关于 firmware-analyst
面向固件安全分析的技能，供授权审计、研究和设备安全评估使用。它提供固件提取、文件系统与二进制分析、仿真及漏洞报告的流程和工具参考。
主要功能
- 01固件获取与提取流程
- 02文件系统和二进制分析
- 03漏洞类别与检查清单
- 04仿真环境配置参考
- 05评估报告与修复建议
适用场景
- 01审计设备固件中的硬编码凭据
- 02检查固件文件系统及二进制文件
- 03仿真固件并记录安全发现
安装
复制下面的命令，在终端中运行。
$
npx skills add https:/安装后在 Claude Code 中输入/firmware-analyst确认已加载。
详细介绍
从供应商下载
wget http://vendor.com/firmware/update.bin
通过调试接口从设备提取
UART 控制台访问
screen /dev/ttyUSB0 115200
复制固件分区
dd if=/dev/mtd0 of=/tmp/firmware.bin
通过网络协议提取
启动期间使用 TFTP
通过设备 Web 界面使用 HTTP/FTP
### Hardware Methods
UART 访问 - 串行控制台连接 JTAG/SWD - 用于访问内存的调试接口 SPI flash 转储 - 直接读取芯片 NAND/NOR 转储 - 提取闪存内容 Chip-off - 拆下物理芯片并读取 逻辑分析仪 - 捕获和分析协议
## Use this skill when
- Working on download from vendor tasks or workflows
- Needing guidance, best practices, or checklists for download from vendor
## Do not use this skill when
- The task is unrelated to download from vendor
- You need a different domain or tool outside this scope
## Instructions
- Clarify goals, constraints, and required inputs.
- Apply relevant best practices and validate outcomes.
- Provide actionable steps and verification.
## Firmware Analysis Workflow
### Phase 1: Identification
```bash
# Basic file identification
file firmware.bin
binwalk firmware.bin
# Entropy analysis (detect compression/encryption)
# Binwalk v3: generates entropy PNG graph
binwalk --entropy firmware.bin
binwalk -E firmware.bin # Short form
# Identify embedded file systems and auto-extract
binwalk --extract firmware.bin
binwalk -e firmware.bin # Short form
# String analysis
strings -a firmware.bin | grep -i "password\|key\|secret"
阶段 2：提取
# Binwalk v3 recursive extraction (matryoshka mode)
binwalk --extract --matryoshka firmware.bin
binwalk -eM firmware.bin # Short form
# Extract to custom directory
binwalk -e -C ./extracted firmware.bin
# Verbose output during recursive extraction
binwalk -eM --verbose firmware.bin
# Manual extraction for specific formats
# SquashFS
unsquashfs filesystem.squashfs
# JFFS2
jefferson filesystem.jffs2 -d output/
# UBIFS
ubireader_extract_images firmware.ubi
# YAFFS
unyaffs filesystem.yaffs
# Cramfs
cramfsck -x output/ filesystem.cramfs
阶段 3：文件系统分析
# Explore extracted filesystem
find . -name "*.conf" -o -name "*.cfg"
find . -name "passwd" -o -name "shadow"
find . -type f -executable
# Find hardcoded credentials
grep -r "password" .
grep -r "api_key" .
grep -rn "BEGIN RSA PRIVATE KEY" .
# Analyze web interface
find . -name "*.cgi" -o -name "*.php" -o -name "*.lua"
# Check for vulnerable binaries
checksec --dir=./bin/
阶段 4：二进制分析
# Identify architecture
file bin/httpd
readelf -h bin/httpd
# Load in Ghidra with correct architecture
# For ARM: specify ARM:LE:32:v7 or similar
# For MIPS: specify MIPS:BE:32:default
# Set up cross-compilation for testing
# ARM
arm-linux-gnueabi-gcc exploit.c -o exploit
# MIPS
mipsel-linux-gnu-gcc exploit.c -o exploit
常见漏洞类别
身份验证问题
Hardcoded credentials - Default passwords in firmware
Backdoor accounts - Hidden admin accounts
Weak password hashing - MD5, no salt
Authentication bypass - Logic flaws in login
Session management - Predictable tokens
命令注入
// Vulnerable pattern
char cmd[256];
sprintf(cmd, "ping %s", user_input);
system(cmd);
// Test payloads
; id
| cat /etc/passwd
`whoami`
$(id)
内存损坏
Stack buffer overflow - strcpy, sprintf without bounds
Heap overflow - Improper allocation handling
Format string - printf(user_input)
Integer overflow - Size calculations
Use-after-free - Improper memory management
信息泄露
Debug interfaces - UART, JTAG left enabled
Verbose errors - Stack traces, paths
Configuration files - Exposed credentials
Firmware updates - Unencrypted downloads
工具熟练度
提取工具
binwalk v3 - Firmware extraction and analysis (Rust rewrite, faster, fewer false positives)
firmware-mod-kit - Firmware modification toolkit
jefferson - JFFS2 extraction
ubi_reader - UBIFS extraction
sasquatch - SquashFS with non-standard features
分析工具
Ghidra - Multi-architecture disassembly
IDA Pro - Commercial disassembler
Binary Ninja - Modern RE platform
radare2 - Scriptable analysis
Firmware Analysis Toolkit (FAT)
FACT - Firmware Analysis and Comparison Tool
仿真
QEMU - Full system and user-mode emulation
Firmadyne - Automated firmware emulation
EMUX - ARM firmware emulator
qemu-user-static - Static QEMU for chroot emulation
Unicorn - CPU emulation framework
硬件工具
Bus Pirate - Universal serial interface
Logic analyzer - Protocol analysis
JTAGulator - JTAG/UART discovery
Flashrom - Flash chip programmer
ChipWhisperer - Side-channel analysis
仿真设置
QEMU 用户模式仿真
# Install QEMU user-mode
apt install qemu-user-static
# Copy QEMU static binary to extracted rootfs
cp /usr/bin/qemu-arm-static ./squashfs-root/usr/bin/
# Chroot into firmware filesystem
sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/sh
# Run specific binary
sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/httpd
使用 Firmadyne 进行完整系统仿真
# Extract firmware
./sources/extractor/extractor.py -b brand -sql 127.0.0.1 \
-np -nk "firmware.bin" images
# Identify architecture and create QEMU image
./scripts/getArch.sh ./images/1.tar.gz
./scripts/makeImage.sh 1
# Infer network configuration
./scripts/inferNetwork.sh 1
# Run emulation
./scratch/1/run.sh
安全评估
检查清单
[ ] Firmware extraction successful
[ ] File system mounted and explored
[ ] Architecture identified
[ ] Hardcoded credentials search
[ ] Web interface analysis
[ ] Binary security properties (checksec)
[ ] Network services identified
[ ] Debug interfaces disabled
[ ] Update mechanism security
[ ] Encryption/signing verification
[ ] Known CVE check
报告模板
# Firmware Security Assessment
## Device Information
- Manufacturer:
- Model:
- Firmware Version:
- Architecture:
## Findings Summary
| Finding | Severity | Location |
|---------|----------|----------|
## Detailed Findings
### Finding 1: [Title]
- Severity: Critical/High/Medium/Low
- Location: /path/to/file
- Description:
- Proof of Concept:
- Remediation:
## Recommendations
1. ...
道德准则
适当用途
- 经设备所有者授权的安全审计
- 漏洞赏金计划
- 学术研究
- CTF 竞赛
- 个人设备分析
绝不协助
- 未经授权入侵设备
- 非法规避 DRM/许可
- 创建恶意固件
- 未经许可攻击设备
- 工业间谍活动
响应方式
- 验证授权：确保研究背景合法
- 评估设备：了解目标设备类型和架构
- 指导获取：选择合适的固件提取方法
- 系统分析：遵循结构化的分析工作流
- 识别问题：发现安全漏洞和错误配置
- 记录发现：清晰报告并提供修复指导
评论
支持 Markdown