CYD ESP32 Marauder Build Guide: Flashing, Pinouts, and Debugging

The Verdict: Which CYD Variant to Buy for Marauder

The 'Cheap Yellow Display' (CYD) ecosystem is flooded with clone boards featuring mismatched touch controllers and display drivers. If you buy the wrong variant, the ESP32 Marauder firmware will compile but fail to render the UI or register touch inputs. Here is the decision path to ensure you get a compatible board:

Parts List and Pin Mapping for the ESP32-2432S028R

The CYD is notorious for routing the TFT display and the Touch controller on two completely separate SPI buses. If you attempt to share the SPI bus in your User_Setup.h file, the touch controller will pull the TFT MOSI line low, resulting in a black screen. Below is the exact hardware mapping for the ESP32-2432S028R.

Bill of Materials

• MCU/Display: ESP32-2432S028R (Sunton 2.8" CYD)
• GPS Module (Optional): ATGM336H-5N (UART, 3.3V logic)
• Power: 5V/2A USB-C power supply (Marauder peaks at ~800mA during WiFi TX bursts)
• Enclosure: 3D printed snap-fit case (search Thingiverse for 'CYD 2.8 Marauder case')

Dual SPI Pin Mapping Table

Flashing the Firmware: Step-by-Step

This procedure targets the ESP32-2432S028R hardware using the Arduino IDE (v2.2+). The Marauder codebase relies on the ESP32 Arduino Core v2.0.11 or newer. Do not use v3.x yet, as the TFT_eSPI library has breaking changes in the new core.

1. Install the CH340 Driver: The USB-C CYD uses a WCH CH340 USB-UART bridge. Download the official driver from WCH if your OS doesn't auto-resolve it.
2. Clone the Repository: Clone the ESP32 Marauder GitHub repo and open esp32_marauder.ino.
3. Configure Board Settings: In the Arduino IDE Tools menu, set the following exact parameters:
   • Board: ESP32 Dev Module
   • PSRAM: Enabled (Critical for packet buffer allocation)
   • Flash Size: 4MB (32Mb)
   • Partition Scheme: Minimal SPIFFS (1.9MB App with OTA/3MB SPIFFS)
4. Hardware Toggle: Open configs.h in the Marauder source and uncomment #define CYD. This tells the compiler to use the CYD-specific TFT_eSPI overrides.
5. Flash: Hold the 'BOOT' button on the CYD PCB, click Upload in the IDE, and release the BOOT button when the console says 'Connecting...'.

Debugging the 'White Screen of Death' and Touch Failures

When a CYD Marauder build fails, it rarely fails silently. Here are the first three things to check, mapped to the exact serial output you will see at 115200 baud.

1. The Bootloop (Guru Meditation Error)

Exact Error String: Guru Meditation Error: Core 1 panic'ed (Cache disabled but cached memory region accessed)

Ranked Causes:

1. PSRAM Disabled: Marauder allocates large arrays for beacon flooding and PCAP buffering. Without PSRAM, it writes to protected cache regions. Fix: Set PSRAM to 'Enabled' in Tools menu.
2. Wrong Partition Scheme: The default 'Default 4MB' scheme doesn't leave enough contiguous RAM for the SPIFFS file system. Fix: Switch to 'Minimal SPIFFS'.

2. The White Screen of Death

Exact Error String: Serial monitor shows Setup Complete but the screen is blinding white or completely black.

Ranked Causes:

1. TFT_CS Pin Conflict: You accidentally defined the Touch CS and TFT CS on the same pin in User_Setup.h. Fix: Verify TFT_CS is 15 and TOUCH_CS is 33.
2. Backlight Pin Floating: GPIO 21 controls the backlight. If the Marauder init sequence skips it, the screen is on but dark. Fix: Add pinMode(21, OUTPUT); digitalWrite(21, HIGH); to the top of setup().

3. Touch Axis Inversion

Symptom: UI renders perfectly, but tapping the top-left registers as bottom-right, or the X/Y axes are swapped.

Ranked Causes:

1. Missing Calibration Data: The XPT2046 requires a 4-point calibration matrix. Fix: Run the 'TouchCalibrate' example sketch from the TFT_eSPI library first, then paste the generated CAL array into Marauder's Touch.cpp.
2. Resistive Film Damage: The CYD's resistive touch layer is fragile. If the corners are pressed too hard during assembly, the ITO layer cracks, causing permanent axis skew. Fix: Hardware replacement required.

Extending the Build: Adding a GPS Module for Wardriving

The base CYD Marauder is excellent for deauth attacks and probe logging, but adding a GPS module turns it into a dedicated wardriving rig that geotags every captured handshake. We will use the ATGM336H-5N (a drop-in, high-sensitivity alternative to the NEO-6M that runs natively at 3.3V).

GPS Wiring

• GPS VCC: 3.3V (Do NOT use 5V, the CYD's 5V rail is noisy and will degrade GPS SNR)
• GPS GND: GND
• GPS TX: Connect to CYD GPIO 16 (ESP32 RX2)
• GPS RX: Connect to CYD GPIO 17 (ESP32 TX2)

Compilable GPS Integration Code

Below is a complete, standalone test sketch to verify your GPS wiring before integrating it into the main Marauder codebase. It uses HardwareSerial on UART2 and includes timeout error handling to prevent the main loop from hanging if the module fails to lock onto satellites.

#include <TinyGPSPlus.h>
#include <HardwareSerial.h>

// Pin definitions for CYD ESP32-2432S028R UART2
#define GPS_RX_PIN 16
#define GPS_TX_PIN 17

TinyGPSPlus gps;
HardwareSerial ss(2); // Instantiate UART2

unsigned long lastFixTime = 0;
const unsigned long GPS_TIMEOUT_MS = 15000; // 15s timeout for cold start

void setup() {
  Serial.begin(115200);
  
  // Initialize GPS on UART2 at standard 9600 baud
  ss.begin(9600, SERIAL_8N1, GPS_RX_PIN, GPS_TX_PIN);
  
  Serial.println("-----------------------------------");
  Serial.println("CYD Marauder GPS Test Harness");
  Serial.println("Waiting for satellite lock...");
  Serial.println("-----------------------------------");
  
  lastFixTime = millis();
}

void loop() {
  // Read incoming NMEA sentences from the GPS module
  while (ss.available() > 0) {
    char c = ss.read();
    if (gps.encode(c)) {
      lastFixTime = millis(); // Reset timeout on any valid NMEA parse
      
      if (gps.location.isValid()) {
        Serial.printf("[FIX] Lat: %.6f, Lon: %.6f | Sats: %d\n", 
                      gps.location.lat(), 
                      gps.location.lng(), 
                      gps.satellites.value());
      } else {
        Serial.printf("[SEARCHING] Sats in view: %d\n", gps.satellites.value());
      }
    }
  }

  // Error handling: Timeout detection for hardware faults or antenna issues
  if (millis() - lastFixTime > GPS_TIMEOUT_MS && millis() > GPS_TIMEOUT_MS) {
    Serial.println("[ERROR] GPS Timeout: No valid NMEA data in 15s.");
    Serial.println("-> Action: Check TX/RX swap, verify 3.3V rail, or inspect active antenna.");
    lastFixTime = millis(); // Reset to prevent serial spam
  }
}

How to Simplify if You Don't Need GPS

If you are strictly using the CYD for indoor network auditing or CTFs, strip the GPS code entirely from Marauder's GPSInterface.cpp. The ESP32's UART2 peripheral draws a trivial amount of power, but disabling the NMEA parsing loop frees up roughly 4% of CPU cycle overhead on Core 0, which slightly improves the responsiveness of the capacitive touch polling thread.

Final Bench Notes

Building a CYD ESP32 Marauder is an exercise in managing clone-board quirks. By strictly sourcing the ESP32-2432S028R with the ILI9341/XPT2046 combo, respecting the dual-SPI bus architecture, and enabling PSRAM in your IDE, you bypass 90% of the issues documented in community forums. Keep your TFT CS (15) and Touch CS (33) separated, flash with the Minimal SPIFFS partition, and your rig will be ready for the field in under an hour.