DynaCyLabs
Menu
HomeServicesResearchAboutContact
← All research

ESP32 / ESP-IDF

ESP32 Reverse Engineering Toolchain

A Ghidra toolchain built for ESP32 firmware: flash loader, flash-dump parser, and type and function-signature archives for ESP-IDF v2.0 through v5.1.

GhidraESP32FirmwareTooling
image placeholder — replace via `cover`

Overview

ESP32-based products are common in consumer IoT, and their firmware is far easier to analyze with the right tooling around it. This toolchain was built to take a raw flash dump to a navigable Ghidra project.

Status: this project is no longer actively maintained.

Components

  • Xtensa processor module: the Ghidra Xtensa module, including register windowing, MAC16, and loop options.
  • Flash-image loader: a fork of the ESP32 flash-image loader for Ghidra.
  • Flash-dump parser: extracts partitions from a full flash dump.
  • Type archives and signatures: Ghidra data type archives (GDT) and Rizzo function signatures, generated automatically for ESP-IDF v2.0 through v5.1, so library code in stripped firmware is identified instead of reversed by hand.
  • A port of the Rizzo plugin for identifying functions in stripped binaries.
  • An SVD loader with more than 650 CMSIS-SVD peripheral definitions.
  • A GDT archive generator that builds type archives from PDB and DWARF data.