# Embedded Systems & Firmware

> Build an embedded security lab with Buildroot and QEMU: audit attack surfaces, reverse firmware, exploit UART and ARM services, secure boot.

- Source: https://stevenfoerster.com/tutorials/paths/embedded-systems-firmware/

Learning Path

Build an embedded security lab with Buildroot and QEMU, audit attack surfaces, reverse-engineer firmware, exploit UART consoles and ARM services, and implement secure boot.

7 available [Start the path](https://stevenfoerster.com/tutorials/cross-compiling-and-debugging-with-buildroot-qemu-and-gdb/)

1.  - 1
    - intermediate

    ## [Cross-Compiling with Buildroot and QEMU](https://stevenfoerster.com/tutorials/cross-compiling-and-debugging-with-buildroot-qemu-and-gdb/)

    Set up an embedded Linux dev environment: build a custom ARM image with Buildroot, boot it in QEMU, and remotely debug binaries with GDB. No hardware required.

2.  - 2
    - intermediate

    ## [Embedded Linux Attack Surface Analysis](https://stevenfoerster.com/tutorials/attack-surface-analysis-of-a-minimal-embedded-linux-image/)

    Build a stripped embedded Linux image with Buildroot, then audit open ports, syscalls, suid binaries, kernel modules, and writable paths, and harden it.

3.  - 3
    - advanced

    ## [Firmware RE with Binwalk and Ghidra](https://stevenfoerster.com/tutorials/firmware-extraction-and-reverse-engineering-with-binwalk-and-ghidra/)

    Extract firmware from an IoT update file, unpack the filesystem, identify interesting binaries, and reverse engineer them in Ghidra to find bugs.

4.  - 4
    - intermediate

    ## [UART and Serial Console Exploitation](https://stevenfoerster.com/tutorials/uart-and-serial-console-exploitation/)

    Identify and interact with UART interfaces on embedded devices using QEMU, extract boot logs, interrupt U-Boot for a root shell, and dump flash over serial.

5.  - 5
    - advanced

    ## [Exploiting an Embedded Service: Buffer Overflow on ARM](https://stevenfoerster.com/tutorials/exploiting-an-embedded-service-buffer-overflow-on-arm/)

    Cross-compile a vulnerable network daemon for ARM, exploit a stack buffer overflow with ARM-specific techniques, and build ARM ROP chains in a QEMU/GDB lab.

6.  - 6
    - advanced

    ## [Secure Boot and Firmware Integrity Verification](https://stevenfoerster.com/tutorials/secure-boot-and-firmware-integrity-verification/)

    Implement a verified boot chain on embedded Linux with U-Boot FIT image signing, then attack it: downgrade attacks, unsigned image rejection, and bypasses.

7.  - 7
    - advanced

    ## [SPI and JTAG Flash Dumping from Hardware](https://stevenfoerster.com/tutorials/spi-and-jtag-flash-dumping-from-hardware/)

    Identify SPI flash chips, dump them with a CH341A programmer or in-circuit SOIC clip, and use OpenOCD over JTAG to extract firmware with no removable chip.


[All tutorials and learning paths](https://stevenfoerster.com/tutorials/)