ida-efitools2

About It is an IDA plugin for extending UEFI reverse engineering capabilities. Based on ida-efitools with a bunch of fixes and new features. Works with both Python 2 and Python 3. Supports outdated versions of IDA Pro 7.x with no guarantees. Features GUIDs defining Structures propagating register...

intel-me-research

Intel ME 固件逆向工程 — 实时 CSME 16.x 分析 “你的电脑里藏着一台秘密的第二台电脑。我们找到了它，绘制了它的地图，并记录下了里面隐藏的东西。” 🔥 亲自尝试 — HECI SPY 🔥 一个 Python 脚本。零依赖。直接与你的 Intel 管理引擎对话。 python scripts/hecispy.py Requirements: Windows, Python 3.6+, Run as Administrator 它的功能： 自动检测你的 Intel HECI/MEI 设备 通过 MKHI 协议连接 ME 查询固件版本、分区清单和隐藏值 发现内存泄漏 —...

workshop_firmware_reverse_engineering

工作坊：固件逆向工程 此仓库包含 幻灯片 和动手实践材料，内容围绕 Emproof 在 ScapyCon Automotive 2025 上举办的固件逆向工程工作坊。该工作坊面向具有最少安全经验的技术受众，通过实用、自包含的任务教授基础知识。主题包括： 基础文件/ELF分析； 软件破解与密钥生成； 字符串解密与恶意软件分类； 嵌入式Linux固件解包； 裸机分析； 密码检测； 混淆/反分析技术及其绕过方法； 如果这也合你胃口，还可以查看 Emproof 技术网络研讨会系列，其中包含更多练习和录制课程。 工作坊内容由 Tim Blazytko 设计与组织，Simran Kathpalia...

Philips-PM-5139-5138A-5136-Firmware-Project

Philips PM5139 — 固件逆向工程 一台约 1994 年的 20 MHz 函数发生器，在软件层面被拆解：两份 EPROM 转储、一个被当作测量仪器使用的 8051 模拟器，以及 35 节文档，其中每一条论断都有清单地址、模拟器测量结果或原理图作为依据。 最终成果是一个 固件 V2.0 ，修复了 Philips 出厂时的一个缺陷， 六个我们自己的任意波形，以及一个逐条指令运行原始 ROM 的浏览器模拟器。 程序 EPROM 中的每一个波形表，直接从二进制中绘制出来。右下角那个 开启了本项目最有趣的部分。 目录 这是什么 结果一览 仪器 方法：模拟器即测量仪器 走到这里的路 精彩...

yealink_tools

Yealink 固件逆向工程 此仓库包含一些在 Yealink VOIP 电话固件逆向工程过程中使用的脚本工具。 如需了解更多有关这项研究的信息，请阅读博客文章...

isa_recovery

ISA 恢复系统 一条逆向工程流水线，可将固件二进制文件及其（可能有误的）反汇编结果转换为可用的 Ghidra 处理器规范。当你遇到一个没有文档、也不受 Ghidra 支持的专有处理器时，此工具会恢复每条指令的真实编码——哪些位是操作码、哪些是寄存器、哪些是立即数——并写出一个你可以直接加载到 Ghidra 中对固件进行反编译的 SLEIGH 规范。 其底层是一个智能体工作流（agentic workflow） ：一条固定流水线，其中每个步骤都是一个被提示完成单项任务的大型语言模型。工作流由确定性代码编排——而非由 LLM 自身——并且最终生成的每个 SLEIGH 构造函数都必须先用...

IIITA-IoT-Security-Research

IIIT Allahabad – 物联网安全研究实习 概述 本仓库展示了我于印度阿拉哈巴德信息技术学院（IIIT Allahabad）的 密码学与网络安全（CNS）实验室进行研究实习 期间所完成的工作。 在实习期间，我从事了物联网安全 、固件逆向工程 和漏洞研究 方面的工作，重点关注嵌入式 IP 摄像头固件的安全评估。该研究促成了对安全漏洞的负责任披露，这些漏洞被正式分配了两个 CVE 编号 ，并由 CERT-In 发布。 研究人员 Venkata Mythreya Kumara Sarma Isukapalli Venkata Sesha Shaina Reddy Tiyyagura...

firmware-reverse-engineering

固件逆向工程技能 来自 OrbitCurve 的五个代理技能，涵盖固件提取、静态分析、Ghidra 逆向工程、仿真和安全报告，由 Hussein Muhaisen 提供。 该集合将现有的工作流程、参考资料、模板和 Ghidra 脚本打包，供 Claude Code 和 Codex 使用。安装后即可让您的代理获得这些指令；分析工具需单独安装。 验证： 包含 Claude Code 和 Codex 的打包/发现检查、Ghidra 脚本回归测试，以及选定的提取/报告检查。请参阅已测试版本和限制。固件仿真仍因目标而异。 技能 技能| 用途 ---|--- firmware-extraction|...

study_embedded_security

studyembeddedsecurity A hands-on study...

CVE-2025-1242

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicio...

EUVD-2025-208113

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicio...

CVE-2025-1242 Administrative Credentials Can Be Extracted Through Gardyn API Responses

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicio...

CVE-2025-1242

CVE-2025-1242 affects Gardyn Home Kit via Gardyn IoT Hub. Root cause: hard-coded administrative credential iothubowner exposed across multiple vectors (API responses, mobile app, and device firmware), enabling unauthenticated full admin access to the hub and connected devices. Connected documents...

CVE-2025-1242 Administrative Credentials Can Be Extracted Through Gardyn API Responses

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the Gardyn IoT Hub exposing connected devices to malicio...

Gardyn 4 信任管理问题漏洞

Gardyn 4 is a home-use vertical hydroponic cultivation system developed by the American company Gardyn. Gardyn 4 has a vulnerability related to trust management. This vulnerability stems from the ability to extract management credentials through application API responses, mobile application rever...

PT-2026-21920

Name of the Vulnerable Software and Affected Versions Gardyn IoT Hub affected versions not specified Description Administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. This exposure may allow ...

Enterprise Security Incident Analysis and Countermeasures Based on the T-Mobile Data Breach

This paper presents a comprehensive analysis of T-Mobile's critical data breaches in 2021 and 2023, alongside a full-spectrum security audit targeting its systems, infrastructure, and publicly exposed endpoints. By combining case-based vulnerability assessments with active ethical hacking...

Fuzzy matching with Ghidra BSim, a guide

TL;DR BSim, Ghidra’s new built-in plugin is a game-changer for reversing firmware and other stripped binaries. Rapidly identify and annotate functions from known libraries. Fuzzy matching works with unknowns, like exact library versions and compiler options. Automatically define custom variable...

Reverse Engineering Keys from Firmware. A how-to

TL;DR It is possible to reverse engineer keys from firmware with some tips: 1. Always looks for strings/constants. 2. Make guesses about the original source. 3. Find a function you can recognise and work backwards to identify other functions. 4. It helps if they use open-source code so you can cr...

Turning an OBD-II reader into a USB / NFC attack tool

One of my favourite sorts of hardware hacking is making a device do something it was never intended for. It's creative, disruptive, and fun. Everyone has their own way of going about things. Different methodologies, habits, and skill sets mean that approaches will be diverse. This is how I work...