AwesomeREA.org

Learning resource

Emproof workshop: Firmware Reverse Engineering

Slides and 14 self-contained exercises from Emproof's firmware reverse-engineering workshop at ScapyCon Automotive 2025, designed by Tim Blazytko for a technical audience with little security experience. The firmware and binary tasks move from reading ELF metadata with binutils and first steps in Ghidra or Binary Ninja, through unpacking two embedded-Linux CTF images with binwalk, to bare-metal analysis: identifying the microcontroller, toolchain and memory map of a model car's firmware ELF, and rebasing a raw STM32F103 flash dump with segments taken from the datasheet. Other tasks decrypt strings statically in a Mirai sample and trace a hardcoded AES key back to its data section.

Requirements & limits

  • The reviewed main commit, from 2025-09-25, ends a 14-commit history that began on 2025-09-21. It holds slides.pdf and 14 tasks, each a task.md with step-by-step questions next to a samples folder; no model solutions are included, and the two embedded-Linux tasks link an external write-up.
  • The README says most samples target ARMv7 (Thumb/ARM32) or AArch64, and many come with C source. A Kali Linux-based Docker image fixed to linux/arm64, emulated on x86_64 hosts, supplies binutils, binwalk, John the Ripper and armhf runtime libraries; on first use docker_run.sh installs QEMU binfmt handlers on the host through a privileged container. Ghidra and Binary Ninja Free are installed on the host, and because Binary Ninja Free lacks AArch64 support, many tasks also ship an .armv7 build.
  • Bare-metal tasks expect the analyst to consult the microcontroller's datasheet or reference manual; the STM32F103 task names the flash, SRAM, peripheral and system-control-space ranges to define before re-analysis. Several further tasks are crackme-style license, keygen and anti-patching exercises on the workshop's own binaries; this entry covers the firmware and binary-analysis tasks.
  • The workshop materials are GPL-2.0, but the README excludes three sample folders from that license and provides them for analysis and education only, without redistribution: the two embedded-Linux images, which the tasks attribute to WORMCON CTF 2021, and a Mirai botnet binary that its task describes as active malware not to be executed, stored in a password-protected archive.
  • The materials mention no AI or REA use. This collection read the README, task files and container setup; it did not open the slides, build the container or handle any sample.

About this entry

Type
Learning resource
Category
Learning resources
Relationship
Learning resource
Targets
Binary · Firmware

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · emproof-com/workshop_firmware_reverse_engineering · Revision 10dc72a
  2. tasks/hello_world/task.md GitHub · emproof-com/workshop_firmware_reverse_engineering · Revision 10dc72a
  3. tasks/embedded_linux_2/task.md GitHub · emproof-com/workshop_firmware_reverse_engineering · Revision 10dc72a
  4. tasks/car_demo/task.md GitHub · emproof-com/workshop_firmware_reverse_engineering · Revision 10dc72a
  5. tasks/iot_diag/task.md GitHub · emproof-com/workshop_firmware_reverse_engineering · Revision 10dc72a
  6. tasks/crypto_detection/task.md GitHub · emproof-com/workshop_firmware_reverse_engineering · Revision 10dc72a
  7. Dockerfile GitHub · emproof-com/workshop_firmware_reverse_engineering · Revision 10dc72a
  8. docker_run.sh GitHub · emproof-com/workshop_firmware_reverse_engineering · Revision 10dc72a
  9. LICENSE GitHub · emproof-com/workshop_firmware_reverse_engineering · Revision 10dc72a

More in References and learning

All 44 entries in References and learning