performing-firmware-malware-analysis

name	performing-firmware-malware-analysis
description	Use when analyzing firmware images for embedded malware, backdoors, and unauthorized modifications targeting routers, IoT devices, UEFI/BIOS, and embedded systems. Covers firmware extraction, filesystem analysis, binary reverse engineering, and bootkit detection. Activates for requests involving firmware security analysis, IoT malware investigation, UEFI rootkit detection, or embedded device compromise assessment.
domain	cybersecurity
tags	["malware","firmware","IoT","UEFI","embedded-security"]
subdomain	malware-analysis
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"]

Performing Firmware Malware Analysis

Overview

Cybersecurity skill for performing firmware malware analysis. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing firmware malware analysis"

• "Analyzes firmware images for embedded malware, backdoors, and unauthorized modif"

• A compromised IoT device or router needs firmware analysis to identify implanted backdoors

• Investigating UEFI/BIOS rootkits that persist across OS reinstallations

• Analyzing firmware updates for supply chain compromise or malicious modifications

• Extracting and examining embedded Linux filesystems from IoT device firmware images

• Verifying firmware integrity after a suspected hardware or firmware-level compromise

Do not use for standard operating system malware; use PE/ELF analysis tools for OS-level malware on conventional systems.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• binwalk installed for firmware image analysis and extraction (pip install binwalk)
• Ghidra with ARM/MIPS architecture support for embedded binary reverse engineering
• UEFI Tool (UEFITool) for UEFI firmware parsing and analysis
• Firmware Analysis Toolkit (FAT) or EMBA for automated firmware analysis
• QEMU for emulating extracted firmware filesystems
• Cross-compilation toolchains for ARM, MIPS, and other embedded architectures

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: ) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}