Firmware Analysis Tools (Firmware & Embedded): open-source projects that exist because someone reverse engineered a closed product, sorted by GitHub stars.
Firmware analysis tool for identifying and extracting embedded files
Tool to investigate and reverse-engineer unknown wireless protocols
Open-source SDR platform for wireless RE
Binary emulation framework used for firmware and IoT analysis
UEFI firmware image viewer and editor
Tool for partially deblobbing Intel ME firmware images
Security analyzer for embedded device firmware
Embedded system simulator for running and debugging unmodified firmware
Unofficial Qualcomm Firehose, Sahara, streaming and DIAG tools
Extraction suite for arbitrary firmware and binary blobs
Scots Army Knife for electronics and hardware reverse engineering
Open-source Bluetooth monitoring and experimentation platform
Platform for emulation and dynamic analysis of Linux-based firmware
Framework to unpack, modify and repack binaries and firmware
Recovers an analyzable ELF from a raw kernel image using kallsyms
Toolkit to emulate firmware and analyze it for security vulnerabilities
Flashing tool for Tasmota firmware onto ESP devices
Firmware Analysis and Comparison Tool
MediaTek flash and repair utility using bootrom/preloader protocols
Bluetooth 5 and 4.x LE sniffer for TI CC1352/CC26x2
Project IceStorm: reverse engineered bitstream documentation and tools for Lattice iCE40 FPGAs
Utilities to parse and extract vendor BIOS/UEFI firmware
Tools to extract and rebuild firmware images for routers
Large-scale emulation for IoT firmware dynamic analysis
Parse BIOS/UEFI and Intel ME firmware images
Documents the reverse-engineered Xilinx 7-series FPGA bitstream format
Arduino/Raspberry Pi tool to identify JTAG pins on unknown hardware
Bluetooth experimentation framework for Broadcom/Cypress chips
Identify CPU architecture of unknown firmware binaries
Firmware for the Bus Pirate universal serial interface hacking tool
IDAPython scripts for automating analysis of embedded device firmware
Extract files from UBI and UBIFS images
Intel ME 11.x firmware image unpacker
Raw firmware analysis tool to find load address and endianness
Target orchestration framework for dynamic firmware analysis
Tool to create and extract Kindle update packages
Ghidra plugins for analyzing PC firmware (UEFI, option ROMs)
Broadcom/Cypress Bluetooth firmware emulation for fuzzing
Flash and back up BK7231 and other Tuya-module chips
CAD tool for extracting bits from mask ROM die photographs
Analysis framework for Intel CPU microcode
Ghidra analyzer for UEFI firmware
Tools to help reverse engineer UEFI-based firmware
Firmware base address search tool
Tool to load code on MediaTek SoCs via UART boot ROM
One-click firmware emulation built on firmadyne
Reverse engineered x86 AMD microcode updates from the USENIX 2017 paper
Hardware hacking multi-tool platform
JFFS2 filesystem extraction tool
IDA Pro scripts for reverse engineering EFI binaries
Passive data capture and reconstruction of serial flash chip contents
Firmware for Bus Pirate 5 hardware hacking multitool
Detect IP camera hardware and dump firmware
Toolkit for reverse engineering ESP32 firmware images
IDA Pro plugin for finding vulnerabilities in IoT firmware
Tools for analyzing UEFI firmware with FwHunt rules
Autonomous reverse engineering system, demonstrated on Fortinet firmware
GUI and CLI flashing and dumping tool for BK7231, RTL8710B and RTL8720C chips in Tuya devices
Tool to unpack Sony camera firmware images
Tools for security research on the Starlink user terminal
Research on the bootloader used in Xiaomi phones
Firmware cartography tool that maps binaries and their relations
Tools for reverse engineering 8051 firmware
Firmware rehosting through abstraction-layer (HAL) emulation
Android boot.img, recovery.img, SELinux and property unpack/repack tool
Android firmware image unpack and repack assistant
Information and tools on JieLi Bluetooth audio chips
Archive of Galaxy Buds firmware images, flashable with GalaxyBudsClient
Universal MCU firmware emulator for dynamic analysis without hardware
Notes and tools from reverse engineering firmware
Intel Cyclone V FPGA bitstream reverse engineering
Reverse-engineered Dell iDRAC firmware to stop throttling of unsupported GPUs in C4130
Tools for Qualcomm MSM devices (Sahara, DM/DIAG, streaming protocols)
Notes and utilities for reverse engineering USB-to-PCIe/NVMe bridge controllers
Reverse engineering tools for Altera and Xilinx FPGA bitstreams
Converts ESP8266 flash dumps into ELF files
Reverse engineering the Xilinx XC2064 FPGA bitstream
EFI DXE emulator and interactive debugger
Framework for dynamic analysis of embedded firmware with hardware-in-the-loop orchestration
ESP8266 and ESP32 firmware binary analysis toolkit
System Management RAM (SMRAM) analysis tool for UEFI firmware
IDA Pro scripts to assist reverse engineering EFI binaries
Reverse engineering the TI AM3358 boot ROM
Automatic emulation of DMA input channels for dynamic firmware analysis
FPGA reverse engineering and bitstream documentation project
Extract hidden fastboot oem commands from firmware blobs
Fast firmware base address scanner
.NET library to talk to Samsung Android devices in download (Odin) mode for flashing
SD-card-flashable firmware generator for the Fimi X8 SE drone
Finds a firmware's load address by matching string and pointer addresses
Format analysis and tool for TP-Link v3-header firmware images
Firmware reverse engineering tools for i.MX NAND flash
Reverse engineering of the AIXUN T3A soldering station
Script building a full flashable image of the official Shelly firmware
Reverse-engineered docs and tools for 8BitDo firmware encryption
Reverse-engineered AMT630A display controller from a cheap backup camera screen
Reverse-engineering Samsung Odyssey G5 monitor firmware for hidden features
Unofficial firmware tool for Insta360 GO 2/3/3S cameras
QEMU with support for QDSP6 user mode emulation
Archive of OTA firmware updates for Aqara IoT devices
Extracts information and files from Reolink camera firmware
OMA-DM client with FUMO support for retrieving Samsung firmware updates and metadata
WebAssembly app downloading Samsung OTA firmware files directly in the browser
Documentation and tools for Marvell 88MW300/302 firmware used in Yeelight bulbs
Annotated disassembly of the NTR 2.x custom firmware for the Nintendo N3DS
Automated rehosting framework for Linux-based embedded firmware
Byte-matching decompilation of the PlayStation 3 boot chain (lv0, loaders) and isolated SPU modules
Command line BK7231 flashing tool for SPI mode
Tool for unpacking and repacking Wyze camera firmware for modification
Tools for unpacking and analysing Ecovacs vacuum firmware
Dumps internal ROM from Cypress (Fujitsu) F2MC-8L microcontrollers
Binary Ninja loader for MediaTek preloaders and Little Kernel images
ROM reader for Toshiba TLCS-90 microcontrollers used in arcade boards
Firmware toolkit for unpacking and analyzing firmware images
Reverse-engineered firmware of the Bose QuietComfort 35 II
Reverse-engineered Intel Cyclone IV FPGA bitstream routing with Claude Code
Unpacker for eCos ROMFS images in firmware
Unpacks and repacks Hikvision R2 firmware files
Reverse-engineered instruction set reference for the Cirrus Logic HALO Core DSP (CS40L/CS35L amps)
Hardware reverse engineering of the WonderMedia WM8505 platform (JAY-tech UMPC 9901)
Research and tools for analysing phone binary blobs with the goal of replacing them with free software
SPI flash access tracer based on the Raspberry Pi Pico
FPGA bitstream reverse engineering and documentation project for multiple vendor FPGA families
Deterministic QEMU emulation of the ESP32 wireless stack running Espressif's unmodified blobs
Disassembly and reverse engineering of DEC TU58 tape drive firmware
Annotated VT100 terminal firmware (commented 8080 disassembly)
Firmware programmer for WCH microcontrollers over their USB ISP bootloader protocol