Reverse engineering of esp32 flash dumps with ghidra or IDA Pro

esptool.py -p /dev/ttyUSB0 -b 460800 read_flash 0 0x400000 flash.bin
./esp32_image_parser.py show_partitions wemos.bin
readelf -h ota_1.elf 
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2’s complement, little endian
Version: 1 (current)
OS/ABI: UNIX — System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: Tensilica Xtensa Processor
Version: 0x1
Entry point address: 0x400811bc
...

Identifying the functions

xtensa-softmmu/qemu-system-xtensa -M esp32 -s -d guest_errors,page -nographic -drive file=wemos.bin,if=mtd,format=raw -global driver=timer.esp32.timg,property=wdt_disable,value=true -no-reboot -s -S
Adding SPI flash device
ets Jul 29 2019 12:21:46
rst:0x1 (POWERON_RESET),boot:0x12 (SPI_FAST_FLASH_BOOT)
M25P80: Read id (command 0x90/0xAB) is not supported by device
configsip: 0, SPIWP:0x00
clk_drv:0x00,q_drv:0x00,d_drv:0x00,cs0_drv:0x00,hd_drv:0x00,wp_drv:0x00
mode:DIO, clock div:1
load:0x3fff0008,len:8
load:0x3fff0010,len:160
load:0x40078000,len:10632
load:0x40080000,len:252
entry 0x40080034
M25P80: Unknown cmd 31
Startup in known elf
xTimerCreateTimerTask
undefined4 main_task(undefined4 param_1){
uint uVar1;
undefined4 uVar2;

uVar1 = _DAT_ram_3ff4808c;
memw();
_DAT_ram_3ff5f048 = _DAT_ram_3ff5f048 & 0xfffffff1;
memw();
memw();
_DAT_ram_3ff4808c = _DAT_ram_3ff4808c & 0xfffffbff;
memw();
uVar2 = FUN_ram_40086098(uVar1);
app_main(uVar2);
vTaskDelete(0);
return param_1;
}
undefined4 app_main(undefined4 param_1){
undefined4 unaff_a10;

setup(unaff_a10);
xTaskCreatePinnedToCore(loop_task,s_?loopTask_ram_3f40324b + 1,0x1000,0,1,0,1);
return param_1;
}
loop_task
xtensa-softmmu/qemu-system-xtensa -M esp32 -s -d guest_errors,page -nographic -drive file=wemos.bin,if=mtd,format=raw -global driver=timer.esp32.timg,property=wdt_disable,value=true -no-rebootxtensa-esp32-elf-gdb.qemu -ex 'target remote:1234' ota_1.elf(gdb) b *0x400d7a90
(gdb) layout asm
(gdb) si
(gdb) p (char *) $a3
$9 = 0x3f400bcb "Dec 23 2017 10:27:52"
The inner loop
Hello, My firstESP32 !
Dec 23 2017 10:27:52

Conclusion

--

--

--

Software Engineer.

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Efficient similarity search for PostgreSQL-backed entities

CCNA 200–301 free training

It’s Time to Talk About the Elephant in the Cloud: We Are in a Hybrid-cloud World for the Next 10…

Android Hack, your competitor doesn’t want your team to know about

🔰 Create High Availability Architecture with AWS CLI 🔰

Agile — The Tech Buzzword

Deep Work in Tech

Functional Programming: Using Swift

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Olof Astrand

Olof Astrand

Software Engineer.

More from Medium

Air and humidity detection system over IoT using Raspberry PI

Bad Logic App — C2 Simulation

Make a USB Rubber Ducky with less than $3

ESP32 Project #7 Bluetooth