38C3

Liberating Wi-Fi on the ESP32
2024-12-27 , Saal 1
Language: English

Reverse engineering the Wi-Fi peripheral of the ESP32 to build an open source Wi-Fi stack.


During the 38c3, there are probably multiple thousands of ESP32s in the CCH, all of which run a closed source Wi-Fi stack. And while that stack works, it would be nicer to have an open source stack, which would grant us the ability to modify and audit the software, which carries potentially sensitive data.

So we set to work, reverse engineering the proprietary stack and building a new open source one. We soon discovered just how versatile the ESP32 can be, both as a tool for research and IoT SoC, when its capabilities are fully unlocked. This includes using it as a pentesting tool, a B.A.T.M.A.N. mesh router or an AirDrop client.

You'll learn something about Wi-Fi, the ESP32, reverse engineering in general and how to approach such a project.

Hi! I'm Simon. I like writing code in Rust, and through a series of events got nerd-sniped into working with Wi-Fi and Radio communications in general.