RSSAmplifier

Blog

ESP32 open MAC

Recent content on ESP32 open MAC

esp32-open-mac.beRSS feed ↗14 posts

Latest posts

Year in review: 2025

During the past year, quite a lot happened within the esp32-open-mac project (and within the broader ESP32 reverse engineering community in general), both code-wise and event-wise. Events: We gave a talk at 38C3 (the largest hacker conference in Europe), see https://media.ccc.de/v/38c3-liberating-wi-fi-on-the-esp32 . A paper got published, based in part on the reverse engineering work we did…

First exclusive feature for open ESP32 Wi-Fi stack: standards-compliant meshing

First, a short recap of what this project is doing: the Wi-Fi stack for the ESP32 (a popular, cheap microcontroller) is provided through a binary blob. We’re trying to reverse engineer the software and hardware to build our own open-source Wi-Fi stack. This will enable features that the current, closed source ESP32 Wi-Fi implementation does not have, for example 802.11s mesh networking. It…

Reverse engineering WPA crypto acceleration on ESP32

This is a more technical blob post about a specific aspect of the ESP32 Wi-Fi hardware; see previous blog posts for a more general overview. In one of the previous blog posts, we talked about implementing station mode on the ESP32. We then only implemented connecting to open networks, since there is a bunch of extra work that goes into connecting to WPA protected networks. In this blog post,…

Entirely eliminating the FreeRTOS dependency

We’re writing an open source 802.11 (Wi-Fi) stack for the ESP32. We can currently already connect to an open network, and we can even set the ESP32 to be an open network itself. The biggest hurdle in having an entirely open source stack, is the radio calibration: this is very complex on the ESP32. To get the hardware initialized, we used to call the proprietary API, which would then…

'Liberating Wi-Fi on the ESP32 ' talk at 38th Chaos Communication Congress

Today, we gave a talk at 38C3 about our work on reverse engineering the ESP32 Wi-Fi hardware with the goal of creating an open source MAC stack. You can find the video recording here .

MAC RX filter on the ESP32

This is a more technical blob post about a specific aspect of the ESP32 Wi-Fi hardware; see previous blog posts for a more general overview. A problem we had, was that our MAC got a bit overwhelmed: we used to put it in promiscous mode, so that it received every single Wi-Fi packet in the channel it was listening to. To solve this, the designer of the Wi-Fi MAC in the ESP32 implemented hardware…

'Reverse engineering the ESP32 Wi-Fi hardware' talk at the RIOT Summit 2024

I gave a talk at the Riot Summit 2024 about reverse engineering the ESP32 Wi-Fi hardware. You can watch the subtitled video recording and slides here .

'Reversing the ESP32 Wi-Fi hardware' talk at Gulaschprogrammiernacht 22

Today, I gave a talk about this project at the 22nd Gulaschprogrammiernacht (a hardware/software hacking conference in Germany). You can find the slides here .

Reverse engineering ESP32 Wi-Fi driver: the road ahead

First, a short recap of what this project is doing: the Wi-Fi stack for the ESP32 (a popular, cheap microcontroller) is provided through a binary blob. We’re trying to reverse engineer the software and hardware to build our own open-source Wi-Fi stack. This will enable features that the current, closed source ESP32 Wi-Fi implementation does not have, for example 802.11s mesh networking. It…

Connecting the lwIP stack to our opensource ESP32 Wi-Fi driver

This is the fourth article in a series about reverse engineering the ESP32 Wi-Fi networking stack, with the goal of building our own open-source MAC layer. In the previous articles in this series, we reverse engineered hardware registers for transmitting and receiving Wi-Fi packets. We showed a demo that could transmit hard-coded UDP packets on an open Wi-Fi network. We also built a low-cost…

Building a Faraday cage with data passthrough for ESP32 reverse engineering

First, a short recap of what this project is doing: the Wi-Fi stack for the ESP32 (a popular, cheap microcontroller) is provided through a binary blob. We’re trying to reverse engineer the software and hardware to build our own open-source Wi-Fi stack. If this sounds interesting, I recommend you read the first and second blog posts. However, this is not necessary to read the rest of this…

Unveiling secrets of the ESP32 part 2: reverse engineering RX

This second article talking about reverse engineering the ESP32 Wi-Fi RX registers and showing of the first proof of concept that was able to connect to an access point was posted on the Zeus WPI blog: https://zeus.ugent.be/blog/23-24/esp32-reverse-engineering-continued/

Unveiling secrets of the ESP32: creating an open-source MAC layer

This first article talking about how to start reverse engineering the Wi-Fi hardware registers was posted on the Zeus WPI blog: https://zeus.ugent.be/blog/23-24/open-source-esp32-wifi-mac/

About

Read the introductory blog post on https://zeus.ugent.be/blog/23-24/open-source-esp32-wifi-mac/; other blog posts are on this site. This is a sizeable project that could definitely use multiple contributors; I’d really like to collaborate with other people to create a fully functional, open-source Wi-Fi stack for the ESP32. If you want to help out with developing, feel free to join the…