# Reverser Firmware

> Router / IoT firmware extraction pipeline — unpack nested filesystems, locate web server, identify backdoor credentials.

- Skill: `purpleailab/reverser-firmware` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/reverser-firmware`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/reverser-firmware/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/reverser-firmware

---


# Firmware Extraction Playbook

## 1. Extract
```bash
apt-get install -y binwalk squashfs-tools cramfsprogs
mkdir -p /workspace/fw && cd /workspace/fw
binwalk -eM /workspace/firmware.bin
find _firmware.bin.extracted -name "squashfs-root" -o -name "rootfs"
```

## 2. Map the root
```bash
ROOT=$(find _firmware.bin.extracted -type d -name "squashfs-root" | head -1)
ls -la "$ROOT/etc/"
cat "$ROOT/etc/passwd"          # look for hardcoded users
cat "$ROOT/etc/shadow"          # password hashes — feed to hashcat
cat "$ROOT/etc/init.d/S*" 2>/dev/null
cat "$ROOT/etc/rc.d/rc.local" 2>/dev/null
```

## 3. Web server binary
```bash
find "$ROOT" -name "httpd" -o -name "lighttpd" -o -name "nginx" -o -name "boa"
# For each: bin_identify + bin_strings + bin_symbols_report
```
CGI binaries under `www/cgi-bin/` are the highest-yield targets — often
one file per endpoint with direct `system()` calls from query params.

## 4. Hardcoded credentials
```
bin_strings(path=web_server_binary, category_filter="secret")
bin_strings(path=web_server_binary, category_filter="crypto")
```
Also check for base64 / hex key patterns near `strcmp` calls (manual
audit via Ghidra — use `bin_ghidra_script` to seed).

## 5. Authentication bypass audit
Look for:
- Magic string comparisons (`strcmp(user, "admin")`)
- Debug backdoor paths (`/debug`, `/cgi-bin/shell`, `.sys`)
- UART/JTAG enabled in bootargs (check `bootargs.txt` in extraction)

## 6. Cross-reference CVEs
For the extracted busybox / kernel / dropbear / openssl versions:
```
cve_by_package("busybox", "1.27.2", "OSS-Fuzz")
cve_lookup("CVE-2021-28831,CVE-2023-0464")
```

## 7. Record
Add:
- `repo` node for the firmware image
- `file` nodes for each interesting binary
- `credential` nodes for any hardcoded creds
- `vulnerability` nodes for each audit finding
- `entrypoint` for each cgi-bin path