Skip to content

How to modify ARM Cortex M based firmware A step by step app

Dennis Giese

Many IoT devices use an ARM Cortex-M based MCU and run some kind of RTOS/"bare metal" OS. In comparison to Linux-based firmwares it is a lot more difficult to modify the firmware. If you want to change the functionali...

Summary

### Dissecting ARM Cortex-M Firmware At 00:00, embedded security researcher Dennis Giese delivers a technical guide on extracting, reverse-engineering, and modifying ARM Cortex-M firmware for smart consumer appliances at the IoT Village. Giese focuses on demonstrating practical methods for gaining local root control over connected household devices.

### Smart Device Attack Surfaces and Over-The-Air Updates At 12:01, Giese analyzes smart lightbulb and smart appliance network architecture. He details how these devices interface with cloud servers and local mobile applications, demonstrating methods for intercepting and decrypting over-the-air (OTA) firmware update images during transit.

### Reverse-Engineering Monolithic Bare-Metal Binaries At 23:22, the presentation breaks down the internal architecture of bare-metal microcontrollers. Unlike Linux-based IoT gateways, Cortex-M microcontrollers run single monolithic firmware binaries without filesystems. Giese demonstrates how to locate vector tables, map memory-mapped I/O peripherals, and identify core RTOS task dispatchers using disassembly tools.

### Patching Cloud Telemetry and Regional Restrictions At 34:57, Giese demonstrates live binary patching techniques. By modifying string constants, IP addresses, and branching instructions, he alters firmware to bypass regional cloud locks, redirect telemetry to self-hosted servers, and unlock local debugging capabilities without vendor cloud mediation.

### Checksum Recalculation and Re-Flashing Workflows Concluding between 42:00 and 47:01, Giese explains how to recalculate hardware CRC checksums and flash modified binaries back onto microcontrollers via Serial Wire Debug (SWD) and JTAG interfaces, achieving complete local control over commercial smart devices.

(AI summary — Gemini Flash)

Related talks