/FIRMWARE · 2026-08-10

BusyBox is not the product

Every gateway rootfs is full of applets. The product is the vendor daemon that speaks the proprietary protocol. Find that binary before you decompile wget.

Unpacked firmware looks busy: busybox, dropbear, dnsmasq, a kernel, a web UI of CGI scripts. Those are the platform. The SKU is whatever listens on the odd port or parses the vendor JSON.

How we pick the binary

Init scripts: what is exec’d and not a busybox applet.
Listen list from the init story, not from a running production box.
Unique strings: model name, cloud host, “mgmt”.
Size and strip: a 1.2 MB stripped MIPS ELF named vhttpd is a candidate; busybox is not.

Web UI vs daemon

The HTML is often a skin. The CGI calls a Unix socket or a custom binary. Reverse the binary. Screenshotting login.html is not reverse engineering.

Multiple daemons

Updater, cloud agent, local httpd, a meshd. Scope names one. We may inventory the others in a table (“present, not reversed”). If the customer wants all four, that is four SOW lines, not one heroic Ghidra session.

If the interesting protocol is in a kernel module, say so and load the .ko. Do not spend a week in userspace because it is more comfortable.

Combination with the rest of the desk

unpack  →  /etc inventory  →  init map
                │
                ├─ dropbear default key     (config finding)
                ├─ unsigned update          (update finding)
                └─ vendor-httpd             (the reverse job)
                         │
                         Ghidra → Unicorn confirm  (offset oracle)

That last hop is the same native desk as everything else. Firmware gets a special unpack. See the desk and the unpack.