Class 15a - Firmware Extraction the UART way - Intro
Class 15a - Firmware Extraction the UART way - Intro
Hardware Hacking Expert - Level 2 - Module 1: UART Hacking
About Module 01 – UART Hacking
About Module 01 – UART Hacking
Class 01 - Why Hack UART?
Class 01 - Why Hack UART?
Class 02 - Identify UART pins
Class 02 - Identify UART pins
Class 03 - Sniffing Log
Class 03 - Sniffing Log
Class 05 - UART and the OT World
Class 05 - UART and the OT World
Class 06 - Connecting to OT Comm Line
Class 06 - Connecting to OT Comm Line
Class 07 - Identifying the right wires
Class 07 - Identifying the right wires
Class 09 - Sniffing OT Network
Class 09 - Sniffing OT Network
Class 11 - true MITM on OT
Class 11 - true MITM on OT
Class 12 - Fault Injection in UART Attacks
Class 12 - Fault Injection in UART Attacks
Class 13 - Bypassing Kill Switch Protection
Class 13 - Bypassing Kill Switch Protection
Class 14 - Bypassing Secure Boot
Class 14 - Bypassing Secure Boot
This class teaches how to extract complete firmware images from devices once UART access has been gained. The instructor first demonstrates leveraging built-in MCU bootloaders, showing how vendors like STMicroelectronics, NXP, TI, Espressif, and others expose UART-based programming interfaces that can be repurposed for firmware dumping. The second technique uses captured UART logs: a firmware hexdump streamed to the terminal can be reconstructed into a binary file using a simple Python script. By the end, students will know how attackers recover entire firmware images for offline reverse engineering, analysis, and implant development.
Learning Objective
Perform firmware extraction from MCUs and embedded devices using UART access.
Training Outcomes
Use built-in UART bootloaders of popular MCUs to dump firmware
Capture firmware hexdumps via UART logs and reconstruct them into binaries
Apply extracted firmware for vulnerability research and exploit development
Hands-On Experience
Connect to MCU bootloaders (STM32, ESP32, MSP430, AVR, etc.) and dump firmware images
Capture UART log hexdumps and rebuild them into binary firmware with the provided Python script
Analyze recovered binaries as a foundation for reverse engineering and further exploitation