Network-appliance firmware — security research

This project is a reverse-engineering workbench for the firmware that runs enterprise network-edge appliances — the boxes that sit at the boundary of corporate networks and whose weaknesses become the industry’s most consequential security stories. That firmware is proprietary, packed into custom container formats, and stripped of the symbols that make analysis tractable. The goal here was strictly defensive: characterize weaknesses and their fixes, score their severity honestly, and prepare them for responsible disclosure — never to build attack tooling.

The effort retargeted a mature game-binary decompilation toolchain at a completely new domain, coordinating a fleet of automated analysis agents on top of Ghidra. It indexed roughly 1,300 firmware images (about 237 GB) across around 26 vendors, cross-referenced by public release date so findings could be reasoned about as “already patched” versus “still present.” A declarative control layer managed many concurrent Ghidra workspaces, which mattered because individual targets were tens of megabytes of stripped position-independent code that took roughly 20 minutes each just to auto-analyze.

The hardest problem was verification. Game decompilation can check its work against original source; firmware has no such oracle, so a plausible-looking flaw can easily be a mirage introduced by the decompiler itself. The answer was a from-scratch harness built on one creed: trust the bytes, not the decompiler’s labels. One tool cross-checks the decompiled C against a disassembly of the actual instruction bytes, catching calls and arguments the higher-level rendering silently drops. Another proves or disproves behavior empirically by running functions under CPU emulation against generated inputs. This is what let scary-looking findings be disproven rather than merely argued about.

That discipline was the real outcome. A small number of findings reached disclosure-ready state with verified reachability and honestly-capped impact — while several initially promising leads were deliberately walked back to “unreachable” or “not a finding” once the harness held them to the bytes. Catching your own over-claims was treated as a win. The work also contributed an upstream concurrency fix to the open-source Ghidra tooling it relied on. It is paused, with disclosure hand-off and further targets left as open threads.