# Firmware Penetration Testing Workflow in reverse-skill: A 4-Stage OWASP FSTM Pipeline

> Explore the firmware penetration testing workflow in reverse-skill. Discover the 4-stage OWASP FSTM pipeline: extraction, static analysis, emulation, and fuzzing for robust security assessments.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-06

---

**The reverse-skill repository implements a complete firmware penetration testing workflow based on the OWASP Firmware Security Testing Methodology (FSTM), organizing the security assessment process into four sequential stages: extraction, automated static analysis, emulation, and fuzzing.**

The zhaoxuya520/reverse-skill project provides a structured framework for embedded device security assessments. This firmware penetration testing workflow aligns with industry-standard methodologies, mapping specific tools and reference documents to each phase of the assessment. The entire pipeline is defined within the `skills/firmware-pentest` directory and referenced in the main routing table at [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md).

## Stage 1: Firmware Extraction

The workflow begins with unpacking the firmware image to retrieve embedded filesystems and raw binaries. According to [`skills/firmware-pentest/references/extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/extraction-methodology.md), this stage targets common embedded filesystems including **SquashFS**, **UBI**, and **JFFS2**.

The repository recommends **binwalk** for signature-based extraction and **unblob** for deep recursive unpacking. For verification and extraction, use the following commands:

```bash

# Recursive extraction with binwalk (matryoshka mode)

binwalk -Me firmware.bin

# Deep extraction with unblob

unblob --depth 10 -d out/ firmware.bin

```

These commands ensure complete extraction of nested archives and filesystems, providing the raw materials needed for subsequent static analysis.

## Stage 2: Automated Static Analysis

Once extracted, the firmware contents undergo automated vulnerability scanning. The [`skills/firmware-pentest/references/emba-automated-analysis.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/emba-automated-analysis.md) file documents the integration of **EMBA** (Embedded Malware Binary Analyzer) for rapid CVE detection and **cve-bin-tool** for binary-level vulnerability assessment.

To perform automated static analysis with EMBA, execute:

```bash

# Run EMBA with deep extraction and log output

sudo ./emba -D -l ./logs/x -f ./firmware.bin

```

This stage identifies known vulnerabilities and suspicious code patterns without requiring dynamic execution, creating a baseline security assessment before emulation.

## Stage 3: Emulation with Firmadyne

After static analysis, the workflow moves to dynamic analysis through emulation. The [`skills/firmware-pentest/references/emulation-and-fuzz.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/firmware-pentest/references/emulation-and-fuzz.md) reference outlines the use of **Firmadyne** combined with **QEMU** to recreate the target environment for ARM or MIPS architectures.

The emulation setup requires initializing a PostgreSQL database and running the firmware analysis toolkit:

```bash

# Initialize the Firmadyne database

sudo -u postgres createdb -O firmadyne firmware
sudo -u postgres psql -d firmware < ./database/schema

# Execute the firmware analysis toolkit

git clone https://github.com/attify/firmware-analysis-toolkit.git ~/tools/fat
sudo ./fat.py /path/to/firmware.bin

```

This stage allows security researchers to observe runtime behavior, network service initialization, and interaction points that static analysis cannot reveal.

## Stage 4: Fuzzing with AFL++

The final stage targets zero-day discovery through fuzzing. Once the firmware is successfully emulated, **AFL++** fuzzes exposed network daemons, command-line interfaces, and services to uncover memory corruption vulnerabilities.

As documented in [`emulation-and-fuzz.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/emulation-and-fuzz.md), execute AFL++ within the QEMU-emulated environment:

```bash

# Start fuzzing a target binary

afl-fuzz -i input_dir -o findings_dir -m none -- ./target_binary @@

```

This dynamic testing phase complements the earlier static analysis by identifying vulnerabilities that only manifest during runtime execution.

## Summary

- **The reverse-skill workflow** follows the OWASP Firmware Security Testing Methodology through four distinct stages documented in `skills/firmware-pentest/references/`.
- **Extraction** relies on binwalk and unblob to unpack SquashFS, UBI, and JFFS2 filesystems from firmware images.
- **Static analysis** employs EMBA (`emba -D -l ./logs/x -f ./firmware.bin`) to detect known CVEs and malware signatures.
- **Emulation** uses Firmadyne with QEMU to boot ARM/MIPS firmware in a controlled virtual environment.
- **Fuzzing** integrates AFL++ to discover zero-day vulnerabilities in emulated services that static analysis misses.
- **Entry point** for this workflow is defined in [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md), which maps the "Firmware / IoT" category to the `firmware-pentest/` directory.

## Frequently Asked Questions

### What tools does reverse-skill recommend for firmware extraction?

The repository recommends **binwalk** for signature-based recursive extraction using `binwalk -Me`, and **unblob** for deep filesystem unpacking with `unblob --depth 10`. These tools handle common embedded formats including SquashFS, UBI, and JFFS2 as detailed in [`extraction-methodology.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/extraction-methodology.md).

### How does EMBA integrate into the reverse-skill static analysis stage?

**EMBA** serves as the primary automated scanner in Stage 2. The [`emba-automated-analysis.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/emba-automated-analysis.md) reference specifies running `sudo ./emba -D -l ./logs/x -f ./firmware.bin` to perform deep extraction and CVE detection on the firmware binary, generating logs for vulnerability triage.

### Can Firmadyne emulation work without the firmware-analysis-toolkit wrapper?

While Firmadyne can run independently, the reverse-skill workflow specifically utilizes the **firmware-analysis-toolkit** ([`fat.py`](https://github.com/zhaoxuya520/reverse-skill/blob/main/fat.py)) wrapper script to automate database initialization (`createdb -O firmadyne firmware`) and QEMU configuration, streamlining the emulation setup process documented in [`emulation-and-fuzz.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/emulation-and-fuzz.md).

### What is the purpose of the routing.md file in the firmware penetration testing workflow?

The [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) file acts as the central index that maps the "Firmware / IoT" category to the `firmware-pentest/` directory. It summarizes the four-step assessment chain—extract, EMBA, emulate, fuzz—providing the entry point for navigating the complete firmware penetration testing workflow.