HACKING PROJECT · forensics · Advanced
Smart-Device Firmware Reverse Engineering
Extract, unpack, and reverse-engineer smart-device firmware to identify embedded secrets, vulnerabilities, and malicious code.
IoT and smart devices ship with opaque, rarely-patched firmware that hides hardcoded credentials, backdoors, insecure update mechanisms, and exploitable services — yet defenders and investigators rarely have a repeatable process to extract and analyze that firmware. When a smart device is implicated in an incident, responders need to recover the firmware, understand its behavior, and identify malicious or vulnerable code. This blind spot leaves entire classes of devices unaudited.
**What you'll build**
Build a firmware analysis workflow that acquires firmware (vendor images, OTA capture, or hardware dumping via UART/JTAG/SPI flash), unpacks and identifies the filesystem and bootloader, and performs static and dynamic analysis to surface hardcoded secrets, cryptographic weaknesses, vulnerable services, and backdoors. Use emulation to execute and instrument the firmware, and produce a structured findings report mapped to IoT security frameworks.
**Objective** — Extract, unpack, and reverse-engineer smart-device firmware to identify embedded secrets, vulnerabilities, and malicious code.
**Expected outcome** — A firmware analysis report and reusable pipeline that extracts the filesystem, emulates the device, and enumerates hardcoded credentials, CVEs, and insecure services with evidence.
**Difficulty** — Advanced — combines hardware interfacing, firmware unpacking, binary RE, and emulation.
**Primary category** — Security Research / RE; Secondary = IoT/Embedded Security, DFIR
**Security domains** — Primary = Security Research; Secondary = Digital Forensics, Malware Analysis, Red Team, IoT Security
**Technical focus** — Firmware Extraction, Hardware Interfacing (UART/JTAG/SPI), Firmware Unpacking, Binary Reverse Engineering, Emulation/Dynamic Analysis, Secret/Credential Discovery, Vulnerability Research, Cryptographic Analysis
**Core technologies** — Languages: C, Python, Assembly (ARM/MIPS), Bash; Frameworks/Libraries: binwalk, unblob, FACT (Firmware Analysis and Comparison Tool); Security Tools: Ghidra, radare2/Cutter, QEMU, FirmAE/Firmadyne, angr, EMBA (firmware security analyzer); Cloud/Infra: analysis VM, hardware bench (bus pirate/logic analyzer, flash programmer); AI/Data: optional ML for function similarity/vuln matching; Databases: CVE feeds, SQLite for findings
**Where it's valued** — IoT/OT manufacturers, product security teams, security research firms, critical infrastructure, consumer electronics, red-team/pentest consultancies
**Careers it builds toward** — Firmware/IoT Security Researcher, Reverse Engineer, Embedded Security Engineer, Vulnerability Researcher, Red Team Operator, Hardware Security Analyst
**Framework alignment**
• MITRE ATT&CK: ATT&CK for ICS/Embedded context — T1542 (Pre-OS Boot incl. .001 System Firmware), T1601 (Modify System Image), T1554 (Compromise Host Software Binary); credential findings relate to T1552.001
• NIST CSF 2.0: Identify (ID.RA vulnerability discovery, ID.SC supply chain), Protect (PR.PS platform security), Detect (DE)
• OWASP: OWASP IoT Top 10 (I1 Weak/Hardcoded Passwords, I4 Insecure Update Mechanisms, I5 Insecure Components); OWASP FSTM methodology
• CIS Controls v8: 2 (Inventory of Software Assets), 4 (Secure Configuration), 7 (Continuous Vulnerability Management), 16 (Application Software Security)
**Innovation** — Improved Existing Solution / Research-Level — the tooling (binwalk, EMBA, FirmAE) exists, but an integrated acquisition-to-emulation pipeline with automated vuln triage and hardware capture has research and startup potential. Scores: Innovation 8/10, Startup 7/10, Enterprise-Readiness 6/10, Patent = Possible.