{"id":31747169,"url":"https://github.com/emproof-com/workshop_firmware_reverse_engineering","last_synced_at":"2025-10-09T13:26:12.276Z","repository":{"id":315854093,"uuid":"1061035024","full_name":"emproof-com/workshop_firmware_reverse_engineering","owner":"emproof-com","description":"Workshop on firmware reverse engineering","archived":false,"fork":false,"pushed_at":"2025-09-21T06:47:39.000Z","size":8987,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-09-21T08:23:07.464Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/emproof-com.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-09-21T05:23:26.000Z","updated_at":"2025-09-21T07:41:41.000Z","dependencies_parsed_at":"2025-09-21T08:33:13.420Z","dependency_job_id":null,"html_url":"https://github.com/emproof-com/workshop_firmware_reverse_engineering","commit_stats":null,"previous_names":["emproof-com/workshop_firmware_reverse_engineering"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/emproof-com/workshop_firmware_reverse_engineering","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/emproof-com%2Fworkshop_firmware_reverse_engineering","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/emproof-com%2Fworkshop_firmware_reverse_engineering/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/emproof-com%2Fworkshop_firmware_reverse_engineering/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/emproof-com%2Fworkshop_firmware_reverse_engineering/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/emproof-com","download_url":"https://codeload.github.com/emproof-com/workshop_firmware_reverse_engineering/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/emproof-com%2Fworkshop_firmware_reverse_engineering/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279001503,"owners_count":26083102,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-09T02:00:07.460Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-10-09T13:26:11.171Z","updated_at":"2025-10-09T13:26:12.266Z","avatar_url":"https://github.com/emproof-com.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Workshop: Firmware Reverse Engineering\n\nThis repository contains [slides](slides.pdf) and hands-on materials for [Emproof's](https://emproof.com) workshop on firmware reverse engineering, presented at [ScapyCon Automotive 2025](https://dissec.to/scapycon-automotive-2025/). The workshop targets a technical audience with minimal security experience and teaches the fundamentals through practical, self-contained tasks. Topics include\n\n* basic file/ELF analysis;\n* software cracking and keygenning;\n* string decryption \u0026 malware triage;\n* embedded-Linux firmware unpacking;\n* bare-metal analysis;\n* crypto detection;\n* obfuscation/anti-analysis techniques and how to bypass them;\n\nIf this is up your alley, also check out the [Emproof technical webinar series](https://github.com/emproof-com/webinars) with additional exercises and recorded sessions.\n\nWorkshop content was designed and organized by [Tim Blazytko](https://github.com/mrphrazer/), with support from Simran Kathpalia.\n\n\n## Setup\n\nTo set up the environment, clone the repository:\n\n```bash\ngit clone https://github.com/emproof-com/workshop_firmware_reverse_engineering\ncd workshop_firmware_reverse_engineering\n```\n\nFor several tasks we require an AArch64 Linux execution environment. We provide a [Docker container](Dockerfile) based on [Kali Linux](https://www.kali.org) with common tools (e.g., [GNU Binutils](https://www.gnu.org/software/binutils/), [Binwalk](https://github.com/ReFirmLabs/binwalk)) preinstalled. This streamlines the environment across Linux, Windows, and macOS—regardless of the host CPU architecture. To start the container and enter the shell, execute:\n\n```bash\n./docker_run.sh\n```\n\n\u003e **Note:** The first run may take a while to build the image.\n \n\u003e **Note (architecture):** The Docker Compose service sets `platform: \"linux/arm64\"`.  \n\u003e On x86_64 hosts (Intel macOS/Windows/Linux) Docker Desktop will run the image under emulation, so the first build and startup can be slower — that’s expected. On native ARM64 hosts (Apple Silicon, ARM servers) it runs natively and is faster.\n\n\u003e **Note:** The Docker container can also run ARMv7 (armhf) binaries. We install the armhf runtime (dynamic loader + libs) in the image and register binfmt handlers for both `aarch64` and `arm` via the startup script.\n\nIn addition, install the following graphical tools on your host for interactive reverse engineering tasks (these are not included in the container):\n\n* [Ghidra](https://ghidra-sre.org)\n* [Binary Ninja Free](https://binary.ninja/free/)\n\nBoth tools are available for Windows, Linux, and macOS.\n\n\u003e **Note:** Binary Ninja Free does **not** support AArch64. For AArch64 analysis use Ghidra (or a licensed Binary Ninja build). Therefore, several labs ship an **ARMv7 companion** binary (`*.armv7`) specifically for Binary Ninja Free; these can also be run in the same container.\n\n\n## Tasks Order\n\nEach task is self-contained in `tasks/\u003cname\u003e/` and includes:\n\n* `samples/` — binaries (and sometimes source) used in the exercise  \n* `task.md` — the assignment with step-by-step instructions and hints\n\nTasks can be attempted independently, but we provide a **recommended order** (listed below) that ramps up difficulty and gradually introduces new techniques. Most samples target **ARMv7 (Thumb/ARM32)** or **AArch64**; where relevant, the task notes call out architecture, required tools, and any special runtime needs.\n\n* [tasks/hello_world](tasks/hello_world): basics of ELF files and metadata analysis; first steps in Ghidra / Binary Ninja.\n\n* [tasks/license_check](tasks/license_check): extract hardcoded secrets / unlock features; basic patching to bypass validations (cracking).\n\n* [tasks/game](tasks/game): simple number-guessing game; understand the logic and crack trial vs. full mode.\n\n* [tasks/keygenning_1](tasks/keygenning_1): reverse a license validation and write a minimal keygen to generate valid serials.\n\n* [tasks/keygenning_2](tasks/keygenning_2): a slightly more sophisticated keygenning task (salts/keys, hex encoding).\n\n* [tasks/string_encryption](tasks/string_encryption): binary with encrypted strings (common in malware); identify the decryptor and recover strings statically.\n\n* [tasks/mirai](tasks/mirai): embedded malware using a string-decryption routine; navigate a larger codebase, identify interesting constructs, and deal with obfuscated strings.\n\n* [tasks/embedded_linux_1](tasks/embedded_linux_1): embedded-Linux firmware with filesystem; unpack, explore, and crack Linux login information (CTF-style).\n\n* [tasks/embedded_linux_2](tasks/embedded_linux_2): similar, but find and analyze a hidden binary that shouldn’t be there.\n\n* [tasks/car_demo](tasks/car_demo): bare-metal firmware analysis: identify architecture, board, memory map, toolchain artifacts; extract Wi-Fi credentials and protocol endpoints.\n\n* [tasks/iot_diag](tasks/iot_diag): bare-metal firmware dump of a diagnostics tool; recreate memory layouts from the datasheet, then find the password to unlock diagnostics mode.\n\n* [tasks/crypto_detection](tasks/crypto_detection): AArch64 binary performing cryptographic operations with a hardcoded AES key; locate the EVP call and backtrack key/IV to decrypt without the program.\n\n* [tasks/license_check_anti_patching](tasks/license_check_anti_patching): anti-patching via code checksumming; understand the CRC guard and learn ways to bypass it.\n\n* [tasks/fibonacci_obfuscation](tasks/fibonacci_obfuscation): clean vs. obfuscated Fibonacci implementations (switch flattening, computed goto, opaque predicates, arithmetic obfuscation, small VM); understand techniques and normalize them.\n\n\n## License\n\nUnless noted otherwise, all workshop materials in this repository are licensed under the **GNU General Public License, version 2 (GPL-2.0)**. See [`LICENSE`](LICENSE) for the full text.\n\nSome **third-party / externally sourced samples** are **excluded** from the GPL and provided **for analysis/education only** (no redistribution). These are:\n\n- [tasks/mirai/samples/](tasks/mirai/samples/)\n- [tasks/embedded_linux_1/samples/](tasks/embedded_linux_1/samples/)\n- [tasks/embedded_linux_2/samples/](tasks/embedded_linux_2/samples/)\n\n\u003e **Note:** If a subdirectory includes its own license file or header, that license takes precedence for that subdirectory’s contents.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Femproof-com%2Fworkshop_firmware_reverse_engineering","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Femproof-com%2Fworkshop_firmware_reverse_engineering","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Femproof-com%2Fworkshop_firmware_reverse_engineering/lists"}