Firmware Reverse Engineering: Unpacking and Analyzing IoT Device Binaries.

Internet of Things (IoT) devices are notoriously insecure, often containing hardcoded credentials, outdated Linux kernels, and severe command injection vulnerabilities. Unpacking the device's firmware is the first step in assessing its security posture.

Binwalk is the de facto standard tool for analyzing firmware images. It scans binary headers for known file types, compression signatures, and file systems (like SquashFS or CramFS) and extracts them automatically:

binwalk -e firmware.bin

After extracting the file system, navigate to /bin or /usr/sbin to locate the CGI web server. Open the target binary in Ghidra. Look for invocations of unsafe functions like system(), popen(), or sprintf(). By tracing the data flow from client inputs (e.g. GET/POST parameters) to these functions, you can identify remote command execution points.

Once the filesystem is extracted, researchers can locate the web server or control binaries. Using QEMU user mode emulation, you can run and debug these compiled MIPS or ARM binaries directly on an x86/x64 analysis machine, facilitating dynamic vulnerability analysis.

# Copy QEMU binary to the extracted rootfs
cp /usr/bin/qemu-mips-static ./rootfs/
# Run using chroot
sudo chroot ./rootfs ./qemu-mips-static ./usr/sbin/httpd