Bare Metal Reverse Engineering
Presents a structured Ghidra methodology for reverse engineering stripped ARM Cortex bare-metal and FreeRTOS embedded binaries using SVD and BSim plugins.
Summary
Challenges of Bare-Metal Firmware Analysis
Reverse engineering stripped bare-metal firmware and RTOS binaries on ARM Cortex platforms is notoriously difficult due to the absence of symbol tables, dynamic loaders, and standard file formats.
Mapping Board Support Packages via SVD Loader
Using the SVD (System View Description) loader plugin in Ghidra, analysts map memory-mapped hardware peripheral registers directly to MCU hardware specifications, instantly contextualizing hardware control routines.
Deconstructing the Hardware Abstraction Layer
Custom type recovery scripts and function pattern matching allow researchers to identify hardware initialization sequences, peripheral clock gating, and GPIO driver logic without source code.
RTOS Kernel Reconstruction with BSim
Applying Ghidra’s BSim plugin facilitates signature matching against FreeRTOS and other embedded kernels, recovering task creation routines, scheduler priorities, and inter-process communication constructs in complex firmware.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Creator Stage·21 min
Craig Heffner
Breaks down practical software and hardware techniques for decrypting obfuscated and encrypted IoT firmware without requiring advanced cryptography math.
Creator Stage·28 min
Justin Mott · Ava Petersen
Documents finding nine zero-day vulnerabilities in Vilo consumer home routers through UART interfacing, firmware reversing, and protocol analysis.