Firmware extraction: UART, JTAG and the flash

IoT security analysis starts with the firmware. Extracting it gives access to code, hardcoded credentials, keys and authentication logic.

The routes

UART: a serial header on the board that often gives a boot (U-Boot) or passwordless root shell. JTAG/SWD: a debug interface to read memory and halt the CPU. Direct flash dump: attach a programmer (CH341/SOIC8 clip) to the SPI chip and read everything, bypassing all software protection.

flashrom -p ch341a_spi -r dump.bin   # dump the flash chip
binwalk -e dump.bin                  # extract filesystem and components

binwalk locates and unpacks the filesystem; from there you look for /etc/shadow, keys, binaries.

Defence

Disable/remove debug interfaces in production (fuse JTAG, UART without a shell). Secure boot with signed firmware, encrypted flash, no hardcoded credentials. Read-out protection on the microcontroller. Assume an attacker with physical access will read it anyway: security must not depend on firmware secrecy.