U-Boot Bootloader Firmware Extraction Tools

U-Boot is a common bootloader found in embedded Linux systems that if left unlocked can be used to extract firmware from the device. In this video I demo some new python tools to automate file extraction from ext4 mmc file systems using uboot's ext4ls and ext4load commands.

firmwaretools Github Repo:

IoT Hackers Hangout Community Discord Invite:

🛠️ Stuff I Use 🛠️

🪛 Tools:

🫠 Soldering & Hot Air Rework Tools:

🔬 Microscope Setup:

About Me:
My name is Matt Brown and I'm an Hardware Security Researcher and Bug Bounty Hunter. This channel is a place where I share my knowledge and experience finding vulnerabilities in IoT systems.

- Soli Deo Gloria

💻 Social:

#hacking #iot #cybersecurity

[xbitbybit]

Keen to see you tackle a more realistic device, say without the full uboot version, a login prompt for UART, encrypted firmware etc. that's what I keep getting lately, or not being able to find a file system at all after desoldering and reading the memory chip 😢

[muhh]

Thanks for making these videos! I watch them purely for education and entertainment, even though i have no professional relationship with any of this. I really find your videos very interesting to watch and easy to grasp, so please keep them going!!!

[mytechnotalent]

Nice job as always Matt. Really like the firmware tools, awesome automation for this extraction analysis.

[Spozinbro]

Love your stuff! This is super useful for what I'm trying to do right now with my router, keep up the awesome work!

[XYZ]

Thank you for the content, great insights, as always!

[feff]

Lots of really good info here, thanks!

[bartzilla]

If you run 'bdinfo' that will give you the memory organization of U-Boot. Failures on md/mw on address could be; 1. Memory is mapped to CPU registers, 2 the address does not exist, or 3 U-boot could be running out of that memory rang. There could be a lot of things to cause failure.

[alecseiify]

Thank you, the content is awesome, good information!!

[TheRealWulfderay]

Thanks, Matt. Uboot has always seemed a bit mystical to me. Very practical example.

[charlesdorval]

Wow! That was interesting! Thanks!
I wish I had some device to mess around with now lol

[zachkost-smith]

Surprised to see that your parse uboot dump wasn't just wrapping a call to 'xxd -r'

[kaderdz]

am i only person get entertained by watching your content 🤠 ❤
GOOD 👍 JOB 👌 BRO

[kixxthemanz]

Matt make a video on extracting the files on locked down phones like Samsung, extracting the files that tell the device can use ADB or that tell the device if the OEM is on or not so we can extract them and change the values then push them back to the device to gain root access

[tritnaha]

You should give any Avaya J-series phone a try, they offer a pretty fun challenge

[saad]

awesome tool. i will be putting it to work and def makes life a whole lot easier to just be able to fetch the actual files rather than MD. Can you elaborate on any write methods which can help write files or strings back to a location on an ext4fs via uboot.

[tomwimmenhove]

Don't you think the reset is simply caused by you overwriting code in memory that is currently being executed? Maybe the bootloader code itself, or interrupt vectors?

[timmturner]

What's the sensitive nature of the device? I don't understand why you would not want the viewers to know what it is?

[robertsimon]

I have a Device, that boots it's normal OS after 30-60 seconds in u-boot command-prompt. Any chance to interrupt this autoboot?

[xenoxaos]

10:35 probably memory mapped io or memory that's being used by the bootloader.

[Hobypyrocom]

if i have a firmware extracted from a device (example wifi camera), is there any way to modify the firmware? can you make such video?