Wiki

The software baked into a device's flash. Extract it and you can audit the whole device offline, which is why it is the prize of most hardware hacks.

The first code to run after reset. It brings up the chip and hands control to the OS, which makes it the root of the boot chain and a prime place to break or enforce trust.

A measure of how random data is, from 0 to 8 bits per byte. Plotted across a firmware image it reveals compression, encryption, and where interesting regions begin.

Each boot stage cryptographically verifies the next before running it, anchored in an immutable root of trust, so only vendor-signed firmware runs.

Compressed, read-only Linux filesystem. The standard way IoT firmware packs its root filesystem, and almost always what you unpack after a carve.

Flash contents are stored encrypted under a key held on-die, so a raw chip dump yields only ciphertext. It closes the offline read that Secure Boot does not.

The filesystem mounted at / on a Linux device. Carve it out of the firmware and you have the whole userland on disk: binaries, configs, and secrets.

The container for Linux executables and libraries. Its header tells you the CPU, endianness, and linking, everything you need before opening a disassembler.

Keys, passwords, certificates, and tokens baked into firmware instead of provisioned at runtime. Static, fleet-wide, and often found with a single grep.

The full set of entry points a connected device exposes across hardware, firmware, network, radio, and cloud. Unlike a server, it is attackable from many angles at once.

ESP-IDF's key-value store in a dedicated flash partition, where Wi-Fi credentials, tokens, and config persist across reboots, plaintext unless encryption is explicitly enabled.

The map of a flash chip. It tells you where the bootloader, app, OTA slots, and secret-bearing data partitions like NVS begin and end.

Capture a valid transmission and re-send it to trigger the same action, without ever decrypting it. The default weakness of any system that authenticates by static command.

A privacy feature where a device probes or advertises from a random, locally-administered MAC instead of its real burned-in one, to resist passive tracking over Wi-Fi and BLE.

Recovering secrets from physical leakage, power, timing, EM, or induced faults, rather than by breaking the algorithm. The reason a mathematically sound cipher can still surrender its key.

A radio whose tuning, demodulation, and decoding happen in software on raw IQ samples, so one piece of hardware can receive (and sometimes transmit) almost any protocol you can describe.

The logarithmic unit every RF number is quoted in. A dB is a pure ratio, a dBm is an absolute power referenced to one milliwatt, a dBi is an antenna gain referenced to an isotropic radiator, and confusing the three is the classic beginner error.

One column of additions in decibels that decides whether a radio link works. Transmit power plus gains minus losses gives the level at the receiver; compare it to what the receiver needs and the difference is the margin.

A carrier is a featureless sine wave until you disturb it, and there are exactly three things you can disturb: amplitude, frequency, and phase. Every scheme from a garage remote to a satellite downlink is one of those three or a mix.

Sampling turns a wave into numbers, and it has one hard rule: anything above half the sample rate folds back and lies to you. The same folding, used on purpose, is how a receiver digitises a band far above its converter rate.

Adding structured redundancy at the transmitter so the receiver can repair damage alone, with nothing to ask again. The reason a deep-space downlink, a broadcast, or a capture you recorded yesterday can survive a channel that corrupts bits.

The block code that repairs a noisy link by charging per corrupted symbol rather than per corrupted bit. Ubiquitous on space downlinks, and a silent failure the moment your decoder's field does not match the encoder's.

The inner code of almost every legacy space link: a shift register that spreads each input bit across several output bits, and a decoder that finds the single most likely transmitted sequence rather than judging bits one at a time.

Locating a transmitter from how much later its signal reaches one receiver than another. Each pair of synchronised receivers gives one hyperbola, and the crossing of several hyperbolas is the fix.

Recovering a key from how much current a chip draws while it uses it. Statistics turn a noisy measurement into one key byte at a time, which is why 16 bytes cost 4096 guesses instead of 2 to the 128.

Encrypt the same plaintext twice, once correctly and once with a fault, then read the key out of the difference between the two ciphertexts. The active counterpart to power analysis, and on AES it takes a handful of faults, not thousands of traces.

A keyed hash that proves a message came from someone holding the key and was not altered on the way. Its odd nested shape exists to kill length extension, and its verification must be constant-time or the tag leaks a byte at a time.

Turning something you have, a password or an existing secret, into a key of the right size and strength. Password KDFs are slow on purpose and salted per user; key-based KDFs are fast and exist to separate one secret into many.

A fixed pseudo-random sequence XORed over a radio frame before it is keyed, so long runs of identical bytes do not put a spike in the spectrum. It is a spectral tool, not a secret, and undoing it is a lookup, not an attack.

The per-device secret printed on a Zigbee 3.0 label, and the unique link key a coordinator derives from it instead of the well-known default.

What happens when a stream cipher encrypts two different messages under the same key and nonce: the key cancels out and the two plaintexts are left XORed with each other.

A cyclic redundancy check: a few bytes of polynomial arithmetic appended to a frame so a receiver can spot corruption. For an analyst it is the single best oracle there is, because it tells you your decode is right without anyone confirming it.

Pixel data with no header: a flat run of bytes whose meaning depends entirely on a width, a bit depth and a bit order that live somewhere else, usually in the firmware.

Why a CAN frame is never early and often late. Priority arbitration, bit stuffing and cycle time turn the timestamp column of a capture into evidence in its own right.

Every transmitter runs on its own crystal, and no two crystals agree. Measuring that disagreement from arrival timestamps attributes traffic to a physical device that carries no identity of its own.

Information carried by when a message is sent rather than what it contains. Every payload passes inspection, and the message is in the gaps.

The file that turns eight opaque octets into named physical quantities, and what to do on the overwhelming majority of vehicles where nobody will give you one.