ESP32 Bit Pirate is an open-source firmware that turns compatible ESP32 devices into versatile hardware hacking and debugging tools, inspired by the original Bus Pirate.
It lets you analyze, control, and automate protocols such as I2C, UART, SPI, or 1-Wire through either a serial terminal or a web-based CLI. It also includes support for wireless technologies like Wi-Fi, Bluetooth, Sub-GHz, or RFID.
ESP32 Bit Pirate features:
- HiZ (default)
- I2C (scan, glitch, slave mode, dump, eeprom)
- SPI (eeprom, flash, sdcard, slave mode)
- UART / Half-Duplex UART (bridge, read, write)
- 1WIRE (ibutton, eeprom)
- 2WIRE (sniff, smartcard) / 3WIRE (eeprom)
- DIO (Digital I/O, read, pullup, set, pwm)
- Infrared (send, record, universal remote)
- USB (HID, flashrom, storage, usb-uart)
- Bluetooth (BLE HID, scan, spoofing, sniffing)
- Wi-Fi / Ethernet (sniff, deauth, nmap, netcat)
- JTAG (scan, SWD, openOCD)
- LED (animations, set LEDs)
- I2S (test speakers, mic, play sound)
- CAN (sniff, send and receive frames)
- SUBGHZ (analyze, record, replay)
- RFID (read, write, clone)
- RF24 (scan, send, receive)
- FM (analyze, broadcast)
- CELL (dump sim card, sms, call)
ESP32 Bit Pirate v1.6 introduces a set of USB adapters that let a single ESP32-S3 work with established applications such as flashrom, PulseView, AVRDUDE, OpenOCD, and LIRC.
The simplest adapter is a standard USB-to-UART bridge. After selecting the RX and TX pins, the ESP32-S3 restarts and appears on the computer as a regular serial port. It can then be used with applications such as PuTTY, screen, minicom, or the Arduino Serial Monitor to read debug messages, communicate with embedded devices, or access the console of a single-board computer. Optional BOOT and RESET pins can also be configured when the target requires automatic control of its programming mode.
AVRDUDE SPI ProgrammerThe AVRDUDE adapter uses the legacy Bus Pirate binary SPI protocol, allowing the ESP32-S3 to work as a programmer for supported AVR microcontrollers. Once the SPI and reset pins are configured, AVRDUDE can communicate with the target using its existing Bus Pirate backend. This makes it possible to read device signatures, flash firmware, verify memory, or inspect fuse settings without requiring a dedicated AVR programmer.
The Flashrom adapter turns the ESP32-S3 into a serprog-compatible SPI programmer. After configuring the CS, SCK, MOSI, and MISO pins, the device can be selected directly from flashrom to identify, read, write, or verify supported SPI flash chips. This is especially useful for backing up firmware from routers, development boards, and other embedded devices before attempting modifications or reverse engineering.
The SUMP adapter turns the ESP32-S3 into a logic analyzer compatible with sigrok and PulseView. Multiple GPIO pins can be sampled simultaneously and displayed as digital channels, making it possible to inspect UART, SPI, I2C, PWM, and other signals using PulseView’s built-in protocol decoders. It is a practical option for quick debugging and reverse-engineering tasks when a dedicated logic analyzer is not available.
The OpenOCD adapter lets the ESP32-S3 act as a Bus Pirate-compatible JTAG interface. After assigning the TCK, TMS, TDI, and TDO pins, OpenOCD can use the board to detect supported targets, inspect the JTAG chain, access debug registers, and perform basic debugging operations. It is intended for lightweight testing and hardware exploration rather than replacing a dedicated high-speed debug probe.
More USB AdaptersThese are only a few examples of the available USB modes. ESP32 Bit Pirate can also emulate a USB IR Toy for use with LIRC, expose a CC1101 radio through a simple serial protocol, and provide other specialized interfaces. The complete list, wiring instructions, compatible software, and usage examples are available in the USB Adapters documentation.
The ESP32 Bit Pirate DockThe USB adapters make the ESP32-S3 compatible with many desktop tools, but a development board alone is not always convenient for working with real hardware. External devices may operate at 1.8 V, 3.3 V, or 5 V, and connecting them directly to the ESP32 can require additional level shifters, power modules, and a collection of jumper wires.
To solve this, Andrei Vladescu and fdufnews designed the ESP32 Bit Pirate Dock, an open-source carrier board built specifically for the ESP32-S3 DevKit and the ESP32 Bit Pirate firmware.
The dock provides voltage and logic-level translation between the 3.3 V ESP32-S3 and external devices. It supports 1.8 V, 3.3 V, and 5 V targets, making it easier to work with flash memories, microcontrollers, sensors, and unknown embedded boards without rebuilding the interface on a breadboard for every project.
For readers who want to reproduce the board, the provided Gerber and BOM files can be uploaded directly to PCBWay for PCB manufacturing and assembly. This makes the dock accessible both to users who want to modify the open hardware design and to those who simply want a ready-to-assemble board for their ESP32-S3.
Together, the dock and the firmware form a more complete hardware debugging platform: the ESP32-S3 provides the protocols and USB adapters, while the dock handles the physical connections, target voltage, and level translation required on the workbench.
Comments