Close
0%
0%

ESP32 Bit Pirate

A Hardware Hacking Tool With Web-based CLI That Speaks Every Digital & Radio Protocol

geoGeo
Similar projects worth following
ESP32 Bit Pirate is an open-source firmware that turns your device into a multi-protocol hacker's tool, inspired by the legendary Bus Pirate.

It supports sniffing, sending, scripting, and interacting with various digital protocols (I2C, UART, 1-Wire, SPI, etc.) via a serial terminal or web-based CLI. It also communicates with radio protocols like Bluetooth, Wi-Fi, Sub-GHz and RFID.

Use the ESP32 Bit Pirate Web Flasher to install the firmware in one click. See the Wiki for step-by-step guides on every mode and command. Check ESP32 Bus Pirate Scripts for a collection of scripts.

Everything about the project: ESP32 Bit Pirate Website

Getting Started

Banner of the ESP32 Bus Pirate web flasher

  • 🔧 Flash the firmware
  • 🔌 Connect via Serial or Web
  • 🧪 Use commands like:
    mode
    help
    scan
    sniff
    ...

Wiki

Banner of the ESP32 Bit Pirate Wiki page

📚 Visit the Wiki for detailed documentation on every mode and command.

Includes:

The wiki is the best place to learn how everything works.

Scripting

Banner of the ESP32 Bit Pirate Scripts page

🛠️ You can automate interactions with the ESP32 Bit Pirate using Python scripts over serial.

Examples and ready-to-use scripts are available in the repository: ESP32 Bus Pirate Scripts.

Including: Logging data in a file, eeprom and flash dump, interracting with GPIOs, LED animation...

bit_pirate_17_cardputer-adv.bin

octet-stream - 3.86 MB - 08/14/2026 at 12:23

Download

bit_pirate_17_xiao-esp32s3.bin

octet-stream - 3.63 MB - 08/14/2026 at 12:23

Download

bit_pirate_17_heltec_wifi_lora_32_V4.bin

octet-stream - 3.64 MB - 08/14/2026 at 12:23

Download

bit_pirate_17_t-embed-s3-cc1101plus.bin

octet-stream - 3.79 MB - 08/14/2026 at 12:23

Download

bit_pirate_17_m5stack-sticks3.bin

octet-stream - 3.86 MB - 08/14/2026 at 12:23

Download

View all 31 files

  • 1 × ESP32S3 Dev-Kit Works on all ESP32S3

  • v1.7

    Geo3 days ago 0 comments

    Changelog

    WEBSITE

    🔹 ESP32 Bit Pirate is evolving from a standalone firmware into a broader ecosystem built around the firmware, supported hardware and browser-based tools.
    🔹 New Web Tools extend the project directly from the browser, making common debugging, programming and analysis workflows easier to access without installing dedicated software.

    https://geo-tp.github.io/ESP32-Bit-Pirate/

    LORA

    🔹 Added a new LoRa mode for SX1262 transceivers, with packet transmission, reception and RF analysis.

    `send`, `receive`, `rssi`, `scan`, `waterfall`, `cad`
    🔹 Send and receive LoRa packets, monitor RSSI and scan frequency activity.

    `record` / `load`
    🔹 Record LoRa packets to LittleFS and replay them later with their radio configuration.

    `meshtastic`
    🔹 Added a dedicated Meshtastic analysis shell to send, receive and inspect Meshtastic packets.

    `config`
    🔹 Configure SX1262 pins, frequency, bandwidth, spreading factor, coding rate, TX power, preamble, sync word and radio options.

    https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/24-LORA

    USB

    `BPIO2`
    🔹 Added a BPIO2 USB adapter for GPIO, I2C and SPI control from a host computer.
    🔹 Added sequence import/export and microsecond delay support for BPIO2 workflows.
    🔹 Added a browser-based BPIO2 controller through Web Serial.

    https://geo-tp.github.io/ESP32-Bit-Pirate/web-tools/bpio2/

    `Flashrom SPI Programmer`
    🔹 Increased the transfer buffer size.

    https://geo-tp.github.io/ESP32-Bit-Pirate/web-tools/spi-flash-programmer/

    🔹 Standardized the USB product name as `ESP32 Bit Pirate` across boards.
    🔹 Updated USB PID handling to avoid stale host-side USB configuration caching.

    https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/99-Adapters

    I2C

    `dump` - Thanks to @mvanhorn.
    🔹 Added a raw-read fallback for devices that do not expose a traditional register interface.
    🔹 Regular register devices still use the full register scan behavior.

    INFRARED

    🔹 Increased the raw receive buffer from 100 to 512 entries to capture longer infrared signals.
    🔹 Fixed the IR receiver lifecycle when reconfiguring pins, preventing old receive buffers from leaking.

    Thanks to @82ghost82.

    WIFI

    🔹 Wi-Fi is now properly deinitialized and reinitialized after spam/flood operations.

    NEW BOARDS

    🔹 Added support for the Heltec Vision Master T190, including its built-in SX1262 LoRa radio.
    heltec-t190_s

    🔹 Added a dedicated Heltec WiFi LoRa 32 V4  and onboard SX1262 support.
    heltec-lora-32-v4_s

    🔹 Added initial Waveshare ESP32-S3-GEEK build support. Thanks to @iodn.
    waveshare-s3-geek_s

    MISC

    🔹 Pinned the ESP32 Arduino platform version as a temporary workaround for excessive RAM usage with the latest framework.

    🔹 Various reliability, cleanup and resource-management improvements.

    LINKS

    * Use the Web Flasher: https://geo-tp.github.io/ESP32-Bit-Pirate/webflasher/
    * Collection of scripts: https://github.com/geo-tp/ESP32-Bus-Pirate-Scripts
    * Full guide: https://github.com/geo-tp/ESP32-Bit-Pirate/wiki
    * Bus Expander: https://github.com/geo-tp/ESP32-Bus-Expander
    * ESP32 Bit Pirate Dock: https://github.com/AndreiVladescu/ESP32-Bit-Pirate-Dock

    bit_pirate_dock_board

    Get the Dock on PCBWAY

  • v1.6

    Geo06/12/2026 at 22:35 0 comments

    Changelog

    PIRATE ASSISTANT

    🔹 Added the Pirate Assistant to the WebUI.

    image

    https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/99-Assistant

    TERMINAL MODE - WIFI HOTSPOT

    🔹 The device can now create its own Wi-Fi hotspot. 🔹 Connect directly to the hotspot from a phone or computer to access the Web CLI without requiring an existing Wi-Fi network.

    https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/00-Terminal

    GENERAL

    wizard 

       🔹 has been reworked to reduce false-positive signal type detection.

    UART

    sniff [raw] - Thanks to @fdufnews

       🔹 Passively monitor UART activity without transmitting data.

    scan and autobaud 

       🔹 Reworked for more precise UART activity and baud-rate detection.

    I2C

    trace <addr> [reg] [ms] 

       🔹 Continuously monitor a specific register and display its changes.

    USB

    adapters 

       🔹 Added a dedicated USB adapter selection shell to transform your device into hardware USB adapters.

    image

    Available adapters

    USB-UART Bridge 

       🔹 Expose a USB CDC serial port connected to configurable UART RX/TX GPIOs.

    Flashrom SPI Programmer 

       🔹 Expose a serprog-compatible SPI programmer for use with flashrom.

    AVRDUDE Bus Pirate SPI Programmer 

        🔹 Implement the legacy Bus Pirate binary SPI protocol used by avrdude -c buspirate.

    SUMP Logic Analyzer 

       🔹 Transform the device into a SUMP-compatible logic analyzer for sigrok and PulseView.

       🔹 Supports the display and configuration of up to eight GPIO channels.

    OpenOCD Bus Pirate Adapter 

       🔹 Expose a Bus Pirate-compatible JTAG interface for OpenOCD.

    USB IR Toy / LIRC Adapter 

      🔹 Emulate a USB IR Toy-compatible device for infrared tools such as LIRC.

    SubGHz Raw CDC CC1101 Adapter 

      🔹 Expose the CC1101 through a simple USB CDC protocol for configuration, raw capture and transmission.

    https://github.com/geo-tp/ESP32-Bit-Pirate/wiki/99-Adapters

    JTAG

    openocd 

       🔹 Directly configure and reboot the device as an OpenOCD-compatible USB adapter.

    BLUETOOTH

    mouse 

       🔹 Corrected BLE HID mouse and keyboard report definitions.

    MISC

    🔹 The project has been renamed from ESP32 Bus Pirate to ESP32 Bit Pirate across the firmware

    🔹 Configured GPIOs are now automatically protected from duplicate assignments.

    🔹 Inactive WebSocket connections are now properly closed to prevent unexpected WebUI disconnections.

    🔹 Improved the smart-card PSC prompt to make PIN/security operations less confusing.

    🔹 Improved HTTP server and hotspot-mode initialization.

    🔹 Harmonized data prompt for flash and eeproms operations.

    🔹 Reworked SubGHz reception around a ring buffer to avoid losing pulses while captured data is transferred or displayed.

    🔹 Fixed CC1101 initialization on ESP32-S3 devices. Thanks to @AmorFati-coder.

    🔹 The CC1101 is now properly deinitialized after transmit operations. Thanks to @manato-tajiri.

    🔹 Various reliability, cleanup and resource-release improvements.

    LINKS

  • V1.1

    Geo09/29/2025 at 23:37 0 comments

    v1.1 Latest


    Changelog

    I2C

    • sniff 🔹 More readable data, improvements.

    DIO

    • pulldown <pin> 🔹 Active pulldown resistor on given pin

    SUBGHZ

    • load 🔹 Fixes and improvements.
    • listen 🔹 RSSI to audio mapping (using I2S configured output or internal speaker if any)
    • replay 🔹 Fixes and improvement.

    STANDALONE TERMINAL MODE (New)

    Use arrows up/down to scroll and esc to scroll down line by line. Use tab for command history.

    standalonemode_s

    MISC

  • V1.0 Changelog

    Geo09/26/2025 at 09:45 0 comments

    v1.0 Latest

    Changelog

    INFRARED

    WIFI

    SUBGHZ

    RF24 (New mode)

    • scan
      🔹 Search best active channel.
    • sniff
      🔹 Sniff raw frames.
    • sweep
      🔹 Analyze channels activity.
    • jam
      🔹 Jam selected channels group.
    • setchannel
      🔹 Set operating channel.
    • config
      🔹 Configure NRF24 settings.

    LittleFS (Storage / Import & Export)

    image

    New Device Supported

    • M5Cardputer ADV

    image

    Misc / Notes

View all 4 project logs

  • 1
    Flash the firmware

    Banner of the ESP32 Bit Pirate web flasher

    1. 🔧 Flash the firmware

    2. 🔌 Connect via Serial or Web

    3. 🧪 Use commands like:

      mode
      help
      scan
      sniff
      ...
      

  • 2
    Documentation

    Banner of the ESP32 Bit Pirate Wiki page

    📚 Visit the Wiki for detailed documentation on every mode and command.

    Includes:

    The wiki is the best place to learn how everything works.

  • 3
    Scripting

    Banner of the ESP32 Bit Pirate Scripts page

    🛠️ Automate interactions with the ESP32 Bit Pirate using Python scripts over serial.

    Examples and ready-to-use scripts are available in the repository: ESP32 Bit Pirate Scripts.

    Including: Logging data in a file, eeprom and flash dump, interracting with GPIOs, LED animation...

View all 5 instructions

Enjoy this project?

Share

Discussions

mbt28 wrote 10/02/2025 at 09:55 point

Hello,

Thank you for the nice project. I tried it with my esp32-s3 for I2C debugging however it is a bit difficult to understand output especially if there is so much bus communication. I wish it is able to output slave address in hex and indicate read/write condition and share the data in hex until the message completes.

  Are you sure? yes | no

Geo wrote 10/02/2025 at 13:13 point

If you're talking about the I2C sniffer, it has been reworked in version 1.1 to display the data in a more readable way.

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates