HACKING PROJECT · forensics · Advanced
Automated Firmware Unpacking & Emulation
Automatically transform arbitrary firmware images into fully-extracted, catalogued, emulation-ready artifacts with a security triage report.
Before any firmware can be analyzed, its opaque binary blob must be carved into bootloader, kernel, filesystem, and config regions — a step that fails constantly against custom headers, unknown compression, encrypted payloads, and exotic filesystems. Analysts waste hours hand-carving images, and the fragility of unpacking blocks any downstream automation. At scale, across thousands of device models, manual extraction is untenable.
**What you'll build**
Build an automated extraction-and-analysis pipeline that recursively unpacks firmware using modern extractors (unblob, binwalk v3, FACT), identifies and mounts root filesystems, extracts SBOM/component and credential/key material, and hands successfully-carved images directly into an emulation stage. Add recursive extraction with entropy/encryption detection, known-key trials, and a triage report summarizing components, versions, hardcoded secrets, and known-vulnerable binaries.
**Objective** — Automatically transform arbitrary firmware images into fully-extracted, catalogued, emulation-ready artifacts with a security triage report.
**Expected outcome** — A pipeline plus web/CLI dashboard that ingests firmware and outputs extracted filesystems, a component/SBOM inventory, detected secrets, and an emulation-readiness verdict.
**Difficulty** — Advanced — recursive binary carving, filesystem/compression zoo, secret detection, and integration into emulation demand broad depth, but leverages strong existing tooling.
**Primary category** — Firmware/Embedded Security; Secondary = Software Supply Chain Security, Reverse Engineering, Vulnerability Management
**Security domains** — Primary = Security Research; Secondary = Threat Intelligence (device analysis), DevSecOps (supply chain), Malware Analysis, Red Team
**Technical focus** — Recursive binary extraction, filesystem carving (SquashFS/JFFS2/UBI/CramFS), entropy/encryption detection, SBOM generation, secret/key scanning, N-day matching, static triage, emulation handoff, pipeline orchestration
**Core technologies** — Languages: Python, C, Bash; Frameworks/Libraries: unblob, binwalk v3, FACT (Firmware Analysis and Comparison Tool), sasquatch, jefferson, ubi_reader; Security Tools: Ghidra/radare2, Semgrep, trufflehog/gitleaks-style secret scanners, CVE/CPE matchers (e.g. cve-bin-tool); Cloud/Infra: Docker, object storage for images, CI runners; AI/Data: ML for file-type/compression classification, embeddings for binary similarity; Databases: PostgreSQL/Elasticsearch for the component and findings index
**Where it's valued** — IoT/OT manufacturers, supply-chain security vendors, threat-intel firms, regulators/certification labs, MDR providers, bug-bounty programs
**Careers it builds toward** — Firmware Security Analyst, Software Supply Chain Security Engineer, Vulnerability Researcher, Reverse Engineer, Threat Intelligence Analyst (device-focused)
**Framework alignment**
• MITRE ATT&CK: Supports discovery of Unsecured Credentials (T1552) and Pre-OS Boot (T1542) weaknesses in firmware; informs Supply Chain Compromise (T1195) risk analysis; ICS ATT&CK for OT firmware provenance.
• NIST CSF 2.0: Identify (asset/component inventory, SBOM), Protect (secret/key hygiene validation), Detect (N-day discovery pre-deployment). Heavy Identify.
• OWASP: OWASP IoT Top 10 (I2 Insecure network services, exposed keys, hardcoded credentials); OWASP Top 10 A05 (Security Misconfiguration), A06 (Vulnerable and Outdated Components).
• CIS Controls v8: Control 2 (Software/firmware inventory + SBOM), Control 7 (Continuous Vulnerability Management), Control 3/16 (data protection of embedded secrets, app security).
**Innovation** — Improved Existing Solution — extraction tools are mature, but an end-to-end unpack → SBOM → secret-scan → emulation-handoff pipeline with a triage dashboard is a valuable, near-productizable platform. Scores: Innovation 7/10, Startup 7/10, Enterprise-Readiness 8/10, Patent = No.