Firmware, hardware and signals
Find the filesystem inside a firmware blob, read a debug interface off a board, and decode a captured signal back into bytes.
Assumes21. Reverse engineering
By the end you can
- Locate and extract an embedded filesystem from a firmware image by signature and entropy
- Identify the architecture and endianness of an embedded binary before disassembling it
- Read a UART, SPI or I2C capture from a logic analyser back into framed bytes
- Recognise what a JTAG or SWD interface offers, and why a challenge hands you one
- Decode a captured RF or infrared transmission into its underlying symbols
- Find hardcoded credentials and keys in an image, and explain why they cannot simply be rotated
1. Read
Firmware challenges: the filesystem hiding inside the blob
A firmware image is a whole embedded Linux system packed into one file. How to pull the filesystem out with binwalk, find the hardcoded secrets and backdoors CTF authors plant, and recognise the bootloader and flash layout around it.
Hardware and signal challenges: logic captures, RF, and barcodes
What to do with a logic-analyzer capture, how to recognise UART, SPI and I2C from their waveforms, decoding a Flipper sub-GHz or IR file, reading damaged QR codes, and where the flag hides in a JTAG or SWD dump.
2. Use the tools
In the order they come up while solving. Read what each one does, or go straight to the workspace tab that runs it.
- Firmware unpacker: entropy, filesystems and partition tables
Work out what a router or IoT firmware image is made of - entropy profile, SquashFS/CramFS/JFFS2/UBI headers, U-Boot and partition tables - and unpack what can be unpacked in the browser.
Open it in the workspace - Logic analyzer decoder: UART, I2C, SPI and 1-Wire
Drop a CSV or VCD capture of digital lines and read the protocol out of it - serial text, I2C transactions, SPI words, or 1-Wire bytes.
Open it in the workspace - Flipper .sub and .ir decoder: RF and infrared captures
Decode a captured remote - NEC, Samsung, Sony SIRC and RC5 on infrared; Princeton, CAME and KeeLoq on sub-GHz - straight from a Flipper Zero capture file.
Open it in the workspace - QR code decoder
Decode QR codes from any image, including inverted, low-contrast, and partially damaged codes. Nothing is uploaded.
Open it in the workspace - ELF, PE and Mach-O binary analyzer
Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.
Open it in the workspace - Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
Open it in the workspace - Hex viewer and hexdump
Inspect any file byte by byte with a side-by-side hex and ASCII view, offsets, and structure highlighting.
Open it in the workspace
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 16 match in total - see the full index.
Common mistakes
The wrong turns this topic reliably produces. Written as the mistake rather than the rule, because the rule is easy to agree with and easy to walk straight past.
- Extracting a firmware image and stopping at the first filesystem. Images routinely carry several, plus a bootloader and a kernel, and the interesting one is rarely first.
- Disassembling embedded code as x86 because the tool defaulted to it. ARM, MIPS and RISC-V all appear, and the entropy plot will not tell you which.
- Reading a logic capture as data before setting the framing. Baud rate, bit order and idle level decide what the bytes are, and all three are guesses until confirmed.
- Accepting whatever the unpacker extracted. It reports what it recognised, and the gap between the image size and the extracted bytes is an encrypted or unknown partition that nothing warned you about.
- Writing up a hardcoded key as 'rotate the credential'. It is present in every device already shipped, so the honest remediation is a firmware update and a key that is not the same everywhere.
Checkpoint
From a firmware image, extract the root filesystem, find the credential or key it ships with, and state the offset and format of the container it came from.
Teaching note
Hardware challenges look inaccessible without hardware, which is untrue and worth saying in the first minute: the capture, the blob and the dump are the challenge, and they are all files. Start from a supplied capture, not from a board.
Go deeper
The lessons above are written to get you through a challenge. These go after the subject instead. Each one opens our notes on that chapter - what it argues, what to take from it and where it stops - so this is somewhere to read now rather than a book to buy first. Nothing here is affiliate-linked or sold by us.
Chapter 7, UART, JTAG, and SWD Exploitation
Practical IoT Hacking - Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, and Beau Woods
What each debug interface gives you and how it is found on an unlabelled board.
Chapter 8, SPI and I2C
Practical IoT Hacking - Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, and Beau Woods
The two bus protocols behind most logic-analyser challenges, framed as captures to decode.
Chapter 9, Firmware Hacking
Practical IoT Hacking - Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, and Beau Woods
The extraction and analysis workflow this module's tools automate, done by hand once.
Chapter 16, UEFI Firmware Vulnerabilities
Rootkits and Bootkits - Alex Matrosov, Eugene Rodionov, and Sergey Bratus
Firmware as an attack surface rather than as a container, on hardware you probably own.
Every book the curriculum cites has a page in the library.