const {P,H2,H3,Callout,Code,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/FIRMWARE" date="2026-08-10" title="BusyBox is not the product" lede="Every gateway rootfs is full of applets. The product is the vendor daemon that speaks the proprietary protocol. Find that binary before you decompile wget."/>
<P>Unpacked firmware looks busy: <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>busybox</span>, <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>dropbear</span>, <span style={{fontFamily:'var(--font-mono)',fontSize:13}}>dnsmasq</span>, a kernel, a web UI of CGI scripts. Those are the platform. The SKU is whatever listens on the odd port or parses the vendor JSON.</P>
<H2>How we pick the binary</H2>
<Ul items={[
'Init scripts: what is exec’d and not a busybox applet.',
'Listen list from the init story, not from a running production box.',
'Unique strings: model name, cloud host, “mgmt”.',
'Size and strip: a 1.2 MB stripped MIPS ELF named vhttpd is a candidate; busybox is not.'
]}/>
<H3>Web UI vs daemon</H3>
<P>The HTML is often a skin. The CGI calls a Unix socket or a custom binary. Reverse the binary. Screenshotting login.html is not reverse engineering.</P>
<H3>Multiple daemons</H3>
<P>Updater, cloud agent, local httpd, a meshd. Scope names one. We may inventory the others in a table (“present, not reversed”). If the customer wants all four, that is four SOW lines, not one heroic Ghidra session.</P>
<Callout>If the interesting protocol is in a kernel module, say so and load the .ko. Do not spend a week in userspace because it is more comfortable.</Callout>
<H2>Combination with the rest of the desk</H2>
<Code lang="desk.txt">{`unpack  →  /etc inventory  →  init map
                │
                ├─ dropbear default key     (config finding)
                ├─ unsigned update          (update finding)
                └─ vendor-httpd             (the reverse job)
                         │
                         Ghidra → Unicorn confirm  (offset oracle)`}</Code>
<P>That last hop is the same native desk as everything else. Firmware does not get a special decompiler. It gets a special unpack. See <a href="post-re-stack.html">the desk</a> and <a href="post-firmware.html">the unpack</a>.</P>
<Related items={[
['post-fw-boot.html','The boot chain is the map'],
['post-fw-config.html','The finding is often in /etc'],
['post-re-stack.html','The reverse-engineering desk']
]}/>
</>;
}
window.Article=Article;
mountPost();