Skip to content

ε - Espilon

ESP32 Embedded Agent Framework for Security Research

A minimal ESP32 runtime with encrypted C2, dynamic module loading, and zero hardcoded behavior. Flash a device, inject capabilities at runtime, operate from anywhere.

Quick Start ESPM Reference

Authorized Use Only

Espilon is a security research and educational tool. Use it only in authorized penetration testing engagements, controlled lab environments, CTF competitions, or educational contexts. Unauthorized deployment is illegal.

How it works

Espilon firmware boots into a hollow shell - crypto layer, transport, and the ESPM module loader. There is no hardcoded behavior. Every capability is a signed C module compiled offline, injected into IRAM at runtime over an encrypted Management Protocol channel, and zeroed on unload. A power cycle leaves nothing behind.

graph LR
    subgraph Device["ESP32 Agent"]
        FW["Firmware shell<br/>crypto + transport + ESPM"]
    end

    subgraph Transport["Transport"]
        WIFI["WiFi STA"]
        GPRS["GPRS / PPP"]
    end

    subgraph C3PO["C3PO Operator (Qt6)"]
        UI["Six-view UI + console"]
        PROV["Provision view"]
        MOD["Module compiler / injector"]
    end

    FW --> WIFI & GPRS
    WIFI & GPRS -->|"TCP :2626 · ChaCha20-Poly1305"| UI
    PROV -->|"build + key + flash"| Device
    MOD -->|"signed ELF -> IRAM"| FW

    style Device fill:#1e3a5f
    style C3PO fill:#14532d

Key features

  • Encrypted C2

    ChaCha20-Poly1305 AEAD + HKDF-SHA256. Per-device keys. Random 96-bit nonce per message. Protobuf framing over TCP.

  • Dynamic Modules (ESPM)

    Write a C file, inject it into IRAM at runtime. A 102-syscall table - WiFi, BLE, sockets, GPIO, I2C, UART, crypto. Zeroed on unload.

  • Dual Transport

    WiFi STA for local deployments. GPRS / PPP for remote hardware or anywhere WiFi is unavailable.

  • Multi-chip

    ESP32, S2, S3, C3, C6, H2. Both Xtensa and RISC-V, with per-chip BLE and PSRAM support.

Components

Component What it is
Espilon-Firmware ESP-IDF firmware. Boots into crypto + transport + the ESPM loader. No hardcoded payloads.
C3PO Qt6 operator app. Management Protocol server, six-view UI, module compiler/injector, and built-in provisioning.
ESPM Dynamic module system: C source to relocatable ELF, signed, loaded into IRAM. 102 syscalls, ESPM v0.2.0.

Hardware

Board Arch BLE WiFi GPRS PSRAM
ESP32 Xtensa LX6 No Yes Yes No
ESP32-C6 RISC-V On-demand Yes No No
ESP32-S3 v0.3+ Xtensa LX7 Yes Yes No 8 MB
ESP32-S3 v0.2 Xtensa LX7 No (errata) Yes No 8 MB
LilyGO T-Call Xtensa LX6 No Yes SIM800L No
ESP32-CAM Xtensa LX7 per silicon Yes No 8 MB

Full hardware guide →

Available modules

The current catalog covers network (mod_network), WiFi recon (mod_recon), and wireless offense (mod_redteam, mod_ble, mod_fakeap, mod_mitm). Camera and trilateration are planned for a future version.

Modules reference →