Wiki
The reference for hardware hacking: the tools, the protocols, the hardware, and the concepts behind every course and lab. Look something up, then go break it.
Hardware
17The layered board that ties every chip together. Learn to read its traces, vias, pads, and silkscreen before you touch a probe, because the board itself is your first recon report.
The reference USB-to-UART bridge for reaching a device's TTL serial console. Turns a USB port into /dev/ttyUSB0 so you can read boot logs and drop into a bootloader or root shell.
The small 8-pin chip that stores a device's firmware. Clip it or desolder it, dump the whole image over SPI, and you have the firmware offline with no network and no login.
Cheap USB programmer that reads and writes 25-series SPI flash and 24-series I2C EEPROM chips. Paired with a SOIC-8 clip and flashrom, it dumps a device's firmware for a few euros.
Spring-loaded test clip that grips the eight legs of a SOIC-8 chip so you can read an SPI flash or I2C EEPROM in-circuit, without desoldering it.
Microcontroller or system-on-chip? The distinction decides where firmware lives, how you dump it, and which attacks are even on the table.
Samples several digital lines at once and, with sigrok/PulseView, decodes them back into UART, SPI, and I2C bytes. Turns unlabelled test points into a readable transcript of the bus.
One-time-programmable bits blown into silicon. They store keys and set irreversible policy: Secure Boot, Flash Encryption, JTAG disable, download-mode locks. Reading the fuse map tells you which doors are still open.
Measures voltage, continuity, and resistance. On the hardware bench it is how you map an unknown header and confirm logic levels before you ever connect an adapter.
The hardware debug ports. If left enabled they give full halt, single-step, and memory read/write access to the CPU core, enough to dump internal flash and read keys live.
Espressif Wi-Fi/BLE SoC family. Boots from external flash, stores secrets in NVS, and ships with Secure Boot, Flash Encryption, and eFuses that are usually left off.
A serial interface (TX/RX/GND) on a PCB that frequently exposes a device's debug console, boot log, or even an unauthenticated root shell, just three pins away.
How a chip is mounted decides whether you clip it, hot-air it, or reball it. Reading the package sets your whole toolchain before you attempt to dump or probe the part.
Small non-volatile memory holding config, calibration, serials and sometimes secrets. Usually a tiny 8-pin I2C 24-series part, trivial to read in-circuit and to diff for stored fields.
The clock source that paces the chip. A passive crystal or an active oscillator sets the beat every instruction marches to, which makes it a prime target for glitching and fault injection.
A pocket, USB-driven multi-protocol interface. Speaks SPI, I2C, UART, 1-Wire and more from a serial terminal, so one board can probe, sniff, and dump unknown chips.
The cheap USB dongle that turned a TV tuner chip into a wideband SDR receiver. RX only, roughly 24 to 1766 MHz, and the standard entry point into radio hacking.
Software
18NSA's open-source reverse-engineering suite. Disassembles and decompiles firmware for almost any CPU into readable C-like pseudocode.
Firmware triage tool. Scans a flash dump for known signatures, maps where the bootloader, kernel and filesystem live, and carves them out into a browsable tree.
Reads, writes and verifies SPI/LPC/parallel flash chips through a programmer like the CH341A, an FTDI adapter or a Bus Pirate. The standard tool for out-of-band firmware extraction.
Espressif's official flashing tool. Talks to the ESP32/ESP8266 serial bootloader over UART to identify the chip and read, write, or erase its flash, no desoldering needed.
The reference MQTT broker, shipped with the mosquitto_sub / mosquitto_pub CLI clients that are the standard way to test and attack a broker.
Espressif's eFuse tool. Reads and permanently burns the one-time-programmable bits that control Secure Boot, Flash Encryption and JTAG on ESP32 chips. Reading is safe; burning is forever.
Open-source logic-analyser stack: capture digital signals with sigrok-cli or PulseView, then decode the edges into UART, SPI, I2C, or JTAG bytes.
The standard network scanner. Beyond port discovery, its NSE scripting engine fingerprints and probes IoT and OT services like Modbus, MQTT, DNP3 and BACnet.
The standard network protocol analyser. Captures live or from a file and dissects hundreds of protocols field by field, including industrial ones like Modbus/TCP, DNP3 and EtherNet/IP.
Python library for Modbus TCP and RTU: script reads and writes against PLC and RTU registers and coils from your own machine.
Interactive TLS-intercepting proxy. Sits between a device and its cloud backend to inspect, replay and rewrite encrypted API traffic, scriptable for automation.
Linux SocketCAN command-line toolkit: bring up an interface, sniff, dump, replay, and inject CAN bus frames against ECUs and industrial gear.
Open On-Chip Debugger: bridge a JTAG/SWD probe to GDB and a Telnet console to halt an MCU, read its memory and flash, and step through code.
Scriptable command-line reverse-engineering framework. Opens any blob at any base address to analyse, debug, and patch firmware, with a visual graph and the Cutter GUI.
One CLI and library for the physical layer (radio and wired buses). The same commands drive a virtual lab target and real hardware.
Minimal serial terminal emulators to reach a device's UART console: your first interactive window into a target's bootloader and shell.
Espilon's universal serial monitor for embedded devices: watch multiple ports at once, detect crashes by pattern, bridge a PTY without resetting the target, and stream JSON for CI.
Machine emulator that runs foreign-architecture binaries and full firmware images, so you can execute and debug embedded code without the physical device.
Protocols
23Two-wire async serial link (TX/RX), the number-one hardware entry point on a board and often a direct root shell.
Fast four-wire synchronous bus. The standard way to clip onto an external flash chip and dump the firmware whole.
Two-wire addressable bus (SDA/SCL). Configuration EEPROMs, sensors, and RTCs hang off it, and the EEPROM often holds the secrets.
On-chip debug interfaces. Halt the CPU, read and write RAM and flash directly, and defeat readout protection.
Differential two-wire vehicle and industrial bus. Frames are broadcast with no addressing and no authentication, so one tap reads and spoofs everything.
Legacy industrial request/response protocol for PLCs and RTUs. Plaintext, unauthenticated, and on TCP port 502 the only barrier is network reachability.
Lightweight IoT pub/sub messaging: often anonymous, leaking telemetry and accepting commands.
Low-power 2.4GHz wireless built on GATT: services and characteristics for wearables, locks, and beacons.
Wireless LAN standard: capture handshakes, crack keys, and stand up rogue APs.
Zero-config LAN name resolution: enumerate and spoof local services on .local.
Plug-and-play device discovery: exposes SOAP control endpoints and port-mapping abuse.
Host-controlled bus where a device declares what it is through descriptors. The host trusts those claims, which is the whole attack surface.
Single-data-line bus where every device carries a unique 64-bit ROM ID. iButton access tokens trust that ID, so cloning it clones the key.
Low-power 802.15.4 mesh for the smart home: sniffable, with weak default key provisioning.
Long-range sub-GHz chirp radio: sniffable, with replayable and mis-keyed LoRaWAN joins.
The modern secure-by-design industrial protocol (IEC 62541). The stack is strong; the field deployments turn the awkward parts off, so a None endpoint and a trust-any cert list undo all of it.
The SCADA protocol of electric and water utilities (IEEE 1815). Master and outstation, points and objects, and on TCP port 20000 the base protocol has no authentication at all.
Siemens' proprietary PLC protocol for the S7 family, carried over ISO-on-TCP on port 102. Legacy S7comm is unauthenticated; read a data block, write a merker, stop the CPU.
The supervisory layer that lets humans watch and steer a plant. The HMI is the most internet-exposed part of OT, and a screen that lies to the operator is a safety hazard, not just a data leak.
Sub-GHz smart-home mesh. The cipher is AES-128; the break is the key bootstrap. S0 hands the network key out under an all-zero key during inclusion and has no anti-replay.
The network and security layer above LoRa. Two AES-128 keys stand in for TLS, so LoRaWAN security is a key-management problem: reused AppKeys, static ABP keys, and replayable joins.
Contactless cards and tags powered by the reader's field. LF (125 kHz) is often plain-ID and clonable; HF (13.56 MHz) carries NFC and real crypto, some of it broken.
The 13.56 MHz card behind a generation of transit and access systems. Its proprietary CRYPTO1 cipher is broken, so keys fall to nested, darkside, and reuse attacks and the card is dumped and cloned.
Concepts
16The software baked into a device's flash. Extract it and you can audit the whole device offline, which is why it is the prize of most hardware hacks.
The first code to run after reset. It brings up the chip and hands control to the OS, which makes it the root of the boot chain and a prime place to break or enforce trust.
A measure of how random data is, from 0 to 8 bits per byte. Plotted across a firmware image it reveals compression, encryption, and where interesting regions begin.
Each boot stage cryptographically verifies the next before running it, anchored in an immutable root of trust, so only vendor-signed firmware runs.
Compressed, read-only Linux filesystem. The standard way IoT firmware packs its root filesystem, and almost always what you unpack after a carve.
Flash contents are stored encrypted under a key held on-die, so a raw chip dump yields only ciphertext. It closes the offline read that Secure Boot does not.
The filesystem mounted at / on a Linux device. Carve it out of the firmware and you have the whole userland on disk: binaries, configs, and secrets.
The container for Linux executables and libraries. Its header tells you the CPU, endianness, and linking, everything you need before opening a disassembler.
Keys, passwords, certificates, and tokens baked into firmware instead of provisioned at runtime. Static, fleet-wide, and often found with a single grep.
The full set of entry points a connected device exposes across hardware, firmware, network, radio, and cloud. Unlike a server, it is attackable from many angles at once.
ESP-IDF's key-value store in a dedicated flash partition, where Wi-Fi credentials, tokens, and config persist across reboots, plaintext unless encryption is explicitly enabled.
The map of a flash chip. It tells you where the bootloader, app, OTA slots, and secret-bearing data partitions like NVS begin and end.
Capture a valid transmission and re-send it to trigger the same action, without ever decrypting it. The default weakness of any system that authenticates by static command.
A privacy feature where a device probes or advertises from a random, locally-administered MAC instead of its real burned-in one, to resist passive tracking over Wi-Fi and BLE.
Recovering secrets from physical leakage, power, timing, EM, or induced faults, rather than by breaking the algorithm. The reason a mathematically sound cipher can still surrender its key.
A radio whose tuning, demodulation, and decoding happen in software on raw IQ samples, so one piece of hardware can receive (and sometimes transmit) almost any protocol you can describe.