ESP32-Bit-Pirate

CLI Tool

geo-tp/ESP32-Bit-Pirate

Multi-protocol hardware hacking tool for ESP32 with web CLI.

Overview

Firmware that turns ESP32-S3 boards into a multi-protocol analyzer and debugger, supporting I2C, SPI, UART, 1-Wire, JTAG, CAN, infrared, Bluetooth, Wi-Fi, Sub-GHz and RFID. Features sniffing, scripting, EEPROM dumping and web-based terminal access.

README Preview

# ESP32 Bit Pirate\n\n[](https://geo-tp.github.io/ESP32-Bit-Pirate/)\n\n\n**ESP32 Bit Pirate** is open-source firmware that turns your device into a multi-protocol development and analysis tool, inspired by the legendary Bus Pirate.\n\nIt supports sniffing, sending, scripting, and interacting with various digital protocols (I2C, UART, 1-Wire, SPI, etc.) via a serial terminal or web-based CLI. It also communicates with radio protocols like Bluetooth, Wi-Fi, Sub-GHz and RFID.\n\nThe official project website centralizes everything: [ESP32 Bit Pirate Website](https://geo-tp.github.io/ESP32-Bit-Pirate/).\n\nFrom there you can [install the firmware](https://geo-tp.github.io/ESP32-Bit-Pirate/webflasher/), open the [web tools](https://geo-tp.github.io/ESP32-Bit-Pirate/web-tools/), follow [hardware guides](https://geo-tp.github.io/ESP32-Bit-Pirate/hardware/), explore [recipes](https://geo-tp.github.io/ESP32-Bit-Pirate/recipes/), and access the [documentation](https://github.com/geo-tp/ESP32-Bit-Pirate/wiki).\n\n\n\n\n## Features\n\n- Interactive command-line interface (CLI) via **USB Serial or WiFi Web**.\n- **Modes for:**\n   - [HiZ](https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/01-HiZ) (default)\n   - [I2C](https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/05-I2C) (scan, glitch, slave mode, dump, eeprom)\n   - [SPI](https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/06-SPI) (eeprom, flash, sdcard, slave mode)\n   - [UART](https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/03-UART) / [Half-Duplex UART](https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/04-HDUART) (bridge, read, write)\n   - [1WIRE](https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/02-1WIRE) (ibutton, eeprom)\n   - [2WIRE](https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/07-2WIRE) (sniff, smartcard) / [3WIRE](https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/08-3WIRE) (eeprom)\n   - [DIO](https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/09-DIO) (Digital I/O, read, pullup, set, pwm)\n   - [Infrared](https://github.com/geo-t

FAQ (4)

compatibility
Does LoRa mode work on Cardputer ADV with the M5Stack LoRa Cap SX1262?

Yes. Connect the LoRa cap to the Cardputer ADV and use the default pin configuration; the required pins are already preconfigured.

GitHub Issue #160
Troubleshooting
How to fix IRremoteESP8266 splitting long air-conditioner remote raw signals into multiple frames and missing marks/spaces?

The default raw capture buffer is too small. In IRremoteESP8266, kRawBuf = 100 stores only 99 mark/space entries, so long AC remotes such as a repeated 72-bit frame can exceed it and be split or truncated. In InfraredService.cpp, allocate IRrecv with a larger buffer, for example 512:

_receiver = new IRrecv(_rxPin, 512);

Before reallocating on each configure() call, release the previous receiver to avoid leaking the larger buffer:

if (_receiver != nullptr) {
  _receiver->disableIRIn();
  delete _receiver;
  _receiver = nullptr;
}
_receiver = new IRrecv(_rxPin, 512);

Then rebuild and flash the ESP32 Bit Pirate firmware. A temporary alternative is to change kRawBuf in the library's IRrecv.h, but passing the size to the IRrecv constructor and fixing the object lifecycle is the preferred solution.

GitHub Issue #154
Troubleshooting
How do I add support for ESP32-S3-Zero or ESP32-S3 SuperMini with ESP32-S3FH4R2, 4 MB flash, and 2 MB PSRAM?

Use a custom PlatformIO environment/profile based on the ESP32-S3 DevKit and set board_build.flash_size = 4MB. Create a 4 MB partition table, for example partitions_s3_4m.csv:

# Name,     Type, SubType,   Offset,    Size,
nvs,        data, nvs,       0x9000,    0x6000,
phy_init,   data, phy,       0xF000,    0x1000,
factory,    app, factory,   0x10000,   0x390000,
spiffs,     data, spiffs,    0x3A0000,  0x60000,

Reference it with board_build.partitions = partitions_s3_4m.csv, then configure the board-specific GPIOs in the new PlatformIO environment. This layout omits the coredump partition and uses a 384 KB SPIFFS partition to fit the 4 MB flash. If the dedicated environment triggers the memset-related crash from issue #180, calling ::memset() explicitly is a known workaround.

GitHub Issue #151
Troubleshooting
How do I fix IR signal reception or recording not working on M5StickS3 when using the default TX pins?

Use the M5StickS3’s internal IR receiver through the RMT peripheral instead of the default TX pins. Update to a library/firmware version that includes the M5StickS3 IR receive implementation, then configure IR receiving to use RMT reading and decoding as shown in M5Stack’s M5StickS3 IR NEC example. After rebuilding, test recording with an NEC-compatible remote.

GitHub Issue #161