Purpose
Perform comprehensive firmware analysis: partition extraction, config/secret hunting, service hardening review, and emulation-based behavior analysis. Aligns with skill-forge structure-first and prompt-architect constraint/confidence standards.
Use When / Redirect When
- Use when: complex firmware with custom partitions, update paths, or services that need behavioral validation.
- Redirect when: general binary analysis (
reverse-engineer-debug/-deep) or quick IOC-only triage (reverse-engineering-quick-triage).
Guardrails
- Authorized firmware/hardware only; respect licenses/export rules.
- Isolated environments with snapshots; never flash production devices.
- Sanitize secrets; avoid external uploads without approval.
- Confidence ceilings enforced (inference/report ≤0.70, research 0.85, observation/definition 0.95).
Prompt Architecture Overlay
- HARD/SOFT/INFERRED constraints (device model, arch, services of interest, outputs needed).
- Two-pass refinement: structure → epistemic.
- English-only output with explicit confidence line.
SOP (Extended Firmware Loop)
- Scope & Setup: Authorization, hashes, device metadata, and objectives; stage isolated workspace.
- Extraction & Mapping: Unpack partitions; identify file systems and startup/init flows; map attack surface (services, ports, update channels).
- Static Review: Hunt for credentials/keys/endpoints, unsafe defaults, crypto misuse, and outdated components (CVE mapping).
- Emulation/Dynamic (if allowed): qemu/chroot for service behavior; capture logs/traces and persistence/install paths.
- Validation & Delivery: Cross-check static/dynamic findings; produce SBOM, remediation plan, and archive artifacts to
skills/security/reverse-engineering-extended/reverse-engineering-firmware-analysis/{project}/{timestamp} with MCP tags (WHO=reverse-engineering-firmware-analysis-{session}, WHY=skill-execution).
Deliverables
- Firmware report (attack surface, findings, CVE/CWE mapping) and SBOM.
- Evidence bundle (extraction logs, configs, traces) with timestamps.
- Remediation/hardening guidance and safe update/rollback notes.
Quality Gates
- Structure-first documentation; missing resources/examples/tests tracked.
- Chain-of-custody maintained (hashes, env, tool versions).
- Evidence with confidence ceilings; dual validation for critical/high.
- Isolation and approval confirmed before emulation.
Anti-Patterns
- Flashing unvetted firmware to production devices.
- Publishing secrets or proprietary code.
- Ignoring update/rollback safety.
Output Format
- Scope + constraints table (HARD/SOFT/INFERRED).
- Findings and SBOM summary with evidence.
- Remediation and validation log.
- Confidence line:
Confidence: X.XX (ceiling: TYPE Y.YY) - reason.
Confidence: 0.72 (ceiling: inference 0.70) - Extended firmware SOP aligned with skill-forge and prompt-architect standards.
1---2name: reverse-engineering-firmware-analysis-23description: Extended firmware analysis for embedded/IoT images with deep extraction, emulation, and vulnerability assessment.4---5
6
7
8## Purpose
9Perform comprehensive firmware analysis: partition extraction, config/secret hunting, service hardening review, and emulation-based behavior analysis. Aligns with **skill-forge** structure-first and **prompt-architect** constraint/confidence standards.
10
11## Use When / Redirect When
12- **Use when:** complex firmware with custom partitions, update paths, or services that need behavioral validation.
13- **Redirect when:** general binary analysis (`reverse-engineer-debug`/`-deep`) or quick IOC-only triage (`reverse-engineering-quick-triage`).
14
15## Guardrails
16- Authorized firmware/hardware only; respect licenses/export rules.
17- Isolated environments with snapshots; never flash production devices.
18- Sanitize secrets; avoid external uploads without approval.
19- Confidence ceilings enforced (inference/report ≤0.70, research 0.85, observation/definition 0.95).
20
21## Prompt Architecture Overlay
221. HARD/SOFT/INFERRED constraints (device model, arch, services of interest, outputs needed).
232. Two-pass refinement: structure → epistemic.
243. English-only output with explicit confidence line.
25
26## SOP (Extended Firmware Loop)
271. **Scope & Setup**: Authorization, hashes, device metadata, and objectives; stage isolated workspace.
282. **Extraction & Mapping**: Unpack partitions; identify file systems and startup/init flows; map attack surface (services, ports, update channels).
293. **Static Review**: Hunt for credentials/keys/endpoints, unsafe defaults, crypto misuse, and outdated components (CVE mapping).
304. **Emulation/Dynamic (if allowed)**: qemu/chroot for service behavior; capture logs/traces and persistence/install paths.
315. **Validation & Delivery**: Cross-check static/dynamic findings; produce SBOM, remediation plan, and archive artifacts to `skills/security/reverse-engineering-extended/reverse-engineering-firmware-analysis/{project}/{timestamp}` with MCP tags (`WHO=reverse-engineering-firmware-analysis-{session}`, `WHY=skill-execution`).
32
33## Deliverables
34- Firmware report (attack surface, findings, CVE/CWE mapping) and SBOM.
35- Evidence bundle (extraction logs, configs, traces) with timestamps.
36- Remediation/hardening guidance and safe update/rollback notes.
37
38## Quality Gates
39- Structure-first documentation; missing resources/examples/tests tracked.
40- Chain-of-custody maintained (hashes, env, tool versions).
41- Evidence with confidence ceilings; dual validation for critical/high.
42- Isolation and approval confirmed before emulation.
43
44## Anti-Patterns
45- Flashing unvetted firmware to production devices.
46- Publishing secrets or proprietary code.
47- Ignoring update/rollback safety.
48
49## Output Format
50- Scope + constraints table (HARD/SOFT/INFERRED).
51- Findings and SBOM summary with evidence.
52- Remediation and validation log.
53- Confidence line: `Confidence: X.XX (ceiling: TYPE Y.YY) - reason`.
54
55Confidence: 0.72 (ceiling: inference 0.70) - Extended firmware SOP aligned with skill-forge and prompt-architect standards.
majiayu000