Ghidra analyzer extension from Digital Security for individual UEFI modules, enabled by default during auto-analysis of x86 and x64 PE images with an EFI subsystem.
Rule-based checker for filesystem images taken from firmware: it reads ext2/3/4, FAT/VFAT, SquashFS and UBIFS images, cpio archives or a directory, and writes a JSON report of every file that breaks the rules in a TOML configuration.
Binarly's Python scanner that checks UEFI firmware modules against FwHunt rules, the YAML detection format for known UEFI firmware vulnerabilities whose rules are kept in the separate fwhunt repository.
Python tool that reconstructs serial flash contents from passive bus captures: it parses SPI or I²C analyzer exports from Saleae Logic, recorded while a device reads and writes its own flash chip, and writes the observed data into a binary image at the original memory addresses.
Maddie Stone's IDAPython scripts for triaging and annotating embedded-device firmware images in IDA Pro, presented at RECON Montreal and DerbyCon in 2017.
Quarkslab's firmware cartography tool, which indexes an extracted firmware filesystem into a database browsed with NumbatUI, Quarkslab's fork of the Sourcetrail code explorer.
Python reverse-engineering framework for the Polyend Tracker music device that patches the vendor's stock firmware, replacing an unused USB RAWHID handler with its own command handler.
Tools Quarkslab published from its research on Google's Titan M security chip in Pixel phones: a Ghidra loader for Titan M (Citadel) firmware files, nosclient for tracing and sending the chip's protobuf-based commands from Android with a black-box fuzzer built on libprotobuf-mutator, a parser for sigrok SPI captures, and scripts that convert firmware images to the rec files of the chip's SPI rescue feature.
Qt desktop programmer that reads, writes, erases and verifies I2C, SPI and MicroWire EEPROMs, FeRAM, DataFlash and SPI NOR/NAND flash chips through low-cost CH341A, CH347T and FT232H USB programmers.
Multithreaded Rust command-line tool that brute-forces the load address of a flat 32-bit firmware image, reimplementing mncoppola's basefind.py and rsaxvc's basefind.cpp.
IDA plugin that applies a microcontroller's memory map to a raw firmware image: once the analyst picks an MCU model, it creates RAM and other memory segments, adds peripheral segments with named registers and, where a vector table is described, labels its entries and turns the handlers they point to into functions.
Static analysis pipeline for extracted IoT firmware: pointed at one ELF or an unpacked root filesystem, it disassembles binaries with Capstone for x86, ARM/Thumb-2, AArch64 and MIPS, recovers functions, call graphs and exploit mitigations, and reports candidate issues from dangerous-function calls, call-graph taint paths, CVE correlation through cve-bin-tool, embedded secrets, script injection patterns and filesystem hardening checks.
Python script that estimates the load address of a flat 32-bit little-endian firmware image without brute-forcing every candidate base, building on mncoppola's basefind.py and rbasefind.
Joe Grand's open-source hardware tool and Parallax Propeller firmware for locating on-chip debug interfaces among an unfamiliar board's test points, vias, component pads or connectors.
Python collection of 16 parsers and extractors for vendor BIOS/UEFI update formats, including AMI BIOS Guard (PFAT) and UCP, Dell PFS, Insyde iFlash/iFdPacker, Phoenix TDK Packer, Award, Fujitsu, Panasonic, Portwell, Toshiba and VAIO packages and several Apple EFI containers.
Python script that estimates a firmware image's base address by comparing string addresses with the targets of every possible pointer, for any pointer size and either endianness.
Tenable's Python command-line tool, described in its repository as a toolkit for reverse engineering ESP32 firmware, that reads the partition table of an ESP32 flash dump and rebuilds an app partition such as factory or ota_0 as an Xtensa ELF file.
Open-hardware board built around the FTDI FT2232H that connects a computer to a target device's UART, SPI, I2C, JTAG and SWD interfaces through level shifters that operate from 1.8 to 5.5 V.
Python module and command-line scripts that read UBI and UBIFS images, including ones inside raw NAND dumps, by locating the first UBI or UBIFS data in a file.
Go command-line tool and library that extracts partition images from Android A/B OTA payloads, reading either a raw payload.bin or the OTA zip that contains it in place.
Offline C++ scanner for the contents of firmware and IoT software, pointed at a single file or an already unpacked root filesystem, that reports embedded secrets, a software bill of materials, known CVEs, open-source licenses, boot-security configuration and weak or publicly known keys, each finding with its evidence and a confidence level.
PMCA-RE RELOADED is a Rust desktop and CLI toolkit for Sony cameras that includes experimental analysis of where menu settings reside in camera settings memory.
Python monitor by Dmytro Oleksiuk (Cr4sh) that reads debug messages from Qualcomm cellular-modem firmware in real time over the modem's DIAG serial port, on a rooted Android phone or a USB modem.
Patches to the unsquashfs utility from squashfs-tools 4.3 that try to read as many vendor-modified SquashFS implementations from embedded firmware as possible.
remus-rlf-reader parses REMUS-100 autonomous underwater vehicle run logs and companion ADCP, GPS, and mission files using an empirically derived record layout.
An owner-authorized XM530V200 camera case uses REA/Ghidra to investigate native Sofia command handlers, then adds local control and Home Assistant integration while preserving stock drivers and recording.
RTX 3070 Ti VBIOS Reverse Engineering documents analysis of an MSI GA104 VBIOS, covering its ROM layout, NPDE and BIT structures, x86 BIOS, compressed UEFI GOP and Falcon fuc5 microcode.
A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them.
Adds emulation of Real3D’s Pro-1000, the SCSI-attached image generator from which Sega’s Model 3 graphics hardware derives, to the Supermodel arcade emulator.
Reimplements in C the firmware of the Wii U’s DMCU, the M68HC11-compatible display microcontroller in its AMD graphics controller, which in Wii mode reads the Video Interface state and configures display output, deinterlacing, scaling and overscan.
Reimplements the Boxine cloud services a Toniebox talks to as a self-hosted C server, so the box can fetch audio, settings and over-the-air content locally while the owner controls what reaches the manufacturer.
Replaces the vendor cloud of supported robot vacuums with a local service that runs on the rooted robot beside the vendor firmware and emulates the cloud endpoints that firmware expects, including a miio dummycloud and a counterpart for Midea's MSmart protocol.
Replaces the software on an unlocked second-generation Amazon Echo Dot (2016, codename biscuit) so it works as a local Home Assistant voice satellite over the ESPHome API: EchoMuse's own Go firmware drives the microphones, speaker, LED ring and buttons, and a controller on the LAN handles wake words, devices and a dashboard.
sony-bravia-linux investigates the Linux-based, pre-Android Sony BRAVIA platform and reconstructs selected media and portal behavior for owner-run services.
Hisense AEH-W41H1 local control replaces the air conditioner's cloud-connected Wi-Fi module with ESPHome firmware for an ESP32 board or the stock RTL8710C module.
airport-express-tools reconstructs configuration and Wi-Fi client functions for the second-generation AirPort Express A1392 from firmware and ACP protocol research.
SL-GlassesLed26x7 documents the connections of a 26×7 charlieplexed LED-glasses matrix and drives it with an ESP32 in place of the original controller.
