{
  "added_at": "2026-10-27",
  "additional_evidence_urls": [
    "https://github.com/scriptingxss/owasp-fstm/blob/ec666e8f8b9f7618a248a1c354469893abf0edb2/README.md#L1051-L1084",
    "https://github.com/scriptingxss/owasp-fstm/blob/ec666e8f8b9f7618a248a1c354469893abf0edb2/README.md#L945-L1050",
    "https://github.com/scriptingxss/owasp-fstm/blob/ec666e8f8b9f7618a248a1c354469893abf0edb2/License.md",
    "https://github.com/scriptingxss/owasp-fstm/blob/e32570c52f9d224ef66dbb46dc5df4bad1e48fda/README.md"
  ],
  "category": "learning",
  "description_en": "A free English methodology, maintained by Aaron Guzman and published on GitBook, for security testing and reverse engineering embedded-device firmware. It is organized as nine stages: information gathering, obtaining firmware, analyzing the image, extracting the filesystem, static analysis of its contents, emulation, dynamic testing, runtime analysis and binary exploitation, with example commands for tools such as binwalk, unblob, FACT, EMBA, Firmwalker, QEMU and Ghidra. An October 2025 revision added C/C++ static-analysis tools, SBOM generation and a mapping to the OWASP IoT Security Verification Standard (ISVS).",
  "description_zh": "由 Aaron Guzman 维护、发布在 GitBook 上的免费英文方法论，用于嵌入式设备固件的安全测试与逆向工程。全文分为九个阶段：信息收集、获取固件、分析固件镜像、提取文件系统、静态分析文件系统内容、仿真、动态测试、运行时分析和二进制漏洞利用，并给出 binwalk、unblob、FACT、EMBA、Firmwalker、QEMU 和 Ghidra 等工具的示例命令。2025 年 10 月的修订加入了 C/C++ 静态分析工具、SBOM 生成，以及与 OWASP IoT 安全验证标准（ISVS）的对应关系。",
  "entry_url": "https://awesomerea.org/resources/owasp-fstm/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/owasp-fstm/",
  "evidence_url": "https://github.com/scriptingxss/owasp-fstm/blob/ec666e8f8b9f7618a248a1c354469893abf0edb2/README.md",
  "group": "learn",
  "id": "owasp-fstm",
  "json_url": "https://awesomerea.org/resources/owasp-fstm/record.json",
  "kind": "learning-resource",
  "markdown_url": "https://awesomerea.org/resources/owasp-fstm/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/owasp-fstm/index.md",
  "name": "OWASP Firmware Security Testing Methodology (FSTM)",
  "name_zh": "OWASP 固件安全测试方法论（FSTM）",
  "record_type": "resource",
  "relationship": "learning",
  "requirements": [
    "Reviewed at default-branch commit ec666e8 (2025-10-05). Most of the text dates from 2019–2020, with a 2022 EMBA/EMBArk update and an October 2025 revision that refreshed tool references, removed commercial ones and added the SAST, SBOM and ISVS sections; the published GitBook includes those additions. A feature branch adding ISVS requirement mappings by stage (June 2026) was not merged at review, and a shorter 2020 Chinese translation sits on the separate zhong-wen-fstm branch.",
    "Its stated audience is security researchers, software developers, consultants, hobbyists and information-security professionals. It is a single long reference page of procedures and commands rather than a paced course, and it points to the OWASP IoT Security Testing Guide for hardware, wireless, network and user-interface tests outside firmware.",
    "Following it needs the firmware image or the physical device under an authorized assessment; the methodology tells testers to choose acquisition methods by project objectives and rules of engagement and to follow local laws. Some stages assume hardware debug access and a chip programmer. Tools mostly run on Linux; the README links a preconfigured EmbedOS Ubuntu VM from 2020 and, for practice, deliberately vulnerable firmware such as OWASP IoTGoat, DVRF and DVID.",
    "Licensed CC BY-SA 4.0 (License.md)."
  ],
  "requirements_zh": [
    "审阅的默认分支提交为 ec666e8（2025-10-05）。正文大多写于 2019–2020 年，2022 年更新过 EMBA/EMBArk 部分；2025 年 10 月的修订更新了工具引用、删除了商业工具，并加入 SAST、SBOM 和 ISVS 章节，已发布的 GitBook 也包含这些内容。另有一个按阶段补充 ISVS 要求对应关系的功能分支（2026 年 6 月），审阅时尚未合并；一份篇幅较短的 2020 年中文译本位于单独的 zhong-wen-fstm 分支。",
    "其目标读者为安全研究人员、软件开发人员、顾问、爱好者和信息安全专业人员。全文是一篇很长的参考页面，提供流程和命令，而不是循序渐进的课程；固件以外的硬件、无线、网络和用户界面测试，则请读者参考 OWASP IoT 安全测试指南（ISTG）。",
    "按此方法操作需要在获得授权的评估中拿到固件镜像或实体设备；方法论要求根据项目目标和约定的测试规则选择获取方式，并遵守当地法律。部分阶段需要硬件调试接口和芯片编程器。工具大多在 Linux 上运行；README 链接了一个 2020 年预配置的 EmbedOS Ubuntu 虚拟机，并推荐 OWASP IoTGoat、DVRF 和 DVID 等故意含漏洞的固件用于练习。",
    "采用 CC BY-SA 4.0 许可证（License.md）。"
  ],
  "targets": [
    "firmware"
  ],
  "url": "https://scriptingxss.gitbook.io/firmware-security-testing-methodology/",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}