opens the charge port on any Tesla. Static 43-byte OOK payload, zero authentication, zero rolling code. Works on every Tesla ever made. US (315 MHz), EU (433.92 MHz), or both.
• .Sub Read — Browse and transmit Flipper Zero .sub files from SD card. Supports RAW, Princeton, CAME, Nice FLO across full CC1101 frequency range. No .sub files required — shows empty state if folder is missing. Drop files in /subghz/ when you have them.

RFID

The RFID menu opens a backend picker — choose one, then run the card suite: scan, read, clone, brute force, emulate MIFARE Classic.

• PN-532 (default) — Elechouse PN532 V3 in SPI mode. The full card suite runs here.
• Chameleon Ultra — Connects over BLE. NTAG read/write and mfkey32 key recovery.
• ST25R3916 — Stub. The menu is wired up, but the RFAL driver is still in development.
• NTAG Tools — NFC Tools-style suite for NTAG213/215/216 (and Ultralight EV1). Model ID, full page dump, NDEF decode (URL + Text), multi-record composer, and the write side: erase, permanent read-only lock, password set/remove, auth-on-write. On-screen keyboard for URL/text/password entry.

Jam Detect

Defensive modules. WiFi Guardian catches deauth floods, SubGHz Sentinel detects carrier jamming, 2.4GHz Watchdog spots broadband disruption, Full Spectrum monitors all bands at once.

SIGINT

• EAPOL Capture — WPA 4-way handshake + PMKID extraction. Deauth to force reauth, capture, save in hashcat format.
• Karma Attack — Auto-respond to every probe request, chain into captive portal for credential harvest.
• IoT Recon — Connect to WiFi, scan the subnet, fingerprint services (HTTP, RTSP, Telnet, MQTT, Modbus, XMEye), brute force default credentials. Dual-core: networking on Core 0, UI on Core 1. Drop custom creds in /creds.txt on SD.
• Flock You — Passive detection of Flock Safety ALPR cameras and Raven/ShotSpotter sensors via BLE fingerprinting. 22 OUI prefixes, 8 Raven GATT service UUIDs, firmware version estimation. GPS-tagged saves to SD.
• Loot — Unified browser for all captured data: wardriving CSVs, EAPOL handshakes, WhisperPair/BLE Predator/Flock You loot, IoT Recon reports, credentials.

Drone

Anti-drone toolkit. Detection runs two radios at once — the NRF24 sniffs for BLE drone presence while the ESP32 sweeps WiFi in promiscuous mode, dual-core so neither side blocks the other.

• Drone Detect — Flags drones by ASTM F3411 Remote ID plus SSID and BLE fingerprint. Two independent radios, passive RX.
• RID Spoof — Broadcasts an ASTM F3411 Remote ID beacon over WiFi (Beacon + NaN) and BLE.
• Drone Jelly — Full-spectrum drone carrier with a live equalizer readout.
• Drone Deauth — Targeted deauth against a drone's control link.

Skimmer Hunter (BETA)

Bluetooth credit-card-skimmer hunter. Multi-signal scoring plus an active confirmation pass to cut false positives. Built and shipping for field testing — treat it as beta until the hardware validation pass is done.

VALHALLA Protocol

Every offensive module is gated behind a liability disclaimer. Accept to unlock offensive tools, decline to enter Blue Team mode — defensive and passive modules only. Blue Team mode persists across reboots. The VALHALLA/BLUE TEAM banner on the home screen shows your current mode.

---

Wiring

All external radios share the VSPI bus (GPIO 18/19/23) with the built-in SD card. Only one device talks at a time — the SPI manager handles bus arbitration automatically. The Radio Test module (Tools > Radio Test) also has 4-page visual wiring diagrams built into the firmware.

Note: CiferTech's original firmware had CC1101 TX/RX pins swapped. HaleHound corrects this — GDO0 is TX (to radio), GDO2 is RX (from radio).

CC1101 SubGHz Radio

┌─────────────────┐              ┌──────────────────┐
│    CC1101       │              │    CYD ESP32     │
│    HW-863       │              │                  │
├─────────────────┤              ├──────────────────┤
│ VCC ────────────┼──────────────┤ 3.3V             │
│ GND ────────────┼──────────────┤ GND              │
│ SCK ────────────┼──────────────┤ GPIO 18 (VSPI)   │
│ MOSI ───────────┼──────────────┤ GPIO 23 (VSPI)   │
│ MISO ───────────┼──────────────┤ GPIO 19 (VSPI)   │
│ CS ─────────────┼──────────────┤ GPIO 27 (CN1 hdr)│
│ GDO0 (TX) ──────┼──────────────┤ GPIO 22 (P3 hdr) │
│ GDO2 (RX) ──────┼──────────────┤ GPIO 35 (P3 hdr) │
└─────────────────┘              └──────────────────┘

E32R35T (3.5"): CC1101 CS moves to GPIO 21 (GPIO 27 is the backlight on the 3.5"). E32R28T (2.8"): CC1101 CS stays on GPIO 27 (GPIO 21 is the backlight on the 2.8"). All other pins identical.

NRF24L01+PA+LNA

┌─────────────────┐              ┌──────────────────┐
│  NRF24L01       │              │    CYD ESP32     │
│  +PA+LNA        │              │                  │
├─────────────────┤              ├──────────────────┤
│ VCC ────────────┼──────────────┤ 3.3V             │
│ GND ────────────┼──────────────┤ GND              │
│ SCK ────────────┼──────────────┤ GPIO 18 (VSPI)   │
│ MOSI ───────────┼──────────────┤ GPIO 23 (VSPI)   │
│ MISO ───────────┼──────────────┤ GPIO 19 (VSPI)   │
│ CSN ────────────┼──────────────┤ GPIO 4(was RGB R)│
│ CE ─────────────┼──────────────┤ GPIO 16(was RGB G)│
│ IRQ (optionl) ──┼──────────────┤ GPIO 17(was RGB B)│
└─────────────────┘              └──────────────────┘

E32R28T / E32R35T: NRF24 CSN moves to GPIO 26 (GPIO 4 used for CC1101 PA TX_EN). CE and IRQ stay the same.

10uF capacitor between VCC/GND at the NRF24 module if you get random resets.

PN532 NFC/RFID

┌─────────────────┐              ┌──────────────────┐
│    PN532 V3     │              │    CYD ESP32     │
│   (Elechouse)   │              │                  │
├─────────────────┤              ├──────────────────┤
│ VCC ────────────┼──────────────┤ 3.3V (CN1 hdr)   │
│ GND ────────────┼──────────────┤ GND  (CN1 hdr)   │
│ SCK ────────────┼──────────────┤ GPIO 18 (VSPI)   │
│ MOSI ───────────┼──────────────┤ GPIO 23 (VSPI)   │
│ MISO ───────────┼──────────────┤ GPIO 19 (VSPI)   │
│ SS ─────────────┼──────────────┤ GPIO 17 (was RGB B)│
└─────────────────┘              └──────────────────┘

DIP Switches: CH1=OFF, CH2=ON for SPI mode.

GPS Module

┌─────────────────┐              ┌──────────────────┐
│    GT-U7        │              │  CYD P1 Connector│
│    GPS          │              │  (JST header)    │
├─────────────────┤              ├──────────────────┤
│ VCC ────────────┼──────────────┤ VIN              │
│ GND ────────────┼──────────────┤ GND              │
│ TX ─────────────┼──────────────┤ TX (GPIO 1)      │
│ RX (not used ───┼──────────────┤ RX (GPIO 3)      │
└─────────────────┘              └──────────────────┘

Wiring: GPS TX → GPIO 1 (the P1 "TX" pin) works on every board. The 3.5" E32R35T and sale units lock GPS only on GPIO 1; the 2.8" also tolerates GPIO 3. GPS RX is unused (receive-only) — leave it open.

USB Conflict: GPIO 1/3 are the ESP32's USB-serial UART0 pins. The firmware detaches UART0 (Serial.end()) while GPS runs so the GPS owns the line, then restores it on exit.

Baud: 9600 (GT-U7 default). Firmware auto-scans GPIO 1/3/26, so it locks regardless of which pin your board uses.

E07-433M20S PA Module (Optional Amplified SubGHz)

┌─────────────────┐              ┌──────────────────┐
│ E07-433M20S     │              │  E32R28T/E32R35T │
│ (CC1101 + PA)   │              │    ESP32         │
├─────────────────┤              ├──────────────────┤
│ VCC ────────────┼── 3.3V BUCK ─┤ (NOT CYD 3.3V!)  │
│ GND ────────────┼──────────────┤ GND (common)     │
│ SCK ────────────┼──────────────┤ GPIO 18 (VSPI)   │
│ MOSI ───────────┼──────────────┤ GPIO 23 (VSPI)   │
│ MISO ───────────┼──────────────┤ GPIO 19 (VSPI)   │
│ CS ─────────────┼──────────────┤ GPIO 27/21       │
│ GDO0 (TX) ──────┼──────────────┤ GPIO 22          │
│ GDO2 (RX)───────┼──────────────┤ GPIO 35          │
│ TX_EN ──────────┼──────────────┤ GPIO 4           │
│ RX_EN ──────────┼──────────────┤ GPIO 0           │
└─────────────────┘              └──────────────────┘

Must be powered from an independent 5V→3.3V buck converter — not the CYD's 3.3V rail. The PA module draws too much current. Same applies to the NRF24 E01-2G4M27SX. Enable PA mode in Settings > CC1101 Module. E32R28T/E32R35T only.

---

SD Card

FAT32 formatted MicroSD. Nothing is required — every module handles missing folders gracefully.

/sd/
├── subghz/         .sub files for Sub Read (organize into subfolders)
├── eapol/          EAPOL/PMKID captures
├── wardriving/     GPS-tagged AP logs
├── wp_loot/        WhisperPair + BLE Predator + Flock You loot
├── loot/           BLE Predator GATT dumps + honeypot loot
├── creds.txt       Custom credentials for IoT Recon (optional)
├── iot_recon.txt   IoT Recon attack reports
└── firmware/       OTA update .bin files

---

Flash — Web Flasher

Flash straight from your browser. Nothing to install.

Open flash.halehound.com in Chrome or Edge on desktop. Safari and phones can't flash.

1. Plug in your CYD with a data USB cable and pick your board
2. Hit Connect & Flash, then power cycle when it's done

One shot, every time — bootloader, partitions, and app, always the latest build.

First Boot

Touch calibration runs automatically on first boot. Tap the 4 corner crosshairs. If display orientation is wrong, fix it in Settings > Rotation — no reflash needed.

CH340 Driver

CYD boards use CH340 USB serial. Install if your computer doesn't see the board:

• Windows: CH341SER.EXE
• macOS: CH341SER_MAC.ZIP
• Linux: Built into kernel 5.x+

---

Build from Source

# Install PlatformIO, plug in CYD, then:

pio run -e esp32-cyd --target upload          # 2.8" CYD
pio run -e esp32-e32r35t --target upload      # E32R35T 3.5"
pio run -e esp32-e32r28t --target upload      # E32R28T
pio run -e esp32-cyd-hat --target upload      # NM-RF-Hat

# Serial monitor
pio device monitor -b 115200

Requires Python 3.10-3.13 (3.14 needs a platform.py patch).

---

TX Power

Every attack radio runs at max.

---

Known Issues

---

Credits

HaleHound-CYD by JesseCHale

Community

This project exists because of the people who use it, break it, and tell me what to build next.

@CircuitZ — IoT Recon idea

@ValleytechSolutions — Jam Detect concept

BKBroiler — NRF Tuning panel idea

@ValleytechSolutions, @TalkingSasquach, @Notorious-Squirrel, @Man-In-The-Mayhem, @hamspiced — The efforts and ideas that created the OPSEC of the HaleHound

---

GitHub: github.com/JesseCHale/HaleHound-CYD

I built this. https://www.youtube.com/watch?v=25et7KJzb1s&t=464s