Lesson pack 23 · Advanced · 120 minutes
Firmware, hardware and signals
Find the filesystem inside a firmware blob, read a debug interface off a board, and decode a captured signal back into bytes.
Print this page for a paper plan - the navigation and links drop out.Student-facing version
Before the session
- Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
- Read the lesson yourself first - about 12 minutes.
- Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.
Objectives
Written as things a student can do afterwards, so they can be assessed rather than asserted.
- Locate and extract an embedded filesystem from a firmware image by signature and entropy
- Identify the architecture and endianness of an embedded binary before disassembling it
- Read a UART, SPI or I2C capture from a logic analyser back into framed bytes
- Recognise what a JTAG or SWD interface offers, and why a challenge hands you one
- Decode a captured RF or infrared transmission into its underlying symbols
- Find hardcoded credentials and keys in an image, and explain why they cannot simply be rotated
Running order (120 min)
| Time | What happens |
|---|---|
| 0:00-0:12 | Frame the problemWhat the category looks like when you meet it cold, and why the naive approach fails. |
| 0:12-0:36 | Teach the methodThe technique itself, on the board or from the lesson. No tools open yet. |
| 0:36-1:06 | Demonstrate liveSame technique, in the workspace, on your worked example. Narrate every choice. |
| 1:06-1:48 | Practice setStudents work the challenges. Circulate rather than present. |
| 1:48-2:00 | Checkpoint and wrapCollect the artefact, name what comes next. |
Tools used
- Firmware unpacker: entropy, filesystems and partition tables - Work out what a router or IoT firmware image is made of - entropy profile, SquashFS/CramFS/JFFS2/UBI headers, U-Boot and partition tables - and unpack what can be unpacked in the browser.https://ctfpal.com/?tool=firmware-unpacker
- Logic analyzer decoder: UART, I2C, SPI and 1-Wire - Drop a CSV or VCD capture of digital lines and read the protocol out of it - serial text, I2C transactions, SPI words, or 1-Wire bytes.https://ctfpal.com/?tool=logic-analyzer-decoder
- Flipper .sub and .ir decoder: RF and infrared captures - Decode a captured remote - NEC, Samsung, Sony SIRC and RC5 on infrared; Princeton, CAME and KeeLoq on sub-GHz - straight from a Flipper Zero capture file.https://ctfpal.com/?tool=flipper-rf-ir-decoder
- QR code decoder - Decode QR codes from any image, including inverted, low-contrast, and partially damaged codes. Nothing is uploaded.https://ctfpal.com/?tool=qr-decoder
- ELF, PE and Mach-O binary analyzer - Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.https://ctfpal.com/?tool=elf-pe-analyzer
- Strings extractor for binaries and blobs - Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.https://ctfpal.com/?tool=strings-extractor
- Hex viewer and hexdump - Inspect any file byte by byte with a side-by-side hex and ASCII view, offsets, and structure highlighting.https://ctfpal.com/?tool=hex-viewer
Reading
- Firmware challenges: the filesystem hiding inside the blob - 5 min. A firmware image is a whole embedded Linux system packed into one file. How to pull the filesystem out with binwalk, find the hardcoded secrets and backdoors CTF authors plant, and recognise the bootloader and flash layout around it.
- Hardware and signal challenges: logic captures, RF, and barcodes - 7 min. What to do with a logic-analyzer capture, how to recognise UART, SPI and I2C from their waveforms, decoding a Flipper sub-GHz or IR file, reading damaged QR codes, and where the flag hides in a JTAG or SWD dump.
Practice set
Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.
- binhexa - picoCTF 2024, easy
- Corrupted file - picoMini by CMU-Africa, easy
- endianness - picoCTF 2024, easy
- advanced-potion-making - picoMini by redpwn, medium
- ARMssembly 0 - picoCTF 2021, medium
- ARMssembly 1 - picoCTF 2021, medium
- c0rrupt - picoCTF 2019, medium
- Enhance! - picoCTF 2022, medium
- speeds and feeds - picoCTF 2021, medium
- ARMssembly 2 - picoCTF 2021, hard
- ARMssembly 3 - picoCTF 2021, hard
- ARMssembly 4 - picoCTF 2021, hard
Checkpoint (gradeable)
From a firmware image, extract the root filesystem, find the credential or key it ships with, and state the offset and format of the container it came from.
Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.
Where the room gets stuck
Hardware challenges look inaccessible without hardware, which is untrue and worth saying in the first minute: the capture, the blob and the dump are the challenge, and they are all files. Start from a supplied capture, not from a board.
- Extracting a firmware image and stopping at the first filesystem. Images routinely carry several, plus a bootloader and a kernel, and the interesting one is rarely first.
- Disassembling embedded code as x86 because the tool defaulted to it. ARM, MIPS and RISC-V all appear, and the entropy plot will not tell you which.
- Reading a logic capture as data before setting the framing. Baud rate, bit order and idle level decide what the bytes are, and all three are guesses until confirmed.
- Accepting whatever the unpacker extracted. It reports what it recognised, and the gap between the image size and the extracted bytes is an encrypted or unknown partition that nothing warned you about.
- Writing up a hardcoded key as 'rotate the credential'. It is present in every device already shipped, so the honest remediation is a firmware update and a key that is not the same everywhere.
If a student wants the subject, not the answer
Chapter-level references, so a student can be pointed at twenty pages rather than at a book. Nothing here is required to complete the module.
- Practical IoT Hacking, Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, and Beau Woods. Chapter 7, UART, JTAG, and SWD Exploitation. What each debug interface gives you and how it is found on an unlabelled board.
- Practical IoT Hacking, Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, and Beau Woods. Chapter 8, SPI and I2C. The two bus protocols behind most logic-analyser challenges, framed as captures to decode.
- Practical IoT Hacking, Fotios Chantzis, Ioannis Stais, Paulino Calderon, Evangelos Deirmentzoglou, and Beau Woods. Chapter 9, Firmware Hacking. The extraction and analysis workflow this module's tools automate, done by hand once.
- Rootkits and Bootkits, Alex Matrosov, Eugene Rodionov, and Sergey Bratus. Chapter 16, UEFI Firmware Vulnerabilities. Firmware as an attack surface rather than as a container, on hardware you probably own.
If you finish early
- Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
- Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
- Ask a student to break their own example - construct an input that defeats the tool, and explain why.
Take this into a room
Markdown files, built here in your browser. They print, they open in anything, and they carry the challenge text - so the session works with no network in the room.