Analyze Firmware for Security Vulnerabilities

Firmware Analyst is a skill for extracting, analyzing, and assessing device firmware for security vulnerabilities, gated by an explicit authorization requirement and a mandatory confirmation step before any command that probes, exploits, or extracts data from a real target. Acquisition covers vendor downloads, network extraction (TFTP during boot, HTTP/FTP from a device's web interface), and hardware methods (UART serial console, JTAG/SWD debug access, SPI/NAND/NOR flash dumping, chip-off, logic-analyzer protocol capture).

Its four-phase workflow runs identification (file/binwalk, entropy analysis to detect compression/encryption, string searches for embedded passwords/keys), extraction (binwalk's recursive "matryoshka" mode, or format-specific tools for SquashFS, JFFS2, UBIFS, YAFFS, and Cramfs), filesystem analysis (searching for config files, passwd/shadow, hardcoded credentials, private keys, and CGI/PHP/Lua web-interface code, plus checksec on extracted binaries), and binary analysis (identifying the CPU architecture, loading it correctly in Ghidra, and cross-compiling test payloads for ARM/MIPS). It names common vulnerability classes to check for: authentication issues (hardcoded credentials, backdoor accounts, weak hashing, bypasses, predictable sessions), command injection (unsanitized input into system()/sprintf), memory corruption (stack/heap overflows, format strings, integer overflows, use-after-free), and information disclosure (left-enabled debug interfaces, verbose errors, exposed configs, unencrypted update downloads).

It names specific tools by category - extraction (binwalk v3, firmware-mod-kit, jefferson, ubi_reader, sasquatch), analysis (Ghidra, IDA Pro, Binary Ninja, radare2, FACT), emulation (QEMU, Firmadyne, EMUX, Unicorn), and hardware (Bus Pirate, JTAGulator, Flashrom, ChipWhisperer) - and covers both QEMU user-mode chroot emulation of a single binary and Firmadyne's full-system emulation with network inference. A security-assessment checklist and a structured reporting template (device info, findings table with severity, proof of concept, remediation) close out the workflow.

This skill is explicitly authorized-use only: it requires written permission from the system owner, and before any command that probes, changes, or extracts from a real target it asks for the exact target, confirms authorization and scope, shows the exact commands, and waits for explicit confirmation - remaining read-only and defensive otherwise. Appropriate use covers authorized security audits, bug bounty programs, academic research, CTF competitions, and personal device analysis; it will never assist with unauthorized device compromise, illegal DRM bypass, malicious firmware creation, or attacking devices without permission.

Input is a firmware image or physical device access, plus explicit authorization and scope. Output is extracted filesystem contents, identified vulnerabilities by class, and a structured security-assessment report with severity and remediation guidance. A basic emulation setup looks like this:

### Install QEMU user-mode
apt install qemu-user-static

### Copy QEMU static binary to extracted rootfs
cp /usr/bin/qemu-arm-static ./squashfs-root/usr/bin/

### Chroot into firmware filesystem
sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/sh

It integrates binwalk, Ghidra/IDA Pro/Binary Ninja/radare2 for disassembly, QEMU/Firmadyne/EMUX for emulation, and hardware tools like JTAGulator and ChipWhisperer for physical extraction and side-channel analysis.

Security researchers and firmware engineers doing authorized firmware security assessments - bug bounty work, academic research, CTFs, or personal device analysis - who need a structured extraction, analysis, and reporting workflow.