# Curated reverse engineering resources · Page 41

> Page 41 of 52, entries 4,001–4,100. 5,191 tools, projects, integrations, case studies, and references for websites, games, apps, native binaries, firmware, and communication protocols.

Source-reviewed means descriptions were checked against primary documentation. Each entry page lists the full requirements and sources; this page shows their counts and the review date.

- HTML: <https://awesomerea.org/resources/page/41/>
- JSON: <https://awesomerea.org/api/v1/resources.json>
- 简体中文: <https://awesomerea.org/zh/resources/page/41/index.md>

## Firmware and hardware (100)

- [Firmware Analysis Toolkit (FAT)](https://awesomerea.org/resources/attify-firmware-analysis-toolkit/index.md): Tool · Attify's firmware security toolkit, rewritten for version 2 as a Rust command-line tool built around per-image projects. It classifies unknown blobs and firmware images, extracts filesystems, inventories startup scripts, credential strings and crypto material, triages ELF binaries with radare2-based decompilation and source-to-sink taint, and inspects bare-metal MCU images, BMC flash, Edge AI model files and Android APKs. Projects can then go through preflight checks and QEMU emulation on native, FirmAE, Firmadyne or EMUX backends.
- [FujiHack](https://awesomerea.org/resources/fujihack/index.md): Tool · Research codebase for reverse engineering Fujifilm cameras so that custom code can run on them under a patched firmware. It holds ARM firmware patches, chiefly a PTP/USB debugger that adds memory read, write and execute commands, a host CLI that uploads code and dumps memory over USB, and C headers documenting Fujifilm’s RTOS API with per-model firmware addresses and function stubs. On-camera code adds POSIX, graphics and I/O wrappers over that RTOS, a video record-limit mod, button remapping and the Frontier UI and module system.
- [efiSeek](https://awesomerea.org/resources/efiseek/index.md): Tool · Ghidra analyzer extension from Digital Security for individual UEFI modules, enabled by default during auto-analysis of x86 and x64 PE images with an EFI subsystem. It labels known GUIDs from a bundled database, applies UEFI types from bundled data-type archives, passes the image handle and system table from the entry point into called functions, and marks protocols located with LocateProtocol or installed with InstallProtocolInterface, protocol-notify callbacks and SMI handlers registered for software, hardware and child interrupts. Findings are also kept as JSON in the program, which a headless-mode script uses to sort SMM modules into project folders by handler type.
- [FwAnalyzer](https://awesomerea.org/resources/fwanalyzer/index.md): Tool · Rule-based checker for filesystem images taken from firmware: it reads ext2/3/4, FAT/VFAT, SquashFS and UBIFS images, cpio archives or a directory, and writes a JSON report of every file that breaks the rules in a TOML configuration. Rules cover SUID and world-writable files, allowed owners, SELinux labels and Linux capabilities, per-file metadata, content regexes, SHA-256 digests, JSON fields and external scripts such as the bundled checksec wrapper; it can also extract values such as version strings and compare the file tree or selected files with a previous run. Cruise describes it as part of a firmware security check suite, and check.py with an Android OTA unpacker runs it over each image in a firmware package.
- [FwHunt Community Scanner (fwhunt-scan)](https://awesomerea.org/resources/fwhunt-scan/index.md): Tool · Binarly's Python scanner that checks UEFI firmware modules against FwHunt rules, the YAML detection format for known UEFI firmware vulnerabilities whose rules are kept in the separate fwhunt repository. Its rizin-based analyzer reports a PE or TE module's Boot, Runtime and PEI service calls, protocols, PPIs, GUIDs, NVRAM variables and SMI handlers, which rules combine with code patterns, strings and hex strings. The CLI analyzes or scans one module, or extracts the modules of a whole firmware image and scans them, and the same classes work as a Python library.
- [sniffROM](https://awesomerea.org/resources/sniffrom/index.md): Tool · Python tool that reconstructs serial flash contents from passive bus captures: it parses SPI or I²C analyzer exports from Saleae Logic, recorded while a device reads and writes its own flash chip, and writes the observed data into a binary image at the original memory addresses. It recognizes more than 100 SPI flash commands from vendors such as Winbond, Macronix, Spansion and GigaDevice and currently parses 12 of them, reports manufacturer and device IDs seen in JEDEC ID reads, and can print a command summary, show a visual map of the captured address ranges and plot the timing of reads and writes.
- [Pawn](https://awesomerea.org/resources/google-pawn/index.md): Tool · Linux command-line tool from Google that reads the BIOS/UEFI firmware image out of the SPI flash of Intel-based workstations and laptops. Running as root, it identifies the chipset's LPC bridge over PCI, maps the chipset's root-complex registers through /dev/mem, and reports the flash descriptor regions and the BIOS write- and read-protection settings it finds. It then reads the flash through the SPI controller's hardware sequencing into a single image file, which the README suggests processing further with tools such as UEFITool.
- [EMBArk](https://awesomerea.org/resources/embark/index.md): Tool · Web-based enterprise interface for the EMBA firmware security scanner, which it installs and runs as its scanning backend. In the browser, users upload firmware, configure and follow EMBA scans, open the full EMBA HTML report and a security overview per firmware, and compare results in an aggregated dashboard; results are access-controlled per user and can be archived. The current main branch adds a REST API for upload, scan status and SBOM retrieval, and an orchestrator that distributes scans to EMBA worker nodes reached over SSH.
- [IDAPython Embedded Toolkit](https://awesomerea.org/resources/idapython-embedded-toolkit/index.md): Tool · Maddie Stone's IDAPython scripts for triaging and annotating embedded-device firmware images in IDA Pro, presented at RECON Montreal and DerbyCon in 2017. Triage scripts define code and functions from per-architecture prologue and epilogue patterns, mark address ranges as bytes, words or double words and turn unexplored bytes into strings; analysis scripts resolve memory accesses made at offsets from a known base value and add cross-references and value comments, and annotation scripts list CPU port (GPIO) use, tag functions without cross-references as possible dead code and trace where an operand is used. An Android folder adds a script that comments JNIEnv function calls in native libraries and one that decrypts the strings of ARM32 libraries packed with the WeddingCake anti-analysis wrapper.
- [fiano](https://awesomerea.org/resources/fiano/index.md): Tool · LinuxBoot's Go tools and libraries for parsing and modifying UEFI firmware images. Its utk command shows an image's firmware volumes and files as a table or JSON, finds, dumps, inserts, removes or replaces files, and extracts an image into a directory that can be reassembled, with a DXE cleaner for deleting unneeded DXE drivers. Further commands cover flash maps (fmap), coreboot CBFS, Intel FIT tables, FSP headers, microcode and LZMA data, and its Go packages also parse Intel ME regions, Boot Guard and CBnT manifests and AMD firmware structures.
- [Pyrrha](https://awesomerea.org/resources/pyrrha/index.md): Tool · Quarkslab's firmware cartography tool, which indexes an extracted firmware filesystem into a database browsed with NumbatUI, Quarkslab's fork of the Sourcetrail code explorer. The fs mapper uses LIEF to map ELF and PE files, their imports and exports and the symlinks that point to them; fs-cg disassembles every executable with IDA Pro or Ghidra and links their call graphs across binaries, and decomp indexes one executable's decompiled functions with call cross-references. JSON exports can be post-processed in Python, for example to diff two firmware versions.
- [RETracker](https://awesomerea.org/resources/retracker/index.md): Tool · Python reverse-engineering framework for the Polyend Tracker music device that patches the vendor's stock firmware, replacing an unused USB RAWHID handler with its own command handler. With the patched firmware flashed, a host CLI reads, hex-dumps and disassembles device memory in ARM or Thumb mode, writes memory, runs code at an address, assembles and executes position-independent "Polyp" modules such as a pad text scroller and screen fades, and copies files to the SD card over USB. Its fwtool.py also unpacks and repacks the Intel HEX .ptf firmware images for loading into a disassembler.
- [Titan M tools (Quarkslab)](https://awesomerea.org/resources/quarkslab-titanm-tools/index.md): Tool · Tools Quarkslab published from its research on Google's Titan M security chip in Pixel phones: a Ghidra loader for Titan M (Citadel) firmware files, nosclient for tracing and sending the chip's protobuf-based commands from Android with a black-box fuzzer built on libprotobuf-mutator, a parser for sigrok SPI captures, and scripts that convert firmware images to the rec files of the chip's SPI rescue feature. The repository also holds the Black Hat Europe 2021 white paper and slides, the ROOTS'21 paper and the Black Hat USA 2022 slides, which describe reverse engineering the firmware, sniffing its SPI communication with the application processor, and black-box and emulation-based fuzzing; the authors say the vulnerabilities they found were disclosed to Google.
- [uefi_retool](https://awesomerea.org/resources/uefi-retool/index.md): Tool · Python command-line tool and IDA Pro plugin for UEFI firmware reverse engineering. uefi_retool.py unpacks a firmware image with uefi-firmware-parser, collects its executable modules and runs IDA in batch mode on each one, writing their boot-service calls and protocol GUIDs to JSON; a separate command lists protocols whose GUIDs are absent from its EDK2, AMI and vendor GUID tables as proprietary. Inside IDA the plugin applies EFI system-table types and names, lists protocols in an explorer window and, from the JSON, shows a dependency browser and graph across the firmware’s modules.
- [Shannon Modem Loader for IDA Pro](https://awesomerea.org/resources/shannon-modem-loader/index.md): Tool · IDA Pro loader and post-processing scripts for Samsung Exynos "Shannon" baseband modem images that carry a TOC header, including crash dumps. The loader maps the TOC entries to aligned segments and entry points; after auto-analysis the post-processor restores debug-trace structures, names functions from strings and debug-log calls, rebuilds the MPU table and memory map, comments MMU-related coprocessor instructions, performs the ARM scatter-load with its decompression, and labels platform-abstraction-layer and task-initialization functions. The README adds the author's notes on ShannonOS, the PAL and the move from Cortex-R to Cortex-A cores.
- [IMSProg](https://awesomerea.org/resources/imsprog/index.md): Tool · Qt desktop programmer that reads, writes, erases and verifies I2C, SPI and MicroWire EEPROMs, FeRAM, DataFlash and SPI NOR/NAND flash chips through low-cost CH341A, CH347T and FT232H USB programmers. It identifies SPI flash by JEDEC ID against an editable chip database, shows SFDP, status and security registers, scans NAND bad blocks, and keeps the chip image in a hex-editor buffer that can save or load parts of the image and import or export Intel HEX. Companion programs edit the chip database and update it from the author's web server.
- [rbasefind](https://awesomerea.org/resources/rbasefind/index.md): Tool · Multithreaded Rust command-line tool that brute-forces the load address of a flat 32-bit firmware image, reimplementing mncoppola's basefind.py and rsaxvc's basefind.cpp. It records the offsets of ASCII strings, reads every 32-bit word as a possible pointer, and ranks candidate base addresses by how many strings each one would turn into pointer targets. The README calls it a simple heuristic that works rather well on some ARM (non-Thumb) binaries and will not work miracles.
- [Aptio V UEFI Editor](https://awesomerea.org/resources/aptio-v-uefi-editor/index.md): Tool · Browser-based editor for the setup menus of AMI Aptio V UEFI firmware, offered as an alternative to AMIBCP. From four sections the user takes from their own BIOS image, it rebuilds the setup forms and their references and shows each setting's VarStore, offset, size, options, failsafe and optimal defaults, access level and Suppress If conditions. Changes to top-level menu targets, suppressions, access levels and defaults are written back into the section files with a change log, and a session can be saved as hash-checked JSON; a separate IFR-Formatter.js script condenses IFRExtractor-RS output into a per-setting VarStore and offset listing.
- [FirmLoader](https://awesomerea.org/resources/firmloader/index.md): Tool · IDA plugin that applies a microcontroller's memory map to a raw firmware image: once the analyst picks an MCU model, it creates RAM and other memory segments, adds peripheral segments with named registers and, where a vector table is described, labels its entries and turns the handlers they point to into functions. The README compares it to IDA's built-in SVD loader, but it uses a simpler JSON description that can be written by hand from public datasheets. The reviewed commit bundles 813 descriptions for Microchip/Atmel, ST, NXP, TI, Silicon Labs and other MCUs.
- [IFDA (IoT Firmware Deep Analysis)](https://awesomerea.org/resources/ifda-iot-firmware-deep-analysis/index.md): Tool · Static analysis pipeline for extracted IoT firmware: pointed at one ELF or an unpacked root filesystem, it disassembles binaries with Capstone for x86, ARM/Thumb-2, AArch64 and MIPS, recovers functions, call graphs and exploit mitigations, and reports candidate issues from dangerous-function calls, call-graph taint paths, CVE correlation through cve-bin-tool, embedded secrets, script injection patterns and filesystem hardening checks. Reports come out as JSON, Markdown and a CycloneDX SBOM. Optional add-ons are Ghidra headless pseudocode, moria-based extraction of raw images and a Go service with a job queue, REST API, bilingual web UI and an LLM agent that triages a finished scan's findings.
- [basefind2](https://awesomerea.org/resources/basefind2/index.md): Tool · Python script that estimates the load address of a flat 32-bit little-endian firmware image without brute-forcing every candidate base, building on mncoppola's basefind.py and rbasefind. It searches the gaps between sorted pointer values for a run of consecutive gaps between string offsets, takes each match as a candidate base, and scores it by the share of sampled strings whose rebased address also appears as a pointer. The README's example finds the correct base of one image in about 26 seconds.
- [JTAGulator](https://awesomerea.org/resources/jtagulator/index.md): Tool · Joe Grand's open-source hardware tool and Parallax Propeller firmware for locating on-chip debug interfaces among an unfamiliar board's test points, vias, component pads or connectors. Driven from a serial terminal, its 24 level-shifted channels try pin permutations to identify JTAG pinouts by IDCODE or BYPASS scans, SWD pinouts by IDCODE and UART pinouts with their baud rates. With a known JTAG pinout the firmware can also read device IDs, discover instruction and data registers and map a chip's pins to boundary-scan positions with EXTEST, and other modes pass UART traffic through, act as a SUMP-compatible logic analyzer or emulate a Bus Pirate so OpenOCD can use the board as a JTAG adapter.
- [BIOSUtilities](https://awesomerea.org/resources/biosutilities/index.md): Tool · Python collection of 16 parsers and extractors for vendor BIOS/UEFI update formats, including AMI BIOS Guard (PFAT) and UCP, Dell PFS, Insyde iFlash/iFdPacker, Phoenix TDK Packer, Award, Fujitsu, Panasonic, Portwell, Toshiba and VAIO packages and several Apple EFI containers. Each utility checks whether an input matches its format and unpacks the firmware components, such as SPI/BIOS/UEFI, EC and ME images, plus bundled utilities into an output folder, optionally reporting structure information; an Apple EFI identifier names images from their IBIOSI tag. A main.py script tries every utility on the given files, and the biosutilities package exposes the same classes to Python.
- [allyourbase](https://awesomerea.org/resources/allyourbase/index.md): Tool · Python script that estimates a firmware image's base address by comparing string addresses with the targets of every possible pointer, for any pointer size and either endianness. Instead of trying each base in turn, it computes the overlap as an FFT cross-correlation modulo several pairwise-coprime numbers and recovers the base with the Chinese remainder theorem, which keeps 64-bit address spaces tractable. The author keeps it small so that analysts can swap in their own heuristic, such as matching absolute call targets with the instructions that follow returns.
- [ghidra_kernelcache](https://awesomerea.org/resources/ghidra-kernelcache/index.md): Tool · Ghidra script framework for reverse engineering Apple kernelcaches and kernel extensions on iOS and macOS. Starting from the C++ class information that Siguza's iometa extracts, it symbolicates the kernel, rebuilds IOKit class hierarchies, structures, namespaces and virtual tables with typed method definitions, and resolves virtual call references, either through arm64e pointer-authentication constants or with a p-code data-flow pass. Other scripts fix the externalMethod and getTargetAndMethodForIndex dispatch tables, apply XNU function signatures from header files, propagate types, load KDK DWARF symbols and copy structures between projects.
- [esp32_image_parser](https://awesomerea.org/resources/esp32-image-parser/index.md): Tool · Tenable's Python command-line tool, described in its repository as a toolkit for reverse engineering ESP32 firmware, that reads the partition table of an ESP32 flash dump and rebuilds an app partition such as factory or ota_0 as an Xtensa ELF file. Other actions list the partitions, dump a partition's raw bytes and parse an NVS partition's key-value entries as text or JSON; create_elf loads the app image with esptool, maps its flash, DRAM and IRAM segments to ELF sections and adds symbols from a bundled ROM symbol table.
- [Tigard](https://awesomerea.org/resources/tigard/index.md): Tool · Open-hardware board built around the FTDI FT2232H that connects a computer to a target device's UART, SPI, I2C, JTAG and SWD interfaces through level shifters that operate from 1.8 to 5.5 V. One of the chip's two ports is dedicated to UART and the other is shared by the remaining interfaces; switches select the reference voltage and the SPI/JTAG or I2C/SWD wiring, and a logic-analyzer header lets an external analyzer watch the traffic. Tigard has no software of its own: it is designed to work with existing x232H tools, and the README gives settings for reading SPI flash, JTAG debugging with OpenOCD or Black Magic Debug, SWD debugging with OpenOCD, boundary scan, and iCE40 or AVR programming.
- [UBI Reader](https://awesomerea.org/resources/ubi-reader/index.md): Tool · Python module and command-line scripts that read UBI and UBIFS images, including ones inside raw NAND dumps, by locating the first UBI or UBIFS data in a file. They extract files or whole UBI and UBIFS images, list and copy single files, display UBI headers, volume tables and the UBIFS super and master nodes, and search physical erase blocks when debugging failed extractions. ubireader_utils_info also derives the mtd-utils parameters, written as a shell script and config file, needed to rebuild an image to the same specification.
- [payload-dumper-go](https://awesomerea.org/resources/payload-dumper-go/index.md): Tool · Go command-line tool and library that extracts partition images from Android A/B OTA payloads, reading either a raw payload.bin or the OTA zip that contains it in place. It decompresses operations in parallel, can list partitions or dump only selected ones, and verifies operation data, source images and final images with SHA-256, exiting non-zero on any mismatch. Incremental (delta) payloads are applied onto previously extracted base images, and it regenerates the dm-verity hash tree and FEC parity that delta payloads omit, so the README reports bit-exact output.
- [mithril](https://awesomerea.org/resources/mithril-iot-scanner/index.md): Tool · Offline C++ scanner for the contents of firmware and IoT software, pointed at a single file or an already unpacked root filesystem, that reports embedded secrets, a software bill of materials, known CVEs, open-source licenses, boot-security configuration and weak or publicly known keys, each finding with its evidence and a confidence level. Its SBOM also recovers components from ELF version banners, libc filenames and the kernel banner in stripped images and is written as CycloneDX and SPDX, while the CVE pass joins it against a local OSV and NVD mirror annotated with CISA KEV and EPSS. It does not unpack images; the author's companion tool moria handles identification and extraction.
- [img4tool](https://awesomerea.org/resources/img4tool/index.md): Tool · tihmstar's command-line tool and C++ library for Apple's IMG4 firmware container format. It prints the ASN.1 contents of IMG4 files, IM4P payload containers and IM4M signing manifests, including payload types, descriptions and key bags, and extracts IM4P or IM4M parts from IMG4 or SHSH files and payloads from IM4P files, decompressing LZSS or BVX2 (LZFSE) data and decrypting it when given an IV and key. It can also check an IM4M ticket or a signed IMG4 against a BuildManifest, convert IM4M files to SHSH, and build or rename containers for restore tooling.
- [payload dumper](https://awesomerea.org/resources/payload-dumper/index.md): Tool · Python script that extracts the partition images, such as boot.img and system.img, from the payload.bin inside an Android OTA update package. It handles full OTAs directly and incremental OTAs with --diff by applying the update to original images that the user copies from a full OTA or dumps from the device, and it can also run from a Docker image.
- [PMCA-RE RELOADED](https://awesomerea.org/resources/pmca-re-reloaded/index.md): Tool · PMCA-RE RELOADED is a Rust desktop and CLI toolkit for Sony cameras that includes experimental analysis of where menu settings reside in camera settings memory. It also parses firmware files, backup images and usage logs offline, and provides USB access to camera information, apps, firmware updates and settings. Supported operations depend on the camera generation.
- [ThisFirmwareDoesNotExist](https://awesomerea.org/resources/thisfirmwaredoesnotexist/index.md): Tool · ThisFirmwareDoesNotExist maps Arturia MicroFreak firmware 5.0.0.2084 and provides freakpatch to modify a user's official update file. Its notes cover the update format and firmware subsystems, while Ghidra scripts and assembly sources support the documented patch locations.
- [intel_ma](https://awesomerea.org/resources/intel-ma/index.md): Tool · intel_ma inspects PC management firmware in ME/TXE/CSME region images and full SPI dumps. Its Rust library and CLI parse partition tables, AMD PSP directories, UEFI firmware volumes and FIT records, and report Boot Guard, BIOS Guard and descriptor locks. It can also remove selected Intel ME components and set documented disable flags in an output image.
- [MS4X](https://awesomerea.org/resources/ms4x/index.md): Tool · MS4X analyzes Siemens MS42 and MS43 engine-control firmware for BMW M52TU and M54 engines. Its Python tools disassemble and assemble C166 instructions and inspect image checksums, stock-code differences and TunerPro patchlists; companion documents cover memory maps and findings in the factory programs.
- [AC46 Firmware Tool](https://awesomerea.org/resources/ac46-firmware-tool/index.md): Tool · AC46 Firmware Tool unpacks firmware images for JieLi AC4600/BT15 devices. It accepts a dumped flash image or a BFU file with its first 512 bytes removed, detects an encryption state, extracts bootloader and resource files, and writes a repacking batch script. The repository also lists cipher, CRC16, and chip-key utilities.
- [Bin X-ray](https://awesomerea.org/resources/bin-xray/index.md): Tool · Bin X-ray visualizes byte patterns in unknown files and firmware blobs through a 256×256 byte-pair matrix and a 3D byte-trigram plot. A sliding window, ribbon overview, transition-offset search and hex view let analysts move from a pattern to its bytes in the file.
- [PIC microcontrollers disassembler](https://awesomerea.org/resources/pic-disasm/index.md): Tool · PIC microcontrollers disassembler converts Intel HEX dumps for MidRange and Enhanced MidRange PIC12/PIC16 devices into disassembly listings, HI-TECH PICC assembly files, or both. Processor descriptions and instruction definitions are supplied as JSON configuration files.
- [SPRD Flash Tool](https://awesomerea.org/resources/sprdflash-rs/index.md): Tool · SPRD Flash Tool implements the SPRD/UNISOC PAC download protocol in Rust for RDA8910 and UIS8910 devices. Its analysis functions read partitions or whole flash through READ_FLASH and infer a proposed BMAConfig layout from U-Boot, LuatOS and filesystem regions; the author reports byte comparisons on an Air724UG.
- [PCM Explorer](https://awesomerea.org/resources/pcm-explorer/index.md): Tool · PCM Explorer is a read-only Python browser for Porsche PCM and Audi MMI head-unit images. It parses QNX4/QNX6 drives, compressed firmware, update discs, persistence flash and HBM5 HMI files, and supports search, image comparison, extraction and filesystem checks.
- [me_cleaner](https://awesomerea.org/resources/me-cleaner/index.md): Tool · me_cleaner is a Python script that modifies Intel ME firmware images to reduce the firmware's ability to interact with the system. Depending on the ME generation, it removes the firmware or retains only modules needed for boot.
- [Black Magic Debug](https://awesomerea.org/resources/black-magic-debug/index.md): Tool · Black Magic Debug is a self-contained debugger for microcontrollers. It detects and configures connected targets without configuration files.
- [OpenOCD](https://awesomerea.org/resources/openocd/index.md): Tool · OpenOCD is a tool for programming and debugging embedded targets through hardware debug adapters. It supports flash programming, breakpoints, single stepping, and remote debugging through GDB.
- [qc_debug_monitor](https://awesomerea.org/resources/qc-debug-monitor/index.md): Tool · Python monitor by Dmytro Oleksiuk (Cr4sh) that reads debug messages from Qualcomm cellular-modem firmware in real time over the modem's DIAG serial port, on a rooted Android phone or a USB modem. It enables message reporting for chosen 16-bit subsystem IDs, prints or logs text messages with their firmware source file and line, and decodes terse messages, which carry only a 32-bit format-string hash and arguments, when given a hash database. A discovery mode lists the subsystem ID ranges a modem answers to, and logs can be split into one file per subsystem.
- [sasquatch](https://awesomerea.org/resources/sasquatch/index.md): Tool · Patches to the unsquashfs utility from squashfs-tools 4.3 that try to read as many vendor-modified SquashFS implementations from embedded firmware as possible. Simple header changes are handled automatically; when a vendor has altered the LZMA compression options or how they are stored in data blocks, it tries to resolve them by brute force with added lzma-adaptive, lzma-alt and lzma-ddwrt decompressors. Extra options let analysts force the decompressor, SquashFS version, endianness and lzma-adaptive parameters and turn on trace output.
- [FIRMADYNE](https://awesomerea.org/resources/firmadyne/index.md): Tool · Rehost extracted Linux-based embedded firmware with instrumented kernels, NVRAM emulation and inferred network configuration.
- [flashrom](https://awesomerea.org/resources/flashrom/index.md): Tool · Identify and read supported flash chips to obtain firmware images for offline inspection, with separate write and verification operations.
- [InternalBlue](https://awesomerea.org/resources/internalblue/index.md): Tool · Study and patch supported Broadcom/Cypress Bluetooth firmware while observing link-layer traffic on the participating device.
- [MC Extractor](https://awesomerea.org/resources/mc-extractor/index.md): Tool · Find and extract CPU microcode from firmware images, inspect microcode headers and compare entries against a version database.
- [MTKClient](https://awesomerea.org/resources/mtkclient/index.md): Tool · Inspect MediaTek device flash and partitions through chipset-specific boot-ROM or preloader interfaces.
- [BoschMe7x](https://awesomerea.org/resources/ida-bosch-me7x/index.md): Tool · BoschMe7x is an IDA Pro plugin that reads a Bosch ME7.x binary and tries to disassemble it. The documented processor is the Siemens C166 family.
- [CeDImu](https://awesomerea.org/resources/cedimu/index.md): Tool · CeDImu emulates selected Philips CD-I player hardware so user-provided BIOS images can run and be inspected. Its debugger exposes CPU and VDSC viewers, memory access logs, and exception and system call traces; it also reads CD-I file systems and exports files, audio and raw video.
- [CasioEmuNeo](https://awesomerea.org/resources/casioemuneo/index.md): Tool · CasioEmuNeo disassembles Casio calculator ROMs for use with its nX-U8/100 emulator and debugger. Its u8-disas program writes a disassembly file that the emulator can display alongside the selected model.
- [remus-rlf-reader](https://awesomerea.org/resources/remus-rlf-reader/index.md): Tool · remus-rlf-reader parses REMUS-100 autonomous underwater vehicle run logs and companion ADCP, GPS, and mission files using an empirically derived record layout. It provides a binary format specification, Python decoders for sensor and mission records, and a browser explorer that plots parsed RLF data.
- [unME11](https://awesomerea.org/resources/unme11/index.md): Tool · unME11 unpacks Intel ME 11.x firmware regions with Python 2.7 scripts. Given a firmware image, it writes a text report and extracts partitions, modules, and metadata into a directory; LZMA decompression uses an external binary.
- [pocketwalker](https://awesomerea.org/resources/pocketwalker-emulator/index.md): Tool · pocketwalker emulates the PokéWalker's H8/38606F hardware for running its device software. Its C++ core models the H8/300H instruction set, memory bus, timers, serial interfaces, accelerometer, EEPROM, LCD and buzzer, with IR communication over TCP.
- [Wii U Firmware Emulator](https://awesomerea.org/resources/wii-u-firmware-emulator/index.md): Tool · Wii U Firmware Emulator models the console's processors and hardware to run user-dumped boot1, IOSU and Cafe OS through the menu stage. Its debugger supports instruction stepping, breakpoints, watchpoints, memory reads, stack traces, threads, message queues and IPC inspection.
- [Project IceStorm](https://awesomerea.org/resources/project-icestorm/index.md): Tool · Project IceStorm documents the Lattice iCE40 FPGA configuration bitstream format and supplies tools to analyse and create bitstream files. Its source tree includes bitstream utilities and format documentation for logic, I/O and RAM tiles.
- [ThinkPad IMX471: recovering camera tuning for Linux](https://awesomerea.org/resources/thinkpad-imx471-camera-case/index.md): Case study · Recovers selected camera-tuning structures from an Intel Windows driver package and uses them to repair Linux image capture on one ThinkPad model. Public CPFF/AIQB parsers, kernel patches and libcamera changes accompany the author’s Claude-assisted investigation and bounded before/after measurements.
- [MXQ PRO RK3229: an Android firmware investigation and Linux repurposing](https://awesomerea.org/resources/mxqpro-rk3229-rea-repurposing-case/index.md): Case study · An owner documents identifying an RK3229 TV box, investigating its stock Android ROM and repurposing it with a userspace gamepad driver and Armbian. REA assisted ADB inventory and Android-provider routing; APK analysis and device changes are reported as a mixed workflow.
- [iCSee LocalMod: a stock-firmware camera control extension](https://awesomerea.org/resources/icsee-localmod-rea-camera-case/index.md): Case study · An owner-authorized XM530V200 camera case uses REA/Ghidra to investigate native Sofia command handlers, then adds local control and Home Assistant integration while preserving stock drivers and recording. The source-only extension documents separate static, emulated-protocol and physical-device evidence.
- [nikond750: decrypting and mapping Nikon D750 firmware](https://awesomerea.org/resources/nikond750-case/index.md): Case study · Nikond750 investigates the Nikon D750 firmware image D750_0115.bin using decryption scripts, CRC checks, module extraction and Ghidra notes. The author reports recovering a three-table XOR scheme, identifying the ARM application and WLAN modules, and tracing a Wi-Fi throughput limit to the BCM43362 hardware; project instructions also include REA tooling.
- [LemonadeMirror: porting the Lululemon Mirror to mainline Linux](https://awesomerea.org/resources/lemonademirror-case/index.md): Case study · LemonadeMirror ports the Lululemon Mirror's peripherals from its Android vendor software to Debian and a mainline Linux kernel. The author describes using REA, Ghidra, objdump and device-tree decoding to recover display, audio, microphone and camera settings, then implements kernel patches, a device tree and user-space services.
- [Bose USB Bridge: selecting SoundLink Flex USB audio from firmware research](https://awesomerea.org/resources/bose-usb-bridge-case/index.md): Case study · Bose USB Bridge uses firmware and updater research to select an existing USB audio mode on a guarded SoundLink Flex unit. The macOS LaunchAgent sends scoped USB/HID requests and lets the built-in USB audio stack carry playback; its research notes report REA analysis of the updater and separate CSR filesystem and XAP firmware analysis.
- [RTX 3070 Ti VBIOS Reverse Engineering: mapping and analyzing GA104 firmware](https://awesomerea.org/resources/rtx-3070-ti-vbios-re-case/index.md): Case study · RTX 3070 Ti VBIOS Reverse Engineering documents analysis of an MSI GA104 VBIOS, covering its ROM layout, NPDE and BIT structures, x86 BIOS, compressed UEFI GOP and Falcon fuc5 microcode. Its workflow combines ROM parsers, REA with Ghidra, EfiCompress decompression, envydis and a Falcon MMIO probe; the repository includes scripts, format notes and an envydis ISA patch.
- [hantek-dso: reconstructing Hantek DSO5000P USB control](https://awesomerea.org/resources/hantek-dso5000p-linux-case/index.md): Case study · hantek-dso reconstructs USB control of Hantek DSO5000P oscilloscopes in a Linux Python client with GUI, CLI and API. Its protocol reference combines REA and Ghidra analysis of scope firmware, inspection of the original Windows Scope application and live DSO5102P tests. The client reads waveforms and settings, changes controls and retrieves screenshots over the recovered command framing.
- [flipper-telink: replacement firmware for Tuya Zigbee remotes](https://awesomerea.org/resources/flipper-telink-tuya-remote-firmware-case/index.md): Case study · A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them. For Tuya TS0044/TS0046 scene remotes, the notes trace the stock ~500 ms single-click delay to a double-click window; the replacement firmware drops that window while presenting the stock model IDs to Zigbee2MQTT. The latest Zigbee build is marked unverified for pairing, actions and battery reporting.
- [Supermodel: initial Real3D Pro-1000 image-generator emulation](https://awesomerea.org/resources/supermodel-real3d-pro1000-emulation-case/index.md): Case study · Adds emulation of Real3D’s Pro-1000, the SCSI-attached image generator from which Sega’s Model 3 graphics hardware derives, to the Supermodel arcade emulator. It boots user-supplied Pro-1000 firmware from the SDK disc, emulates the board’s interrupt, JTAG and UART hardware, and exposes the firmware’s built-in monitor on the console. Nothing renders yet, and SCSI host communication is unimplemented.
- [OpenDMCUFirm: a reimplemented Wii U DMCU display firmware](https://awesomerea.org/resources/opendmcufirm-wii-u-dmcu-firmware-case/index.md): Case study · Reimplements in C the firmware of the Wii U’s DMCU, the M68HC11-compatible display microcontroller in its AMD graphics controller, which in Wii mode reads the Video Interface state and configures display output, deinterlacing, scaling and overscan. The README says the work is based on reverse engineering of the original firmware with byte-for-byte matching decompilation outside its scope, and calls it a work in progress. The built image replaces the stock firmware in Wii mode when loaded through the evWii plugin.
- [reflecticon-224: running Lexicon 224 reverb firmware on emulated hardware](https://awesomerea.org/resources/reflecticon-224-lexicon-emulation-case/index.md): Case study · Emulates the Lexicon 224, 224X and 224XL digital reverbs so that their own firmware runs in a browser page or a JUCE plugin. The repository layers KiCad schematics, gate-level and board-level Verilog models, an 8080-hosted C++ emulator and analog input/output models, and checks faster layers against slower ones using user-supplied ROMs. It is a work-in-progress hardware-and-firmware emulation whose documentation is still pending.
- [TeddyCloud: a self-hosted replacement for the Toniebox cloud](https://awesomerea.org/resources/teddycloud-toniebox-server-case/index.md): Case study · Reimplements the Boxine cloud services a Toniebox talks to as a self-hosted C server, so the box can fetch audio, settings and over-the-air content locally while the owner controls what reaches the manufacturer. It serves and caches tonie audio, converts other audio into the box’s TAF format, can pass requests through to the original cloud, and adds a web interface, MQTT and Home Assistant integration. Protobuf definitions in the repository describe the box’s freshness-check, RTNL log and TAF header messages.
- [Valetudo: local replacement for robot-vacuum vendor clouds](https://awesomerea.org/resources/valetudo-robot-cloud-replacement-case/index.md): Case study · Replaces the vendor cloud of supported robot vacuums with a local service that runs on the rooted robot beside the vendor firmware and emulates the cloud endpoints that firmware expects, including a miio dummycloud and a counterpart for Midea's MSmart protocol. Its FAQ says each new vendor backend meant reverse engineering data formats, authentication and communication without vendor documentation; Valetudo converts the proprietary map formats into one ValetudoMap format and keeps Kaitai Struct descriptions of Dreame, Roborock and Viomi map files and a Midea protobuf schema as references. It adds a web interface, a REST API with Swagger UI and MQTT/Home Assistant integration, while feature parity with the vendor apps is an explicit non-goal.
- [EchoMuse: replacement software that turns the Echo Dot 2nd gen into a Home Assistant voice satellite](https://awesomerea.org/resources/echomuse-echo-dot-voice-satellite-case/index.md): Case study · Replaces the software on an unlocked second-generation Amazon Echo Dot (2016, codename biscuit) so it works as a local Home Assistant voice satellite over the ESPHome API: EchoMuse's own Go firmware drives the microphones, speaker, LED ring and buttons, and a controller on the LAN handles wake words, devices and a dashboard. Its default emOS mode swaps Amazon's Android userspace for the project's own init and busybox while keeping the Dot's kernel from the owner's boot image. An engineering journal records how codec routes, the mute key and other hardware behavior were worked out by measuring the device and diffing the mixer and DAPM state while stock FireOS plays a sound.
- [OSIRIS: replacing Onkyo receiver firmware through MCU protocol research](https://awesomerea.org/resources/osiris-onkyo-receiver-case/index.md): Case study · OSIRIS replaces the DSP-board software of Onkyo TX-NR515 and TX-NR717 receivers with its own boot loader, Linux services and DSP code. The project documents the SPI exchange between the main MCU and DSP board, including 1032-byte transfers, frame structure and command meanings recovered from stock firmware and logs.
- [Virtual MPC Sample: rehosting Akai MPC Sample firmware in QEMU](https://awesomerea.org/resources/virtual-mpc-sample-case/index.md): Case study · Virtual MPC Sample rehosts Akai MPC Sample 1.3.0.12 firmware in QEMU using a custom lab kernel and a browser panel for the device controls. The repository documents firmware and device architecture, emulates the panel's UART communication and provides a shell, tracing and mod testing against the user's own firmware files.
- [OpenJooki: replacing the Jooki 2 software and recovery path](https://awesomerea.org/resources/openjooki-jooki2-case/index.md): Case study · OpenJooki replaces the Jooki 2 music speaker's embedded Linux core and provides phone-based control, updates and SD-card recovery. Its technical notes map the device's Ingenic Linux and ESP32 split, storage partitions, Mender update slots and recovery behavior, while the repository contains the replacement Lua services and installer tooling.
- [Stickwalker: porting Pokéwalker firmware to the Stick S3](https://awesomerea.org/resources/stickwalker-case/index.md): Case study · Stickwalker ports a matching reconstruction of Pokéwalker firmware to the M5Stack Stick S3. The repository includes firmware source, build tooling and placeholder artwork; users can build with artwork extracted from their own ROM, and a BPV10NF photodiode supplies infrared reception.
- [sony-bravia-linux: pre-Android BRAVIA platform and media behavior](https://awesomerea.org/resources/sony-bravia-linux-case/index.md): Case study · sony-bravia-linux investigates the Linux-based, pre-Android Sony BRAVIA platform and reconstructs selected media and portal behavior for owner-run services. Its documentation records observations from 2011–2012 AZ1, AZ2 and AZ3 sets, including remote input, browser media handling and 3D signalling. The repository also contains tools for H.264 3D SEI and related media workflows.
- [VanMoof BLE: a client for S5, A5 and S6 bicycle protocols](https://awesomerea.org/resources/vanmoof-ble-protocol-case/index.md): Case study · VanMoof BLE implements a Python client for the S5, A5 and S6 bicycle BLE protocols. It authenticates with an Ed25519 certificate, reads and writes documented topics, decodes captured messages, and exposes controls and telemetry according to each model's message format.
- [open-picpak: reconstructing the PicPak frame's BLE protocol and device behavior](https://awesomerea.org/resources/open-picpak-case/index.md): Case study · open-picpak documents the PicPak 4.2-inch e-ink frame's stock firmware behavior, BLE GATT protocol, and image conversion pipeline. The author reports deriving byte-level findings from the stock ESP-IDF image and a device client, then using those findings in custom ESP-IDF firmware, host tools, and a self-hosted backend.
- [Hisense AEH-W41H1: local A/C control over a reconstructed RS-485 bus](https://awesomerea.org/resources/hisense-aeh-w41h1-local-control-case/index.md): Case study · Hisense AEH-W41H1 local control replaces the air conditioner's cloud-connected Wi-Fi module with ESPHome firmware for an ESP32 board or the stock RTL8710C module. The implementation speaks the A/C's RS-485 bus and exposes climate controls and diagnostics to Home Assistant. Protocol notes describe the frame envelope, checksum, bus roles, and command/status behavior derived from device observation.
- [nRF52 e-paper tag: reconstructing an undocumented display interface](https://awesomerea.org/resources/nrf52-eink-price-tag-case/index.md): Case study · nRF52 e-paper tag reconstructs control of an undocumented electronic shelf label with an nRF52832 board and SSD1675A-class panel. The repository records the pinout, 9-bit SPI connection, waveform-table layout and refresh behavior, and provides replacement Zephyr firmware plus a portable C99 display driver.
- [moi3-cluster-pipeline-re: MOI3 instrument-cluster video pipeline](https://awesomerea.org/resources/moi3-cluster-pipeline-re-case/index.md): Case study · The MOI3 cluster pipeline study reconstructs the display path from a VW MIB3 head unit to its instrument cluster on a PC bench. It documents a Wayland ivi_share handoff, RGBA-to-YUV conversion, H.264 encoding and RTP/UDP multicast, and supplies shims and a compositor stub for running a user-provided multi-screen-server binary. Ghidra scripts and a protocol extractor support the investigation.
- [openwrt-dlink-dir842-r1: OpenWrt port informed by Realtek datapath research](https://awesomerea.org/resources/openwrt-dlink-dir842-r1-case/index.md): Case study · openwrt-dlink-dir842-r1 ports OpenWrt to the D-Link DIR-842 R1 using a pinned base checkout and device-specific overlays. Its engineering notes investigate the RTL8197F and RTL8367S network path, switch setup and hardware NAT, while the build produces RAM-boot and NOR-flash firmware images.
- [ZOOM F8: BLE remote-control protocol reconstruction](https://awesomerea.org/resources/zoom-f8-ble-protocol-case/index.md): Case study · ZOOM F8 BLE protocol documentation reconstructs remote control for F8-family field recorders. It describes advertising, GATT handles, the connection handshake, commands, telemetry, settings and SD-card browsing, while distinguishing live observations from firmware-derived and inferred details.
- [UAD-2 OCTO: tracing PCIe command rings and DSP resource loading](https://awesomerea.org/resources/uad2-octo-pcie-case/index.md): Case study · UAD-2 OCTO-RE investigates the PCIe host transport of a Universal Audio DSP card through driver analysis and experiments on one Rev 5 board. The author reports reproducing command-ring and DMA startup across eight DSPs and recovering parts of the firmware and Bill resource containers. General-purpose DSP execution remains blocked by an unresolved runtime response and opaque payload format.
- [GameSir Cyclone 2: firmware findings and controller bridge](https://awesomerea.org/resources/gamesir-cyclone2-case/index.md): Case study · GameSir Cyclone 2 documents analysis of the controller’s JieLi BR23 firmware, including image layout, instruction encodings, timer behavior and firmware patches. It also describes a Raspberry Pi bridge that maps Bluetooth HID input to an Xbox 360 Wireless Receiver USB interface for Windows XInput.
- [airport-express-tools: rebuilding AirPort Express configuration and Wi-Fi client mode](https://awesomerea.org/resources/airport-express-tools-case/index.md): Case study · airport-express-tools reconstructs configuration and Wi-Fi client functions for the second-generation AirPort Express A1392 from firmware and ACP protocol research. Its Python CLI configures Wi-Fi, connection sharing and device settings; a local web UI provides Wi-Fi and device controls. A replacement supplicant joins WPA2 networks. Reference pages map ACP properties, RPCs, firmware contents and client-mode behavior, with Ghidra and unpacking helpers.
- [Gaomon M10K 2018: firmware decoding and report-rate investigation](https://awesomerea.org/resources/gaomon-m10k-2018-firmware-case/index.md): Case study · Gaomon M10K 2018 research decodes a substitution-encoded GD32F350 tablet firmware image and investigates its sensor loop and USB report path. The repository includes an image codec, constrained patch builder, DFU transaction documentation, and observations from experimental report-rate changes.
- [nokia105-emu: Nokia 105 firmware emulation](https://awesomerea.org/resources/nokia105-firmware-emulation-case/index.md): Case study · nokia105-emu runs a Nokia 105 TA-1423 firmware dump from boot ROM to a usable menu interface. Unicorn emulates the ARM926EJ-S CPU, while Python modules model the SC6531E interrupt controller, flash, display, keypad, power management and other peripherals based on firmware behaviour. The user supplies the phone’s own flash and boot ROM images.
- [Hisense VIDAA (MT9603): firmware and local bridge findings](https://awesomerea.org/resources/hisense-vidaa-mt9603-case/index.md): Case study · Hisense VIDAA (MT9603) records an investigation of a TV firmware container and browser-facing local services. The notes map the phoenix:// message format, its WebSocket and HTTP transports, a 96-function bridge and permission checks, with sanitized probe outputs. The author reports that the encrypted firmware payload remained inaccessible.
- [WebTV PTL: documenting the set-top box listings format](https://awesomerea.org/resources/webtv-ptl-format-case/index.md): Case study · WebTV PTL documents the binary television-listings database used by WebTV Plus and DishPlayer set-top boxes. The write-up describes its location on device storage, big-endian integer encoding, versioned header, block layout and footer.
- [SL-GlassesLed26x7: LED matrix pin mapping and replacement driver](https://awesomerea.org/resources/sl-glassesled26x7-case/index.md): Case study · SL-GlassesLed26x7 documents the connections of a 26×7 charlieplexed LED-glasses matrix and drives it with an ESP32 in place of the original controller. The repository records its pin layout and LED sections, with Arduino display examples and a bitmap generator.
- [FIFINE SC3: firmware decryption and four-fader patch](https://awesomerea.org/resources/sc3-firmware-research-case/index.md): Case study · FIFINE SC3 research documents decryption of the mixer's MVsilicon firmware and its ACP control protocol over USB HID. The repository provides cipher and container tooling, protocol findings, and a firmware patch that exposes all four fader positions to host-side volume tools.
- [HHKB Professional Classic: vendor HID and firmware investigation](https://awesomerea.org/resources/hhkb-professional-classic-case/index.md): Case study · HHKB-reverse-engineering investigates the vendor USB HID protocol of the HHKB Professional Classic keyboard. It documents 64-byte request and response frames, command behavior, keymap layouts and firmware-dump behavior, with macOS IOKit tools for probing and changing keymaps.
- [nano3-os: reconstructing the Avalon Nano 3 mining protocol](https://awesomerea.org/resources/nano3-os-miner-protocol-case/index.md): Case study · nano3-os reconstructs the Canaan Avalon Nano 3's K230-to-K210 mining protocol from analysis of btcminer and UART captures. Its notes cover CN frames, CRC-16/XMODEM, job bursts and nonce reports; a Go daemon uses that protocol to run the miner with a Stratum V1 pool, board controls and a web dashboard.
- [gear360-raw: recovering RAW capture and calibration from the Gear 360 SM-R210](https://awesomerea.org/resources/gear360-raw-case/index.md): Case study · gear360-raw investigates the Samsung Gear 360 SM-R210 camera's capture firmware and calibration data to enable 12-bit Bayer RAW shooting. SD-card mod files trigger sensor dumps, while Python tools convert them to DNG using camera color data and stitch images using the decoded per-unit lens model; command and safety notes document the underlying behavior.
- [Minager: reconstructing Antminer control interfaces](https://awesomerea.org/resources/minager-case/index.md): Case study · Minager builds a remote monitoring and control client for Antminer ASIC hardware from reconstructed CGI interfaces. Its Go code maps device responses into typed structures and uses Telegram menus for statistics, pool changes, power modes and alerts; the author also reports firmware and packet analysis.
- [chave-sandeiro: investigating the Renault Sandero turn-signal switch](https://awesomerea.org/resources/chave-sandero-case/index.md): Case study · chave-sandeiro documents an investigation of the Renault Sandero turn-signal switch through connector, interior and schematic images. An accompanying Arduino sketch reads turn-signal and headlight inputs from digital pins and prints state changes over serial.