Langue: English
Firmware of proprietary systems lies on the border of hardware and software. This talk follows up on last year's presentation "Breaking both wires: Reverse engineering builiding access control system for MITM attacks and spoofing", shifting focus from the physical and protocol layer to its embedded firmware, and exploring how behavior, timing, and security logic are implemented, and how they can be systematically uncovered. The talk is structured as a guided progression designed for audiences starting from zero, gradually building the skills and intuition needed to move from an opaque firmware image to a meaningful system-level understanding through iterative analysis, experimentation, and correction of early mistakes.
Rather than treating firmware as a simple user-land binary to be dumped and disassembled by a professional, this talk approaches it as an evolving target that changes as our understanding of its workings evolves. I walk through a step-by-step reverse engineering process: from initial firmware extraction and architecture identification, to dynamic analysis, instrumentation, and behavioral reconstruction of key subsystems such as call handling, and access control decision paths.
A central theme is the comparison between traditional "manual labor" reverse engineering (careful disassembly, tracing, and hypothesis testing) and what the new kids do: agentic workflows that automate hypothesis generation, function clustering, and behavioral exploration. I examine where automation accelerates discovery, where it fails on timing-sensitive or hardware-in-the-loop quirks, and where human intuition still dominates.
As with the previous work, the narrative follows real investigative friction: wrong assumptions about firmware structure, misleading function boundaries, timing artifacts that only appear under load, and the unexpected coupling between firmware state machines and physical-layer constraints.
The result is not just a teardown of proprietary firmware, but a practical exploration of how reverse engineering itself is changing.
Kirils Solovjovs is Latvia's leading white-hat hacker and privacy activist. He began programming at age 7, and by grade 9 was already writing machine code directly in a hex editor during lunch breaks. His hobby is asking "what are you gonna do with that piece of information about me?" everywhere every time.
Renowned for uncovering and responsibly disclosing critical vulnerabilities in national and international systems, today Kirils serves as lead researcher at Possible Security.