π¦ Nosferato β
Companion rig to NearTrace. Not safe for app stores. The frontrat awakens.
NearTrace lives inside Google's Play Store rules β phone-only, defensive-framed, observation-grade. Some things you can't do from inside that box. Nosferato is the body the protocol slips into when it leaves.
A Raspberry Pi Zero 2 W runs NosferatOS β our custom OS built from a vanilla Debian Bookworm debootstrap, with kernel + firmware curated by the Raspberry Pi Foundation's apt repo, plus our own glue. It handles the wireless layer NearTrace can't reach: monitor mode, packet injection, real EAPOL handshake capture, deauth probes, BLE active enumeration. The phone stays the UI. The Pi grows the fangs.
Nosferato is the brand. NosferatOS is the OS it ships. Same root, same vampire heritage β different identities.
What it is β
- A 25g pocket-sized SBC running Debian Bookworm + Pi-Foundation kernel
- Hand-rolled from debootstrap up β every package known, every config audited, every blob accounted for
- BCM43436 onboard wifi (patched with nexmon for monitor + injection β backlog)
- Onboard BLE via standard bluez
- Wifi STA (joins upstream) + Wifi AP (
nosferato-mgmt, mgmt path) + USB OTG composite gadget β all simultaneously - Boots to SSH-ready state in 9 seconds
What it isn't β
- A toy. The brcm chip is a real radio doing real injection.
- A hidden weapon. Nothing about Nosferato is covert β it broadcasts a management AP labelled
nosferato-mgmt. - A Play-store-acceptable feature. Hence the separate lane.
The lore β NOS Β· FERA Β· RATO β
The codename is a deliberate triple portmanteau:
- NOS β Nitrous Oxide Systems. The underground car-racing scene, illegal speed mods, the hacker-tinkerer mindset. Fast & Furious vibes.
- FERA β Latin/Portuguese/Spanish for "beast." Predator. Untamed.
- RATO β Portuguese/Spanish for "rat/mouse." Intelligence, urban survival, picking locks, the hacker-mascot lineage.
Combined: NOS-FERA-RATO, the beast-rat with speed mods.
Lineage also picks up:
- Nosferatu β the silent-film vampire. The rig wakes up at night and listens to what the radios won't admit during the day.
- Dio Brando's vampiric arc in JoJo's Bizarre Adventure β and the legendary stand "The World" that follows him. The umbrella for this whole multi-platform program is The World; Nosferato is the predator that lives inside it.
The Saga β
Building the first working image took 14 hours of debugging. We caught and documented every single bug.
β S01 β The Saga β three-episode chronicle
The whole thing is yours to skim, study, or skip. It's the kind of story you wish you'd had to read before spending a week on a custom Pi distro.
Quick links β
- The Recipe That Works β copy-paste this, save 14 hours
- Build & flash the SD β Mac-side bootstrap (Multipass-based)
- First boot & login β what the Pi does when you power it on
- Reach the rig β wireless mgmt AP / USB tether / IoT wifi
- The tool stack β what the preinstalled pen-test tools do
- Pair with NearTrace β phoneβPi mDNS handshake
- Release channels β daily / weekly / stable
- Gotchas β the trap list
- Bestiary β every bug we fought, classified
- Credits β external sources we consulted
- Diagnose tool β the SD inspector
Codenames β
| Codename | What it is |
|---|---|
| Nosferato | The brand / lane (NSFAS, Pi-side of NearTrace) |
| NosferatOS | The custom OS image we build (apple-style naming) |
| frontrat | The vampire-rat mascot |
| The World | The umbrella codename for the whole multi-phase NearTrace plan |
Status β
| Component | Status |
|---|---|
| Boot to userspace | β Working (S01E14, 2026-05-12) |
| Wifi STA β upstream IoT | β Working |
| SSH login | β Working |
Mgmt AP (nosferato-mgmt) | π§ Recipe verified, bake-in pending (S01E15 #389) |
| Source-level build-rootfs refactor | π§Ή #390 |
| Bluetooth firmware | π #391 |
| Nexmon monitor mode | π Backlog (#376) |
| USB OTG tether | π Backlog (#378) |
| Channel-pipeline release builds | π Backlog (#385) |
Mascot pending
Brand kit + frontrat illustration land in S01E06 #380.
Where to start β
If you're new here β read the saga for the story or the recipe for the answer.
If you're building one β go straight to recipe/from-scratch (or the legacy build guide).
If you're debugging your own β diagnose-sd and bestiary.