Skip to main content
back to List back
on this page

Deep Dive IoT Exploitation: From ARM Binary Hacking to Firmware Analysis

live online
price $1,400
Mars
Advanced
2 Days
Defense
Sun 22 Nov - Mon 23 Nov
price $1,400
Register


Online, Available in English

Overview

IoT and IIoT devices — from consumer routers and smart cameras to industrial sensors and critical-infrastructure gateways — share one uncomfortable property: they run low-level code on resource-constrained hardware that rarely receives the scrutiny a laptop or server would. That is exactly where offensive IoT research lives, and that is where this two-day course operates.

"Deep Dive IoT Exploitation: From ARM Binary Hacking to Firmware Analysis" takes a ground-up approach. We do not start at the protocol layer; we start at the binary. Day 1 is dedicated to ARM exploitation — the instruction set, calling conventions, stack and heap internals, and the modern mitigations students will actually encounter on a real IoT target — built out across eight hands-on labs covering command injection, format-string, stack / heap / UAF, and mitigation-bypass (NX via ret2libc, ROP, ASLR via info-leak / brute-force).

Day 2 raises the camera to the whole device: firmware acquisition, unpacking, static and dynamic analysis, encrypted-firmware key-recovery (both static and runtime), and firmware fuzzing for vulnerability discovery. The class closes with a one-hour orientation on hardware and RF penetration testing — UART / JTAG / SPI / I2C on the hardware side, and Zigbee / BLE / Z-Wave on the RF side — complete with live demos on real IoT devices so students know what those attack surfaces actually look like in practice.

The course is structured so that skills compound: the ARM-exploitation foundations laid on Day 1 are directly applied to the vulnerabilities surfaced during Day 2's firmware labs.

The Middle East and Africa is one of the most IoT- and IIoT-dense regions on the planet per critical-infrastructure asset. This course takes advantage of that: the devices chosen for the hands-on labs are the exact vendors and product families that dominate regional deployments, so every skill students build in class can be carried directly into their own engagements.

Topics:

  • IoT Ecosystem Overview and Attack Vectors
  • ARM Exploitation
  • Lab 1: Command Injection on ARM-based applications
  • Lab 2: Format String Vulnerability exploitation
  • Lab 3: Stack-based Bucer Overflow (BOF) — understanding ARM calling conventions and stack layout
  • Lab 4: Heap-based Bucer Overflow (BOF) — ARM heap internals and exploitation
  • Lab 5: Use After Free (UAF) — dangling pointers and exploitation on ARM
  • Lab 6: Bypass NX — ret2libc techniques on ARM
  • Lab 7: Return Oriented Programming (ROP) — building ROP chains for ARM architecture
  • Lab 8: Bypassing ASLR — information leaks and brute-force techniques
  • Analyzing and Exploiting IoT Firmware
  • Lab 9: Firmware extraction and unpacking using binwalk, firmware-mod-kit
  • Lab 10: File system analysis, hardcoded credential discovery, and configuration review
  • Lab 11: Emulating firmware with QEMU for runtime analysis
  • Lab 12: Debugging running firmware — attaching debuggers and tracing execution flow
  • Lab 13: Static approach — identifying and breaking firmware encryption
  • Lab 14: Dynamic approach — extracting encryption keys from runtime memory
  • Lab 15: Setting up fuzzing environments for IoT firmware
  • Lab 16: Identifying and triaging crash results, writing proof-of-concept exploits

Who Should Attend (Target Audience)

  • Penetration testers moving into IoT / embedded / IIoT engagements who need ARM-level fluency 
  • Vulnerability researchers focused on routers, gateways, cameras, consumer IoT, industrial endpoints, and medical IoT.
  • Product-security engineers working for regional vendors and system integrators who are responsible for securing their own embedded devices and want to understand how those devices will be attacked.
  • Red teamers encountering IoT / edge / OT devices during physical or network engagements and wanting to weaponize them.
  • Exploit developers with prior x86 / x64 experience who want to port their skill-set onto ARM and onto firmware targets.

Prerequisites

Required Knowledge

  • Comfort with the Linux command line and shell scripting.
  • Basic C programming (ability to read and reason about C source; ability to write small C programs).

Hardware / Software Requirements

  • Laptop with at least 16 GB RAM (32 GB recommended for firmware emulation), 75+ GB free disk.
  • Administrative rights on the host OS.
  • Hypervisor of choice (VMware Workstation / Fusion) pre-installed.
  • Please do NOT bring an Apple-silicon Mac — the lab environment uses x86-64 Ubuntu 18.04 VMs for reliable cross-architecture emulation.

By the end of this course, the participant will learn about: 

  • Set up a complete ARM vulnerability-research environment — cross-compilation toolchain, QEMU (user-mode and system-mode), GDB with gef / pwndbg, and pwntools-based exploit scripting.
  • Read and reason about ARM assembly: the register file, CPSR, calling conventions (AAPCS), the MOV / load-store / branch instruction families, stack frame layout, and heap allocator behavior on ARM.
  • Discover and exploit classic memory-safety vulnerabilities on ARM: command injection, format-string vulnerabilities, stack-based and heap-based buffer overflows, and use-after-free conditions.
  • Understand and bypass modern exploit mitigations on ARM: stack canary, No eXecute (NX / XN), ASLR (via information leak and brute-force), and RELRO — and know when each applies to real firmware.
  • Build reliable ROP chains tailored to the ARM calling convention (including the quirks of Thumb-mode gadgets).
  • Walk through the full firmware-analysis pipeline: extraction and unpacking (binwalk, firmware-mod-kit, firmwalker), file-system analysis (SquashFS, JFFS2, UBIFS, CramFS), hardcoded-credential discovery, and configuration review.
  • Emulate firmware with QEMU (including FirmAE-style whole-system emulation), attach debuggers to running firmware, and trace execution flow through real device code.
  • Handle encrypted firmware — recover keys both statically (reverse-engineering the decryption routine as a dedicated component of the vendor update chain) and dynamically (extracting keys from runtime memory).
  • Stand up a firmware-fuzzing environment, triage crashes, and turn interesting crashes into proof-of-concept exploits that reuse the Day-1 ARM exploitation primitives.
  • Apply techniques to overcome hardware dependencies that would normally block firmware analysis.
  • Orient confidently on hardware-level attack surfaces (UART, JTAG, SPI, I2C) and RF attack surfaces (Zigbee, BLE, Z-Wave) — and know when to escalate from firmware to hardware / RF in a real engagement.