jperezduerto.info
Hardware hacking
Ninguna herramienta coincide.
-
binwalkweb
Firmware and binary carving tool for finding embedded filesystems and compressed blobs.
ayuda
Binwalk v2.4.3 Original author: Craig Heffner, ReFirmLabs https://github.com/OSPG/binwalk Usage: binwalk [OPTIONS] [FILE1] [FILE2] [FILE3] ... Disassembly Scan Options: -Y, --disasm Identify the CPU architecture of a file using the capstone disassembler -T, --minsn=<int> Minimum number of consecutive instructions to be considered valid (default: 500) -k, --continue Don't stop at the first match Signature Scan Options: -B, --signature Scan target file(s) for common file signatures -R, --raw=<str> Scan target file(s) for the specified sequence of bytes -A, --opcodes Scan target file(s) for common executable opcode signatures -m, --magic=<file> Specify a custom magic file to use -b, --dumb Disable smart signature keywords -I, --invalid Show results marked as invalid -x, --exclude=<str> Exclude results that match <str> -y, --include=<str> Only show results that match <str> Extraction Options: -e, --extract Automatically extract known file types -D, --dd=<type[:ext[:cmd]]> Extract <type> signatures (regular expression), give the files an extension of <ext>, and execute <cmd> -M, --matryoshka Recursively scan extracted files -d, --depth=<int> Limit matryoshka recursion depth (default: 8 levels deep) -C, --directory=<str> Extract files/folders to a custom directory (default: current working directory) -j, --size=<int> Limit the size of each extracted file -n, --count=<int> Limit the number of extracted files -0, --run-as=<str> Execute external extraction utilities with the specified user's privileges -1, --preserve-symlinks Do not sanitize extracted symlinks that point outside the extraction directory (dangerous) -r, --rm Delete carved files after extraction -z, --carve Carve data from files, but don't execute extraction utilities -V, --subdirs Extract into sub-directories named by the offset Entropy Options: -E, --entropy Calculate file entropy -F, --fast Use faster, but less detailed, entropy analysis -J, --save Save plot as a PNG -Q, --nlegend Omit the legend from the entropy plot graph -N, --nplot Do not generate an entropy plot graph -H, --high=<float> Set the rising edge entropy trigger threshold (default: 0.95) -L, --low=<float> Set the falling edge entropy trigger threshold (default: 0.85) Binary Diffing Options: … (30 more lines — see the tool's home page) -
binwalk3web
Newer binwalk line for carving firmware and binary blobs into filesystems and compressed sections.
ayuda
Analyzes data for embedded file types Usage: binwalk3 [OPTIONS] [FILE_NAME] Arguments: [FILE_NAME] Path to the file to analyze Options: -L, --list List supported signatures and extractors -q, --quiet Supress output to stdout -v, --verbose During recursive extraction display *all* results -e, --extract Automatically extract known file types -M, --matryoshka Recursively scan extracted files -a, --search-all Search for all signatures at all offsets -E, --entropy Plot the entropy of the specified file -l, --log <LOG> Log JSON results to a file -t, --threads <THREADS> Manually specify the number of threads to use -x, --exclude <EXCLUDE>... Do no scan for these signatures -y, --include <INCLUDE>... Only scan for these signatures -C, --directory <DIRECTORY> Extract files/folders to a custom directory [default: extractions] -h, --help Print help -V, --version Print version -
cutecomweb
Graphical serial terminal for talking to hardware consoles and embedded boards on your bench.
-
flashromweb
Reads and writes chip firmware via programmers on hardware you own.
ayuda
flashrom v1.6.0 on Linux 7.1.5+kali-amd64 (x86_64) flashrom is free software, get the source code at https://flashrom.org Usage: flashrom [-h|-R|-L| -p <programmername>[:<parameters>] [-c <chipname>] (--flash-name|--flash-size| [-E|-x|(-r|-w|-v) [<file>]] [(-l <layoutfile>|--ifd| --fmap|--fmap-file <file>) [-i <region>[:<file>]]...] [-n] [-N] [-f])] [-V[V[V]]] [-o <logfile>] -h | --help print this help text -R | --version print version (release) -r | --read [<file>] read flash and save to <file> -w | --write [<file>|-] write <file> or the content provided on the standard input to flash -v | --verify [<file>|-] verify flash against <file> or the content provided on the standard input -E | --erase erase flash memory -V | --verbose more verbose output -c | --chip <chipname> probe only for specified flash chip -f | --force force specific operations (see man page) -n | --noverify don't auto-verify -N | --noverify-all verify included regions only (cf. -i) -x | --extract extract regions to files -l | --layout <layoutfile> read ROM layout from <layoutfile> --wp-disable disable write protection --wp-enable enable write protection --wp-list list supported write protection ranges --wp-status show write protection status --wp-range=<start>,<len> set write protection range (use --wp-range=0,0 to unprotect the entire flash) --wp-region <region> set write protection region --flash-name read out the detected flash name --flash-size read out the detected flash size --fmap read ROM layout from fmap embedded in ROM --fmap-file <fmapfile> read ROM layout from fmap in <fmapfile> --ifd read layout from an Intel Firmware Descriptor -i | --include <region>[:<file>] only read/write image <region> from layout (optionally with data from <file>) --image <region>[:<file>] deprecated, please use --include -o | --output <logfile> log output to <logfile> --flash-contents <ref-file> assume flash contents to be <ref-file> -L | --list-supported print supported devices --progress show progress percentage on the standard output … (19 more lines — see the tool's home page) -
Serial console client for talking to routers, BMCs, and embedded boards over a USB-UART cable.
ayuda
ascii-xfr: invalid option -- 'h' Usage: ascii-xfr -s|-r [-dvn] [-l linedelay] [-c character delay] filename -s: send -r: receive -e: send the End Of File character (default is not to) -d: set End Of File character to Control-D (instead of Control-Z) -v: verbose (statistics on stderr output) -n: do not translate CRLF <--> LF Delays are in milliseconds. -
openocdweb
On-chip debugging via JTAG/SWD for firmware you are allowed to attach a probe to.
-
Full-system x86 emulator for running guest OSes and firmware images in isolation.
ayuda
QEMU emulator version 11.0.3 (Debian 1:11.0.3+ds-2) Copyright (c) 2003-2026 Fabrice Bellard and the QEMU Project developers usage: kvm [options] [disk_image] 'disk_image' is a raw hard disk image for IDE hard disk 0 Standard options: -h or -help display this help and exit -version display version information and exit -machine [type=]name[,prop=value[,...]] selects emulated machine ('-machine help' for list) property accel=accel1[:accel2[:...]] selects accelerator supported accelerators are kvm, xen, hvf, nitro, nvmm, whpx, mshv or tcg (default: tcg) vmport=on|off|auto controls emulation of vmport (default: auto) dump-guest-core=on|off include guest memory in a core dump (default=on) mem-merge=on|off controls memory merge support (default: on) aes-key-wrap=on|off controls support for AES key wrapping (default=on) dea-key-wrap=on|off controls support for DEA key wrapping (default=on) suppress-vmdesc=on|off disables self-describing migration (default=off) nvdimm=on|off controls NVDIMM support (default=off) memory-encryption=<id> memory encryption object to use (default=none) hmat=on|off controls ACPI HMAT support (default=off) spcr=on|off controls ACPI SPCR support (default=on) aux-ram-share=on|off allocate auxiliary guest RAM as shared (default: off) memory-backend='backend-id' specifies explicitly provided backend for main RAM (default=none) cxl-fmw.0.targets.0=firsttarget,cxl-fmw.0.targets.1=secondtarget,cxl-fmw.0.size=size[,cxl-fmw.0.interleave-granularity=granularity] sgx-epc.0.memdev=memid,sgx-epc.0.node=numaid smp-cache.0.cache=cachename,smp-cache.0.topology=topologylevel -M as -machine -cpu cpu select CPU ('-cpu help' for list) -accel [accel=]accelerator[,prop=value[,...]] select accelerator (kvm, xen, hvf, nitro, nvmm, whpx, mshv or tcg; use 'help' for a list) igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off) kernel-irqchip=on|off|split controls accelerated irqchip support (default=on) kvm-shadow-mem=size of KVM shadow MMU in bytes one-insn-per-tb=on|off (one guest instruction per TCG translation block) split-wx=on|off (enable TCG split w^x mapping) tb-size=n (TCG translation block cache size) dirty-ring-size=n (KVM dirty ring GFN count, default 0) eager-split-size=n (KVM Eager Page Split chunk size, default 0, disabled. ARM only) notify-vmexit=run|internal-error|disable,notify-window=n (enable notify VM exit and set notify window, x86 only) thread=single|multi (enable multi-threaded TCG) device=path (KVM device path, default /dev/kvm) -smp [[cpus=]n][,maxcpus=maxcpus][,drawers=drawers][,books=books][,sockets=sockets] [,dies=dies][,clusters=clusters][,modules=modules][,cores=cores] … (115 more lines — see the tool's home page) -
User-mode QEMU for running foreign binaries without booting a whole guest machine.
ayuda
usage: qemu-aarch64 [options] program [arguments...] Linux CPU emulator (compiled for aarch64 emulation) Options and associated environment variables: Argument Env-variable Description -h print this help -help -g port QEMU_GDB wait gdb connection to 'port' -L path QEMU_LD_PREFIX set the elf interpreter prefix to 'path' -s size QEMU_STACK_SIZE set the stack size to 'size' bytes -cpu model QEMU_CPU select CPU (-cpu help for list) -E var=value QEMU_SET_ENV sets targets environment variable (see below) -U var QEMU_UNSET_ENV unsets targets environment variable (see below) -0 argv0 QEMU_ARGV0 forces target process argv[0] to be 'argv0' -r uname QEMU_UNAME set qemu uname release string to 'uname' -B address QEMU_GUEST_BASE set guest_base address to 'address' -R size QEMU_RESERVED_VA reserve 'size' bytes for guest virtual address space -t tsig hsig n[,...] QEMU_RTSIG_MAP map target rt signals [tsig,tsig+n) to [hsig,hsig+n] -d item[,...] QEMU_LOG enable logging of specified items (use '-d help' for a list of items) -dfilter range[,...] QEMU_DFILTER filter logging based on address range -D logfile QEMU_LOG_FILENAME write logs to 'logfile' (default stderr) -one-insn-per-tb QEMU_ONE_INSN_PER_TB run with one guest instruction per emulated TB -tb-size size QEMU_TB_SIZE TCG translation block cache size -strace QEMU_STRACE log system calls -seed QEMU_RAND_SEED Seed for pseudo-random number generator -trace QEMU_TRACE [[enable=]<pattern>][,events=<file>][,file=<file>] -version QEMU_VERSION display version information and exit -perfmap QEMU_PERFMAP Generate a /tmp/perf-${pid}.map file for perf -jitdump QEMU_JITDUMP Generate a jit-${pid}.dump file for perf Defaults: QEMU_LD_PREFIX = /usr/gnemul/qemu-aarch64 QEMU_STACK_SIZE = 8388608 byte You can use -E and -U options or the QEMU_SET_ENV and QEMU_UNSET_ENV environment variables to set and unset environment variables for the target process. It is possible to provide several variables by separating them by commas in getsubopt(3) style. Additionally it is possible to provide the -E and -U options multiple times. The following lines are equivalent: -E var1=val2 -E var2=val2 -U LD_PRELOAD -U LD_DEBUG -E var1=val2,var2=val2 -U LD_PRELOAD,LD_DEBUG QEMU_SET_ENV=var1=val2,var2=val2 QEMU_UNSET_ENV=LD_PRELOAD,LD_DEBUG … (5 more lines — see the tool's home page)
Cuando hay un propósito escrito para esta ruta, se muestra primero. Si no, ves el resumen del paquete. La ayuda se captura en vivo desde un Kali cuando está disponible.