skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

firmware-analysis

Analyzes embedded device firmware through extraction, static analysis, QEMU emulation, and repackaging.

1.7k|238|Updated Dec 7, 2019
Search Tags:#embedded#reverse engineering#iot security#firmware analysis#UART#binwalk#qemu emulation
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill firmware-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: firmware-analysis
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/hardware/firmware-analysis
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill firmware-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Security assessments of IoT and embedded devices require a structured way to acquire firmware, unpack its filesystem, hunt for hardcoded credentials and vulnerabilities, and emulate binaries—tasks that are otherwise fragmented across dozens of tools and manual steps.

Core Features & Use Cases

  • Firmware Acquisition & Extraction: Obtain firmware via vendor downloads, UART/JTAG, SPI flash reading with flashrom, or mobile app extraction, then unpack with binwalk, unsquashfs, jefferson, and ubireader.
  • Static & Dynamic Analysis: Search extracted filesystems for hardcoded credentials, SSH keys, MQTT/cloud configs, and backdoors, then emulate binaries or full systems with QEMU and Firmadyne for runtime testing.
  • Vulnerability Discovery & Repackaging: Identify command injection, buffer overflows, downgrade attack paths, and uClibc heap exploitation opportunities, then modify and repack firmware images.
  • Use Case: Given a router firmware image, extract its SquashFS filesystem, recover a hardcoded MQTT credential derivation key, emulate the web server under QEMU, and confirm a command injection flaw in a CGI endpoint.

Quick Start

Analyze the firmware image router-fw.bin by extracting its filesystem with binwalk and searching for hardcoded credentials and private keys.

Frequently Asked Questions about firmware-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract a filesystem from a firmware image?▼

Run binwalk -ev firmware.bin for automatic recursive extraction. If signatures are not recognized, locate the filesystem offset with binwalk, carve it with dd, then unpack with unsquashfs, jefferson, cpio, or ubireader depending on the filesystem type.

How to find hardcoded passwords in firmware?▼

Extract the filesystem, then inspect etc/shadow and etc/passwd and grep recursively for password, secret, api_key, and token across configuration files. Automated tools like Firmwalker and EMBA can search the extracted tree for sensitive information.

What tools emulate firmware binaries without physical hardware?▼

QEMU user-mode emulators (qemu-mips, qemu-arm, qemu-aarch64) run individual binaries under chroot against the extracted filesystem. For full-system emulation with network configuration, Firmadyne or Firmware Analysis Toolkit automate the process.

How do I read firmware directly from a SPI flash chip?▼

Use a CH341A programmer with a SOIC-8 clip and run flashrom -p ch341a_spi -r flash.bin. Read the chip twice and compare checksums to verify a consistent dump before analysis.

Why does binwalk fail to extract some firmware images?▼

Extraction fails when the firmware is encrypted, uses unknown magic bytes, or has nonstandard layouts. Check entropy with binwalk -E: high entropy suggests encryption requiring key recovery, while unknown formats need manual hexdump analysis and dd carving.

Can modified firmware be repacked and flashed back to a device?▼

Yes. Modify the extracted filesystem, rebuild it with mksquashfs matching the original compression and block size, reassemble the image with dd or firmware-mod-kit, recompute any CRC checksums, then flash via web UI, TFTP, or flashrom.

Related Skills

Explore More Software Engineering Skills→
mohitmishra786mohitmishra786
159

openocd-jtag

Configure OpenOCD for JTAG and SWD debugging with GDB.

Community
Intermediate
AeonDaveAeonDave
15

weevely3

Provide a stealthy PHP webshell with post-exploitation modules for file operations and network scanning.

Community
Advanced
bpnrockstarbpnrockstar

reverse-engineering

Reverse-engineer closed-source binaries and firmware via static and dynamic analysis.

Community
Advanced
david-nossebrodavid-nossebro

web-qa-expert

Run black-box manual QA on web apps via Playwright CLI and return findings-only reports.

Community
Intermediate