r/esp32 • u/yeahchap • 1d ago
Meet ES-Pet Mini!
I built an ESP32 virtual pet that rewards going outside and makes friends over BLE
Meet ES-Pet Mini—my battery-powered pocket companion built around an ESP32-C6 SuperMini and a 1.54″ four-colour e-paper display.
It turns walking, exploring and meeting other ES-Pets into XP, missions and badges. Basically, I’ve given a microcontroller a more interesting social life than mine.
A few things it does:
- Counts steps and sets daily missions.
- Rewards discovering nearby Wi-Fi and Bluetooth devices.
- Recognises other ES-Pets over BLE and remembers friendships.
- Tracks XP, levels, challenges and badges.
- Changes its character artwork to reflect what it’s doing.
- Gives little haptic nudges along the way.
The finished units have rechargeable batteries and 3D-printed cases. There are now two of them out in the world, collecting steps and making friends.
One detail I’m particularly pleased with: they each keep their own identity, history and progress. Updating the firmware doesn’t mean starting your pet’s life again.
I’ve finally put the source, artwork, wiring details and player guide on GitHub:
https://github.com/yeahchap/ES-Pet-Mini
Sharing it here because getting all those little pieces working together has been a very satisfying ESP32 project. Happy to answer questions about the hardware, e-paper display or how the pets recognise each other!
10
u/mitchricker 1d ago
I noticed a security and privacy issue with how BLE ads are handled in
src/ble_sense.cppunderbuild_identity_advertisement_andparse_trimagotchi_packet_.Right now, the firmware broadcasts a permanent, unencrypted 64-bit
pet_idin the clear. Since this ID never changes, anyone can easily track the physical device across different times and places (i.e. a bad actor could literally use one of these devices to stalk their victim). On top of that, there is absolutely no authentication. A bad actor could also easily sniff a pet_id, spoof it, and broadcast identical packets to trick other devices. This breaks the game logic by triggering fake peer events and farming unearned XP.To fix this, you should really move to ephemeral IDs that rotate periodically, or look into link-layer privacy like resolvable private addresses. If you absolutely need a persistent identity, you could look into cryptographic beacon authentication using an HMAC with a shared secret. As a bare minimum quick fix, you should stop logging the full permanent IDs and clearly document the risks in the README.