ESP32 dev board

A cheap Wi-Fi/Bluetooth SoC board: the go-to practice target for flash dumps, eFuses and secure boot, and a scriptable attack platform.

5–10€ Debug & automotive

What it does

The ESP32 is an inexpensive Wi-Fi and Bluetooth SoC, usually sold on a small dev board (a DevKitC, WROOM or Lolin-style module with a USB-serial bridge). On the bench it plays two roles: it is the most common practice target for firmware and silicon security work - dump its external SPI flash, read its eFuses, and learn how flash encryption and secure boot are meant to lock it down - and it is a scriptable radio and GPIO platform you can flash with custom firmware to drive an attack of your own.

Use cases

Dump the firmware over USB

Read the whole flash with esptool, then carve the filesystem and partitions with binwalk to inspect the firmware.

Read the eFuse security state

Query espefuse to see whether flash encryption and secure boot are actually burned, or left disabled on a shipped product.

Flash a custom attack firmware

Turn the board into a Wi-Fi/BLE sniffer, a jammer target, or the SPI host driving another radio module.

How you use it

Talk to the board's serial bootloader with esptool over USB, then read the flash and the eFuse block:

esptool.py chip_id                                 # identify the chip over USB
esptool.py read_flash 0 0x400000 flash.bin        # dump the whole flash
espefuse.py summary                                # read eFuses: flash-enc / secure-boot state
binwalk -e flash.bin                               # carve the dumped image

Wiring

Crossover TX/RX plus a shared GND. Most dev boards flash straight over their onboard USB; on a bare module, pull IO0 to GND while pulsing EN (reset) to enter the serial bootloader esptool talks to.

Variants & pitfalls

Enter download mode. esptool cannot connect unless the chip is in its serial bootloader; hold IO0 low during reset (many boards auto-enter, some cheap ones do not).

Encryption changes the dump. If flash encryption is burned, a read_flash returns ciphertext, not plaintext firmware; check espefuse summary before assuming a bad read.