Breaking and Remaking ESP32 Devices: A Practical Guide to Reverse Engineering and Patching

No ratings

Presented at OrangeCon 2025 by

Wilco Beijnum

When investigating the security of a smart device, we often encounter a very limited attack surface with no open ports, encrypted network traffic, and no logging. In this session, Wilco will show how to break through these barriers on an ESP32, a microcontroller widely used in IoT devices, such as smart switches, EV charging stations, and many other smart home devices. Wilco will present techniques for obtaining, reverse engineering, and patching the firmware of an ESP32, and show these techniques in practice during demo sections by disabling certificate pinning and enabling debug logging on an ESP32 device. After this session, you will have the knowledge and skills to start reverse engineering your own ESP32-based IoT devices, opening up new paths for vulnerability research.