Firmware Penetration Testing Workflow in reverse-skill: A 4-Stage OWASP FSTM Pipeline

The reverse-skill repository implements a complete firmware penetration testing workflow based on the OWASP Firmware Security Testing Methodology (FSTM), organizing the security assessment process into four sequential stages: extraction, automated static analysis, emulation, and fuzzing.

The zhaoxuya520/reverse-skill project provides a structured framework for embedded device security assessments. This firmware penetration testing workflow aligns with industry-standard methodologies, mapping specific tools and reference documents to each phase of the assessment. The entire pipeline is defined within the skills/firmware-pentest directory and referenced in the main routing table at skills/routing.md.

Stage 1: Firmware Extraction

The workflow begins with unpacking the firmware image to retrieve embedded filesystems and raw binaries. According to skills/firmware-pentest/references/extraction-methodology.md, this stage targets common embedded filesystems including SquashFS, UBI, and JFFS2.

The repository recommends binwalk for signature-based extraction and unblob for deep recursive unpacking. For verification and extraction, use the following commands:

# Recursive extraction with binwalk (matryoshka mode)

binwalk -Me firmware.bin

# Deep extraction with unblob

unblob --depth 10 -d out/ firmware.bin

These commands ensure complete extraction of nested archives and filesystems, providing the raw materials needed for subsequent static analysis.

Stage 2: Automated Static Analysis

Once extracted, the firmware contents undergo automated vulnerability scanning. The skills/firmware-pentest/references/emba-automated-analysis.md file documents the integration of EMBA (Embedded Malware Binary Analyzer) for rapid CVE detection and cve-bin-tool for binary-level vulnerability assessment.

To perform automated static analysis with EMBA, execute:

# Run EMBA with deep extraction and log output

sudo ./emba -D -l ./logs/x -f ./firmware.bin

This stage identifies known vulnerabilities and suspicious code patterns without requiring dynamic execution, creating a baseline security assessment before emulation.

Stage 3: Emulation with Firmadyne

After static analysis, the workflow moves to dynamic analysis through emulation. The skills/firmware-pentest/references/emulation-and-fuzz.md reference outlines the use of Firmadyne combined with QEMU to recreate the target environment for ARM or MIPS architectures.

The emulation setup requires initializing a PostgreSQL database and running the firmware analysis toolkit:

# Initialize the Firmadyne database

sudo -u postgres createdb -O firmadyne firmware
sudo -u postgres psql -d firmware < ./database/schema

# Execute the firmware analysis toolkit

git clone https://github.com/attify/firmware-analysis-toolkit.git ~/tools/fat
sudo ./fat.py /path/to/firmware.bin

This stage allows security researchers to observe runtime behavior, network service initialization, and interaction points that static analysis cannot reveal.

Stage 4: Fuzzing with AFL++

The final stage targets zero-day discovery through fuzzing. Once the firmware is successfully emulated, AFL++ fuzzes exposed network daemons, command-line interfaces, and services to uncover memory corruption vulnerabilities.

As documented in emulation-and-fuzz.md, execute AFL++ within the QEMU-emulated environment:

# Start fuzzing a target binary

afl-fuzz -i input_dir -o findings_dir -m none -- ./target_binary @@

This dynamic testing phase complements the earlier static analysis by identifying vulnerabilities that only manifest during runtime execution.

Summary

• The reverse-skill workflow follows the OWASP Firmware Security Testing Methodology through four distinct stages documented in skills/firmware-pentest/references/.
• Extraction relies on binwalk and unblob to unpack SquashFS, UBI, and JFFS2 filesystems from firmware images.
• Static analysis employs EMBA (emba -D -l ./logs/x -f ./firmware.bin) to detect known CVEs and malware signatures.
• Emulation uses Firmadyne with QEMU to boot ARM/MIPS firmware in a controlled virtual environment.
• Fuzzing integrates AFL++ to discover zero-day vulnerabilities in emulated services that static analysis misses.
• Entry point for this workflow is defined in skills/routing.md, which maps the "Firmware / IoT" category to the firmware-pentest/ directory.

Frequently Asked Questions

What tools does reverse-skill recommend for firmware extraction?

The repository recommends binwalk for signature-based recursive extraction using binwalk -Me, and unblob for deep filesystem unpacking with unblob --depth 10. These tools handle common embedded formats including SquashFS, UBI, and JFFS2 as detailed in extraction-methodology.md.

How does EMBA integrate into the reverse-skill static analysis stage?

EMBA serves as the primary automated scanner in Stage 2. The emba-automated-analysis.md reference specifies running sudo ./emba -D -l ./logs/x -f ./firmware.bin to perform deep extraction and CVE detection on the firmware binary, generating logs for vulnerability triage.

Can Firmadyne emulation work without the firmware-analysis-toolkit wrapper?

While Firmadyne can run independently, the reverse-skill workflow specifically utilizes the firmware-analysis-toolkit (fat.py) wrapper script to automate database initialization (createdb -O firmadyne firmware) and QEMU configuration, streamlining the emulation setup process documented in emulation-and-fuzz.md.

What is the purpose of the routing.md file in the firmware penetration testing workflow?

The skills/routing.md file acts as the central index that maps the "Firmware / IoT" category to the firmware-pentest/ directory. It summarizes the four-step assessment chain—extract, EMBA, emulate, fuzz—providing the entry point for navigating the complete firmware penetration testing workflow.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}