# How reverse-skill Supports Firmware Pentesting: A 9-Stage OWASP Methodology

> Discover how reverse-skill streamlines firmware pentesting using a 9-stage OWASP methodology. Automate binary extraction, fuzzing, and more for robust security testing.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-29

---

**reverse-skill implements a complete firmware penetration testing workflow through nine modular stages aligned with the OWASP Firmware Security Testing Methodology (FSTM), automating everything from binary extraction to AFL++ fuzzing.**

The reverse-skill repository provides a dedicated `firmware-pentest` skill package that transforms raw firmware binaries into exploitable vulnerability findings. By encapsulating industry-standard tools within a structured routing system, reverse-skill support firmware pentesting through documented command chains and cross-skill orchestration.

## The 9-Stage OWASP-Based Workflow

The firmware pentesting methodology is defined in [`skills/firmware-pentest/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md) (lines 1-9) and visualized in [`docs/ARCHITECTURE.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/docs/ARCHITECTURE.md) (line 57) as a core architectural node. The workflow implements the following nine stages:

- **Stage 1 – Information Gathering**: Collect device models, chipsets, and known CVEs using shell snippets and FCC ID queries.
- **Stage 2 – Obtaining Firmware**: Download or dump images via `curl`, `mitmdump`, `picocom`, or `flashrom`.
- **Stage 3 – Preliminary Analysis**: Execute quick static inspection using `binwalk v3`, `unblob`, `jefferson`, or `ubi_reader`.
- **Stage 4 – Filesystem Extraction**: Extract squashfs, JFFS2, and UBI partitions according to [`skills/firmware-pentest/references/extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/extraction-methodology.md).
- **Stage 5 – Automated Static Analysis**: Run EMBA for vulnerability discovery per [`references/emba-automated-analysis.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/emba-automated-analysis.md).
- **Stage 6 – Emulation / Full-System Simulation**: Deploy QEMU or Firmadyne environments as documented in [`references/emulation-and-fuzz.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/emulation-and-fuzz.md).
- **Stage 7 – Dynamic Analysis**: Attach remote debuggers including GDB-multiarch and IDA Pro/Ghidra headless modes.
- **Stage 8 – Runtime Analysis**: Monitor services and analyze runtime behavior during emulation.
- **Stage 9 – Binary Exploitation**: Execute AFL++ in QEMU mode and develop ARM/MIPS payloads.

Each stage invokes only the tools required for the current phase, maintaining a modular execution path that minimizes resource overhead.

## Automated Skill Routing and Keyword Mapping

The repository's intelligent routing system in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) (lines 26-30) automatically maps tasks to the firmware-pentest skill when detecting keywords such as "firmware", "binwalk", "EMBA", or "AFL++". This routing table places the skill under the "Firmware / IoT" classification column, ensuring appropriate tool selection without manual configuration.

## Integration with Hardware and Protocol Skills

The firmware-pentest skill operates as part of a broader analysis pipeline:

- **Hardware Initialization**: The `hardware-security` skill ([`skills/hardware-security/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/hardware-security/SKILL.md), lines 12-29) supplies UART/JTAG interface procedures before handing control to firmware analysis.
- **Protocol Deep-Dive**: Post-emulation, `protocol-reverse` ([`skills/protocol-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/protocol-reverse/SKILL.md), lines 30-85) analyzes proprietary protocols discovered within the firmware.
- **Network Exploitation**: Results feed into `pentest-tools` or `attack-chain` for network-level exploit development, as referenced in the routing matrix ([`skills/routing_zh.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing_zh.md), lines 24-30).

## Practical Implementation Examples

The following commands demonstrate the actual toolchain execution used throughout the nine stages:

```bash

# Stage 1 – Gather device information

curl -s "https://fccid.io/?q=$FCC_ID" | grep -i "model"

# Stage 2 – Obtain firmware via OTA capture

mitmdump -s save_response.py -w ota_dump.pcap

# Stage 3 – Quick binwalk inspection

binwalk -e -M firmware.bin       # -M for multi-file extraction

# Stage 4 – Full extraction (fallback chain)

unblob firmware.bin
jefferson firmware.bin          # for UBI images

ubi_reader -i firmware.bin

# Stage 5 – Run EMBA (automated analysis)

emba -i firmware.bin -o report.html

# Stage 6 – Emulate with Firmadyne

run-firmadyne.sh firmware.bin   # launches QEMU + chroot

# Stage 7 – Dynamic analysis (remote GDB)

gdb-multiarch -ex "target remote localhost:1234"

# Stage 9 – Fuzz with AFL++ (QEMU mode)

afl-fuzz -i in/ -o out/ -Q -m none ./qemu-arm firmware.bin

```

These snippets correspond to the reference implementations documented in the skill's `references/` directory.

## Summary

- reverse-skill structures firmware pentesting as a **nine-stage OWASP FSTM workflow** from information gathering to binary exploitation.
- The **modular architecture** ensures only necessary tools execute per phase, configured in [`skills/firmware-pentest/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md).
- **Automated routing** in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) maps firmware-related keywords to the appropriate skill automatically.
- **Cross-skill integration** connects hardware interfaces, protocol analysis, and network exploitation into a continuous pipeline.
- **Reference implementations** in [`extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/extraction-methodology.md), [`emba-automated-analysis.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/emba-automated-analysis.md), and [`emulation-and-fuzz.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/emulation-and-fuzz.md) provide executable command chains.

## Frequently Asked Questions

### What tools does reverse-skill use for firmware extraction?

reverse-skill employs a fallback extraction chain including `binwalk v3`, `unblob`, `jefferson`, and `ubi_reader` for handling squashfs, JFFS2, and UBI filesystems. Specific methodologies are documented in [`skills/firmware-pentest/references/extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/extraction-methodology.md).

### How does reverse-skill automate vulnerability scanning in firmware?

The framework integrates **EMBA** (Embedded Analyzer) for automated static analysis during Stage 5. Running `emba -i firmware.bin -o report.html` generates comprehensive vulnerability reports without manual reverse engineering, as specified in [`references/emba-automated-analysis.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/references/emba-automated-analysis.md).

### Can reverse-skill perform dynamic analysis and fuzzing on extracted firmware?

Yes. Stage 6 utilizes **Firmadyne** and **QEMU** for full-system emulation, while Stage 9 implements **AFL++** in QEMU mode via `afl-fuzz -Q` to fuzz ARM and MIPS binaries. Remote debugging capabilities support GDB-multiarch and IDA Pro attachments during runtime analysis.

### How does the routing system know when to use the firmware-pentest skill?

The routing table in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) monitors task keywords such as "firmware", "binwalk", "EMBA", or "AFL++" and automatically assigns them to the "Firmware / IoT" column, ensuring the `firmware-pentest` skill handles embedded device analysis without manual intervention.