reverser-firmware

Router / IoT firmware extraction pipeline — unpack nested filesystems, locate web server, identify backdoor credentials.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/reverser/firmware/SKILL.md

Firmware Extraction Playbook

1. Extract

apt-get install -y binwalk squashfs-tools cramfsprogs
mkdir -p /workspace/fw && cd /workspace/fw
binwalk -eM /workspace/firmware.bin
find _firmware.bin.extracted -name "squashfs-root" -o -name "rootfs"

2. Map the root

ROOT=$(find _firmware.bin.extracted -type d -name "squashfs-root" | head -1)
ls -la "$ROOT/etc/"
cat "$ROOT/etc/passwd"          # look for hardcoded users
cat "$ROOT/etc/shadow"          # password hashes — feed to hashcat
cat "$ROOT/etc/init.d/S*" 2>/dev/null
cat "$ROOT/etc/rc.d/rc.local" 2>/dev/null

3. Web server binary

find "$ROOT" -name "httpd" -o -name "lighttpd" -o -name "nginx" -o -name "boa"
# For each: bin_identify + bin_strings + bin_symbols_report

CGI binaries under www/cgi-bin/ are the highest-yield targets — often one file per endpoint with direct system() calls from query params.

4. Hardcoded credentials

bin_strings(path=web_server_binary, category_filter="secret")
bin_strings(path=web_server_binary, category_filter="crypto")

Also check for base64 / hex key patterns near strcmp calls (manual audit via Ghidra — use bin_ghidra_script to seed).

5. Authentication bypass audit

Look for:

Magic string comparisons (strcmp(user, "admin"))
Debug backdoor paths (/debug, /cgi-bin/shell, .sys)
UART/JTAG enabled in bootargs (check bootargs.txt in extraction)

6. Cross-reference CVEs

For the extracted busybox / kernel / dropbear / openssl versions:

cve_by_package("busybox", "1.27.2", "OSS-Fuzz")
cve_lookup("CVE-2021-28831,CVE-2023-0464")

7. Record

Add:

repo node for the firmware image
file nodes for each interesting binary
credential nodes for any hardcoded creds
vulnerability nodes for each audit finding
entrypoint for each cgi-bin path

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/reverser/firmware/SKILL.md
Commit: e34afba

Last updated: 8 days ago
First committed: 2 months ago

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.