What problem does it solve? CTF firmware challenges often hide flags inside layered images, partition tables, and boot or update chains, and jumping straight to interesting files wastes time and corrupts evidence. This Skill provides a structured workflow for unpacking firmware, tracing how it boots and updates, and reducing the image to the smallest path that reaches the decisive artifact. ## Core Features & Use Cases - Image Layout Mapping: Identify containers, partition headers, compression, filesystems, and nested images while recording offsets, sizes, and hashes before extraction. - Boot and Update Chain Tracing: Follow control flow from bootloader to kernel to init to services, or from update package to verifier to installer, noting which credentials and configs each stage consumes. - Evidence Packaging: Keep pristine images, extracted layers, and patched copies separate while recording keys, signatures, and entrypoints in one compact evidence chain. - Use Case: Given a router firmware image in a CTF, map its partitions, trace the init scripts that load a hardcoded credential, and prove exactly where the boot flow consumes it to reach the flag. ## Quick Start After the ctf-sandbox-orchestrator has routed here, ask the assistant to unpack the firmware image, map its partition layout, and trace the boot chain to the flag artifact.
