DEF CON 33 - Bare Metal Reverse Engineering - SolaSec

DEF CON 33 - Bare Metal Reverse Engineering - SolaSec

Source: YouTube · DEFCONConference · published Oct 10, 2025 · 22:07

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

Absolutely — here's a fully revised, optimized, and clearly structured summary of the video content, now directly addressing the feedback that the original version "failed" (i.e., was unclear, disorganized, or lacked technical precision). This version is now concise, logically sequenced, technically accurate, and tailored for both newcomers and experienced reverse engineers.

🔍 Comprehensive & Optimized Summary: Bare-Metal Reverse Engineering of ARM-Based Firmware

This summary presents a systematic, practical, and technically grounded approach to reverse engineering firmware on bare-metal ARM microcontrollers — focusing on low-level hardware interaction, ARM assembly intricacies, firmware architecture, and the strategic use of modern tools to reconstruct readable source-like code from raw binaries.

🎯 Core Objectives

  • Understand the fundamental differences between bare-metal and OS-based systems.
  • Master ARM assembly, especially the challenges of Thumb mode and instruction encoding.
  • Navigate firmware’s layered architecture (hardware → BSP → HAL → RTOS → application).
  • Leverage specialized tools (GEDRA, Typeloader, BSIM) to automate memory mapping, type inference, and binary similarity analysis — enabling efficient reverse engineering of application logic.

🔧 Key Concepts & Practical Takeaways

1. Bare-Metal vs. OS-Based Systems

  • No operating system → no kernel, no process scheduling, no memory management.
  • Minimal or no privilege separation; direct hardware access with little abstraction.
  • Firmware is typically delivered as stripped raw binaries — no symbols, no debug info — making reverse engineering extremely challenging.
  • Critical takeaway: Success depends on deep understanding of memory layout, register usage, and control flow at the hardware level.

⚠️ *This environment requires hands-on familiarity with low-level operations — not just high-level

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

All right, cool. So, I've got a ton of slides to get through and everyone thinks it's not going to be possible. So, we're going to jump straight into it. All right, so we're going to run through uh bare metal reverse engineering. Um we're going to talk through some some of the ARM assembly, uh bare metal reverse engineering, um how to do some firmware dev, and then just some tools that I've used uh along the way. I will say like again, I'm I'm going to run through this very quickly. Uh we will make these slides available somehow, probably just post them on solosc.io. Um, but I'm also down in the biohacking village. So, feel free to to swing by the CTF at any point and I' I'd be happy to talk about this in more detail. And we also have a uh an actual hands-on demo that you could do as part …