Firmware Acquisition

Systematic firmware extraction from IoT and embedded targets — vendor portals, OTA interception, SPI flash dumping with flashrom/CH341A, eMMC chip-off, and UART/JTAG console dumps. Covers the full acquisition chain from zero hardware access to a raw binary ready for static analysis.

purpleailab fecd41f 9.2 KB Updated Sep 17, 2026

Coding & Dev Tools

Install

Press C to copy

$ npx skillmds@latest add purpleailab/firmware-acquisition

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

Download SKILL.md

＋ Add to collection

README badge

[![SkillMD](https://skillmd.com/badge/purpleailab/firmware-acquisition.svg)](https://skillmd.com/skills/purpleailab/firmware-acquisition)

Trust & safety

Audits pending

Not yet audited · commit fecd41f

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Firmware Acquisition

Acquire a binary image of the target's firmware before any static analysis. Work through the acquisition tiers in order — cheapest and least invasive first. Each tier degrades hardware less and preserves the device's operational state.

Prerequisites

Device PCB photographed (top + bottom). Mark: SoC part number, flash chip marking, debug pad pattern (UART = 4-pin row; JTAG = TAP header or test points).
Identify flash type from silkscreen or datasheet: SPI NOR (SOIC-8/WSON), SPI NAND, eMMC (BGA-153/169), parallel NOR/NAND.
Bench tools staged: CH341A programmer + SOIC-8 clip, BusPirate / J-Link / SEGGER J-Trace, USB-UART adapter (CP2102 / FT232), multimeter for UART baud sniffing.

Tier 0 — Vendor Portal / OTA Proxy (no hardware needed)

0a. Vendor download portal

# Check common firmware CDN patterns
curl -sI "https://firmware.vendor.com/latest/<model>.bin"
curl -sI "https://downloads.vendor.com/firmware/<model>/<version>.tar.gz"

# Scrape firmware release page for direct links
wget -r -l1 -nd -A "*.bin,*.tar.gz,*.zip,*.img" \
    "https://www.vendor.com/support/firmware/<model>"

# Checksum-verify before unpacking
sha256sum <fw.bin>

0b. OTA interception (MITM the device's update check)

# 1. ARP-spoof the device to route its traffic through your machine
sudo arpspoof -i eth0 -t <device_ip> <gateway_ip> &
sudo arpspoof -i eth0 -t <gateway_ip> <device_ip> &

# 2. Forward all traffic except OTA traffic; intercept OTA with mitmproxy
sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8080
mitmproxy --mode transparent --set ssl_insecure=true -w /tmp/ota_capture.mitm

# 3. Trigger an OTA check from the device (power cycle or companion app)
# 4. Inspect intercepted traffic; export firmware binary
mitmdump -r /tmp/ota_capture.mitm -w /tmp/ota_fw.bin \
    --set flow_detail=3 '~t application/octet-stream or ~t application/x-gzip'

# 5. Decrypt if AES-encrypted OTA (key often in companion app resources)
openssl enc -d -aes-128-cbc -K <hex_key> -iv <hex_iv> -in /tmp/ota_fw.bin -out /tmp/fw_plain.bin

0c. Companion-app embedded firmware

# APK often bundles the firmware binary or partial images
apktool d companion.apk -o companion_decompiled/
find companion_decompiled/ -name "*.bin" -o -name "*.fw" -o -name "*.img" | xargs file
grep -r "firmware\|update\|download\|cdn" companion_decompiled/assets/ --include="*.js"

Tier 1 — UART Console Dump

UART is the fastest hardware path: non-destructive, works while device is powered.

1a. Identify UART pins

Typical 4-pin UART header: VCC | GND | TX | RX
Probe each with multimeter (DC, 3.3 V idle = TX candidate).
Baud detect: minicom -D /dev/ttyUSB0 -b 115200 (try 9600, 57600, 115200, 460800).

# Baud-rate autoprobe with sigrok / baudrate.py
python3 baudrate.py /dev/ttyUSB0    # https://github.com/devttys0/baudrate
# Or with screen – step through common rates
for baud in 9600 19200 38400 57600 115200 230400 460800 921600; do
    echo "Testing $baud..."; screen /dev/ttyUSB0 $baud; done

1b. Interrupt boot and dump from U-Boot

# Connect: GND → GND, RX(USB) → TX(device), TX(USB) → RX(device)
screen /dev/ttyUSB0 115200
# Power on device; press any key within 1-3s to break into U-Boot

# At U-Boot prompt: locate kernel + rootfs partition offsets
=> printenv
=> mtdparts      # shows flash map  (e.g. 0x00000000 kernel 0x200000, rootfs 0x600000)

# Dump via XMODEM to host
=> loady 0x80000000          # load address in RAM
=> md.b 0x80000000 0x200000  # memory-display: prints hex to terminal
# Capture terminal output → convert hex dump → binary:
python3 -c "
import sys, re
data = open('uart_hexdump.txt').read()
chunks = re.findall(r':\s+((?:[0-9a-fA-F]{8} ){1,4})', data)
raw = bytes.fromhex(''.join(''.join(c.split()) for c in chunks))
open('fw_from_uart.bin','wb').write(raw)"

1c. Full flash dump via UART + tftp

# If U-Boot has tftp + nand/sf commands:
=> setenv ipaddr 192.168.1.100
=> setenv serverip 192.168.1.10
=> sf probe; sf read 0x80000000 0x0 0x1000000    # read 16MB SPI NOR into RAM
=> tftp 0x80000000 flash_full.bin                 # upload to your tftp server
# On your host: python3 -m py3tftp -p 69 --ip 0.0.0.0

Tier 2 — JTAG / SWD Debug Interface

2a. OpenOCD + J-Link SWD dump (ARM Cortex-M)

openocd -f interface/jlink.cfg -f target/stm32f4x.cfg \
    -c "init; halt; dump_image /tmp/flash.bin 0x08000000 0x100000; shutdown"
# Adjust start address and size per datasheet (STM32F4: 1 MB @ 0x08000000)

2b. JTAG boundary-scan enumeration (MIPS/ARM application processors)

# UrJTAG or JTAGulator to identify IR length + IDCODE
jtag> cable jtagkey
jtag> detect
jtag> print chain
# Identify MIPS/ARM AP; attach GDB via OpenOCD
gdb-multiarch vmlinux
(gdb) target remote :3333
(gdb) monitor halt
(gdb) dump binary memory /tmp/mem.bin 0x80000000 0x90000000   # DRAM range

2c. JTAG boundary-scan via eBBoot / Segger

# Segger J-Flash CLI for known targets:
JFlash -openprj target.jflash -readchip /tmp/flash_full.bin -exit

Tier 3 — SPI NOR Flash Dump (CH341A + flashrom)

Most cost-effective hardware method for 8-pin SPI NOR chips.

3a. In-circuit dump (device powered off, clip attached)

# Connect SOIC-8 clip to CH341A programmer
# Identify chip: run flashrom probe first
sudo flashrom -p ch341a_spi --verbose 2>&1 | grep -E "Found|Matched|chip"

# Dump (use the exact chip name from probe output)
sudo flashrom -p ch341a_spi -c "MX25L12835F" -r /tmp/flash_dump.bin
sudo flashrom -p ch341a_spi -c "MX25L12835F" -r /tmp/flash_dump2.bin

# Verify both reads match (disk corruption / clip contact issue otherwise)
sha256sum /tmp/flash_dump.bin /tmp/flash_dump2.bin
cmp /tmp/flash_dump.bin /tmp/flash_dump2.bin && echo "MATCH" || echo "MISMATCH — re-seat clip"

3b. Troubleshooting in-circuit reads

Symptom: flashrom sees 0x00 or 0xFF → chip held in reset by SoC pull-downs.
Fix: power-cycle with clip attached BEFORE the SoC powers up (race the SoC).
Or: locate HOLD# / WP# pins, tie to VCC; CS# must go low only from CH341A.
If SoC fights the bus: desolder for Tier 4.

3c. SPI NAND / eMMC alternative: python-flashrom / serprog

# For SPI NAND (Winbond W25Nxxxx), use nandwrite flow:
# 1. Use flashrom with serprog (Raspberry Pi as SPI master):
sudo flashrom -p serprog:dev=/dev/ttyUSB0:4000000 -c "W25N01GV" -r /tmp/nand.bin

# 2. Extract with nanddump equivalent for raw bin:
binwalk -e /tmp/nand.bin     # handles OOB stripping for most NAND dumps

Tier 4 — eMMC Chip-Off

Last resort: BGA desoldering, direct eMMC reader. Destructive to PCB.

4a. Chip-off procedure

1. Hot-air rework (350 °C, 60 L/min): heat BGA from below; lift with vacuum.
2. Clean pads with flux + wick.
3. Reflow eMMC onto BGA breakout board (eMMC adapter):
   - SD-to-eMMC: Allwinner eMMC reader, Emuelec adapter, or custom PCB.
4. Insert into card reader that supports eMMC protocol.

4b. Dump with dd / usbimager

# Identify device node (dmesg after plugging in)
dmesg | tail -20 | grep sd
lsblk -d /dev/sdb    # confirm size matches eMMC spec

# Full raw dump
sudo dd if=/dev/sdb of=/tmp/emmc_full.img bs=512 status=progress conv=noerror,sync
sha256sum /tmp/emmc_full.img > /tmp/emmc_full.img.sha256

# Partition inspection
fdisk -l /tmp/emmc_full.img
file /tmp/emmc_full.img

# Mount individual partition (offset in sectors from fdisk output)
sudo mount -o loop,offset=$((512*2048)) /tmp/emmc_full.img /mnt/emmc_p1

Evidence

Store all artifacts under /workspace/evidence/iot/<target>/firmware/:

mkdir -p /workspace/evidence/iot/<target>/firmware
cp /tmp/flash_dump.bin /workspace/evidence/iot/<target>/firmware/flash_full.bin
sha256sum /workspace/evidence/iot/<target>/firmware/flash_full.bin \
    > /workspace/evidence/iot/<target>/firmware/flash_full.bin.sha256
# Log acquisition method and hardware used
echo "Acquired via: CH341A + SOIC-8 clip; flashrom 1.4.0; chip: MX25L12835F" \
    > /workspace/evidence/iot/<target>/firmware/acquisition.log

OPSEC Notes

In-circuit clips can corrupt firmware if contact is intermittent — always compare two reads before treating the image as canonical.
OTA MITM is logged server-side; only perform on isolated test-lab networks unless RoE explicitly permits production intercept.
JTAG debug may trigger internal tamper fuses on hardened targets (e.g., Qualcomm secure boot with JTAG-disable eFuse). Read the SoC TRM before probing.
eMMC RPMB partition requires authentication key to read — skip on initial triage; flag for key extraction if bootloader secrets are needed.

References

flashrom supported hardware: https://flashrom.org/Supported_hardware
CH341A pinout + SOIC clip wiring: references/ch341a-soic-wiring.md
U-Boot command reference: https://u-boot.readthedocs.io/en/latest/usage/index.html
OpenOCD target configs: /usr/share/openocd/scripts/target/

---name: firmware-acquisitiondescription: Systematic firmware extraction from IoT and embedded targets — vendor portals, OTA interception, SPI flash dumping with flashrom/CH341A, eMMC chip-off, and UART/JTAG console dumps. Covers the full acquisition chain from zero hardware access to a raw binary ready for static analysis.---# Firmware Acquisition> Acquire a binary image of the target's firmware before any static analysis.> Work through the acquisition tiers in order — cheapest and least invasive first.> Each tier degrades hardware less and preserves the device's operational state.## Prerequisites- Device PCB photographed (top + bottom). Mark: SoC part number, flash chip marking, debug pad pattern (UART = 4-pin row; JTAG = TAP header or test points).- Identify flash type from silkscreen or datasheet: SPI NOR (SOIC-8/WSON), SPI NAND, eMMC (BGA-153/169), parallel NOR/NAND.- Bench tools staged: CH341A programmer + SOIC-8 clip, BusPirate / J-Link / SEGGER J-Trace, USB-UART adapter (CP2102 / FT232), multimeter for UART baud sniffing.---## Tier 0 — Vendor Portal / OTA Proxy (no hardware needed)### 0a. Vendor download portal```bash# Check common firmware CDN patternscurl -sI "https://firmware.vendor.com/latest/<model>.bin"curl -sI "https://downloads.vendor.com/firmware/<model>/<version>.tar.gz"# Scrape firmware release page for direct linkswget -r -l1 -nd -A "*.bin,*.tar.gz,*.zip,*.img" \ "https://www.vendor.com/support/firmware/<model>"# Checksum-verify before unpackingsha256sum <fw.bin>```### 0b. OTA interception (MITM the device's update check)```bash# 1. ARP-spoof the device to route its traffic through your machinesudo arpspoof -i eth0 -t <device_ip> <gateway_ip> &sudo arpspoof -i eth0 -t <gateway_ip> <device_ip> &# 2. Forward all traffic except OTA traffic; intercept OTA with mitmproxysudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8080mitmproxy --mode transparent --set ssl_insecure=true -w /tmp/ota_capture.mitm# 3. Trigger an OTA check from the device (power cycle or companion app)# 4. Inspect intercepted traffic; export firmware binarymitmdump -r /tmp/ota_capture.mitm -w /tmp/ota_fw.bin \ --set flow_detail=3 '~t application/octet-stream or ~t application/x-gzip'# 5. Decrypt if AES-encrypted OTA (key often in companion app resources)openssl enc -d -aes-128-cbc -K <hex_key> -iv <hex_iv> -in /tmp/ota_fw.bin -out /tmp/fw_plain.bin```### 0c. Companion-app embedded firmware```bash# APK often bundles the firmware binary or partial imagesapktool d companion.apk -o companion_decompiled/find companion_decompiled/ -name "*.bin" -o -name "*.fw" -o -name "*.img" | xargs filegrep -r "firmware\|update\|download\|cdn" companion_decompiled/assets/ --include="*.js"```---## Tier 1 — UART Console DumpUART is the fastest hardware path: non-destructive, works while device is powered.### 1a. Identify UART pins```Typical 4-pin UART header: VCC | GND | TX | RXProbe each with multimeter (DC, 3.3 V idle = TX candidate).Baud detect: minicom -D /dev/ttyUSB0 -b 115200 (try 9600, 57600, 115200, 460800).``````bash# Baud-rate autoprobe with sigrok / baudrate.pypython3 baudrate.py /dev/ttyUSB0 # https://github.com/devttys0/baudrate# Or with screen – step through common ratesfor baud in 9600 19200 38400 57600 115200 230400 460800 921600; do echo "Testing $baud..."; screen /dev/ttyUSB0 $baud; done```### 1b. Interrupt boot and dump from U-Boot```bash# Connect: GND → GND, RX(USB) → TX(device), TX(USB) → RX(device)screen /dev/ttyUSB0 115200# Power on device; press any key within 1-3s to break into U-Boot# At U-Boot prompt: locate kernel + rootfs partition offsets=> printenv=> mtdparts # shows flash map (e.g. 0x00000000 kernel 0x200000, rootfs 0x600000)# Dump via XMODEM to host=> loady 0x80000000 # load address in RAM=> md.b 0x80000000 0x200000 # memory-display: prints hex to terminal# Capture terminal output → convert hex dump → binary:python3 -c "import sys, redata = open('uart_hexdump.txt').read()chunks = re.findall(r':\s+((?:[0-9a-fA-F]{8} ){1,4})', data)raw = bytes.fromhex(''.join(''.join(c.split()) for c in chunks))open('fw_from_uart.bin','wb').write(raw)"```### 1c. Full flash dump via UART + tftp```bash# If U-Boot has tftp + nand/sf commands:=> setenv ipaddr 192.168.1.100=> setenv serverip 192.168.1.10=> sf probe; sf read 0x80000000 0x0 0x1000000 # read 16MB SPI NOR into RAM=> tftp 0x80000000 flash_full.bin # upload to your tftp server# On your host: python3 -m py3tftp -p 69 --ip 0.0.0.0```---## Tier 2 — JTAG / SWD Debug Interface### 2a. OpenOCD + J-Link SWD dump (ARM Cortex-M)```bashopenocd -f interface/jlink.cfg -f target/stm32f4x.cfg \ -c "init; halt; dump_image /tmp/flash.bin 0x08000000 0x100000; shutdown"# Adjust start address and size per datasheet (STM32F4: 1 MB @ 0x08000000)```### 2b. JTAG boundary-scan enumeration (MIPS/ARM application processors)```bash# UrJTAG or JTAGulator to identify IR length + IDCODEjtag> cable jtagkeyjtag> detectjtag> print chain# Identify MIPS/ARM AP; attach GDB via OpenOCDgdb-multiarch vmlinux(gdb) target remote :3333(gdb) monitor halt(gdb) dump binary memory /tmp/mem.bin 0x80000000 0x90000000 # DRAM range```### 2c. JTAG boundary-scan via eBBoot / Segger```bash# Segger J-Flash CLI for known targets:JFlash -openprj target.jflash -readchip /tmp/flash_full.bin -exit```---## Tier 3 — SPI NOR Flash Dump (CH341A + flashrom)Most cost-effective hardware method for 8-pin SPI NOR chips.### 3a. In-circuit dump (device powered off, clip attached)```bash# Connect SOIC-8 clip to CH341A programmer# Identify chip: run flashrom probe firstsudo flashrom -p ch341a_spi --verbose 2>&1 | grep -E "Found|Matched|chip"# Dump (use the exact chip name from probe output)sudo flashrom -p ch341a_spi -c "MX25L12835F" -r /tmp/flash_dump.binsudo flashrom -p ch341a_spi -c "MX25L12835F" -r /tmp/flash_dump2.bin# Verify both reads match (disk corruption / clip contact issue otherwise)sha256sum /tmp/flash_dump.bin /tmp/flash_dump2.bincmp /tmp/flash_dump.bin /tmp/flash_dump2.bin && echo "MATCH" || echo "MISMATCH — re-seat clip"```### 3b. Troubleshooting in-circuit reads```Symptom: flashrom sees 0x00 or 0xFF → chip held in reset by SoC pull-downs.Fix: power-cycle with clip attached BEFORE the SoC powers up (race the SoC).Or: locate HOLD# / WP# pins, tie to VCC; CS# must go low only from CH341A.If SoC fights the bus: desolder for Tier 4.```### 3c. SPI NAND / eMMC alternative: python-flashrom / serprog```bash# For SPI NAND (Winbond W25Nxxxx), use nandwrite flow:# 1. Use flashrom with serprog (Raspberry Pi as SPI master):sudo flashrom -p serprog:dev=/dev/ttyUSB0:4000000 -c "W25N01GV" -r /tmp/nand.bin# 2. Extract with nanddump equivalent for raw bin:binwalk -e /tmp/nand.bin # handles OOB stripping for most NAND dumps```---## Tier 4 — eMMC Chip-OffLast resort: BGA desoldering, direct eMMC reader. Destructive to PCB.### 4a. Chip-off procedure```1. Hot-air rework (350 °C, 60 L/min): heat BGA from below; lift with vacuum.2. Clean pads with flux + wick.3. Reflow eMMC onto BGA breakout board (eMMC adapter): - SD-to-eMMC: Allwinner eMMC reader, Emuelec adapter, or custom PCB.4. Insert into card reader that supports eMMC protocol.```### 4b. Dump with dd / usbimager```bash# Identify device node (dmesg after plugging in)dmesg | tail -20 | grep sdlsblk -d /dev/sdb # confirm size matches eMMC spec# Full raw dumpsudo dd if=/dev/sdb of=/tmp/emmc_full.img bs=512 status=progress conv=noerror,syncsha256sum /tmp/emmc_full.img > /tmp/emmc_full.img.sha256# Partition inspectionfdisk -l /tmp/emmc_full.imgfile /tmp/emmc_full.img# Mount individual partition (offset in sectors from fdisk output)sudo mount -o loop,offset=$((512*2048)) /tmp/emmc_full.img /mnt/emmc_p1```---## EvidenceStore all artifacts under `/workspace/evidence/iot/<target>/firmware/`:```bashmkdir -p /workspace/evidence/iot/<target>/firmwarecp /tmp/flash_dump.bin /workspace/evidence/iot/<target>/firmware/flash_full.binsha256sum /workspace/evidence/iot/<target>/firmware/flash_full.bin \ > /workspace/evidence/iot/<target>/firmware/flash_full.bin.sha256# Log acquisition method and hardware usedecho "Acquired via: CH341A + SOIC-8 clip; flashrom 1.4.0; chip: MX25L12835F" \ > /workspace/evidence/iot/<target>/firmware/acquisition.log```## OPSEC Notes- In-circuit clips can corrupt firmware if contact is intermittent — always compare two reads before treating the image as canonical.- OTA MITM is logged server-side; only perform on isolated test-lab networks unless RoE explicitly permits production intercept.- JTAG debug may trigger internal tamper fuses on hardened targets (e.g., Qualcomm secure boot with JTAG-disable eFuse). Read the SoC TRM before probing.- eMMC RPMB partition requires authentication key to read — skip on initial triage; flag for key extraction if bootloader secrets are needed.## References- flashrom supported hardware: `https://flashrom.org/Supported_hardware`- CH341A pinout + SOIC clip wiring: `references/ch341a-soic-wiring.md`- U-Boot command reference: `https://u-boot.readthedocs.io/en/latest/usage/index.html`- OpenOCD target configs: `/usr/share/openocd/scripts/target/`

purpleailab/decepticon/tree/main/packages/decepticon/decepticon/skills/standard/iot/firmware-acquisition commit fecd41fcc0

Frequently asked questions

npx skillmds@latest add purpleailab/firmware-acquisition