AI Assisted Vulnerability Research on Embedded Targets | QTNKSR<br>Photo by Vinoth Ragunathan on unsplash<br>Recently, bl4sty created vibe coded sl0p.foo, a streaming platform where you can live stream your agents working in tmux sessions for fun. I liked the idea, and it finally got me to experiment with AI-assisted vulnerability research and exploit development.<br>Most of the publications I’ve seen so far have focused on browsers and operating systems. These are clearly hard targets, but the agent has access to source code and plenty of stable tools like language servers to navigate the code, ASAN/UBSAN to confirm crashes, and time-travel debugging to help write exploits.<br>I wanted to explore another kind of hard target: real-time operating systems. They’re not that hard to exploit, they usually lack modern exploit mitigation techniques. What makes them difficult is the limited tooling an AI agent can call to navigate firmware or debug a running device.<br>Models and Harnesses<br>For this session, I used Codex, OpenAI’s coding harness, configured to use gpt-5.6-sol in xhigh thinking mode. At some point I had to downgrade to gpt-5.5 because gpt-5.6-sol had become a victim of its own success.<br>Codex is launched with --dangerously-bypass-approvals-and-sandbox so it can work independently. More information about how I’m mitigating the risks is available in the Tooling section.<br>Important note: I’m vetted for “Trusted Access for Cyber”.<br>Skills<br>The agent has access to the following skills:<br>Trail of Bits Skills Marketplace<br>ghidra-rpc SKILL.md<br>ecos-offensive-research<br>The Trail of Bits skills are clearly one the best thing that happened to agentic security research since its inception. I’m not calling them explicitly, but these are the ones that I see the agent benefiting from the most:<br>audit-context-building - Build deep architectural context through ultra-granular code analysis before vulnerability hunting. Extremely useful<br>c-review - C/C++ security code review plugin. Based on Trail of Bits Testing Handbook.<br>fp-check - A plugin that enforces systematic false positive verification when verifying suspected security bugs.<br>modern-python - Modern Python tooling and best practices. Your agent will write modern exploit scripts with Python 3.11+ and not OSCP-era Python 2.7 garbage.<br>The ghidra-rpc SKILL simply tells the agent how to call ghidra-rpc from the command line. It makes things faster.<br>Finally, ecos-offensive-research is a skill set split into seven parts. I asked an LLM to generate it based on all the research I’ve published on the subject: ecos.wtf, Git repositories, and two blog posts published here. The main SKILL.md looks like this:<br>--- name: ecos-offensive-research description: Reproduce and extend<br>the 2021 eCos offensive security research on Broadcom cable modems, including<br>firmware dumping, ProgramStore extraction, eCos/BFC architecture,<br>Ghidra/radare2 reversing, bcm2-utils profiles, exploit staging, shellcode, and<br>firmware implants. Use when working on eCos, Broadcom BFC, BCM33xx cable<br>modems, ProgramStore, GatewaySettings/NVRAM, bcm2-utils, recos, ecoshell,<br>ecosploits. ---
# eCos Offensive Research
## Quick Start
1. Identify the target SoC, bootloader, firmware signature, console access, and<br>storage layout.<br>2. Dump bootloader, NVRAM, and firmware with `bcm2dump`; add or refine a<br>profile when auto-detection fails.<br>3. Extract ProgramStore images with Broadcom Aeolus `ProgramStore` or the local<br>Ghidra loader.<br>4. Load raw firmware as MIPS32 big-endian at the ProgramStore load address,<br>usually `0x80004000`.<br>5. Map `.text`, `.data`, `.bss`, stack, heap, VSR, and VVT before deep<br>reversing.<br>6. Apply eCos/BFC FunctionID, debug-log renaming, and vtable relabeling before<br>bug hunting.<br>7. For exploitation, prefer a minimal ROP stage that loads a compiled<br>`ecoshell` second stage.
## Core Workflows
- Firmware acquisition: see<br>[acquisition-and-tooling.md](acquisition-and-tooling.md).<br>- File formats and config: see [formats-and-config.md](formats-and-config.md).<br>- Architecture and runtime internals: see [architecture.md](architecture.md).<br>- Static analysis and bug hunting: see<br>[static-analysis.md](static-analysis.md).<br>- Exploitation and implants: see<br>[exploitation-and-implants.md](exploitation-and-implants.md).<br>- Target case studies: see [case-studies.md](case-studies.md).<br>- Source corpus: see [sources.md](sources.md).
## Operating Rules
- Prefer exact local scripts and profiles over reimplementing from memory.<br>- Treat `bcm2-utils/profiledef.c` and `ecoshell/*/payload.ld` as<br>target-specific truth.<br>- Confirm load address, endianness, and calling convention before trusting<br>xrefs or gadgets.<br>- Always account for MIPS branch delay slots and cache coherency when moving<br>from ROP to shellcode.<br>- When console I/O is shared, threaded shells can steal the active console; use<br>threads mainly for background tasks or implants.<br>- For live devices, preserve NVRAM copies and checksums; old-style dynamic<br>settings may contain multiple active or...