// Firmware & Embedded

Firmware Security

Static analysis and reverse engineering of router, camera, and BMC firmware, plus the tooling behind it. Every number here came from binaries I unpacked and measured, not from vendor claims.

Hardening Coverage
3
OpenWrt images
144
executables measured
3
CPU architectures
0 / 144
unmeasurable
Stack canary coverage, OpenWrt 23.05
Share of executables built with -fstack-protector, measured by reading the dynamic symbol table of every ELF in each image.
OpenWrt mipsel ramips / mt7621
80%
OpenWrt mips ath79 / archer-c7
75%
OpenWrt x86-64 generic rootfs
74%
Stack protection is on by default across every architecture. The binaries that miss it are not random: the same core packages (procd, ubox, ubus, uci, fstools, logd, and nftables) ship without canaries on all three images. The number that predicts coverage is the package, not the CPU. Full method and per-package breakdown in the writeup below.
Research & Writeups
Tool · Open Source
Public
Sentinel: a firmware scanner that will not guess
A static analysis tool for extracted firmware. Every confirmed finding carries a proof you can re-check offline, and it reports present, absent, or unknown instead of reporting a mitigation as missing when it simply could not read it.
GoPythonELFProof-carrying
Read → GitHub →
Measurement Study
Published
How much of OpenWrt actually ships with stack canaries?
Scanned OpenWrt 23.05 across three architectures. Stack protection turned out to be on by default (74 to 80 percent), and the same set of core packages opts out on every build. Includes the measurement bug that made an earlier pass read zero, and how it was fixed.
OpenWrtMIPSx86-64Hardening
Read →
Firmware Research
Reported
Hikvision DS-K1T671M access terminal teardown
Reverse engineering of a physical access control terminal (ARM ELF). The RTSP session token uses a weak time-based seed, reported to Hikvision HSRC and under review. Includes every lead I chased and why most were ruled out.
ARM ELFIoTReverse Engineering
Read →
Coordinated Disclosure
🔒 Locked
OpenBMC (bmcweb / phosphor stack)
A finding in the BMC web management stack is under coordinated disclosure. Details are withheld until the process finishes.
Under review. Check back after disclosure.
Firmware Research
In progress
QNAP QTS attack surface review
Unpacking and static review of QTS firmware and its CGI handlers. The core authentication path held up under review. Work continues on the bundled app packages and file handlers.
QTSx86-64CGI
Ongoing.