ESP32 Bus Pirate

🔌 Hacking Devices with ESP32 Bus Pirate

Ever wished your ESP32 could act like a full-fledged protocol analyzer? Meet the ESP32 Bus Pirate – an open-source firmware that transforms M5Stack devices (like Cardputer and Stick C Plus 2) into a multi-protocol hacker toolkit, inspired by the legendary Bus Pirate.

With one flash, your ESP32 becomes a serial,I2C, OneWIre, BT, WiFi sniffer, IR blaster, HID emulator, Wi-Fi/Bluetooth explorer, and more, all controllable via USB or Web-based CLI.

Use the ESP32 Bus Pirate Web Flasher to install the firmware in one click. See the Wiki for step-by-step guides on every mode and command. Check ESP32 Bus Pirate Scripts for a collection of scripts.

🏴‍☠️ What Is a Bus Pirate?

The Bus Pirate is a legendary open-source hacker tool designed to communicate with digital buses and protocols directly from a terminal.

It acts as a universal translator between your computer and electronic components, allowing you to:

• 🧪 Probe unknown devices
• 🛠️ Read and write data to chips and sensors
• 🔄 Monitor communication between devices
• 🧰 Debug hardware without custom firmware
• 💡 Reverse-engineer embedded systems

Originally built as a bench tool for hardware hackers and security researchers, the Bus Pirate simplifies common tasks like scanning I2C buses, talking to SPI flash, speaking UART, or sniffing traffic.

Whether you're exploring a new sensor, poking around a dev board, or testing an old gadget with unknown pins, the Bus Pirate makes it easy, scriptable, and fun.

🌐 Web and Serial Terminal

The ESP32 Bus Pirate offers two types of terminals: a fast USB Serial interface and a wireless Web CLI accessible from any browser.

📡 Supported Protocols & Use Cases

• Hi-Z (High Impedance) The default mode. All pins are set as inputs with no pull-ups. Disables all protocols.
• UART / Half-Duplex UART Standard serial interface with auto baudrate detection, real-time read/write, and full-duplex bridging. Perfect for talking to GPS modules, debugging microcontrollers, or reverse-engineering serial devices.
• I2C Protocol (SDA/SCL) used for sensors, EEPROMs, and peripherals. Includes scan, read/write, and sniffing. Use it to scan for I2C devices, dump EEPROM contents, or configure an environmental sensor like BME280.
• SPI Fast, full-duplex protocol used for memory chips, displays, and more. Read data from a SPI Flash chip or send commands to an OLED screen.
• 1-Wire Single-wire protocol used in temperature sensors and iButtons. Read a DS18B20 sensor or copy an iButton access tag.
• 2-WIRE / 3-WIRE Support for custom 2- or 3-wire protocols, often found in smartcards or other memory.
• Infrared (IR) Send and receive IR signals using over 80 supported protocols (NEC, Sony, RC5, etc.). Blast devices with “Device-b-Gone” or decode remote control buttons from any IR device. Read .ir files.
• DIO (Digital I/O) Direct digital pin control (read/write), including PWM and state toggling. Quickly test a sensor, toggle a relay, set a PWM, or read a pushbutton.
• USB (HID, Mass Storage) Emulate a USB keyboard, mouse, gamepad, or mass storage device using an SD card. Turn your ESP32 into a USB rubber ducky or a HID prank device.
• Bluetooth (BLE HID, scan, spoofing, sniffing) Supports BLE keyboard/mouse emulation, device scanning, MAC spoofing, and passive sniffing. Send keystrokes over BLE, spoof your MAC address, or sniff nearby BLE traffic.
• Wi-Fi (scan, connect, AP mode, spoofing, sniffing)Scan networks, connect as client or access point, spoof MACs, and sniff 2.4GHz packets. Identify vulnerable networks, explore Wi-Fi environment.
• JTAG Support for JTAG hardware debugging. Detect correct pins on a JTAG header.
• Sub-GHz (315/433/868/915 MHz) OOK/FSK RX/TX for simple remotes, doorbells, weather stations. Sniff and replay basic packets, log sensors, toggle cheap RF outlets. Read .sub files.
• nRF24 (2.4 GHz) nRF24L01+ send/receive, channel/address scan, sniff simple ESB traffic.
• RFID / NFC (13.56 MHz) Basic clonin for simple tags. Check badges, copy simple key fobs, inspect NFC stickers.
• Ethernet (SPI MAC/PHY) W5500/ENC28J60-style wired networking: DHCP/, TCP/UDP sockets, simple HTTP/Telnet bridges.
• LED Control Drive addressable LEDs (like WS2812 or APA102) for feedback, display, or status indicators. Use RGB animations, test LEDs.
• I2S Test speakers, micro, record, play tone.
• CAN Sniff frames, send, receive.

🧰 Why M5 Devices ?

We chose the M5Stack Cardputer and M5Stick C Plus 2They strike the perfect balance between portability, features, and developer-friendliness.

• Cardputer

👉 Perfect for portable scripting and standalone operation, with no external gear needed.

✅ It features a keyboard, sd slot, mic, screen, speaker, IR LED... Making it easy to type Wi-Fi credentials directly. Powered by two internal batteries. It also have the advantage of supporting USB HID.

⚠️ The only downside? Limited available GPIOs, but it’s still ideal for protocol exploration, automation scripts, and Wi-Fi/Bluetooth tools on the go.

• M5Stick C Plus 2

👉 Ideal for embedding into hardware setups, quick tests, or using as a compact probe, packed with essentials like a display, battery, Wifi, Bluetooth.

✅ The M5StickC Plus 2 offers more free GPIOs for peripheral control, has a 3 buttons, a mic, a buzzer, a builtin IMU and an IR LED.

⚠️ The only downside? No USB HID support. It also has significantly lower battery life, and of course, no keyboard.

• M5 Stamp S3

👉 Designed for full integration into embedded projects or custom hardware — ultra-compact, no screen or battery, but full power.
✅ The StampS3 exposes almost all ESP32-S3 GPIOs, supports USB Host/Device, Wi-Fi, Bluetooth, and is perfect for building custom tools, analyzers, or headless probes.
⚠️ The only downside? No built-in display, 1 button, and requires external power, but it’s unmatched for maximum flexibility.

• M5 Atom S3 Lite

👉 Designed for full integration into embedded projects or custom hardware — ultra-compact, no screen or battery, but full power.
✅ TheAtomS3Lite exposes 8 GPIOs, supports USB Host/Device, Wi-Fi, Bluetooth...
⚠️ The only downside? No built-in display, 1 button, and requires external power.

They’re plug-and-play, easy to flash thanks to M5Burner, and instantly ready for protocol exploration

📚 More Information

For full documentation, supported protocols, usage examples, and hardware notes, check out:

📘 Project Wiki

📦 Source Code & Updates on GitHub

👉 Web Flasher

Contributions are welcome! If you’re familiar with any of the supported protocols, feel free to help me improve or expand the firmware.

⚠️ Warning

The ESP32 Bus Pirate is designed to interface with 3.3V or 5V logic only. Connecting devices that use higher voltages may damage your ESP32 permanently. Always double-check the voltage levels before connecting any external hardware.

🖼️ Media