intel-me-research

Intel ME Firmware Reverse Engineering — Live CSME 16.x Analysis "Your computer has a secret second computer inside it. We found it, mapped it, and documented what's hiding in there." 🔥 TRY IT YOURSELF — HECI SPY 🔥 One Python script. Zero dependencies. Talk to your Intel Management Engine directly...

yealink_tools

Yealink firmware reverse engineering This repository contains some script utilities used during the reverse engineering of Yealink VOIP phones firmware. For more information about this research, please read the blogpost...

workshop_firmware_reverse_engineering

Workshop: Firmware Reverse Engineering This repository contains slides and hands-on materials for Emproof's workshop on firmware reverse engineering, presented at ScapyCon Automotive 2025. The workshop targets a technical audience with minimal security experience and teaches the fundamentals...

IIITA-IoT-Security-Research

IIIT Allahabad – IoT Security Research Internship Overview This repository showcases the work carried out during my Research Internship at the Indian Institute of Information Technology, Allahabad IIIT Allahabad under the Cryptography and Network Security CNS Lab. During this internship, I worked...

firmware-reverse-engineering

Firmware Reverse Engineering Skills Five agent skills from OrbitCurve for firmware extraction, static analysis, Ghidra reverse engineering, emulation, and security reporting, by Hussein Muhaisen. The collection packages the existing workflows, references, templates, and Ghidra scripts for Claude...

ida-efitools2

About It is an IDA plugin for extending UEFI reverse engineering capabilities. Based on ida-efitools with a bunch of fixes and new features. Works with both Python 2 and Python 3. Supports outdated versions of IDA Pro 7.x with no guarantees. Features GUIDs defining Structures propagating register...

Philips-PM-5139-5138A-5136-Firmware-Project

Philips PM5139 — Firmware Reverse Engineering A 20 MHz function generator from about 1994, taken apart in software: two EPROM dumps, an 8051 emulator used as a measuring instrument, and 35 sections of documentation where every single claim is backed by a listing address, an emulator measurement, ...

isa_recovery

ISA Recovery System A reverse-engineering pipeline that turns a firmware binary and its possibly-wrong disassembly into a working Ghidra processor specification. When you hit a proprietary processor with no documentation and no Ghidra support, this tool recovers the real encoding of each...

study_embedded_security

studyembeddedsecurity A hands-on study...

CVE-2025-1242

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicio...

EUVD-2025-208113

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicio...

CVE-2025-1242 Administrative Credentials Can Be Extracted Through Gardyn API Responses

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicio...

CVE-2025-1242 Administrative Credentials Can Be Extracted Through Gardyn API Responses

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicio...

CVE-2025-1242

CVE-2025-1242 affects Gardyn Home Kit via Gardyn IoT Hub. Root cause: hard-coded administrative credential iothubowner exposed across multiple vectors (API responses, mobile app, and device firmware), enabling unauthenticated full admin access to the hub and connected devices. Connected documents...

PT-2026-21920

Name of the Vulnerable Software and Affected Versions Gardyn IoT Hub affected versions not specified Description Administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. This exposure may allow ...

Gardyn 4 信任管理问题漏洞

Gardyn 4 is a home-use vertical hydroponic cultivation system developed by the American company Gardyn. Gardyn 4 has a vulnerability related to trust management. This vulnerability stems from the ability to extract management credentials through application API responses, mobile application rever...

Enterprise Security Incident Analysis and Countermeasures Based on the T-Mobile Data Breach

This paper presents a comprehensive analysis of T-Mobile's critical data breaches in 2021 and 2023, alongside a full-spectrum security audit targeting its systems, infrastructure, and publicly exposed endpoints. By combining case-based vulnerability assessments with active ethical hacking...

Fuzzy matching with Ghidra BSim, a guide

TL;DR BSim, Ghidra’s new built-in plugin is a game-changer for reversing firmware and other stripped binaries. Rapidly identify and annotate functions from known libraries. Fuzzy matching works with unknowns, like exact library versions and compiler options. Automatically define custom variable...

Reverse Engineering Keys from Firmware. A how-to

TL;DR It is possible to reverse engineer keys from firmware with some tips: 1. Always looks for strings/constants. 2. Make guesses about the original source. 3. Find a function you can recognise and work backwards to identify other functions. 4. It helps if they use open-source code so you can cr...

Turning an OBD-II reader into a USB / NFC attack tool

One of my favourite sorts of hardware hacking is making a device do something it was never intended for. It's creative, disruptive, and fun. Everyone has their own way of going about things. Different methodologies, habits, and skill sets mean that approaches will be diverse. This is how I work...