Home / coco-research / coco · GitHub

firmware-pentest SKILL.md skillA

firmware-pentest from coco-research/coco is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

Install it, pinned

mdr add coco-research/coco/firmware-pentest@git:20260914.480426e

Pins git:20260914.480426e in mdr.lock. Pin the fingerprint instead.

Audit grade: A, 17 of 17 checks passed
Kind: SKILL.md skill
Repository: coco-research/coco
Path: systems/reverse-skill/skills/firmware-pentest/SKILL.md
Versions recorded: 1
Latest version: git:20260914.480426e, committed Sep 14, 2026
Size: 9,049 bytes
Repository stars: 629
License: Apache-2.0

固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。.

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# 固件 / IoT 渗透链 (Firmware Pentest)

## 适用范围

下列任务进入本 skill：

1. **拿到一份固件文件**（.bin / .img / .trx / .chk / OTA zip），需要从零到 RCE
2. **路由器/摄像头/IoT 设备审计** — 需要批量发现已知 CVE 和未公开漏洞
3. **加密/打包固件**，需要找 bootloader 解密例程或硬件 dump
4. **需要在不接触硬件的情况下跑起来**（QEMU 全系统仿真 / Firmadyne / FAT）
5. **对仿真起来的服务做 fuzz**（AFL++ qemu mode / boofuzz）
6. **硬件接口接入**（UART / JTAG / SPI flash dump）

### 与其他 skill 分工

| 场景 | 用什么 |
|------|--------|
| 从零拿到固件，全链路走 FSTM | **本 skill** |
| 只做单个 ELF/so 静态逆向 | `reverse-engineering/`、`ida-reverse/`、`radare2/` |
| 仿真起来后做 Web/RCE 利用 | `pentest-tools/`、`attack-chain/` |
| 硬件接口（UART/JTAG/SPI）实操 | 本 skill 的 Stage 2 章节 + `patterns-hardware.md` |
| APK / Android 固件（含 boot.img） | `apk-reverse/`（先剥 boot.img 再用本 skill） |
| 跨版本固件符号迁移 | `binary-diff/` |

## 核心原理

```text
固件 .bin
   │
   ├─ Stage 1-3: 信息收集 / 获取 / 静态分析（不解压也能看的部分）
   │
   ├─ Stage 4: 提取文件系统  ← binwalk v3 / unblob / jefferson / ubi_reader
   │     │
   │     └─ 失败 → 找 bootloader 解密例程 / UART dump / SPI flash 硬件读
   │
   ├─ Stage 5: 文件系统静态分析  ← EMBA 自动化 + 手工 grep
   │
   ├─ Stage 6: 模拟运行  ← Firmadyne / FAT / qemu-user-static + chroot
   │
   ├─ Stage 7-8: 动态 / 运行时分析  ← gdb-multiarch、IDA 远程调试、Ghidra
   │
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint

mdr add coco-research/coco/firmware-pentest@sha256:3ab58cd9a77ef8cf

The line at the top of this page pins the label git:20260914.480426e, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

[![mdr](https://markdownregistry.com/badge/art_2s4pcpbafvumzi4b.svg)](https://markdownregistry.com/a/art_2s4pcpbafvumzi4b)

7 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 1 version of this file, committed on Sep 14, 2026.

version	committed	commit	size	audit
git:20260914.480426e latest	2026-09-14	480426e	9,049 B	A	view

Audit of the latest version

A 17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.

pass: Frontmatter block present
pass: Frontmatter declares a name
pass: Frontmatter declares a description
pass: Size between 200 bytes and 200 KB (9049 bytes)
pass: No zero-width or bidi control characters
pass: No instruction hidden inside an HTML comment
pass: No link to an exfiltration or paste host
pass: No credential-shaped string
pass: No instruction to send local credentials anywhere
pass: No text hidden with inline styles
pass: No prompt-injection phrasing
pass: No curl or wget piped into a shell
pass: No recursive delete of root, home or parent
pass: No instruction to read or print local credentials
pass: No base64 blob over 200 characters
pass: No link to a raw IP address
pass: No script tag

Source

GitHub

coco-research/coco · 629 stars · license Apache-2.0 · pushed 2026-11-08 · branch main

API

GET https://markdownregistry.com/api/v1/artifacts/art_2s4pcpbafvumzi4b
GET https://markdownregistry.com/api/v1/resolve?ref=coco-research/coco/firmware-pentest
GET https://markdownregistry.com/api/v1/blob/3ab58cd9a77ef8cf83c05fd70963e3589cc2133db8fbaacacad1d8cafb1de16d

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from coco-research/coco

AGENTS.md AGENTS.md file

coco-research/coco · AGENTS.md

git:20261007.61dca6d · audit A · 629 stars

create-rule SKILL.md skill

coco-research/coco · adapters/cursor/skills/create-rule/SKILL.md · Create Cursor rules for persistent AI guidance. Use when the user wants to create a rule, add coding standards, set up…