Liberating Bluetooth on the ESP32

Liberating Bluetooth on the ESP32

Speakers: Antonio Vázquez Blanco (Antón), Research and Development Team, Talogic Security

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=q-_YVIIrF6A

Overview

In this insightful talk, Antonio Vázquez Blanco, known as Antón, from Talogic Security, unveils his extensive work in reverse engineering the undocumented Bluetooth internals of the Espressif ESP32 microcontroller. The presentation, titled "Liberating Bluetooth on the ESP32," addresses a critical gap in Bluetooth security research: the lack of affordable, low-level access to Bluetooth hardware capabilities. Antón's research aims to demystify the ESP32's dual-mode Bluetooth controller, providing the community with the tools and knowledge necessary to perform advanced security assessments and develop custom Bluetooth functionalities.

Antón's motivation stems from a long-standing commitment to Bluetooth security, evidenced by his team's prior work on discoveries like Blue Spy (listening to audio from earbuds) and the development of BISAM, a Creative Commons licensed Bluetooth security assessment methodology akin to OWASP for web applications. Despite these advancements, a significant hurdle remained: the limited control offered by standardized protocols like HCI, which abstracts away much of the critical low-level communication between Bluetooth controllers. This talk details a methodical approach to overcome these limitations on the ESP32, a chip uniquely positioned for this kind of research due to its affordability, widespread availability, and support for both Bluetooth Classic and Bluetooth Low Energy.

The significance of this work extends beyond academic curiosity. By exposing the inner workings of the ESP32's Bluetooth peripheral, Antón is empowering security researchers, developers, and tinkerers to build more robust security tools, identify previously unknown vulnerabilities, and even develop alternative, open-source Bluetooth controller stacks. The talk not only shares the technical findings but also the sophisticated reverse engineering methodology employed, including custom Ghidra plugins and hardware debugging setups, making it a valuable resource for anyone looking to delve into embedded system security.

Background

▶ Watch: Introduction and low-level Bluetooth access problem (0:00)

The architecture of Bluetooth communication fundamentally separates the host (e.g., a PC, smartphone) from the controller (a specialized chip handling radio frequency operations). Communication between the host and the controller typically occurs via a standardized protocol known as HCI (Host Controller Interface). While HCI provides a common interface, it inherently limits the host's ability to directly manipulate the low-level, time-sensitive operations performed by the controller. Most critical communication between Bluetooth devices occurs at these lower layers, controller-to-controller, often remaining opaque to the host and, consequently, to security researchers. This lack of low-level visibility and control has historically hampered comprehensive Bluetooth security assessments and the development of advanced custom tooling.

Recognizing this challenge, Antón and his team at Talogic Security embarked on a mission to find an affordable and accessible hardware platform to gain deeper control over Bluetooth operations. The Espressif ESP32 emerged as the ideal candidate for several compelling reasons. Firstly, it is "dirt cheap" and one of the most widely available microcontrollers supporting both Bluetooth Classic (BR/EDR) and Bluetooth Low Energy (BLE). Secondly, while its Software Development Kit (SDK) is largely open source, it also contains certain closed-source blobs. Crucially, these blobs are Apache licensed, a feature that legally permits reverse engineering and the publication of derived work, providing a solid foundation for Antón's research.

This effort builds upon Talogic Security's established track record in Bluetooth security. Their previous research led to significant findings, including Blue Spy, which demonstrated the ability to intercept audio from Bluetooth earbuds, and the creation of BISAM (Bluetooth Security Assessment Methodology), a comprehensive, Creative Commons licensed framework designed to standardize Bluetooth security assessments, drawing parallels to the OWASP methodology for web application security. Despite these achievements, the team realized that a deeper, more granular understanding and control of Bluetooth hardware were essential to further improve the state of Bluetooth security tooling and analysis.

Key Findings

▶ Watch: Creating a 'golden binary' for reverse engineering (5:30)

Antón's meticulous reverse engineering efforts on the ESP32 unveiled a surprisingly complex Bluetooth peripheral architecture. At its core lies a Bluetooth dual mode core block, which manages radio frequency communication internally and interfaces with the main ESP32 core through three primary mechanisms:

1. Interrupt Line: The Bluetooth core utilizes this line to notify the main core of significant events or when specific handling is required.
2. Registers: The main core can read from and write to specific registers within the peripheral. These registers are crucial for general configuration, including enabling/disabling features, interrupt configuration, and error reporting. Antón's team successfully documented over 40 registers, with 20 of these being "really well documented," providing granular control over aspects such as timing, clocks, and encryption. The findings, including patches for these documented registers, have been submitted upstream to the official ESP packs repository, specifically the ESP Rust community team's patched SVD files, to benefit the wider community.
3. Memory Controller: This acts as the main channel for exchanging information. The peripheral has an internal memory controller capable of reading from and writing to the ESP32's main RAM.

A significant discovery was the shared RAM region, a substantial area containing numerous linked tables. This region is central to the Bluetooth core's interaction and data exchange with other devices. Each table within this shared memory is dedicated to handling specific aspects of Bluetooth communication. Examples include:

• Bluetooth Slot Configuration: Tables that define what each Bluetooth slot should do, such as scanning for devices, advertising its presence, initiating connections, or awaiting incoming connections.
• Frequency Management and Hop Control: Structures that manage the frequencies used and the hopping sequences for robust communication.
• Transmission and Reception Buffers: Dedicated tables for managing data packets being sent and received.
• Other critical structures for encryption, whitelisting, and specific data for EDR (Enhanced Data Rate) and BR (Basic Rate) communications.

A key challenge in this dual-core architecture is managing simultaneous access to the shared RAM by both the Bluetooth core and the main core, compounded by the stringent, fine-timing requirements of Bluetooth communication. Antón's research identified a sophisticated prefetch mechanism designed to address these issues. At the beginning of the shared memory, a 16-event slot table is present. Each of these slots is read and processed, synchronized to a precise 625-microsecond clock. Just before processing an event, the peripheral prefetches the necessary information from the exchange memory, ensuring timely and coordinated operations.

The culmination of this reverse engineering effort is the revelation that the ESP32 hardware, with the newly documented internals, is now sufficiently understood to perform all standard Bluetooth procedures—scanning, advertisement, connection, and awaiting connections—but with low-level access. Furthermore, Antón documented several RF radio frequency testing modes that allow for continuous transmission and reception. This newfound control unlocks unprecedented capabilities for security research, enabling actions previously impossible with the ESP32's standard SDK.

Technical Deep Dive

▶ Watch: Ghidra plugin for loading linker script symbols (6:20)

Antón's journey to "liberate" Bluetooth on the ESP32 involved a rigorous and multi-faceted reverse engineering methodology, combining static analysis with dynamic testing and custom tooling.

The initial phase focused on gathering public information. Espressif, the manufacturer of the ESP32, provides a wealth of public documentation, including ROMs, Bluetooth, and radio frequency libraries within their SDK. Crucially, these ROMs often come with embedded symbols, which proved invaluable for initial understanding. To streamline the analysis of inter-dependent libraries, Antón developed a technique to create a "golden binary." By taking a minimal ESP IDF project, setting the minimal bit property to off, and including all target components, the linker tooling within the SDK would combine everything into a single output file containing all necessary symbols. This significantly eased the process of navigating cross-references within tools like Ghidra, though Antón noted that different ESP IDF versions yield different outputs, necessitating compilation for various versions.

Recognizing that Ghidra couldn't automatically import all valuable context, Antón developed a Ghidra plugin to parse linker scripts found in the SDK. These scripts contain function names and their corresponding addresses. The plugin automatically loads this information into Ghidra, tagging functions with their correct names, thereby providing extensive context for understanding obfuscated code.

A critical step was mapping the peripheral memory. The ESP32's Bluetooth core directly interacts with memory-mapped peripheral regions, which are distinct from standard RAM. While datasheets provide some information, manually mapping these regions is tedious. Antón leveraged the SVD (System View Description) format, a parsible XML format for describing peripheral registers. He wrote another Ghidra plugin (in Java) that imports SVD files, automatically creating memory sections with their correct properties within Ghidra's memory map. He specifically recommended using the ESP Rust community team's patched SVD files over Espressif's official ones, as they offer significantly improved quality and accuracy.

With the memory map established, the next challenge was identifying undocumented memory regions accessed by the Bluetooth code. Antón developed a third, "fairly simple" Ghidra plugin specifically designed to find all code references (reads, writes, data access) to memory regions that were not yet mapped or documented. This plugin generated a list of functions and the undocumented addresses they accessed, prominently featuring functions with "BT" in their names accessing the 3FF71000 base address plus various offsets.

The analysis then transitioned to "elbow grease" – extensive code reading, looking for clues in bitmask function names, debug information (line and file names), and string asserts that sometimes leaked register names. When static analysis proved insufficient, dynamic testing became necessary. This involved building numerous small firmware tests to programmatically read and write values to the identified memory regions. To facilitate deeper debugging, Antón designed custom ESP32 boards with JTAG interfaces and SMA connectors for connecting specialized RF hardware, such as a Cat Sniffer from Electronic Cats and a HackRF. He also utilized cheap RF isolation bags to minimize outside interference during testing in his "fairly radio frequency quiet place."

The detailed architecture revealed the Bluetooth Dual Mode Core as the central processing unit for Bluetooth operations. This core is responsible for the intricate timing and logic of Bluetooth protocols. It communicates with the main ESP32 processor via interrupts for event notifications and directly manipulates configuration registers for overall control. The primary data exchange, however, happens through a dedicated memory controller that accesses the shared RAM. This shared RAM is highly structured, containing various linked tables for managing every aspect of Bluetooth communication, from the configuration of 16 event slots processed every 625 microseconds (the prefetch mechanism) to detailed tables for frequency hopping, encryption, whitelisting, and the management of transmission and reception buffers for both BR/EDR and BLE packets. This intricate interplay allows the ESP32's Bluetooth controller to manage complex, time-critical radio communications efficiently.

Demo / Proof of Concept

▶ Watch: Ghidra plugin for SVD peripheral memory mapping (8:00)

While the talk did not feature a live, interactive demonstration of a specific exploit or tool, Antón thoroughly elaborated on the capabilities and proof-of-concept potential unlocked by his low-level access to the ESP32's Bluetooth peripheral. The essence of the "demo" lies in the newfound ability to perform operations with granular control that were previously impossible or highly restricted via the standard HCI interface.

The core achievement is the ability to execute all standard Bluetooth procedures—scanning, advertisement, connection, and awaiting connections—but with unprecedented low-level control. This means researchers can now:

• Log all low-level radio frequency traffic: This enables comprehensive analysis of Bluetooth communications for compliance, security auditing, and detection of unexpected or malicious traffic patterns.
• Perform per-channel scanning: Unlike standard Bluetooth APIs that abstract channel selection, Antón's work allows researchers to specify and scan on a particular channel, which is crucial for targeted analysis and certain attack methodologies.
• Transmit arbitrary radio frequency traffic: This capability is fundamental for advanced fuzzing and injection attacks. While there are some limitations (memory structures must have "some kind of meaning"), Antón believes that by carefully crafting packets, one can embed arbitrary data within a valid frame, enabling custom protocol fuzzing.
• Follow and sniff connections: By extracting parameters from initial connection packets, researchers can now "follow" an ongoing Bluetooth connection and dump its traffic. This even extends to partial sniffing, where some traffic can be received even without knowing the precise synchronization word, due to a mechanism allowing reception with a certain level of bit error.
• Continuously jam one single channel: This is particularly useful for offensive research, as it can force Bluetooth devices to utilize other advertisement channels, allowing for targeted listening on those alternative channels.
• Modify specific behaviors of a normally working Bluetooth controller: With a full understanding of the reverse-engineered registers and internal logic, it becomes possible to patch or alter specific behaviors of the existing Bluetooth stack, allowing for custom security features or attack vectors to be implemented on the fly without rewriting the entire stack.
• Perform low-level protocol fuzzing: The arbitrary sending and receiving capabilities open the door to fuzzing Bluetooth protocols at a much deeper level than previously possible with the ESP32.

Antón acknowledged one limitation: building a full monitor mode sniffer remains challenging. This is because Bluetooth packets, especially connection packets, contain a synchronization word (preamble) that is generally unknown for arbitrary connections. While partial sniffing is possible, obtaining all Bluetooth packets from the peripheral might not be achievable, as some packets could be handled internally without being exposed to the user. Despite this, the unlocked capabilities represent a significant leap forward for Bluetooth security research on the ESP32.

Defensive Implications

▶ Watch: Ghidra plugin to find undocumented memory regions (10:00)

Antón's work, while primarily focused on enabling offensive security research and deep technical understanding, carries significant defensive implications for the Bluetooth ecosystem, particularly for devices utilizing the ESP32. By "liberating" the ESP32's Bluetooth capabilities, this research empowers defenders in several key ways:

Firstly, the detailed documentation of the ESP32's internal Bluetooth peripheral architecture, including over 40 registers and the intricate shared RAM structure, provides an unprecedented level of transparency. This transparency is crucial for security audits of ESP32-based products. Developers and security professionals can now better understand how Bluetooth is implemented on the chip, identify potential misconfigurations, and proactively pinpoint vulnerabilities that might arise from unintended interactions between the main core and the Bluetooth peripheral.

The ability to log all low-level radio frequency traffic and perform per-channel scanning equips defenders with powerful diagnostic and monitoring tools. They can now meticulously analyze the Bluetooth communications of their own devices to ensure compliance with specifications, detect anomalous behavior, or identify signs of eavesdropping or unauthorized communication. This granular visibility can help in validating the security posture of Bluetooth applications and protocols running on ESP32 hardware.

Furthermore, the capability to transmit arbitrary RF traffic and perform low-level protocol fuzzing allows defenders to proactively test the robustness and resilience of their Bluetooth implementations against sophisticated attacks. By constructing malformed or unexpected packets, they can stress-test their devices, uncover potential denial-of-service vulnerabilities, or identify flaws in state machine handling that an attacker might exploit. This proactive testing is a critical component of a strong defensive strategy.

The research also opens possibilities for custom security mitigations. If a specific vulnerability is identified in the standard ESP32 Bluetooth stack, the ability to "patch something and do the thing work as we want instead of the standard way" means that defenders could potentially implement custom fixes or security enhancements directly at the controller level, even if Espressif has not yet released an official patch. This provides a powerful mechanism for rapid response to emerging threats.

Finally, by fostering a deeper understanding of the ESP32's Bluetooth internals, Antón's work contributes to the development of more advanced open-source Bluetooth security tooling. Such tools, built upon this foundational research, can then be used by a broader community of defenders to secure their own IoT devices and systems, ultimately raising the baseline security for the entire Bluetooth landscape.

Key Takeaways

• Low-Level Bluetooth Access Unlocked: Antón's research provides unprecedented low-level access to the ESP32's dual-mode Bluetooth controller, moving beyond the limitations of the HCI protocol.
• Comprehensive Internal Documentation: A complex Bluetooth peripheral architecture, including over 40 registers, a shared RAM region with linked tables, and a prefetch mechanism, has been extensively documented.
• Advanced Security Research Capabilities: The work enables per-channel scanning, arbitrary RF traffic transmission, connection sniffing (including partial sniffing), channel jamming, and low-level protocol fuzzing on the ESP32.
• Open-Source Tooling and Knowledge Sharing: Custom Ghidra plugins for linker script and SVD file import, along with patches for the ESP packs repository, are released to aid community reverse engineering efforts.
• Foundation for Future Exploration: The project lays the groundwork for further investigation into the ESP32's modem and other radio frequency physical peripherals.
• Challenges Remain for Full Monitor Mode: Despite significant progress, building a full monitor mode sniffer is still difficult due to the unknown synchronization words for arbitrary Bluetooth connections.

About the Speaker(s)

Antonio Vázquez Blanco, known as Antón, is a dedicated security researcher working as part of the Research and Development team at Talogic Security, a company based in Spain. He has a strong background and passion for Bluetooth security, which has driven much of his professional work. His previous contributions to the field include the discovery of vulnerabilities like Blue Spy, which highlighted the ability to intercept audio from Bluetooth earbuds, and the development of BISAM (Bluetooth Security Assessment Methodology), a Creative Commons licensed framework designed to standardize Bluetooth security assessments. Antón is a proponent of open-sourcing research and documentation, particularly for hardware internals, to empower the wider security community. His work on "Liberating Bluetooth on the ESP32" exemplifies his commitment to pushing the boundaries of what is known and accessible in embedded system security.