firmware-pentest

name	firmware-pentest
description	Firmware penetration testing following the OWASP FSTM nine-stage flow: extraction, EMBA automation, Firmadyne/QEMU emulation, AFL++ fuzzing, and hands-on exploitation in authorized labs.
risk	offensive
source	https://github.com/zhaoxuya520/reverse-skill
source_repo	zhaoxuya520/reverse-skill
source_type	community
date_added	2026-08-25
license	MIT
license_source	https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

1. Ask the user to state the exact target URL, IP, account, or resource.
2. Ask the user to confirm written authorization and the permitted scope.
3. Show the exact command(s) and explain their expected effect.
4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

固件 / IoT 渗透链 (Firmware Pentest)

When to Use

• Assessing device firmware within an authorized engagement.
• Building an emulated environment for repeatable firmware analysis.

适用范围

下列任务进入本 skill：

1. 拿到一份固件文件（.bin / .img / .trx / .chk / OTA zip），需要从零到 RCE
2. 路由器/摄像头/IoT 设备审计 — 需要批量发现已知 CVE 和未公开漏洞
3. 加密/打包固件，需要找 bootloader 解密例程或硬件 dump
4. 需要在不接触硬件的情况下跑起来（QEMU 全系统仿真 / Firmadyne / FAT）
5. 对仿真起来的服务做 fuzz（AFL++ qemu mode / boofuzz）
6. 硬件接口接入（UART / JTAG / SPI flash dump）

与其他 skill 分工

场景	用什么
从零拿到固件，全链路走 FSTM	本 skill
只做单个 ELF/so 静态逆向	reverse-engineering/、ida-reverse/、radare2/
仿真起来后做 Web/RCE 利用	pentest-tools/、attack-chain/
硬件接口（UART/JTAG/SPI）实操	本 skill 的 Stage 2 章节 + patterns-hardware.md
APK / Android 固件（含 boot.img）	apk-reverse/（先剥 boot.img 再用本 skill）
跨版本固件符号迁移	binary-diff/

核心原理

固件 .bin
   │
   ├─ Stage 1-3: 信息收集 / 获取 / 静态分析（不解压也能看的部分）
   │
   ├─ Stage 4: 提取文件系统  ← binwalk v3 / unblob / jefferson / ubi_reader
   │     │
   │     └─ 失败 → 找 bootloader 解密例程 / UART dump / SPI flash 硬件读
   │
   ├─ Stage 5: 文件系统静态分析  ← EMBA 自动化 + 手工 grep
   │
   ├─ Stage 6: 模拟运行  ← Firmadyne / FAT / qemu-user-static + chroot
   │
   ├─ Stage 7-8: 动态 / 运行时分析  ← gdb-multiarch、IDA 远程调试、Ghidra
   │
   └─ Stage 9: 二进制利用  ← AFL++ fuzz / 手工 PoC / ARM / MIPS payload