The ESP32 is a super-low-cost IoT device with Bluetooth & WiFi support. This target board does not break out any of the RF capabilities, and is primarily concerned with testing portions of the device stand-alone (such as secure boot, AES hardware accelerator, etc).
Available from Mouser.
Firmware can be built using ESP-IDF v3.3, install instruction for which can be found here. Using the prebuilt toolchain is recommended. If you're using Windows, make sure to use mingw32.exe.
Once you have the toolchain installed, make sure
IDF_PATH points to the path where you installed
example, if you cloned the repositry to
Once the toolchain is installed, navigate to
can be built with
make and cleaned with
make clean. If you're asked to fill in configuration settings, the default
settings will work.
Currently, to flash firmware, you will need a USB to 3.3V UART cable such as the TTL-232R-3V3. Connect the host TX pin to RX/GPIO2 and the host RX pin to TX/GPIO1.
To program the ESP32, ChipWhisperer must be set up as follows:
scope.default_setup() scope.clock.clkgen_freq = 26E6 scope.io.tio1 = None scope.io.tio2 = None scope.io.tio3 = 0
The full programming command listed at the end of
make must be used.
chipwhisperer/hardware/victims/firmware/esp32/simpleserial can be used as a shorthand
to program the esp32 as follows (including the pin/clock setup):
python esp_prog.py <SERIAL_PORT>
This device uses a Texas Instruments TXB0104 as a SPI buffer. This is a bidirectional buffer chip, meaning you can use it in any of the following ways:
- Disable chip, allowing ESP32 to load/program the attached SPI flash chip.
- Sniff the SPI bus, but with a buffer in-line to prevent your sniffer from affecting the SPI load process (or trigger on SPI packets).
- Program the SPI chip using external programmer. To do this hold ESP32 in reset.
- Use an external SPI chip (or emulator) to load the data for the ESP32. To do this you'll have to disconnect the CS pin of the SPI chip.
The direction is detected automatically.
SPI Flash Device¶
The ESP32 needs an attached SPI flash. The production devices use a W25Q32BVSSIG from Winbond, but this can be difficult to find from regular distributors. If you are building your own device I suggest using ISSI IS25WP032D-JBLE which is more widely available.
A variety of other devices will not work with the bootloader, meaning you cannot easily program them. It's not known exactly what is needed (they need to support DSPI at least), but for example SST26VF016BT-104I/SN did not work.
For PDF see GIT repository.