# Firmware Analysis Guide

## Acquisition Methods

| Method | Use Case | Tools |
|--------|---------|-------|
| Software dump | Live system access | flashrom, CHIPSEC, vendor utilities |
| Hardware programmer | Physical access, bricked devices | CH341A, Bus Pirate, Dediprog |
| Network download | Comparison baseline | Vendor support sites |
| VM extraction | Virtual environments | VM settings, OVMF dumps |

## Extraction Tools

| Tool | Purpose |
|------|---------|
| **binwalk** | Firmware signature scanning and extraction |
| **jefferson** | JFFS2 filesystem extraction |
| **sasquatch** | Non-standard SquashFS extraction |
| **ubi_reader** | UBI/UBIFS filesystem extraction |
| **cramfsck** | CramFS filesystem extraction |
| **yaffshiv** | YAFFS filesystem extraction |

## Common Filesystem Types

- **SquashFS**: Read-only compressed, most common in Linux-based firmware
- **JFFS2**: Flash-friendly journaling filesystem
- **CramFS**: Compressed ROM filesystem
- **UBIFS**: Unsorted Block Image filesystem
- **YAFFS**: Yet Another Flash File System
- **ext2/3/4**: Standard Linux filesystems (less common in embedded)

## Architecture Identification

```bash
# Using binwalk
binwalk -A firmware.bin

# Using file on extracted binaries
file extracted/usr/bin/*

# Common architectures
# MIPS (big endian): Many routers (TP-Link, Netgear, D-Link)
# MIPS (little endian): Some routers, Ubiquiti devices
# ARM: Modern IoT, IP cameras, newer routers
# ARM64: High-end networking, modern embedded
# x86: UEFI firmware, some NAS devices
```

## Emulation

```bash
# QEMU user-mode (single binary emulation)
qemu-mipsel -L extracted/ extracted/usr/bin/target

# QEMU system-mode (full system)
qemu-system-mips -M malta -kernel vmlinux -initrd rootfs.cpio

# firmadyne (automated firmware emulation)
# Supports ARM and MIPS Linux-based firmware
./fat.py firmware.bin
```

## Security Checklist

- [ ] Default/hardcoded credentials in passwd/shadow
- [ ] Exposed debug interfaces (UART, JTAG, telnet)
- [ ] Outdated/vulnerable libraries (OpenSSL, BusyBox, etc.)
- [ ] Unnecessary network services enabled
- [ ] Lack of firmware signature verification
- [ ] Cleartext sensitive data in NVRAM
- [ ] Command injection in web interface CGI scripts
- [ ] Writable firmware partitions