# Emproof workshop: Firmware Reverse Engineering

> Slides and 14 self-contained exercises from Emproof's firmware reverse-engineering workshop at ScapyCon Automotive 2025, designed by Tim Blazytko for a technical audience with little security experience. The firmware and binary tasks move from reading ELF metadata with binutils and first steps in Ghidra or Binary Ninja, through unpacking two embedded-Linux CTF images with binwalk, to bare-metal analysis: identifying the microcontroller, toolchain and memory map of a model car's firmware ELF, and rebasing a raw STM32F103 flash dump with segments taken from the datasheet. Other tasks decrypt strings statically in a Mirai sample and trace a hardcoded AES key back to its data section.

- Type: Learning resource
- Targets: Binary · Firmware
- Category: Learning resources
- Relationship: Learning resource
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-11-01
- Original resource: <https://github.com/emproof-com/workshop_firmware_reverse_engineering>
- Primary source: <https://github.com/emproof-com/workshop_firmware_reverse_engineering/blob/10dc72a199f2a70c2274b08ff5773412df6d035b/README.md>
- Catalog page: <https://awesomerea.org/resources/emproof-firmware-re-workshop/>
- Record JSON: <https://awesomerea.org/resources/emproof-firmware-re-workshop/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/emproof-firmware-re-workshop/index.md)

## Requirements & limits

- The reviewed main commit, from 2025-09-25, ends a 14-commit history that began on 2025-09-21. It holds slides.pdf and 14 tasks, each a task.md with step-by-step questions next to a samples folder; no model solutions are included, and the two embedded-Linux tasks link an external write-up.
- The README says most samples target ARMv7 (Thumb/ARM32) or AArch64, and many come with C source. A Kali Linux-based Docker image fixed to linux/arm64, emulated on x86_64 hosts, supplies binutils, binwalk, John the Ripper and armhf runtime libraries; on first use docker_run.sh installs QEMU binfmt handlers on the host through a privileged container. Ghidra and Binary Ninja Free are installed on the host, and because Binary Ninja Free lacks AArch64 support, many tasks also ship an .armv7 build.
- Bare-metal tasks expect the analyst to consult the microcontroller's datasheet or reference manual; the STM32F103 task names the flash, SRAM, peripheral and system-control-space ranges to define before re-analysis. Several further tasks are crackme-style license, keygen and anti-patching exercises on the workshop's own binaries.
- The workshop materials are GPL-2.0, but the README excludes three sample folders from that license and provides them for analysis and education only, without redistribution: the two embedded-Linux images, which the tasks attribute to WORMCON CTF 2021, and a Mirai botnet binary that its task describes as active malware not to be executed, stored in a password-protected archive.

## Primary sources

1. <https://github.com/emproof-com/workshop_firmware_reverse_engineering/blob/10dc72a199f2a70c2274b08ff5773412df6d035b/README.md>
2. <https://github.com/emproof-com/workshop_firmware_reverse_engineering/blob/10dc72a199f2a70c2274b08ff5773412df6d035b/tasks/hello_world/task.md>
3. <https://github.com/emproof-com/workshop_firmware_reverse_engineering/blob/10dc72a199f2a70c2274b08ff5773412df6d035b/tasks/embedded_linux_2/task.md>
4. <https://github.com/emproof-com/workshop_firmware_reverse_engineering/blob/10dc72a199f2a70c2274b08ff5773412df6d035b/tasks/car_demo/task.md>
5. <https://github.com/emproof-com/workshop_firmware_reverse_engineering/blob/10dc72a199f2a70c2274b08ff5773412df6d035b/tasks/iot_diag/task.md>
6. <https://github.com/emproof-com/workshop_firmware_reverse_engineering/blob/10dc72a199f2a70c2274b08ff5773412df6d035b/tasks/crypto_detection/task.md>
7. <https://github.com/emproof-com/workshop_firmware_reverse_engineering/blob/10dc72a199f2a70c2274b08ff5773412df6d035b/Dockerfile>
8. <https://github.com/emproof-com/workshop_firmware_reverse_engineering/blob/10dc72a199f2a70c2274b08ff5773412df6d035b/docker_run.sh>
9. <https://github.com/emproof-com/workshop_firmware_reverse_engineering/blob/10dc72a199f2a70c2274b08ff5773412df6d035b/LICENSE>

## More in References and learning

- [iOS App Reverse Engineering](https://awesomerea.org/resources/ios-app-reverse-engineering-book/index.md) · Learning resource
- [Frida Snippets](https://awesomerea.org/resources/frida-snippets/index.md) · Learning resource
- [iOSRE: iOS Reverse Engineering reference](https://awesomerea.org/resources/kpwn-iosre/index.md) · Learning resource
- [linux-re-101](https://awesomerea.org/resources/linux-re-101/index.md) · Learning resource
- [Frida Labs](https://awesomerea.org/resources/frida-labs/index.md) · Learning resource
- [osx & ios re 101](https://awesomerea.org/resources/osx-re-101/index.md) · Learning resource

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.