Loading...
Automated Firmware Extraction and Vulnerability Analysis in Embedded IoT Devices: A Replicable Cybersecurity Infrastructure Framework
O'Mahony, Lucas Oyinloye, Toyosi Hossain, Jakir Speakman, Lee
O'Mahony, Lucas
Oyinloye, Toyosi
Hossain, Jakir
Speakman, Lee
Citations
Altmetric:
Advisors
Editors
Other Contributors
Affiliation
EPub Date
Publication Date
2026-02-18
Submitted Date
Collections
Files
Loading...
Conference paper - AAM
Adobe PDF, 756.68 KB
Other Titles
Abstract
Embedded IoT devices continue to exhibit firmware-level weaknesses caused by unsafe memory operations, legacy libraries and inconsistent validation. These issues are difficult to study due to proprietary firmware, diverse hardware interfaces and the lack of reproducible extraction workflows. This work presents a lightweight, repeatable framework for firmware acquisition and analysis using low-cost hardware and open-source tools. The framework integrates UART, SPI and chip-off extraction with an automated pipeline using magnify.py for ELF triage and flawedfunctions.db, a database of 224 unsafe C functions. Experiments on four devices show that chip-off extraction provides complete and reliable firmware acquisition, while UART and SPI offer partial access depending on hardware design. Automated scanning revealed recurring high-severity memorysafety issues, with Ghidra confirming insecure calls such as strcpy and sprintf. These early results demonstrate the feasibility of accessible, reproducible firmware extraction and static analysis. Future work focuses on scripted Ghidra analysis, broader device testing and enhanced risk scoring.
Citation
O'Mahony, L., Oyinloye, T., Hossain, J., & Speakman, L. (2025, December). Automated Firmware Extraction and Vulnerability Analysis in Embedded IoT Devices: A Replicable Cybersecurity Infrastructure Framework. In 2025 Cyber Research Conference-Ireland (Cyber-RCI) (pp. 1-4). IEEE.
Publisher
IEEE
Journal
Research Unit
PubMed ID
PubMed Central ID
Type
Conference Contribution
Language
Description
© 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.