diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..57b6a08
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "firmware/esp32_firmware_patching_framework"]
+	path = firmware/esp32_firmware_patching_framework
+	url = https://github.com/Matheus-Garbelini/esp32_firmware_patching_framework
diff --git a/README.md b/README.md
index 84f9aa3..b844d72 100644
--- a/README.md
+++ b/README.md
@@ -18,7 +18,8 @@ Differently than <u>**passive**</u> sniffers, which do not interact with the BT
     - [Example 1 - Connect to remote target (Master Role)](#example-1---connect-to-remote-target-master-role)
     - [Example 2 - Wait for BT connection (Slave Role)](#example-2---wait-for-bt-connection-slave-role)
     - [Example 3 - HCI Bridge Mode (connect with other BT Host stack)](#example-3---hci-bridge-mode-connect-with-other-bt-host-stack)
-- [3) Customising BT Host programs (Profiles)](#3-customising-bt-host-programs-profiles)
+- [3) Compile firmware from source (ESP32 Patching Framework)](#3-compile-firmware-from-source-esp32-patching-framework)
+- [4) Customising BT Host programs (Profiles)](#4-customising-bt-host-programs-profiles)
 - [Software Architecture of BrakTooth Sniffer](#software-architecture-of-braktooth-sniffer)
 - [Features Overview](#features-overview)
 - [Acknowledgements](#acknowledgements)
@@ -93,7 +94,22 @@ Lastly, the `--bridge-only`  only creates the HCI pseudo terminal (/dev/pts/x) s
 <img src="docs/mode_bridge_only.png" alt="mode_bridge_only" width="600" height="auto" />
 </p>
 
-### 3) Customising BT Host programs (Profiles)
+
+### 3) Compile firmware from source (ESP32 Patching Framework)
+
+The source code can be built directly from the [ESP32 Firmware Patching Framework](https://github.com/Matheus-Garbelini/esp32_firmware_patching_framework) repository as follows:
+
+```bash
+cd firmware
+./build_from_source.sh # clone submodule & build firmware with platformio environment 'sniffer-serial'
+./firmware.py flash <serial port> # flash built firmware to ESP32 via serial port
+```
+
+The ESP32 firmware binaries (firmware.bin, bootloader.bin, partitions.bin) are copied to `firmware` folder upon successful build. Then, you can proceed to flash the firmware as described in [step 1.B)](https://github.com/Matheus-Garbelini/esp32_bluetooth_classic_sniffer#b-flash-custom-firmware-to-esp32).
+
+
+
+### 4) Customising BT Host programs (Profiles)
 
 Since *BrakTooth* sniffer uses a BT host stack to guide connectivity, the following modified BlueKitchen examples are used:
 
diff --git a/firmware/bootloader.bin b/firmware/bootloader.bin
index 9cc9f03..5fd2819 100644
Binary files a/firmware/bootloader.bin and b/firmware/bootloader.bin differ
diff --git a/firmware/build_from_source.sh b/firmware/build_from_source.sh
new file mode 100755
index 0000000..92b0153
--- /dev/null
+++ b/firmware/build_from_source.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+git submodule init
+git submodule update
+cd esp32_firmware_patching_framework
+./firmware.py build sniffer-serial
+cp .pio/build/sniffer-serial/bootloader.bin ../
+cp .pio/build/sniffer-serial/partitions.bin ../
+cp .pio/build/sniffer-serial/firmware.bin ../ && echo 'Done. flash built firmware via ./firmware.py flash <serial port>'
diff --git a/firmware/esp32_firmware_patching_framework b/firmware/esp32_firmware_patching_framework
new file mode 160000
index 0000000..8b9fb46
--- /dev/null
+++ b/firmware/esp32_firmware_patching_framework
@@ -0,0 +1 @@
+Subproject commit 8b9fb4667e3c5c1faef8e375b8362f287818b106
diff --git a/firmware/firmware.bin b/firmware/firmware.bin
index 4b489c4..13fbb4e 100644
Binary files a/firmware/firmware.bin and b/firmware/firmware.bin differ