ESP32 Bit Pirate: Turn an ESP32 into a Multi-Protocol Hardware Hacking and Bus Analysis Swiss Army Knife

TL;DR: ESP32 Bit Pirate by geo-tp is an open-source firmware that transforms low-cost ESP32 and ESP32-S3 microcontrollers into multi-protocol hardware exploration and bus analysis terminals. Inspired by the iconic Bus Pirate, it provides interactive sniffing, register debugging, EEPROM/Flash dumping, and glitching across I2C, SPI, UART, 1-Wire, JTAG/SWD, CAN bus, and wireless interfaces (Wi-Fi, BLE, Sub-GHz, LoRa, RFID) via serial terminal or browser-based Web Serial tools without requiring expensive dedicated lab instruments.

Hardware reverse engineering, embedded firmware debugging, and hardware penetration testing frequently require interfacing with unlabelled circuit boards and proprietary digital communication buses. Traditionally, engineers and hobbyists purchased specialized standalone debuggers: an I2C/SPI bridge, a dedicated UART level shifter, a JTAG debugger, a logic analyzer, and a CAN bus transceiver.

Dangerous Prototypes revolutionized hardware hacking years ago with the original Bus Pirate, providing a universal interactive serial interface for speaking digital protocols. As microcontrollers advanced, the need arose for a modern, high-speed, wireless-capable equivalent built on ubiquitous and affordable hardware.

The ESP32 Bit Pirate project (formerly known as ESP32 Bus Pirate, created by geo-tp on GitHub and hosted at geo-tp.github.io) accomplishes this mission. By leveraging the dual-core 240 MHz processing speed, hardware peripherals, flexible GPIO matrix, and wireless subsystems of the ESP32-S3, ESP32 Bit Pirate delivers an all-in-one hardware analysis workbench for the price of a $5 development board.

Last updated: August 2026.

What is ESP32 Bit Pirate?

ESP32 Bit Pirate is an open-source embedded firmware for ESP32 and ESP32-S3 microcontrollers that provides an interactive command-line interface and web suite for sniffing, interacting with, scripting, and reverse-engineering digital and wireless electronic communication protocols.

+-------------------------------------------------------------------------+
|                  ESP32 Bit Pirate Core User Interfaces                  |
|  [USB-CDC Serial CLI]   [Web Serial Browser GUI]   [Wi-Fi Web Terminal] |
+------------------------------------+------------------------------------+
                                     |
+------------------------------------v------------------------------------+
|               ESP32 Bit Pirate Multi-Protocol Engine                    |
|  +----------------+----------------+----------------+----------------+  |
|  | Wired Digital  | Memory & Flash | JTAG / Debug   | Industrial/Auto|  |
|  | - I2C (1 MHz)  | - SPI FlashROM | - JTAG Scan    | - CAN / TWAI   |  |
|  | - SPI (80 MHz) | - 24Cxx EEPROM | - ARM SWD      | - 1-Wire/iButt |  |
|  | - UART / HDUART| - 93Cxx Micro  | - Logic Probe  | - 2/3-Wire Card|  |
|  +----------------+----------------+----------------+----------------+  |
|  | Wireless RF    | Optical & Audio| Actuators/LED  | System Storage |  |
|  | - 802.11 Wi-Fi | - 80+ IR Protos| - 50+ LED Chip | - LittleFS NVS |  |
|  | - BLE 5.0 / HID| - TV-B-Gone    | - PWM / Servo  | - Pirate Assist|  |
|  | - Sub-GHz / LoRa| - I2S DAC/Mic | - Glitch Pulse | - Python Macro |  |
|  +----------------+----------------+----------------+----------------+  |
+------------------------------------+------------------------------------+
                                     |
+------------------------------------v------------------------------------+
|                      Target Device Under Analysis                       |
|  [Sensors]  [EEPROM/Flash]  [Automotive ECUs]  [Smartcards]  [RF Nodes] |
+-------------------------------------------------------------------------+

Unlike basic Arduino bus snooping scripts, ESP32 Bit Pirate implements a complete operating environment inspired by classic Bus Pirate syntax. It safely boots into a high-impedance state (HiZ Mode) where all GPIO pins remain disconnected to prevent accidental signal contention or short circuits.

From there, users can switch into specialized protocol modes with simple shorthand commands, execute bus read/write macros, manipulate pull-up resistors, dump SPI NOR flash chips directly to computer storage, and automate complex test sequences using Python or built-in macro bytecode.

Comprehensive Protocol and Hardware Feature Matrix

ESP32 Bit Pirate unifies physical layer debugging across an unmatched range of communication buses:

+-------------------------------------------------------------------------+
|                    Wired & Wireless Protocol Overview                   |
+-------------------+--------------------+-------------------+------------+
| Wired Serial      | Memory & Debug     | Wireless RF       | Industrial |
| - I2C Master/Slave| - SPI Flash (25Q)  | - Wi-Fi Sniffer   | - CAN Bus  |
| - SPI High-Speed  | - I2C EEPROM (24C) | - BLE HID / Scan  | - 1-Wire   |
| - UART Auto-Baud  | - JTAG Auto-Scan   | - Sub-GHz CC1101  | - Smartcard|
| - Half-Duplex UART| - ARM Cortex SWD   | - LoRa / Meshtastic- 80+ IR    |
+-------------------+--------------------+-------------------+------------+

1. I2C Bus Operations (Inter-Integrated Circuit)

• Address Auto-Scanner: Rapidly scans the 7-bit and 10-bit address spaces (0x08 to 0x77) to identify connected peripherals, displaying standard chip identification tables.
• EEPROM Dumping & Writing: Built-in read/write drivers for standard 24C01 through 24C1024 serial EEPROMs.
• I2C Glitching & Slave Emulation: Emulates I2C slave devices to spoof sensors or capture master query sequences.
• Interactive Syntax: Execute multi-byte transactions with start [ and stop ] delimiters:

  I2C> [ 0xA0 0x00 [ 0xA1 r:16 ]

  (Sends write address 0xA0, memory pointer 0x00, repeated start, read address 0xA1, and clocks out 16 bytes).

2. SPI Bus Operations (Serial Peripheral Interface)

• High-Speed Flashrom Bridge: Acts as a direct hardware programmer compatible with Flashrom for dumping, erasing, and reflashing BIOS and firmware chips (Winbond W25Qxx, Macronix, Spansion).
• SPI EEPROM & SD Card Access: Interacts with 25Cxx and 93Cxx EEPROMs and accesses raw sectors on micro-SD cards over SPI.
• Sniffing and Slave Mode: Captures synchronous SPI data streams up to hardware limits.

3. UART & Half-Duplex UART (HDUART)

• Automatic Baud Rate Detection: Analyses incoming bit transitions on RX pins to calculate and lock onto unknown baud rates automatically.
• Transparent Bridge & AT Parser: Transparent bi-directional terminal bridge for debugging GPS modules, cellular modems, and Bluetooth modules with dedicated AT command scripting.
• Half-Duplex Support: Single-wire bidirectional serial communication for smart servos, automotive sensors, and microcontroller bootloaders.

4. 1-Wire, 2-Wire, and 3-Wire Interfaces

• Dallas 1-Wire: Scans the 1-Wire bus for 64-bit ROM IDs, reads DS18B20 temperature sensors, and interfaces with DS2431/DS2433 secure memories.
• iButton Operations: Reads, clones, and emulates Dallas DS1990A physical access keyfobs.
• Smartcard Protocols: Interacts with synchronous ISO/IEC 7816 smartcards (SLE4442, SLE4428) commonly found in legacy banking, hotel, and pay-TV cards.

5. JTAG & ARM SWD Debugging

• JTAG Pinout Scanner: Automated header discovery that cycles through unlabelled header pins using pull-up/pull-down test patterns to locate TDI, TDO, TCK, and TMS pins (similar to a hardware JTAGulator).
• ARM Cortex SWD Interface: Speaks Serial Wire Debug protocol to halt CPUs, read memory-mapped registers, and verify device silicon IDs.
• OpenOCD Bridge: Functions as a remote JTAG/SWD probe interface for OpenOCD over USB or Wi-Fi TCP sockets.

6. CAN Bus & Automotive Diagnostics (TWAI)

• Utilizes the ESP32’s built-in Two-Wire Automotive Interface (TWAI) controller connected to an external 3.3V CAN transceiver (SN65HVD230 / VP230).
• Sniffs CAN traffic at standard bitrates (125 kbps, 250 kbps, 500 kbps, 1 Mbps).
• Injects arbitrary CAN frames and queries vehicle OBD-II diagnostic parameters.

7. Wireless Protocols: Wi-Fi, BLE, Sub-GHz, LoRa, and RFID

• Wi-Fi & Ethernet: Promiscuous packet monitor, 802.11 deauthentication auditing, rogue access point deployment, network port scanner (nmap lite), and HTTP LittleFS web file server.
• Bluetooth Low Energy (BLE): Scans GATT services, captures advertising packets, and injects BadBLE wireless HID keystroke payloads.
• Sub-GHz RF (CC1101): Analyzes, records, and replays 300 MHz to 928 MHz signals from weather sensors, alarm systems, and remote keyfobs.
• LoRa & Meshtastic: Sniffs raw Chirp Spread Spectrum (CSS) packets, analyzes frequency allocations, and debugs Meshtastic off-grid mesh network packets.
• RFID (125 kHz & 13.56 MHz): Reads EM4100 proximity tags, writes T5577 rewritable transponders, and parses ISO 14443 NFC tags.

8. Infrared, Audio, and LED Peripherals

• 80+ IR Protocols: Decodes, transmits, and clones infrared signals from home entertainment, HVAC, and industrial equipment.
• Device-B-Gone: Universal power-cycle database for displays and kiosks.
• Addressable LEDs: Drives and tests over 50 variations of digital RGB/RGBW LEDs (WS2812B, SK6812, APA102, WS2801) with hardware-timed waveforms.
• I2S Audio Diagnostics: Generates sine waves and test audio for external I2S DACs and records digital audio streams from I2S microphones.

Comparison: ESP32 Bit Pirate vs Dedicated Hardware Tools

Hardware Setup and Web Flashing Guide

ESP32 Bit Pirate is designed to run on virtually any ESP32 or ESP32-S3 development board, including bare devkits, the M5Stack Cardputer, and breadboard builds.

+-------------------------------------------------------------------------+
|                       Two Easy Installation Paths                       |
+------------------------------------+------------------------------------+
|   Method 1: 1-Click Web Flasher    |   Method 2: PlatformIO Source      |
|   (Browser via Web Serial)         |   (Custom Pins & Drivers)          |
+------------------------------------+------------------------------------+
| 1. Open official Web Flasher       | 1. Clone repository                |
| 2. Plug ESP32 into USB port        | 2. Checkout 'pioarduino' branch    |
| 3. Click "Install" and select COM  | 3. Run: pio run -t upload          |
| 4. Ready in 45 seconds             | 4. Open serial monitor at 115200   |
+------------------------------------+------------------------------------+

Installation via Browser Web Flasher (Recommended)

1. Open a Chromium-based web browser (Google Chrome, Microsoft Edge, Brave).
2. Visit the official installer: https://geo-tp.github.io/ESP32-Bit-Pirate/webflasher/.
3. Connect your ESP32 / ESP32-S3 board to your computer via USB.
4. Click Install ESP32 Bit Pirate, select the detected serial port, and confirm.
5. The web tool flashes the bootloader, partition table, LittleFS image, and application firmware automatically.

Accessing the Interactive CLI and Web Tools

Once flashed, you can communicate with the firmware through two interfaces:

1. USB Serial Terminal:
   Open any serial terminal (PuTTY, minicom, screen, or the Arduino Serial Monitor) set to 115200 baud, 8-N-1:

   picocom -b 115200 /dev/ttyUSB0

   Press Enter to see the greeting banner and mode prompt:

   =======================================
   *        ESP32 Bit Pirate v2.x        *
   =======================================
   HiZ>

2. Browser Web Tools Suite:
   Navigate to https://geo-tp.github.io/ESP32-Bit-Pirate/web-tools/. The web interface connects directly to your board via Web Serial, providing dedicated graphical panels for:
   • Automated I2C address grid scanning.
   • SPI Flash chip reading, verifying, and flashing with hex visualizers.
   • GPIO state monitors and PWM frequency sliders.
   • The Pirate Assistant, an integrated assistant that translates natural-language engineering requests into accurate Bit Pirate command macros.

Practical Engineering Recipes and Workflows

+-------------------------------------------------------------------------+
|                  Common Hardware Hacking Workflows                      |
+-------------------+--------------------+-------------------+------------+
| 1. Scan I2C Bus   | 2. Dump SPI Flash  | 3. Sniff CAN Bus  | 4. Find SWD|
| -> (m)ode -> 5    | -> (m)ode -> 6     | -> (m)ode -> 17   | -> (m)ode  |
| -> (1) 400 kHz    | -> Flashrom bridge | -> 500 kbps TWAI  | -> 15 JTAG |
| -> (s)can         | -> flashrom -r dump| -> live frame log | -> auto-pin|
+-------------------+--------------------+-------------------+------------+

Recipe 1: Identifying an Unknown I2C Sensor

1. Connect target SDA to GPIO 21 and SCL to GPIO 22 (or your board’s configured pins), and share a common ground GND.
2. Enter I2C mode by typing m and selecting 5 (I2C).
3. Choose your desired bus clock speed (e.g., 400 kHz).
4. Type (1) to enable internal pull-up resistors if the target board lacks them.
5. Type (s) or scan to search all addresses:

   I2C> (s)
   Searching I2C address space...
   Found device at: 0x68 (DS3231 RTC / MPU6050 IMU)
   Found device at: 0x57 (AT24C32 EEPROM)

Recipe 2: Dumping a SPI BIOS Flash Chip with Flashrom

1. Connect MOSI, MISO, SCK, CS, 3.3V, and GND to the target 8-pin SPI NOR Flash chip (e.g., Winbond W25Q128).
2. Switch into SPI mode:

   HiZ> m
   Select mode: 6 (SPI)
   SPI> flashrom
   Entering Flashrom USB bridge mode...

3. On your Linux / macOS workstation, run standard flashrom:

   flashrom -p serprog:dev=/dev/ttyACM0:115200 -r bios_backup.bin

4. Flashrom recognizes the chip ID and extracts the entire flash image at high speed.

Recipe 3: Sniffing Automotive CAN Bus Traffic

1. Connect an external 3.3V CAN transceiver to the ESP32’s TWAI RX/TX pins.
2. Enter CAN mode:

   HiZ> m
   Select mode: 17 (CAN)
   CAN> speed 500
   CAN> sniff
   [0x7DF] DLC:8 DATA: 02 01 0C 00 00 00 00 00 (OBD-II Engine RPM Query)
   [0x7E8] DLC:8 DATA: 04 41 0C 1A F8 00 00 00 (Response: 1726 RPM)

Frequently Asked Questions (FAQ)

What is ESP32 Bit Pirate?

ESP32 Bit Pirate is an open-source firmware for ESP32 microcontrollers that creates a multi-protocol hardware hacking, bus analysis, and firmware debugging terminal inspired by the Dangerous Prototypes Bus Pirate.

Does ESP32 Bit Pirate support wireless protocols?

Yes. Beyond wired digital buses (I2C, SPI, UART, 1-Wire, JTAG, CAN), it natively supports Wi-Fi packet monitoring, Bluetooth Low Energy (BLE) scanning, Sub-GHz RF transceiver operations, and LoRa sniffing.

Can ESP32 Bit Pirate dump SPI flash memory chips?

Yes. It includes built-in SPI memory tools and supports a dedicated USB serprog/flashrom bridge mode, allowing tools like Flashrom to read and write BIOS and firmware chips directly.

Do I need specialized hardware to run ESP32 Bit Pirate?

No. It runs on generic ESP32 and ESP32-S3 development boards, the M5Stack Cardputer, and custom devkits. You can install it directly from your web browser via Web Serial.

How does HiZ mode protect circuit boards during testing?

HiZ (High-Impedance) mode sets all GPIO pins to high-impedance inputs upon boot, ensuring no voltage or current is driven onto connected target circuits until the user explicitly configures a protocol mode.

Summary: Why ESP32 Bit Pirate Belongs in Every Maker’s Toolkit

ESP32 Bit Pirate takes the proven, practical command-line philosophy of the original Bus Pirate and revitalizes it for modern embedded engineering. By running on accessible, high-performance ESP32 hardware and integrating browser-based Web Serial diagnostics, geo-tp has created an essential debugging utility for electronics hobbyists, firmware engineers, and hardware security researchers alike.

73 from 9M2PJU.

Sources and Further Reading

• ESP32 Bit Pirate GitHub Repository – Full open-source firmware and documentation.
• ESP32 Bit Pirate Official Website – Web flasher, web tools, recipes, and hardware guides.
• ESP32 Bit Pirate 1-Click Web Flasher – Install firmware directly in Chrome/Edge via Web Serial.
• ESP32 Bit Pirate Web Serial Tools – In-browser SPI flash dumper and I2C/GPIO diagnostic console.
• Dangerous Prototypes Bus Pirate – The legendary open-source bus interface that inspired the project.
• Flashrom Utility – Universal flash memory programming tool.