Run any Skill in Manus with one click

firmware-extraction

Stars2

Forks1

UpdatedFebruary 25, 2026 at 12:15

Firmware extraction and filesystem analysis for IoT devices. Use when analyzing firmware binaries, extracting filesystems with binwalk, identifying firmware format/structure, locating key files after extraction, or performing initial reconnaissance on router/camera/IoT firmware images. Triggers on tasks involving .bin/.img/.trx/.chk firmware files.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

tangjunyi23

tangjunyi23/IOTAgent

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

3 files

SKILL.md

readonly

name	firmware-extraction
description	Firmware extraction and filesystem analysis for IoT devices. Use when analyzing firmware binaries, extracting filesystems with binwalk, identifying firmware format/structure, locating key files after extraction, or performing initial reconnaissance on router/camera/IoT firmware images. Triggers on tasks involving .bin/.img/.trx/.chk firmware files.

Firmware Extraction

Extract and analyze IoT device firmware to identify the filesystem structure and locate security-relevant files.

Workflow

Identify firmware format (file, binwalk scan)
Extract filesystem (binwalk -eM)
Analyze entropy for encryption/compression (binwalk -E)
Map filesystem structure and locate key targets
Begin targeted file analysis

Quick Start

# Scan firmware structure
binwalk firmware.bin

# Recursive extraction
binwalk -eM firmware.bin

# Entropy analysis (detect encrypted sections)
binwalk -E firmware.bin

# If binwalk fails, try manual offset extraction
dd if=firmware.bin of=extracted.squashfs bs=1 skip=<offset> count=<size>

Key Target Files After Extraction

Priority	Path Pattern	What to Look For
1	`/etc/passwd`, `/etc/shadow`	Hardcoded credentials
2	`/usr/sbin/httpd`, `/usr/bin/goahead`	Web server binaries
3	`/www/cgi-bin/`, `/www/*.cgi`	CGI scripts (command injection)
4	`/etc/*.conf`, `/etc/config/`	Service configurations
5	`/lib/.so`, `/usr/lib/.so`	Shared libraries
6	`/sbin/`, `/usr/sbin/`	Network service daemons
7	`/etc/init.d/`, `/etc/rc.d/`	Startup scripts (backdoor indicators)

Filesystem Types

SquashFS (most common): unsquashfs to extract, check compression type
JFFS2: jefferson or jffs2dump for extraction
CramFS: cramfsck to extract
UBIFS: ubireader_extract_files for NAND flash images
YAFFS2: unyaffs for extraction

Encrypted/Obfuscated Firmware

When entropy analysis shows high entropy (>0.9) across the entire image:

Check for known encryption schemes (e.g., D-Link DES, Netgear AES)
Search for decryption routines in bootloader sections
Use firmware-mod-kit or vendor-specific tools
Check scripts/detect_encryption.py for automated detection

References

Detailed extraction techniques: See references/advanced-extraction.md for handling non-standard formats
Decryption script: Run scripts/detect_encryption.py against firmware to identify encryption scheme

More from this repository

same repository

auth-bypass

tangjunyi23/IOTAgent

Authentication bypass vulnerability hunting in IoT firmware. Use when analyzing login mechanisms, session management, access control, or authentication logic in web interfaces, APIs, or network services of embedded devices. Triggers on auth bypass, login bypass, session hijacking, or access control analysis tasks.

2026-02-252

bootloader-security

tangjunyi23/IOTAgent

U-Boot and embedded bootloader security analysis — environment variable attacks, secure boot bypass, boot sequence exploitation, and firmware integrity verification

2026-02-252

buffer-overflow

tangjunyi23/IOTAgent

Buffer overflow vulnerability hunting in IoT embedded binaries. Use when reverse-engineering ARM/MIPS/x86 binaries for stack-based or heap-based overflow vulnerabilities, analyzing unsafe memory operations (strcpy, sprintf, gets, memcpy), checking binary protections (NX, ASLR, canary), or building overflow PoCs for embedded targets.

2026-02-252

command-injection

tangjunyi23/IOTAgent

Command injection vulnerability hunting in IoT firmware. Use when analyzing CGI binaries, web server handlers, SOAP/UPnP interfaces, or any user-input-to-system-call path in embedded devices. Triggers on searching for OS command injection (CWE-78), argument injection (CWE-88), or code injection in firmware binaries and scripts.

2026-02-252

crypto-weakness

tangjunyi23/IOTAgent

Cryptographic weakness and insecure crypto implementation hunting in IoT firmware. Use when analyzing encryption implementations, TLS/SSL configurations, key management, random number generation, or any cryptographic operations in embedded device firmware. Triggers on crypto analysis, weak encryption, insecure TLS, or key management tasks.

2026-02-252

firmware-decryption

tangjunyi23/IOTAgent

Firmware decryption, deobfuscation, and unpacking for encrypted IoT firmware images. Use when firmware entropy analysis reveals encrypted/obfuscated content, when binwalk extraction fails due to encryption, when decrypting vendor-specific firmware encryption (D-Link, Netgear, TP-Link, Hikvision, Dahua, ZTE), or when reversing custom XOR/AES/DES encryption applied to firmware update files.

2026-02-252

name	firmware-extraction
description	Firmware extraction and filesystem analysis for IoT devices. Use when analyzing firmware binaries, extracting filesystems with binwalk, identifying firmware format/structure, locating key files after extraction, or performing initial reconnaissance on router/camera/IoT firmware images. Triggers on tasks involving .bin/.img/.trx/.chk firmware files.

Firmware Extraction

Extract and analyze IoT device firmware to identify the filesystem structure and locate security-relevant files.

Workflow

Identify firmware format (file, binwalk scan)
Extract filesystem (binwalk -eM)
Analyze entropy for encryption/compression (binwalk -E)
Map filesystem structure and locate key targets
Begin targeted file analysis

Quick Start

# Scan firmware structure
binwalk firmware.bin

# Recursive extraction
binwalk -eM firmware.bin

# Entropy analysis (detect encrypted sections)
binwalk -E firmware.bin

# If binwalk fails, try manual offset extraction
dd if=firmware.bin of=extracted.squashfs bs=1 skip=<offset> count=<size>

Key Target Files After Extraction

Priority	Path Pattern	What to Look For
1	`/etc/passwd`, `/etc/shadow`	Hardcoded credentials
2	`/usr/sbin/httpd`, `/usr/bin/goahead`	Web server binaries
3	`/www/cgi-bin/`, `/www/*.cgi`	CGI scripts (command injection)
4	`/etc/*.conf`, `/etc/config/`	Service configurations
5	`/lib/.so`, `/usr/lib/.so`	Shared libraries
6	`/sbin/`, `/usr/sbin/`	Network service daemons
7	`/etc/init.d/`, `/etc/rc.d/`	Startup scripts (backdoor indicators)

Filesystem Types

SquashFS (most common): unsquashfs to extract, check compression type
JFFS2: jefferson or jffs2dump for extraction
CramFS: cramfsck to extract
UBIFS: ubireader_extract_files for NAND flash images
YAFFS2: unyaffs for extraction

Encrypted/Obfuscated Firmware

When entropy analysis shows high entropy (>0.9) across the entire image:

Check for known encryption schemes (e.g., D-Link DES, Netgear AES)
Search for decryption routines in bootloader sections
Use firmware-mod-kit or vendor-specific tools
Check scripts/detect_encryption.py for automated detection

References

Detailed extraction techniques: See references/advanced-extraction.md for handling non-standard formats
Decryption script: Run scripts/detect_encryption.py against firmware to identify encryption scheme