Microcontroller Firmware Extraction & PCB Clone
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
In July 2023, Espressif Systems issued security advisory AR2023-005, disclosing a vulnerability discovered by researchers from Raelize and the Technology Innovation Institute (TII) that allows an attacker to bypass both Secure Boot V2 and Flash Encryption on the ESP32 chip revision v3.0 using electromagnetic fault injection (EMFI). This attack was particularly significant because the ESP32 v3.0 silicon had been specifically hardened against voltage fault injection, and Espressif had marketed it as a more secure revision that addressed the boot ROM vulnerabilities of earlier chips. The EMFI attack demonstrated that despite these hardening efforts, the chip remained vulnerable to a different physical attack vector that the designers had not adequately mitigated. By using a precisely controlled electromagnetic pulse to induce a fault in the CPU during the boot sequence, the researchers were able to redirect execution flow directly into the UART Download mode implemented in ROM code, completely bypassing the Secure Boot signature verification and Flash Encryption mechanisms. This case study examines the EMFI attack technique, the specific vulnerability in the ESP32 boot process, and the lessons it offers for secure boot design in embedded systems.
Secure Boot V2 is the second generation of Espressif's secure boot mechanism, designed to ensure that only firmware images signed with a trusted private key can execute on the device. When Secure Boot V2 is enabled, the boot ROM verifies the signature of the second-stage bootloader using an ECDSA public key stored in eFuse memory before passing execution to it. The second-stage bootloader then verifies the signature of the application firmware before launching it, creating a chain of trust rooted in the immutable boot ROM. Flash Encryption works in conjunction with Secure Boot by encrypting the contents of external SPI flash memory using an AES key stored in eFuse, so that even if an attacker physically reads the flash chip, the firmware remains unintelligible. When both features are enabled in their Release mode configurations, the ESP32 provides a robust security posture that prevents unsigned firmware from executing and encrypted firmware from being read. The UART Download mode, a factory programming interface implemented in the boot ROM, allows firmware to be loaded onto the chip over a serial connection for manufacturing and development purposes. In Release mode with Secure Boot and Flash Encryption enabled, the UART Download mode is supposed to be restricted or disabled entirely to prevent it from being used as an attack vector. However, the EMFI attack exploits the fact that the UART Download mode code still exists in the ROM and can be reached if the normal boot flow is disrupted by a fault.
Electromagnetic fault injection is a physical attack technique that uses a pulsed electromagnetic field to induce localized currents in the metal interconnects of an integrated circuit, causing transient faults in the chip's operation. Unlike voltage glitching, which manipulates the chip's power supply globally, EMFI can be targeted at specific regions of the die by positioning a small coil probe above the area of interest. The electromagnetic pulse is generated by discharging a capacitor through a fine coil, creating a rapidly changing magnetic field that penetrates the chip package and induces voltages in the silicon's metal traces. When applied to a microcontroller during a critical operation, EMFI can cause the CPU to skip instructions, corrupt register values, or alter the program counter, similar to voltage glitching but with greater spatial precision. The ESP32 v3.0's hardening against voltage fault injection included adding glitch detectors on the power supply rails and implementing redundant checks in the boot ROM code. However, these countermeasures are designed to detect anomalies in the global power supply, not localized electromagnetic interference that affects only specific logic gates. The researchers discovered that by positioning the EMFI probe above the CPU core region of the ESP32 die and firing the pulse at a precise moment during the boot sequence, they could reliably cause a fault that redirected execution to the UART Download mode, bypassing all security checks. The attack requires specialized equipment including an EMFI pulse generator, a precision positioning stage for the coil probe, and a means of synchronizing the pulse with the boot sequence, but the overall setup cost is modest compared to the value of the firmware being protected.
The EMFI attack on the ESP32 begins with physical preparation of the target device. The attacker removes the ESP32 chip's metal shielding can if present and may decapsulate the chip to expose the silicon die, though the researchers found that the attack works through the plastic package with sufficient pulse energy. A small electromagnetic coil probe, typically with a tip diameter of a few hundred micrometers, is mounted on a precision XYZ positioning stage and placed above the CPU core region of the die. The target device is connected to a host computer via its UART interface, and the power supply is controlled to allow precise timing of the boot sequence. The attack itself involves repeatedly resetting the ESP32 and firing the EMFI pulse at increasingly precise moments during the boot process. The researchers used a systematic search approach, sweeping the pulse timing across the entire boot sequence while monitoring the UART output for signs that the device had entered Download mode. When the pulse is fired at the correct moment, it causes a fault in the CPU's execution of the boot ROM code that skips the Secure Boot verification check and the Flash Encryption initialization, causing the CPU to jump directly to the UART Download mode handler. Once in Download mode, the attacker can use standard ESP32 flashing tools to read and write memory, load arbitrary code into RAM, and extract the decrypted firmware contents. The researchers found that the attack has a success rate of approximately one in ten attempts once the optimal pulse parameters are identified, making it practical for real-world exploitation. The entire process from initial setup to successful firmware extraction typically takes several hours, with most of the time spent on identifying the correct pulse timing and probe position.
The specific vulnerability exploited by the EMFI attack lies in the structure of the ESP32 boot ROM and the way it handles the transition between normal boot and UART Download mode. During a normal boot with Secure Boot and Flash Encryption enabled, the boot ROM performs a series of initialization steps including configuring the flash encryption hardware, verifying the bootloader signature, and then jumping to the second-stage bootloader. The UART Download mode is entered only if a specific GPIO strap pin is asserted during reset, or if no valid bootloader image is found in flash. The boot ROM code checks these conditions sequentially and branches accordingly. The EMFI pulse targets the conditional branch instruction that decides whether to enter normal boot or Download mode. By inducing a fault at the exact moment this branch is evaluated, the attacker can cause the CPU to take the wrong branch, entering Download mode even though the conditions for normal boot are met. Crucially, when the fault causes entry into Download mode, the flash encryption hardware has not yet been fully initialized, and the secure boot verification has been skipped. This means that the Download mode handler operates in an unprotected state, allowing the attacker to read flash memory in plaintext and execute arbitrary code. The ESP32 v3.0's hardening against voltage glitching added redundant checks for the boot mode decision, but these checks are all performed in the same CPU core and are therefore all susceptible to the same EMFI pulse. A truly robust implementation would require the boot mode decision to be verified by an independent hardware module that cannot be affected by a single localized fault, a design principle known as spatial redundancy that is common in high-security automotive and aerospace microcontrollers but absent from the cost-optimized ESP32.
The EMFI attack on the ESP32 has significant implications for the security of IoT devices that rely on Secure Boot and Flash Encryption for firmware protection. By bypassing both mechanisms simultaneously, the attack allows an attacker to extract plaintext firmware, modify firmware, and load arbitrary code onto the device, completely undermining the security guarantees that these features are designed to provide. For device manufacturers, this means that any ESP32-based product that may be physically accessible to attackers cannot be considered secure against firmware extraction or modification, regardless of the security features enabled. The attack is particularly concerning for devices that handle sensitive data or perform security-critical functions, such as smart locks, security cameras, industrial sensors, and connected medical devices. The fact that the attack works on the v3.0 silicon revision, which was specifically hardened against fault injection, demonstrates the difficulty of achieving robust physical security in cost-optimized consumer chips. Espressif's advisory noted that the attack requires physical access and specialized equipment, and recommended that customers assess their threat model to determine whether the risk is acceptable for their use case. However, the decreasing cost and increasing availability of EMFI equipment, including open-source designs that can be built for under a thousand dollars, mean that this attack vector is becoming accessible to a growing number of potential adversaries. The attack also has implications for the broader embedded security community, as it demonstrates that hardening against one type of fault injection (voltage) does not automatically provide protection against other types (electromagnetic), and that comprehensive physical security requires defense against all known fault injection techniques.
In response to the EMFI vulnerability disclosure, Espressif issued security advisory AR2023-005, which acknowledged the issue and provided recommendations for mitigating the risk. The advisory stated that the vulnerability affects ESP32 chip revision v3.0 when Secure Boot V2 and Flash Encryption are enabled in Release mode, and that the attack requires physical access to the device and specialized EMFI equipment. Espressif recommended that customers who require protection against physical fault injection attacks consider using the ESP32-C3, ESP32-S3, or newer chip families, which include additional security features and are designed with more robust fault injection countermeasures. For existing ESP32-based products, Espressif suggested implementing physical tamper detection mechanisms that erase sensitive data or disable the device when the enclosure is opened, and ensuring that sensitive cryptographic keys and credentials are not stored in flash memory even with encryption enabled. At the application level, developers can implement additional integrity checks that verify the firmware has not been modified at runtime, and can use secure elements or trusted platform modules for storing sensitive keys outside the ESP32's flash memory. The advisory also noted that Espressif would continue to improve the physical security of its chips in future revisions, incorporating lessons learned from this and other disclosed vulnerabilities. For high-security applications, the most robust mitigation is to avoid storing any sensitive information on the ESP32 itself and to use a dedicated secure element for all cryptographic operations, ensuring that even a complete compromise of the ESP32 does not expose sensitive key material.
The ESP32 EMFI attack offers several important lessons for the design of secure boot mechanisms in embedded systems. First, it demonstrates that secure boot implementations must consider all types of physical fault injection, not just the most common or well-known techniques. The ESP32 v3.0 was hardened against voltage glitching but remained vulnerable to EMFI, illustrating the principle that security is only as strong as the weakest link. Second, the attack highlights the importance of spatial and temporal redundancy in security-critical code paths. If the boot mode decision had been verified by multiple independent hardware modules at different times, a single EMFI pulse would not have been sufficient to bypass it. Third, the case shows that the presence of a factory programming interface like UART Download mode in the boot ROM creates a persistent attack surface that must be carefully protected, even when it is supposed to be disabled in production configurations. A more secure design would physically remove or permanently disable the Download mode code when the device is configured for production, rather than relying on software checks that can be bypassed through fault injection. Fourth, the attack underscores the value of defense-in-depth, where multiple independent security mechanisms are layered so that the failure of one does not compromise the entire system. If the ESP32 had stored encryption keys in a separate secure element or had implemented runtime firmware integrity checking independent of the boot process, the EMFI bypass of secure boot would not have led to complete system compromise. Finally, the case demonstrates that security is an ongoing process, not a one-time design goal, and that chip vendors must remain engaged with the security research community to identify and address vulnerabilities as new attack techniques emerge.
Electromagnetic fault injection has evolved from a laboratory curiosity to a practical attack vector that security professionals must consider when evaluating embedded device security. The decreasing cost of EMFI equipment, including open-source designs based on inexpensive pulse generators and 3D-printed coil positioning stages, has made this attack technique accessible to a growing community of researchers, hobbyists, and potential adversaries. The ESP32 EMFI attack has contributed to this trend by providing a well-documented example of how EMFI can be used to bypass state-of-the-art security features on a widely deployed chip. Researchers have since adapted the EMFI technique to attack other microcontrollers and system-on-chips, including the NXP i.MX RT series, the Microchip SAM D5x/E5x family, and various automotive microcontrollers, demonstrating that the technique is broadly applicable across different chip architectures and manufacturers. The EMFI attack has also been combined with side-channel analysis to create more powerful hybrid attacks, where the electromagnetic probe is used both to inject faults and to measure the chip's electromagnetic emanations for side-channel analysis. This dual-use capability allows an attacker to first characterize the chip's behavior through EM side-channel analysis and then use that characterization to precisely target fault injection at the most vulnerable moments. The ESP32 EMFI case has also prompted research into EMFI countermeasures at the chip level, including the use of metal shielding layers that attenuate electromagnetic fields, on-chip EM sensors that detect abnormal field strengths, and redundant computation that can detect and correct faults caused by EM injection. These countermeasures, while adding cost and complexity to chip design, are increasingly being included in high-security microcontrollers and secure elements. For device manufacturers, the ESP32 EMFI attack highlights the importance of physical security testing as part of the product development lifecycle. Many manufacturers focus their security testing on software vulnerabilities and network attacks, neglecting physical attack vectors that can be equally or more damaging. The availability of low-cost EMFI equipment means that physical security testing is no longer prohibitively expensive, and manufacturers should include fault injection testing in their security evaluation processes. The ESP32 case also demonstrates the value of coordinated vulnerability disclosure, as Espressif was given the opportunity to assess the vulnerability and provide guidance to customers before the attack was publicly disclosed. This responsible disclosure approach allows manufacturers to prepare mitigations and inform customers without leaving them vulnerable to unknown attacks. Looking forward, the EMFI threat is likely to grow as equipment becomes more capable and less expensive, and as researchers develop more sophisticated techniques for targeting specific regions of increasingly complex chips. The development of automated EMFI scanning systems, which can systematically probe different locations on a chip die to identify the most vulnerable points, will further lower the barrier to entry for this attack technique. For the embedded security community, the ESP32 EMFI attack serves as both a warning and a call to action, emphasizing the need for continued investment in physical security research and the development of robust countermeasures that can protect against the full spectrum of physical attack techniques.
Electromagnetic fault injection can bypass both Secure Boot V2 and Flash Encryption on the ESP32. The attack targets the CPU core during the boot sequence with a localized EM pulse. It redirects execution to the UART Download mode in ROM code. The ESP32 v3.0 was hardened against voltage glitching but not EMFI. The attack requires specialized EMFI equipment and physical access. Success rate is approximately one in ten attempts with optimal parameters. Espressif issued advisory AR2023-005 acknowledging the vulnerability. Newer ESP32 chips include improved fault injection countermeasures. Physical tamper detection can provide an additional layer of protection. EMFI can be targeted more precisely than voltage glitching. The boot ROM's UART Download mode code creates a persistent attack surface. Spatial redundancy in security checks could mitigate this attack. The attack was discovered by Raelize and Technology Innovation Institute. EMFI equipment is becoming more affordable and accessible. IoT devices must be designed with physical security in mind. The ESP32 EMFI case demonstrates the need for comprehensive fault injection protection. Voltage hardening does not automatically protect against EMFI. Defense-in-depth remains the most reliable strategy. This attack has implications for all ESP32-based security products. The lessons apply broadly to IoT microcontroller security.
The electromagnetic fault injection attack on the ESP32 represents a significant advance in physical attack techniques against IoT microcontrollers, demonstrating that even chips hardened against voltage glitching remain vulnerable to alternative fault injection methods. By precisely targeting the CPU core with an electromagnetic pulse during the boot sequence, researchers were able to bypass both Secure Boot V2 and Flash Encryption, gaining complete access to the device's firmware and functionality. The attack serves as a powerful reminder that physical security requires comprehensive protection against all known attack vectors, and that reliance on a single hardening measure is insufficient. For the IoT industry, this case underscores the importance of defense-in-depth strategies, continuous security evaluation, and the adoption of chips with robust, independently verified physical security features for security-sensitive applications. As EMFI equipment becomes more affordable and accessible, the threat posed by this attack vector will only grow, making it essential for chip designers and device manufacturers to prioritize physical security in their future products.