Skip to content

CW308T-ESP32

The ESP32 is a super-low-cost IoT device with Bluetooth & WiFi support. This target board does not break out any of the RF capabilities, and is primarily concerned with testing portions of the device stand-alone (such as secure boot, AES hardware accelerator, etc).

Specifications

Feature Notes/Range
Target Device ESP32
Target Architecture LX6
Vcc 3.3V
Programming SPI
Hardware Crypto Yes
Availability Standalone
Status Released
Shunt 10Ω

Available from Mouser.


Building Firmware

Firmware can be built using ESP-IDF v3.3, install instruction for which can be found here. Using the prebuilt toolchain is recommended. If you're using Windows, make sure to use mingw32.exe.

Once you have the toolchain installed, make sure IDF_PATH points to the path where you installed esp-idf. For example, if you cloned the repositry to ~/esp-idf:

export IDF_PATH=~/esp-idf

Once the toolchain is installed, navigate to chipwhisperer/hardware/victims/firmware/esp32/simpleserial. Firmware can be built with make and cleaned with make clean. If you're asked to fill in configuration settings, the default settings will work.

--

Flashing Firmware

Currently, to flash firmware, you will need a USB to 3.3V UART cable such as the TTL-232R-3V3. Connect the host TX pin to RX/GPIO2 and the host RX pin to TX/GPIO1.

To program the ESP32, ChipWhisperer must be set up as follows:

scope.default_setup()
scope.clock.clkgen_freq = 26E6
scope.io.tio1 = None
scope.io.tio2 = None
scope.io.tio3 = 0

The full programming command listed at the end of make must be used. esp_prog.py in chipwhisperer/hardware/victims/firmware/esp32/simpleserial can be used as a shorthand to program the esp32 as follows (including the pin/clock setup):

python esp_prog.py <SERIAL_PORT>

--

SPI Buffer

This device uses a Texas Instruments TXB0104 as a SPI buffer. This is a bidirectional buffer chip, meaning you can use it in any of the following ways:

  • Disable chip, allowing ESP32 to load/program the attached SPI flash chip.
  • Sniff the SPI bus, but with a buffer in-line to prevent your sniffer from affecting the SPI load process (or trigger on SPI packets).
  • Program the SPI chip using external programmer. To do this hold ESP32 in reset.
  • Use an external SPI chip (or emulator) to load the data for the ESP32. To do this you'll have to disconnect the CS pin of the SPI chip.

The direction is detected automatically.


SPI Flash Device

The ESP32 needs an attached SPI flash. The production devices use a W25Q32BVSSIG from Winbond, but this can be difficult to find from regular distributors. If you are building your own device I suggest using ISSI IS25WP032D-JBLE which is more widely available.

A variety of other devices will not work with the bootloader, meaning you cannot easily program them. It's not known exactly what is needed (they need to support DSPI at least), but for example SST26VF016BT-104I/SN did not work.


Schematic

For PDF see GIT repository.

CW308T-ESP32-02_schematic_Page_2.png

CW308T-ESP32-02_schematic_Page_1.png