Learning Path

Embedded Systems & Firmware

Build an embedded security lab with Buildroot and QEMU, audit attack surfaces, reverse-engineer firmware, exploit UART consoles and ARM services, and implement secure boot.

7 available Start the path
  1. 1 intermediate

    Cross-Compiling with Buildroot and QEMU

    Set up an embedded Linux dev environment: build a custom ARM image with Buildroot, boot it in QEMU, and remotely debug binaries with GDB. No hardware required.

  2. 2 intermediate

    Embedded Linux Attack Surface Analysis

    Build a stripped embedded Linux image with Buildroot, then audit open ports, syscalls, suid binaries, kernel modules, and writable paths, and harden it.

  3. 3 advanced

    Firmware RE with Binwalk and Ghidra

    Extract firmware from an IoT update file, unpack the filesystem, identify interesting binaries, and reverse engineer them in Ghidra to find bugs.

  4. 4 intermediate

    UART and Serial Console Exploitation

    Identify and interact with UART interfaces on embedded devices using QEMU, extract boot logs, interrupt U-Boot for a root shell, and dump flash over serial.

  5. 5 advanced

    Exploiting an Embedded Service: Buffer Overflow on ARM

    Cross-compile a vulnerable network daemon for ARM, exploit a stack buffer overflow with ARM-specific techniques, and build ARM ROP chains in a QEMU/GDB lab.

  6. 6 advanced

    Secure Boot and Firmware Integrity Verification

    Implement a verified boot chain on embedded Linux with U-Boot FIT image signing, then attack it: downgrade attacks, unsigned image rejection, and bypasses.

  7. 7 advanced

    SPI and JTAG Flash Dumping from Hardware

    Identify SPI flash chips, dump them with a CH341A programmer or in-circuit SOIC clip, and use OpenOCD over JTAG to extract firmware with no removable chip.

All tutorials and learning paths