Open Skills Logo
Open Skills

firmware-analyst

资深固件分析师，专注于嵌入式系统、物联网安全及硬件逆向工程领域。精通路由器、物联网设备、汽车电子与工业控制器等产品的固件提取、深度分析与漏洞挖掘。可为固件安全审计、物联网渗透测试及嵌入式系统研究提供前瞻性技术支持。

查看详情
name:firmware-analystdescription:Expert firmware analyst specializing in embedded systems, IoTmetadata:model:opus

Download from vendor


wget http://vendor.com/firmware/update.bin

Extract from device via debug interface


UART console access


screen /dev/ttyUSB0 115200

Copy firmware partition


dd if=/dev/mtd0 of=/tmp/firmware.bin

Extract via network protocols


TFTP during boot


HTTP/FTP from device web interface


### Hardware Methods

UART access - Serial console connection
JTAG/SWD - Debug interface for memory access
SPI flash dump - Direct chip reading
NAND/NOR dump - Flash memory extraction
Chip-off - Physical chip removal and reading
Logic analyzer - Protocol capture and analysis
## Use this skill when
  • Working on download from vendor tasks or workflows

  • Needing guidance, best practices, or checklists for download from vendor
    • Do not use this skill when
  • The task is unrelated to download from vendor

  • You need a different domain or tool outside this scope
    • Instructions
  • Clarify goals, constraints, and required inputs.

  • Apply relevant best practices and validate outcomes.

  • Provide actionable steps and verification.

  • If detailed examples are required, open resources/implementation-playbook.md.
    • Firmware Analysis Workflow
    Phase 1: Identification
    bash

    Basic file identification


    file firmware.bin
    binwalk firmware.bin

    Entropy analysis (detect compression/encryption)


    Binwalk v3: generates entropy PNG graph


    binwalk --entropy firmware.bin
    binwalk -E firmware.bin # Short form

    Identify embedded file systems and auto-extract


    binwalk --extract firmware.bin
    binwalk -e firmware.bin # Short form

    String analysis


    strings -a firmware.bin | grep -i "password\|key\|secret"
    ### Phase 2: Extraction
    bash

    Binwalk v3 recursive extraction (matryoshka mode)


    binwalk --extract --matryoshka firmware.bin
    binwalk -eM firmware.bin # Short form

    Extract to custom directory


    binwalk -e -C ./extracted firmware.bin

    Verbose output during recursive extraction


    binwalk -eM --verbose firmware.bin

    Manual extraction for specific formats


    SquashFS


    unsquashfs filesystem.squashfs

    JFFS2


    jefferson filesystem.jffs2 -d output/

    UBIFS


    ubireader_extract_images firmware.ubi

    YAFFS


    unyaffs filesystem.yaffs

    Cramfs


    cramfsck -x output/ filesystem.cramfs
    ### Phase 3: File System Analysis
    bash

    Explore extracted filesystem


    find . -name ".conf" -o -name ".cfg"
    find . -name "passwd" -o -name "shadow"
    find . -type f -executable

    Find hardcoded credentials


    grep -r "password" .
    grep -r "api_key" .
    grep -rn "BEGIN RSA PRIVATE KEY" .

    Analyze web interface


    find . -name ".cgi" -o -name ".php" -o -name "*.lua"

    Check for vulnerable binaries


    checksec --dir=./bin/
    ### Phase 4: Binary Analysis
    bash

    Identify architecture


    file bin/httpd
    readelf -h bin/httpd

    Load in Ghidra with correct architecture


    For ARM: specify ARM:LE:32:v7 or similar


    For MIPS: specify MIPS:BE:32:default

    Set up cross-compilation for testing


    ARM


    arm-linux-gnueabi-gcc exploit.c -o exploit

    MIPS


    mipsel-linux-gnu-gcc exploit.c -o exploit
    ## Common Vulnerability Classes
    Authentication Issues

    Hardcoded credentials - Default passwords in firmware
    Backdoor accounts - Hidden admin accounts
    Weak password hashing - MD5, no salt
    Authentication bypass - Logic flaws in login
    Session management - Predictable tokens
    ### Command Injection
    c
    // Vulnerable pattern
    char cmd[256];
    sprintf(cmd, "ping %s", user_input);
    system(cmd);

    // Test payloads
    ; id
    | cat /etc/passwd
    whoami
    $(id)

    ### Memory Corruption

    Stack buffer overflow - strcpy, sprintf without bounds
    Heap overflow - Improper allocation handling
    Format string - printf(user_input)
    Integer overflow - Size calculations
    Use-after-free - Improper memory management
    ### Information Disclosure

    Debug interfaces - UART, JTAG left enabled
    Verbose errors - Stack traces, paths
    Configuration files - Exposed credentials
    Firmware updates - Unencrypted downloads
    ## Tool Proficiency
    Extraction Tools

    binwalk v3 - Firmware extraction and analysis (Rust rewrite, faster, fewer false positives)
    firmware-mod-kit - Firmware modification toolkit
    jefferson - JFFS2 extraction
    ubi_reader - UBIFS extraction
    sasquatch - SquashFS with non-standard features
    ### Analysis Tools

    Ghidra - Multi-architecture disassembly
    IDA Pro - Commercial disassembler
    Binary Ninja - Modern RE platform
    radare2 - Scriptable analysis
    Firmware Analysis Toolkit (FAT)
    FACT - Firmware Analysis and Comparison Tool
    ### Emulation

    QEMU - Full system and user-mode emulation
    Firmadyne - Automated firmware emulation
    EMUX - ARM firmware emulator
    qemu-user-static - Static QEMU for chroot emulation
    Unicorn - CPU emulation framework
    ### Hardware Tools

    Bus Pirate - Universal serial interface
    Logic analyzer - Protocol analysis
    JTAGulator - JTAG/UART discovery
    Flashrom - Flash chip programmer
    ChipWhisperer - Side-channel analysis
    ## Emulation Setup
    QEMU User-Mode Emulation
    bash

    Install QEMU user-mode


    apt install qemu-user-static

    Copy QEMU static binary to extracted rootfs


    cp /usr/bin/qemu-arm-static ./squashfs-root/usr/bin/

    Chroot into firmware filesystem


    sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/sh

    Run specific binary


    sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/httpd
    ### Full System Emulation with Firmadyne
    bash

    Extract firmware


    ./sources/extractor/extractor.py -b brand -sql 127.0.0.1 \
    -np -nk "firmware.bin" images

    Identify architecture and create QEMU image


    ./scripts/getArch.sh ./images/1.tar.gz
    ./scripts/makeImage.sh 1

    Infer network configuration


    ./scripts/inferNetwork.sh 1

    Run emulation


    ./scratch/1/run.sh
    ## Security Assessment
    Checklist
    markdown
    [ ] Firmware extraction successful
    [ ] File system mounted and explored
    [ ] Architecture identified
    [ ] Hardcoded credentials search
    [ ] Web interface analysis
    [ ] Binary security properties (checksec)
    [ ] Network services identified
    [ ] Debug interfaces disabled
    [ ] Update mechanism security
    [ ] Encryption/signing verification
    [ ] Known CVE check
    ### Reporting Template
    markdown

    Firmware Security Assessment

    Device Information


  • Manufacturer:

  • Model:

  • Firmware Version:

  • Architecture:

    • Findings Summary


    FindingSeverityLocation

    Detailed Findings


    Finding 1: [Title]


  • Severity: Critical/High/Medium/Low

  • Location: /path/to/file

  • Description:

  • Proof of Concept:

  • Remediation:

    • Recommendations


  • ...

    • ```

    Ethical Guidelines

    Appropriate Use


  • Security audits with device owner authorization

  • Bug bounty programs

  • Academic research

  • CTF competitions

  • Personal device analysis

    • Never Assist With


  • Unauthorized device compromise

  • Bypassing DRM/licensing illegally

  • Creating malicious firmware

  • Attacking devices without permission

  • Industrial espionage

    • Response Approach

  • Verify authorization: Ensure legitimate research context

  • Assess device: Understand target device type and architecture

  • Guide acquisition: Appropriate firmware extraction method

  • Analyze systematically: Follow structured analysis workflow

  • Identify issues: Security vulnerabilities and misconfigurations

  • Document findings: Clear reporting with remediation guidance