⚡ Signal Goblin Wiki

"It gobbles your signals and grins about it."

Table of Contents

1. What is Signal Goblin?
2. Hardware Overview
3. PCB Design
4. Pin Reference
5. Module Guide — NFC / RFID
6. Module Guide — Sub-GHz (CC1101)
7. Module Guide — 2.4GHz (nRF24)
8. Module Guide — Infrared
9. Power System
10. Audio System
11. Firmware Setup
12. Building Your Goblin
13. Troubleshooting
14. Bill of Materials
15. Credits & License

What is Signal Goblin?

Signal Goblin is an open-source, ESP32-based multi-radio hacking and signal analysis tool built around a goblin-head shaped PCB. It combines NFC/RFID reading, Sub-GHz sniffing and replay, 2.4GHz channel scanning, and infrared signal capture into a single handheld device with a 3.5" touchscreen, LiPo battery, and a distinctive pixel-art goblin aesthetic baked into the silkscreen.

Think of it as a pocket-sized RF toolkit that looks like it belongs in a dungeon.

Key Features

What Can It Do?

• Read and log NFC/RFID cards — UID, card type, data blocks
• Scan Sub-GHz spectrum — visualize signals in the 433MHz band
• Sniff and replay RF signals — capture remote codes and retransmit
• Scan 2.4GHz channel activity — map Wi-Fi, Bluetooth, and other congestion
• Receive and decode IR signals — identify protocol, address, command
• Replay captured IR codes — universal remote functionality
• Haptic feedback — vibration motor for silent signal alerts
• GPIO expansion — 20-pin header for add-ons (Flipper Zero style)

Hardware Overview

                    LEFT EAR                    RIGHT EAR
                   [2.4GHz SMA]               [433MHz SMA]
                       |                           |
              nRF24 IPEX pigtail          CC1101 IPEX pigtail
                       |                           |
        USB-C ←[LEFT EAR BASE]     [RIGHT EAR BASE]→ Power Switch
        (on TP4056 module)              (SPDT slide, BAT→Boost EN)

                    ╔═══════════════════╗
                    ║  GOBLIN HEAD PCB  ║
                    ║                   ║
              RST ● ║   [PIXEL ART]   ● BOOT
                    ║   GOBLIN FACE     ║
              nRF24 ║   [CC1101]        ║
           [TP4056  ║   [ESP32c5&STM32    ║
            Module] ║                   ║
                    ║   [ILI9488 LCD]   ║
                    ║   [UART][I2C]     ║
                    ║   [GPIO 20-pin]   ║
                    ╚═══════════════════╝

Component List

PCB Design

Board Specifications

Board Shape

The PCB is not a rectangle. It is a fully custom goblin-head silhouette:

• Rounded oval head — organic elliptical outline, no straight edges
• Two ear spikes — long tapered triangles extending left and right
• SMA connectors sit at the ear tips — the antenna connector IS the ear tip
• USB-C lives on the left ear base — ergonomic cable routing
• Power switch lives on the right ear base — natural thumb position
• Slight chin point at the bottom center

The black soldermask makes the board look dark and menacing. The pixel-art goblin warrior silkscreen on the front and lantern goblin on the back complete the aesthetic.

Ordering from JLCPCB

1. Upload signal_goblin_gerbers.zip
2. Set: 2 layers, 1.6mm, Black soldermask, HASL
3. Quantity: 5 (minimum sensible order)
4. At checkout: add SMD stencil — top side only
5. The stencil is not optional if you're soldering the stamp-hole modules

Front Silkscreen

• Pixel-art goblin warrior — 38×50 grid, 1.55mm pixels, rendered from reference artwork
• Grid lines every 5 pixels for a retro aesthetic
• All component labels, pin 1 markers, module outlines
• Dashed RF trace lines from CC1101/nRF24 to ear SMA connectors
• Title bar: SIGNAL GOBLIN v7.1

Back Silkscreen

• Lantern goblin — 30×30 pixel art
• Full GPIO pin reference table
• Decorative inset oval

Pin Reference

ESP32 GPIO Assignments

⚠️ GPIO 6–11 are connected to internal flash. Never use them as GPIO — the board will crash or fail to boot.

SPI Bus Sharing

All SPI devices share MOSI (IO23), MISO (IO19), and SCK (IO18). They are separated by individual chip select pins:

in the works now

J2 — GPIO 20-pin (2×10, 2.54mm)

J3 — UART (1×4, 2.54mm) GND | RX (IO3) | TX (IO1) | 3V3

J4 — I2C (1×4, 2.54mm) GND | SDA (IO21) | SCL (IO22) | 3V3

J5 — Power Rail (1×6, 2.54mm) GND | GND | 3V3 | 3V3 | 5V | 5V

Module Guide — NFC / RFID

Hardware

PN532 — Elechouse V3 red PCB module, connected via I2C.

⚠️ Critical: The PN532 ships in UART mode by default. You MUST switch the two DIP switches to I2C mode BEFORE soldering. With the component side facing you: SW1 = OFF (down), SW2 = ON (up). Once soldered to the PCB you cannot reach the switches.

Supported Card Types

What Signal Goblin Can Do

• Read card UID (unique identifier)
• Identify card type and manufacturer
• Read data from unencrypted blocks
• Log multiple card scans

What It Cannot Do (Yet)

• Crack MIFARE Classic encryption (requires Proxmark-level hardware)
• Emulate cards (PN532 supports emulation but not implemented in v1 firmware)
• Read EMV bank cards (requires different protocol stack)

I2C Address

PN532 default I2C address: 0x24

Module Guide — Sub-GHz (CC1101)

Hardware

CC1101 E07-433M20S by EBYTE. Connected via SPI. External antenna via IPEX pigtail to right ear SMA connector.

Frequency Range

The CC1101 can operate from 300MHz to 928MHz. Signal Goblin defaults to 433.92MHz (common for remote controls, car key fobs, weather stations, garage doors).

Common frequencies to explore:

Modulation Modes

Wiring Summary

Module Guide — 2.4GHz (nRF24)

Hardware

nRF24L01+ E01-ML01SP2 by EBYTE. 20dBm PA+LNA. Connected via SPI. External antenna via IPEX pigtail to left ear SMA connector.

What It Scans

The nRF24 scans all 126 channels in the 2.4GHz band (2400MHz to 2525MHz, 1MHz steps). This lets you visualize:

• Wi-Fi congestion — channels 1, 6, 11 (2.4GHz Wi-Fi)
• Bluetooth activity — frequency-hopping pattern across all channels
• Wireless keyboards and mice — often fixed or pseudo-fixed channels
• Zigbee/Z-Wave devices — home automation protocols
• Baby monitors, drones — various proprietary protocols

Channel vs Frequency

Channel 0  = 2400 MHz
Channel 1  = 2401 MHz
...
Channel 25 = 2425 MHz  ← Wi-Fi Ch 1 center (approx)
Channel 50 = 2450 MHz  ← Wi-Fi Ch 6 center (approx)
Channel 80 = 2480 MHz  ← Wi-Fi Ch 11 center (approx)
Channel 125= 2525 MHz

Wiring Summary

Note: nRF24 is 3.3V only. Never connect to 5V.

Module Guide — Infrared

Hardware

5V IR Transmitter/Receiver combo module. TX connected to GPIO12, RX to GPIO13. Powered from 5V rail.

Supported Protocols (via IRremote v4)

NEC, Samsung, Sony, RC5, RC6, JVC, LG, Panasonic, Denon, Sharp, Dish, Kaseikyo, and raw pulse capture.

TV Remote Presets (built into firmware)

More presets can be added in firmware by extending the IR presets section.

Capturing a New Code

1. Open the IR module screen
2. Point your remote at the IR receiver
3. Press RECEIVE on screen
4. Press the button on your remote
5. The protocol, address, and command display on screen
6. Press REPLAY to retransmit

Adding a Permanent Preset

In signal_goblin.ino, find the TV power preset section in handleModuleTouch and add:

IrSender.sendNEC(0xYOURCODE, 32);   // NEC protocol, 32 bits
IrSender.sendSony(0xYOURCODE, 12);  // Sony SIRC, 12 bits

Power System

Architecture

USB-C (on TP4056 module)
       │
       ▼
   TP4056 LiPo Charger ──────────────────────── Charge LEDs
       │                                         (Red = charging)
       ▼                                         (Green = full)
  LiPo Battery 3.7V 2000mAh
  (JST-PH 2.0 connector)
       │
       ├──── SS14 Schottky Diode (reverse polarity protection)
       │
       ├──── PTC Fuse 500mA (overcurrent protection)
       │
       └──── Power Switch (right ear) ──── MT3608 Boost EN
                                                 │
                                                 ▼
                                          5V Boost Output
                                                 │
                                    ┌────────────┴────────────┐
                                    ▼                         ▼
                               ESP32 5V pin              IR Module
                             (internal LDO               PAM8302
                              → 3.3V rail)               etc.

TP4056 Module Notes

The TP4056+Boost module you already own has everything built in:

• USB-C charging port
• TP4056 LiPo charge IC
• DW01 battery protection (overcharge, overdischarge, short circuit)
• MT3608 5V boost converter

You only need to wire 4 pads on the PCB:

• B+ → Battery positive (JST red wire)
• B- → Battery negative (JST black wire)
• OUT+ → 5V power rail
• OUT- → Ground rail

Battery Life Estimates

Battery Gauge

GPIO36 reads a voltage divider (two 47kΩ resistors) connected across the LiPo. The firmware maps the voltage range 3.2V–4.2V to 0–100% and displays it in the status bar and Settings screen.

Charging

Plug any USB-C cable into the left ear base connector. The red LED lights while charging. Green LED lights when full. Charge time from empty: approximately 3–4 hours at 500mA.

Audio System

Hardware

PAM8302A mono amplifier (SO-8) connected to a small 8Ω speaker via JST connector. Audio signal comes from ESP32 GPIO6 via PWM/DAC.

Uses in Firmware

• Boot jingle on startup
• Scan success alert (short beep)
• Signal detected tone (CC1101/nRF24)
• Card read confirmation (NFC)

Muting

The PAM8302 SD pin is tied to GPIO11. Pull low to mute, high to enable. The firmware mutes audio during active RF scanning to prevent interference pickup on the IR receiver.

Firmware Setup

Required Libraries

Install all of these via Arduino Library Manager before compiling:

TFT_eSPI Configuration

This is required before the firmware will compile. Find User_Setup.h inside the TFT_eSPI library folder and add/replace these lines:

#define ILI9488_DRIVER
#define TFT_MOSI  23
#define TFT_SCLK  18
#define TFT_CS     5
#define TFT_DC     2
#define TFT_RST    4
#define TOUCH_CS  33
#define SPI_FREQUENCY       27000000
#define SPI_TOUCH_FREQUENCY  2500000

Arduino IDE Board Settings

Flashing the Firmware

1. Connect USB-C cable to the Signal Goblin left ear port
2. Hold BOOT button and press RST button simultaneously
3. Release RST, then release BOOT — device enters flash mode
4. Upload from Arduino IDE
5. Press RST once after upload completes

First Boot

On first power-on you will see:

1. Green orb pulsing in darkness
2. Goblin silhouette materializes
3. "SIGNAL GOBLIN" title flashes 3 times
4. Scan line sweeps down the screen
5. "INITIALIZING SYSTEMS..." message
6. Main menu appears with animated goblin mascot

Building Your Goblin

Assembly Order

Follow this order to avoid regret:

1. Flash the ESP32 first — test firmware on a breadboard before soldering anything to the PCB. Much easier to debug before it's mounted.
2. Set PN532 DIP switches — SW1 OFF, SW2 ON for I2C. Do this before anything else because you can't reach them after soldering.
3. Solder SMD passives first — 0402 resistors and capacitors. Decoupling caps, voltage divider, LED current resistors. Use paste + hot air if possible.
4. Solder SMD ICs — PAM8302A (SO-8). SOT-23 components if using bare ICs.
5. Apply stencil and paste to stamp-hole pads — CC1101, nRF24, ESP32. Do all at once, place modules, reflow together.
6. Solder through-hole components — tactile buttons, pin headers, SMA connectors, power switch.
7. Wire TP4056 module pads — B+, B-, OUT+, OUT- to PCB pads. Use short thick wire.
8. Connect battery JST — double-check polarity before connecting. Red = B+, Black = B-.
9. Test before closing up — power on, verify all modules initialize in the boot sequence.
10. Attach IPEX pigtails — route CC1101 pigtail to right ear SMA, nRF24 pigtail to left ear SMA. The pigtails are fragile — route them carefully before screwing down the SMA connectors.

Solder Paste Tips

• Use a steel stencil (order with PCB from JLCPCB)
• Apply paste, place all modules, then reflow in one pass
• The ESP32 stamp holes need proper paste coverage or you'll get cold joints
• After reflow, inspect stamp holes with a magnifier — add solder to any that look dry

IPEX Connector Warning

The IPEX (U.FL) connectors on the CC1101 and nRF24 modules are extremely fragile. They are rated for approximately 30 connect/disconnect cycles. Once the pigtail is routed to the SMA connector, leave it connected. If you need to disconnect it, apply firm straight pressure — never lever or twist.

Troubleshooting

Display Shows Nothing

• Check TFT_eSPI User_Setup.h is configured correctly
• Verify backlight — GPIO32 should be PWM high
• Check SPI connections: MOSI=23, SCK=18, CS=5, DC=2, RST=4
• Try a slower SPI frequency in User_Setup.h: #define SPI_FREQUENCY 20000000

PN532 Not Found

• Most likely cause: DIP switches are still in UART mode. If already soldered, you'll need to desolder the module.
• Check I2C pull-ups are present (4.7kΩ or 10kΩ from SDA/SCL to 3.3V)
• Verify I2C address: default is 0x24, scan with Wire.begin(); for(int i=1;i<127;i++){Wire.beginTransmission(i);if(!Wire.endTransmission())Serial.println(i,HEX);}

CC1101 Not Responding

• Check CS is GPIO14 in firmware init
• Verify SPI is initialized before calling CC1101 init
• CC1101 runs on 3.3V — ensure it's not on 5V rail
• Cold joint on stamp-hole pads is the most common physical cause

nRF24 Not Found

• nRF24 is extremely sensitive to power supply noise — add a 100µF cap close to its VCC/GND pins
• Ensure CSN=16 and CE=25 are correct
• Try radio.begin() and check return value — false means no response

Touch Not Working

• TOUCH_CS must be GPIO33 in User_Setup.h
• Touch IRQ is GPIO36 — this is an input-only pin, which is correct
• Calibrate touch: tft.calibrateTouch(calData, TFT_WHITE, TFT_BLACK, 15)

Device Won't Enter Flash Mode

• Hold BOOT (GPIO0), tap RST, release RST, then release BOOT
• If that fails: hold BOOT, plug in USB-C, release BOOT
• GPIO0 must be pulled LOW during boot to enter flash mode

Battery Not Charging

• Check TP4056 module LED — red = charging, no LED = no input power
• Verify USB-C connector orientation and wiring to module
• Module OUT+ must connect to 5V rail, OUT- to GND

Audio No Sound

• PAM8302 SD pin must be HIGH to enable (GPIO11 high)
• Check speaker JST polarity
• Confirm OUT+ and OUT- from PAM8302 go to speaker, not GND

Bill of Materials

Already Ordered / Owned

Still Needed

Credits & License

Signal Goblin is an original open-source hardware project.

• PCB Design: Custom Python-generated Gerbers using PIL/numpy
• Firmware: Arduino framework for ESP32
• Inspiration: Flipper Zero, HackRF, Proxmark

Libraries Used

• TFT_eSPI — Bodmer — MIT
• IRremote — z3t0/shirriff — MIT
• Adafruit_PN532 — Adafruit — BSD
• RF24 — TMRh20 — GPL-2.0
• SmartRC-CC1101 — LSatan — MIT
• FastLED — FastLED — MIT

Legal Notice

Signal Goblin is an educational tool for security research and RF analysis on systems you own or have explicit permission to test. Transmitting on regulated frequencies without authorization is illegal in most jurisdictions. The CC1101 and nRF24 modules must be used in compliance with local radio regulations. The author takes no responsibility for misuse.

Built with spite, solder, and goblin energy.

/\ /\\

( o o )
\ ^ / SIGNAL GOBLIN
||||| v7.1 FINAL
|||||