Esp32-skimmer detector pro

Hermes Skimmer Detector PRO

A pocket-sized, dual-radio detector for wireless ATM & card-skimmer modules.

Hermes PRO is the next-generation successor to Hermes v0.1a. Where the original used a single ESP32 to scan Bluetooth Classic only, PRO pairs two radios — an ESP32-C5 (Bluetooth LE 5 + dual-band Wi-Fi 6) and an ESP32-WROOM-32E (Bluetooth Classic / BR-EDR) — so it can flag the widest possible range of skimmer hardware, old and new, from a single handheld device.

Status: Hardware design (KiCad schematic complete and electrically verified; PCB layout in progress). See hardware.md for the full BOM and design detail. License: MIT

Why two radios?

Card-skimmer modules communicate over whatever cheap wireless chip the builder used — and those span two incompatible Bluetooth worlds:

• Bluetooth Classic (BR/EDR) — used by the classic HC-05/HC-06-style serial modules. Critically, Classic exists only on the original ESP32 silicon. Every newer Espressif chip (C-, S-, H-series) is BLE-only and cannot see these devices.
• Bluetooth Low Energy (BLE) and Wi-Fi — used by newer AT-09 / HM-10 / JDY-style modules and modern skimmer designs.

A single-chip scanner is therefore always half-blind. Hermes PRO solves this by running both radios at once:

The WROOM runs a headless Bluetooth-Classic inquiry loop and streams results to the C5 over a 3.3 V UART. The C5 merges its own BLE/Wi-Fi findings with the Classic list, de-duplicates by MAC, and drives the display, LEDs, and buzzer. The result is full-spectrum coverage that neither chip could provide alone.

How it works

1. Both radios scan continuously for nearby devices.
2. Discovered devices are checked against a known-skimmer signature list (module names such as HC-05, HC-06, AT-09, HM-10/11, JDY-08/09/10/31, and ~20+ more).
3. The OLED shows a live safe vs. suspicious count; matches trigger a prominent on-screen alert plus LED and buzzer warnings.
4. The C5's Wi-Fi 6 radio is reserved for a future companion-app gateway for logging and richer analysis.

Hardware overview

Full details, pinouts, and BOM are in hardware.md. Highlights:

Indicators: four status LEDs (blue = power/scan, yellow = suspicious, red = skimmer, green = clear), two charge LEDs, and an active buzzer.

One USB-C port, two targets: a USB 2.0 mux with a slide switch (SW7) steers the single data pair to either the C5's native USB or the FT231XS→WROOM path, so both processors flash and the battery charges over one connector.

Repository contents

esp32-skimmer-detector-pro/
├── esp32-skimmer-detector-pro.kicad_pro   # KiCad project
├── esp32-skimmer-detector-pro.kicad_sch   # Schematic
├── esp32-skimmer-detector-pro.kicad_pcb   # PCB layout (in progress)
├── esp32-skimmer-detector-pro.net         # Exported netlist
├── esp32-skimmer-detector-pro.stl         # Enclosure model
├── hardware.md                            # BOM + full hardware reference
├── HANDOFF.md                             # Design handoff notes
└── Datasheets/                            # Component datasheets

Firmware (in development)

The firmware is split across the two MCUs:

• ESP32-WROOM-32E (slave): runs the Bluetooth-Classic discoverAsync loop; emits one JSON line per scan on Serial2, tagging devices radioSource:"BT_CLASSIC".
• ESP32-C5 (master): Wire.begin(4,5) for the OLED; Serial1 (RX 24 / TX 23) for the inter-processor link; performs BLE/Wi-Fi scans, merges both device lists, and drives the UI.

See the GPIO/firmware map in hardware.md.

Flashing

Both MCUs share the single USB-C port via the mux:

1. Set SW7 to select the target (C5 or WROOM).
2. Flash over USB — the C5 uses its native USB-Serial-JTAG; the WROOM uses the FT231XS bridge with automatic boot/reset.
3. A battery must be installed (logic is powered from the regulator, not USB).

Roadmap

• Dual-radio hardware architecture (BLE/Wi-Fi + Bluetooth Classic)
• PCB layout, fabrication, and bring-up
• Merged BLE + Classic firmware with de-duplication
• Expanded / updatable skimmer signature database
• RSSI-based proximity ("getting warmer") guidance
• Wi-Fi companion app for logging and analysis

Responsible use

Hermes is a defensive tool intended to help people check payment terminals and ATMs for tampering, and to support security research and education. It only passively observes wireless device advertisements — it does not connect to, interfere with, or interact with any device.

A positive result indicates a nearby module matching a known skimmer signature; it is not proof of a crime (the same modules appear in countless legitimate gadgets). If you suspect a real skimmer, do not touch or remove it — report it to the establishment and local authorities. Use this device only where you are legally permitted to operate radio scanning equipment.

License

Released under the MIT License, consistent with the original Hermes project.

Hermes PRO — because a skimmer you can't see is one you can't avoid.