How reverse-skill Supports Firmware Pentesting: A 9-Stage OWASP Methodology

reverse-skill implements a complete firmware penetration testing workflow through nine modular stages aligned with the OWASP Firmware Security Testing Methodology (FSTM), automating everything from binary extraction to AFL++ fuzzing.

The reverse-skill repository provides a dedicated firmware-pentest skill package that transforms raw firmware binaries into exploitable vulnerability findings. By encapsulating industry-standard tools within a structured routing system, reverse-skill support firmware pentesting through documented command chains and cross-skill orchestration.

The 9-Stage OWASP-Based Workflow

The firmware pentesting methodology is defined in skills/firmware-pentest/SKILL.md (lines 1-9) and visualized in docs/ARCHITECTURE.md (line 57) as a core architectural node. The workflow implements the following nine stages:

• Stage 1 – Information Gathering: Collect device models, chipsets, and known CVEs using shell snippets and FCC ID queries.
• Stage 2 – Obtaining Firmware: Download or dump images via curl, mitmdump, picocom, or flashrom.
• Stage 3 – Preliminary Analysis: Execute quick static inspection using binwalk v3, unblob, jefferson, or ubi_reader.
• Stage 4 – Filesystem Extraction: Extract squashfs, JFFS2, and UBI partitions according to skills/firmware-pentest/references/extraction-methodology.md.
• Stage 5 – Automated Static Analysis: Run EMBA for vulnerability discovery per references/emba-automated-analysis.md.
• Stage 6 – Emulation / Full-System Simulation: Deploy QEMU or Firmadyne environments as documented in references/emulation-and-fuzz.md.
• Stage 7 – Dynamic Analysis: Attach remote debuggers including GDB-multiarch and IDA Pro/Ghidra headless modes.
• Stage 8 – Runtime Analysis: Monitor services and analyze runtime behavior during emulation.
• Stage 9 – Binary Exploitation: Execute AFL++ in QEMU mode and develop ARM/MIPS payloads.

Each stage invokes only the tools required for the current phase, maintaining a modular execution path that minimizes resource overhead.

Automated Skill Routing and Keyword Mapping

The repository's intelligent routing system in skills/routing.md (lines 26-30) automatically maps tasks to the firmware-pentest skill when detecting keywords such as "firmware", "binwalk", "EMBA", or "AFL++". This routing table places the skill under the "Firmware / IoT" classification column, ensuring appropriate tool selection without manual configuration.

Integration with Hardware and Protocol Skills

The firmware-pentest skill operates as part of a broader analysis pipeline:

• Hardware Initialization: The hardware-security skill (skills/hardware-security/SKILL.md, lines 12-29) supplies UART/JTAG interface procedures before handing control to firmware analysis.
• Protocol Deep-Dive: Post-emulation, protocol-reverse (skills/protocol-reverse/SKILL.md, lines 30-85) analyzes proprietary protocols discovered within the firmware.
• Network Exploitation: Results feed into pentest-tools or attack-chain for network-level exploit development, as referenced in the routing matrix (skills/routing_zh.md, lines 24-30).

Practical Implementation Examples

The following commands demonstrate the actual toolchain execution used throughout the nine stages:

# Stage 1 – Gather device information

curl -s "https://fccid.io/?q=$FCC_ID" | grep -i "model"

# Stage 2 – Obtain firmware via OTA capture

mitmdump -s save_response.py -w ota_dump.pcap

# Stage 3 – Quick binwalk inspection

binwalk -e -M firmware.bin       # -M for multi-file extraction

# Stage 4 – Full extraction (fallback chain)

unblob firmware.bin
jefferson firmware.bin          # for UBI images

ubi_reader -i firmware.bin

# Stage 5 – Run EMBA (automated analysis)

emba -i firmware.bin -o report.html

# Stage 6 – Emulate with Firmadyne

run-firmadyne.sh firmware.bin   # launches QEMU + chroot

# Stage 7 – Dynamic analysis (remote GDB)

gdb-multiarch -ex "target remote localhost:1234"

# Stage 9 – Fuzz with AFL++ (QEMU mode)

afl-fuzz -i in/ -o out/ -Q -m none ./qemu-arm firmware.bin

These snippets correspond to the reference implementations documented in the skill's references/ directory.

Summary

• reverse-skill structures firmware pentesting as a nine-stage OWASP FSTM workflow from information gathering to binary exploitation.
• The modular architecture ensures only necessary tools execute per phase, configured in skills/firmware-pentest/SKILL.md.
• Automated routing in skills/routing.md maps firmware-related keywords to the appropriate skill automatically.
• Cross-skill integration connects hardware interfaces, protocol analysis, and network exploitation into a continuous pipeline.
• Reference implementations in extraction-methodology.md, emba-automated-analysis.md, and emulation-and-fuzz.md provide executable command chains.

Frequently Asked Questions

What tools does reverse-skill use for firmware extraction?

reverse-skill employs a fallback extraction chain including binwalk v3, unblob, jefferson, and ubi_reader for handling squashfs, JFFS2, and UBI filesystems. Specific methodologies are documented in skills/firmware-pentest/references/extraction-methodology.md.

How does reverse-skill automate vulnerability scanning in firmware?

The framework integrates EMBA (Embedded Analyzer) for automated static analysis during Stage 5. Running emba -i firmware.bin -o report.html generates comprehensive vulnerability reports without manual reverse engineering, as specified in references/emba-automated-analysis.md.

Can reverse-skill perform dynamic analysis and fuzzing on extracted firmware?

Yes. Stage 6 utilizes Firmadyne and QEMU for full-system emulation, while Stage 9 implements AFL++ in QEMU mode via afl-fuzz -Q to fuzz ARM and MIPS binaries. Remote debugging capabilities support GDB-multiarch and IDA Pro attachments during runtime analysis.

How does the routing system know when to use the firmware-pentest skill?

The routing table in skills/routing.md monitors task keywords such as "firmware", "binwalk", "EMBA", or "AFL++" and automatically assigns them to the "Firmware / IoT" column, ensuring the firmware-pentest skill handles embedded device analysis without manual intervention.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}