I recently read the Unlimited Results: Breaking Firmware Encryption of ESP32-V3 paper. This paper is about breaking the firmware encryption feature of the ESP32 SoC using a Side-Channel attack. This was an interesting read, and soon, I wanted to try to reproduce these results with the following constraints: To understand everything about this attack, I wanted to start from scratch, even if it meant sometimes reinventing the wheel. I wanted to keep things low-cost. This means no five-figure digital oscilloscope could be used, as it’s sometimes the case for such attacks. A few weeks later, not only have I been able to reproduce the paper’s results regarding the ESP32, but I have also: Mounted a similar attack against the ESP32-C3 and ESP32-C6. Mounted a secure boot bypass attack based on voltage glitches for both the ESP32-C3 and ESP32-C6. The first article will detail the side-channel attacks, starting from the basics. A second one will focus on Secure Boot bypass techniques.