Building Firmware Penetration Testing Chains Following OWASP FSTM Methodology

The reverse-skill framework automates OWASP FSTM-aligned firmware penetration testing through a three-layer architecture that routes tasks, bootstraps dependencies, and generates auditable reports.

The zhaoxuya520/reverse-skill repository provides a platform-agnostic skill router designed to steer AI agents and security analysts through repeatable workflows for complex tasks. When building firmware penetration testing chains following OWASP FSTM methodology, the framework orchestrates everything from initial firmware extraction to final exploit development through automated routing decisions and evidence collection.

Three-Layer Architecture for Firmware Security Testing

The reverse-skill framework implements a structured approach to firmware security testing through three distinct operational layers, each handling specific aspects of the OWASP FSTM workflow.

Routing Layer and Decision Logic

At the foundation, the Routing Layer maps user intent to concrete skills using skills/config/routing.json as the single source of truth for 41 routing rules. When a firmware-related task arrives, MASTER-ROUTING.md performs fast-track matching to the firmware-pentest skill, while skills/routing.md contains the complete routing matrix. This layer ensures that requests like "analyze embedded firmware" immediately trigger the correct testing chain without manual tool selection.

Execution Layer and Tool Bootstrap

The Execution Layer handles environment preparation through scripts located in skills/scripts/*.ps1 for Windows and kali/scripts/*.sh for Kali Linux. Before executing any firmware analysis, the system consults tool-index.md to verify the presence of required utilities such as binwalk, Ghidra, and radare2. Missing dependencies are auto-installed using the bootstrap process defined in bootstrap-manifest.json, ensuring the toolchain is always ready for extraction and reverse engineering tasks.

Outcome Layer and Evidence Management

The Outcome Layer manages the post-execution workflow through field-journal/, docs-generator, and case-review/ directories. After completing dynamic analysis or crash discovery, this layer validates the evidence graph for traceability, generates structured reports with diagram-generator, and writes findings back to the knowledge base for automatic reuse in future firmware assessments.

OWASP FSTM Implementation Workflow

The firmware penetration testing chain operates as a module within the Vulnerability Exploitation sub-graph, following a seven-step methodology that aligns with OWASP FSTM standards.

Case Initialization and Security Gates

Every firmware assessment begins with the Auth & Network Profile gate enforced by RULES.md. Analysts must initialize the case using skills/scripts/case-init.ps1 before any tools execute:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/case-init.ps1 -Hint "Firmware pentest of device XYZ"

This command establishes the case directory, defines scope boundaries, and creates evidence templates that ensure all subsequent actions remain auditable and within authorized parameters.

Automated Tool Discovery

Once initialized, the framework refreshes the local tool index to detect available firmware analysis utilities:

# Windows environment

powershell -File skills/scripts/refresh-tool-index.ps1

# Linux or macOS

bash skills/scripts/refresh-tool-index.sh

# Kali Linux specific

bash kali/scripts/refresh-tool-index.sh

These scripts update tool-index.md and trigger automatic installation of missing components required for firmware extraction and emulation.

Four-Phase Skill Execution

The firmware-pentest skill orchestrates a complete OWASP FSTM-aligned chain stored in skills/firmware-pentest/:

1. Extraction – Unpacks firmware images using binwalk or custom extraction scripts to recover filesystems and binaries.
2. Static Analysis – Identifies vulnerable binaries, libraries, and configuration files through automated scanning.
3. Dynamic Emulation – Executes selected components in QEMU or Unicorn emulators to surface runtime crashes and behavior.
4. Crash-to-Exploit – Feeds crash data into the pwn-chain module for structured exploit development and vulnerability confirmation.

Knowledge Capture and Reporting

Upon completion, case-review/ validates the evidence graph to maintain traceability from initial firmware image to confirmed vulnerability. The docs-generator produces structured reports with visual diagrams from diagram-generator, while findings persist to field-journal/ to improve future routing decisions.

Executing the Firmware Pentest Chain

To run the complete firmware penetration testing workflow directly, invoke the master router with a specific hint:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/master-route.ps1 -Hint "firmware pentest"

After modifying routing rules or adding new firmware analysis tools, validate the entire chain using the regression suite:

powershell -NoProfile -ExecutionPolicy Bypass -File skills/scripts/test-routing.ps1

Summary

• The reverse-skill framework implements OWASP FSTM through a three-layer architecture comprising Routing, Execution, and Outcome layers.
• Routing decisions rely on skills/config/routing.json and MASTER-ROUTING.md to map firmware tasks to the correct testing modules.
• Tool bootstrapping automatically installs missing dependencies like binwalk and Ghidra via refresh-tool-index scripts before execution.
• The firmware-pentest skill follows a four-phase flow: Extraction, Static Analysis, Dynamic Emulation, and Crash-to-Exploit development.
• All activities require initialization through case-init.ps1 and respect the security gates defined in RULES.md.
• Evidence traceability is maintained through field-journal/ and case-review/ directories, ensuring auditable penetration testing workflows.

Frequently Asked Questions

What is OWASP FSTM and how does reverse-skill implement it?

The OWASP Firmware Security Testing Methodology (FSTM) provides a systematic approach to analyzing embedded firmware for vulnerabilities. The reverse-skill framework implements FSTM through automated routing to the firmware-pentest skill, which executes standardized phases including extraction, static analysis, dynamic emulation, and exploit development while maintaining full audit trails in the field-journal/ directory.

How does the routing system determine which firmware testing tools to use?

The routing system consults skills/config/routing.json—the single source of truth containing 41 routing rules—to match firmware-related hints to the appropriate skill module. Once matched, tool-index.md is checked against the current environment, and missing tools are auto-installed via bootstrap-manifest.json before the skills/firmware-pentest/ playbooks execute.

Can the framework run on both Windows and Linux environments?

Yes, the framework provides platform-specific execution scripts: skills/scripts/*.ps1 for Windows PowerShell and kali/scripts/*.sh for Kali Linux environments. The refresh-tool-index utility detects the host operating system and uses the appropriate package managers to bootstrap dependencies, ensuring consistent firmware analysis capabilities across platforms.

How is evidence traceability maintained throughout the penetration test?

Evidence traceability is enforced through mandatory case initialization via case-init.ps1, which creates scoped directories and templates before any tools run. The case-review/ module validates the evidence graph after execution, while docs-generator produces structured reports linking every finding back to the original firmware image, ensuring complete auditability for compliance and research purposes.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}