ESP32S3 WROOM1 recovery with openocd and ESP-PROG via JTAG

ESP32S3 recovery.md

Step 1. Enter the boot mode (optional)

If your S3 device is not visible in the devices list (/dev/tty*):

• unpower it
• hold BOOT and RESET
• power it
• unpress RESET
• unpress BOOT

Now you should see it as some /dev/ttyACM0 or /dev/ttyUSB0. I did these steps only because my original firmware that bricked the device was restarting it in infinite loop. That's why I forced the device into the boot mode. It's optional if you see it in the devices list.

Step 2. Connect the JTAG

ESP-Prog JTAG Header   →    ESP32-S3
──────────────────────────────────────
3V3                    →    3.3V   (optional)
GND                    →    GND
TMS                    →    GPIO42 (MTMS)
TCK                    →    GPIO39 (MTCK)  
TDO                    →    GPIO40 (MTDO)
TDI                    →    GPIO41 (MTDI)

Power both ESP-PROG and S3 (powering S3 via USB is OK though might interfere).

Step 3. OpenOCD and telnet

Running openocd requires root priviliges (at least in my case). Esp32 tools come with openocd binary, let's use it.

sudo /home/dizcza/.espressif/tools/openocd-esp32/v0.12.0-esp32-20241016/openocd-esp32/bin/openocd -f board/esp32s3-builtin.cfg

# In another terminal:
telnet localhost 4444

# OpenOCD commands:
> reset halt
> flash erase_sector 0 0 last
> reset
> exit

Instead of flash erase_sector 0 0 last you can use esp32s3 erase_flash however the latter did not work for me.

In your openocd or telnet terminal you should see something similar:

Info : [esp32s3.cpu0] Target halted, PC=0x4038CB86, debug_reason=00000001
Info : Flash mapping 0: 0x10020 -> 0x3c0a0020, 134 KB
Info : Auto-detected flash bank 'esp32s3.cpu0.flash' size 16384 KB
Info : Using flash bank 'esp32s3.cpu0.flash' size 16384 KB
Info : [esp32s3.cpu0] Target halted, PC=0x4038C87E, debug_reason=00000001
Info : PROF: Erased 16777216 bytes in 5246.43 ms

Step 4

Reboot the device. Now it's ready to work.

P.S. I wrote these steps entirely for me.