Firmware.

Firmware Analysis Tool

EMBA - The firmware security analyzer

Extract files from any kind of container formats

OFRAK: unpack, modify, and repack binaries.

A tool to recover a fully analyzable .ELF from a raw kernel, through extracting the kernel symbol table (kallsyms)

Firmware Analysis and Comparison Tool

Hacking & Reverse Engineering RTL960x-based xPON ONTs to suit your OLT

Hex Viewer/Editor/Analyzer compatible with Linux/Windows/MacOS

Towards Large-Scale Emulation of IoT Firmware for Dynamic Analysis

Ghidra utilities for analyzing PC firmware

The Firmware Security Testing Methodology (FSTM) is composed of nine stages tailored to enable security researchers, software developers, consultants, and Information Security professionals with conducting firmware security assessments.

IoT firmware identification and extraction

EMBArk - The firmware security scanning environment

A firmware base address search tool.

IoT static scanner for secrets, SBOM, CVEs and more.

Tools for analyzing UEFI firmware and checking UEFI modules with FwHunt rules

Tool for decrypting the firmware files for Samsung SSDs

D-Link firmware decryption PoC

A tool for firmware cartography

122 AI skills for reverse engineering: malware analysis, software reversing, firmware and embedded systems, protocol reversing, mobile apps, unpacking and deobfuscation, software cracking, vulnerability research, managed code, forensics and intelligence, and CTFs.

Guide for patching AMI Aptio V UEFI firmware to circumvent Secure Boot checks

Reverse Engineering Framework for the Polyend Tracker

Open-source reverse engineering and firmware development for the FNIRSI 2C53T oscilloscope/multimeter/signal generator

Recent security papers on firmware analysis

System Management RAM analysis tool

A distributed fuzzing management framework

Presented hardware reverse engineering workshops since 2019

binwalk for Windows

A faster firmware base address scanner.

Finds the base address of a firmware by comparing string addresses with target pointer addresses

iOS 26.3 activation lock research -- 31 firmware vulnerabilities + VU#346053 BAA injection PoC

Universal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.

Interactive static pattern discovery tool to locate structures from frequent patterns

Decrypt and extract voice guidance MP3 prompts from Sony WH-1000XM4 encrypted voice packs. AES key extracted via Bluetooth firmware dump of the Airoha MT2811 SoC.

Samsung QN90B and QN90F root

Extract information and files from Reolink firmwares.

N64 Graphics data detection and analysis

Docker container with all extra tools installed to get the most out of binwalk

FETB : Take URL of File For Analysis using File + ExifTool + Binwalk Commands

Additional material for our paper "Breaking all the Things - A Systematic Survey of Firmware Extraction Techniques for IoT Devices" (CARDIS 2018)

Astell&Kern iRiver LS150 SPI firmware dump + telnet access

Python utility for dumping and patching SPI firmware to remove supported BIOS and UEFI passwords.

A BinaryNinja loader plugin for MTK Preloaders and Little Kernels

Automated dynamic security analysis by emulation of IoT firmware images in CI-pipelines.

Deterministic firmware-to-exploit evidence engine. Drop a firmware blob, get hash-anchored findings with SARIF + CycloneDX SBOM + verified exploit chains.

Next-Generation Firmware Analysis Toolkit. A hybrid Rust/Python toolkit for deep firmware analysis, extraction, and vulnerability discovery.

UEFI firmware analysis & research on known vulnerabilities in early boot components

Hacking TrendChip Firmware FG824CD (ADSL modem/router *****v4)

Advanced offline firmware triage and analysis tool for routers, IoT devices, DVRs, IP cameras, and embedded Linux firmware.

Packaged Windows version of binwalk: https://github.com/ReFirmLabs/binwalk/releases/tag/v3.1.0

LLM-powered automated reverse-engineering engine for vendor-abandoned hardware and software

Integrates Firmadyne into FACT

immune Guard agent application

Comprehensive pentest and reverse engineering guide for PAX Linux-based Point of Sale (PoS) merchant applications — firmware analysis, network interception, and app reversing.

Static firmware analysis - for symbol files generated by puncover and as an experiment to do it all in-browser on just an debug ELF file

Review, resources, and pre-lab exercises for the SANS SEC556 IoT Penetration Testing course, covering hardware hacking, firmware analysis, wireless protocols and SDR.

Steganography tool that extracts data from images

writeups! #JUSTCTF

A security-oriented Python script with bulk image analysis and security features such as metadata scrubbing, image file analysis, GPS data check, and file renaming.

Schneider Electric firmware

Zero-G Reverse Engineering Anything & Verified Safe Rust Reconstruction for Gemini 4 Argon + Google Antigravity 2.0 (4-Mount Recon Kits, Whole-Subgraph Extraction, 10,000-Vector Differential Parity Referee)

unpack and repack hikvision R2 firmware files

VS Code extension for Intel HEX & Motorola SREC memory exploration and editing

Host-side extraction and analysis toolkit for MHI2/MHI2Q/MH2P firmware packages

Reverse engineering and read-only tools for the M-VAVE ANN BlackBox: firmware, USB Audio, BLE/M-EFCS, OTA, DSP routing, and runtime internals.

Firmware Region Diff

Complete reverse engineering of the Quadzilla Adrenaline diesel tuner — firmware decryption, BLE protocol, 117 parameters, decompiled code. Done entirely by AI.

ArubaOS 8.13.2.0 pre-auth attack surface research. XXE+SSRF, ICMP reflection, buffer over-read, hardcoded credentials — all submitted to HPE Bugcrowd, marked N/A. No fixes issued.

Extraction and static analysis of IoT devices firmware as project for the "Information Security M" course at the University of Bologna (UNIBO)

AI-native Code-OSS workbench for safety-critical firmware. DO-178C evidence, MISRA, CBMC, CodeQL, measured MC/DC and hardware tooling in one window — with compliance runs that record what was actually measured, and claim nothing else.

Potential Swiss Army Knife Framework for IoT/Hardware Hacking/Vulnerability Research

IoTwizz - A modular IoT security testing framework for hardware hackers, firmware analysts, and IoT security researchers. Features AI-powered assistant, UART debugging, firmware analysis, JTAG/SWD scanning, SPI flashing, and protocol fuzzing.

Fast and reliable software to extract different sections / partitions from firmware images.

Zyxel super-admin credential exposure write-up across CPE/ONT/LTE/5G firmware, with an adapted VMG8825-B50B genpass lab.

20 hands-on security engineering labs covering attack surface discovery, reverse engineering, protocol analysis, fuzzing, CVSS scoring, and responsible disclosure.

Hardware-faithful MAME-based emulator for Millennium-compatible Z180 payphone terminals. Boots real firmware on a cycle-accurate Z180 with a full device tree and a byte-transparent host bridge. Companion to the CoinLine Payphone Management Platform.

ESP32-based UART guardian and Python tooling for safe, controlled reverse engineering of MStar MBoot embedded systems.

post-extraction firmware triage for ELF files

Firmware dumps for specialized OEM and carrier hardware. Research, analysis, and legacy device preservation.

122 publishable, cross-platform AI skills for reverse engineering: malware analysis, software reversing, embedded firmware, protocol reversing, mobile apps, unpacking and deobfuscation, software cracking, vulnerability research, managed code, forensic intelligence, and CTFs.

Static pattern discovery tool to locate structures from frequent patterns and understand file layout

Tool to unlock PVR, Netflix and hidden features on Smart TVs. Includes firmware editor and UART parser ,reapply HW/SW profiles via USB. Supports Vestel-based mainboards.

Interprocess communication analysis tools for firmware

intelmetool fork adds missing PCI IDs from 8th gen through Pnthr Lake. Upstream has incomplete platform coverage from CNL onwards — ICL completely absent, CML/TGL/ADL/RPL/MTL/ARL/PTL all missing. Adds entries to both platform scan and MEI interface tables. Corrects wrong ADL-S and RPL-S device IDs.

Tozed P11IDU (MT7628AN): stock firmware dump, an authenticated RCE in the vendor web UI, official OpenWrt flash, and a verified single-radio NAT Wi-Fi repeater. Full write-up and configs by Nipun Methmal.

Reverse-engineering tools for ZTE H188A/H288A firmware, raw NAND, JFFS2 webfs, HTTPD Lua bytecode, and hardcode analysis

REPI: a local agent platform for reverse engineering, penetration testing, and digital forensics

A technical security analysis and forensic audit of the ZTE ZXHN F670L ONT firmware, focused on attack vectors, data extraction, and embedded-device hardening.

analysis of reolink firmwares

CVE-2026-15469 — Hard-coded RSA-512 mesh group private key in TP-Link Deco XE75/XE5300/WE10800 (CWE-321). Advisory, analysis & PoC methodology (EN/KO).

Firmware analysis and IoT security research toolkit for authorized extraction, UART/JTAG workflows, and vulnerability triage.

Go + YARA-X aggregator and scan engine: collects 18k+ public YARA rules and scans engineering workstations (EWS) and firmware dumps for ICS/OT and commodity malware

IoT Firmware Vulnerability Hunting Skill

Cyber analysis tools used in different domains of cybersecurity.

The Cell/SPU RE tooling behind 'Execution Is Not Extraction' — SPU emulator, sound SLEIGH decompiler, offline lv1 executor, isolation harness. Tooling only.

Python bindings for Binwalk v3, built with PyO3 and maturin.

Reverse engineering and protocol emulation of a closed smart battery system. Hardware and firmware implementation replicating original authentication behavior at embedded level.

Unofficial Ubuntu/Debian .deb package for sasquatch, a SquashFS firmware extraction tool

Firmware-grounded research into automatic content recognition in smart TVs and streaming devices