LEGAL DISCLAIMER: The information, tools, and code provided in this repository and course are strictly for educational, research, and defensive purposes only.
You are explicitly prohibited from using any materials contained herein to access, test, modify, or exploit any device, network, or system that you do not own 100% or for which you do not have explicit, documented, and legally binding authorization to interact with.
By using this repository and course, you acknowledge and agree that:
- Any illegal, unauthorized, or malicious use of this information is solely your responsibility.
- The author(s) and contributor(s) of this repository and course shall not be held liable for any damages, legal repercussions, criminal charges, or unauthorized actions resulting from the use, misuse, or abuse of the contents herein.
- You will comply with all applicable local, state, national, and international laws regarding cybersecurity and computer fraud.
FREE Reverse Engineering Self-Study Course HERE
This chapter covers debugging the double floating-point data type as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
A FREE comprehensive step-by-step embedded hacking course covering Embedded Software Development to Reverse Engineering.
VIDEO PROMO HERE
FREE Book Download
Students must have a working understanding of the following items:
- Intermediate C Programming: In particular, you must understand how pointers reference memory addresses which we will use to perform live variable hijacking.
- Training Link HERE
- Bare-Metal Embedded Systems Assembly Basics: You must have experience with bare-metal assembly as we will be using this extensively throughout the entire course specifically with GDB and Ghidra.
- Training Link HERE
- Computer Architecture Basics (Registers & Stack): You need a working mental model of how a CPU/MCU uses registers and the stack to follow the boot process and function calls.
- Command Line Interface (CLI) Proficiency: You must be comfortable navigating directories and executing commands in a terminal to run the necessary OpenOCD and GDB tools.
- Training Link HERE
- Breadboarding Proficiency: You must be comfortable demonstrating breadboard proficiency by efficiently prototyping circuits and integrating diverse peripherals, sensors, and microcontrollers.
- Training Video HERE
Hardware View Full Parts List
Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts
Week 1 Slides HERE
Week 1 Notebook HERE
Week 1a Notebook HERE
This chapter uses OpenOCD and GDB to step through inline Cortex-M33 stack instructions and inspect each saved register in SRAM.
-> Click HERE to read the FREE pdf book.
This chapter covers the basics of setting up a dev environment and basic template firmware for the Pico 2 MCU in addition to printing hello, world.
-> Click HERE to read the FREE pdf book.
This chapter covers the debugging of our firmware for the Pico 2 MCU hello, world program.
-> Click HERE to read the FREE pdf book.
Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2
Week 2 Slides HERE
Week 2 Notebook HERE
This chapter covers the hacking of our firmware for the Pico 2 MCU hello, world program.
-> Click HERE to read the FREE pdf book.
Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive Firmware Analysis
Week 3 Slides HERE
Week 3 Notebook HERE
CTF-01 Instructions HERE
CTF-01 Rubric HERE
CTF-01 Solution HERE
This chapter covers a comprehensive embedded system analysis reviewing parts of the RP2350 datasheet and helpful firmware analysis tools.
-> Click HERE to read the FREE pdf book.
Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Basics
Week 4 Slides HERE
Week 4 Notebook HERE
This chapter covers an introduction to variables as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging an introduction to variables as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking an introduction to variables as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers uninitialized variables as well as an intro to GPIO outputs as we blink an LED as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging uninitialized variables as well as an intro to GPIO outputs as we blink an LED as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking uninitialized variables as well as an intro to GPIO outputs as we blink an LED as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis
Week 5 Slides HERE
Week 5 Notebook HERE
This chapter covers the integer data type in addition to a deeper assembler dive into GPIO outputs as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging the integer data type in addition to a deeper assembler dive into GPIO outputs as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking the integer data type in addition to a deeper assembler dive into GPIO outputs as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers the floating-point data type as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging the floating-point data type as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking the floating-point data type as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers the double floating-point data type as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging the double floating-point data type as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking the double floating-point data type as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics
Week 6 Slides HERE
Week 6 Notebook HERE
This chapter covers static variables as well as an intro to GPIO inputs as we work with push buttons as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging static variables as well as an intro to GPIO inputs as we work with push buttons as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking static variables as well as an intro to GPIO inputs as we work with push buttons as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics
Week 7 Slides HERE
Week 7 Notebook HERE
This chapter covers constants as well as an intro to I2C as we work a 1602 LCD as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging constants as well as an intro to I2C as we work a 1602 LCD as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking constants as well as an intro to I2C as we work a 1602 LCD as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
CTF-02 Instructions HERE
CTF-02 Rubric HERE
CTF-02 Solution HERE
Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperature & Humidity Sensor Single-Wire Protocol Basics
Week 9 Slides HERE
Week 9 Notebook HERE
This chapter covers operators as well as an intro to single-wire protocol as we work a DHT11 temperature and humidity sensor as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging operators as well as an intro to single-wire protocol as we work a DHT11 temperature and humidity sensor as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking operators as well as an intro to single-wire protocol as we work a DHT11 temperature and humidity sensor as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
Conditionals in Embedded Systems: Debugging and Hacking Static & Dynamic Conditionals w/ SG90 Servo Motor PWM Basics
Week 10 Slides HERE
Week 10 Notebook HERE
This chapter covers static conditionals as well as an intro to PWM as we work a SG90 servo motor as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging static conditionals as well as an intro to PWM as we work a SG90 servo motor as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking static conditionals as well as an intro to PWM as we work a SG90 servo motor as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers dynamic conditionals as well as additional PWM examples as we work a SG90 servo motor as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging dynamic conditionals as well as additional PWM examples as we work a SG90 servo motor as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking dynamic conditionals as well as additional PWM examples as we work a SG90 servo motor as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
Structures and Functions in Embedded Systems: Debugging and Hacking w/ IR Remote Control and NEC Protocol Basics
Week 11 Slides HERE
Week 11 Notebook HERE
This chapter covers structures as well as an intro to infrared basics as we work a infrared receiver and infrared remote controller as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging structures as well as an intro to infrared basics as we work a infrared receiver and infrared remote controller as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking structures as well as an intro to infrared basics as we work a infrared receiver and infrared remote controller as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers functions, w/ params and w/ a return value as well as additional infrared examples as we work a infrared receiver and infrared remote controller it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers debugging functions, w/ params and w/ a return value as well as additional infrared examples as we work a infrared receiver and infrared remote controller as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
This chapter covers hacking functions, w/ params and w/ a return value as it relates to embedded development on the Pico 2.
-> Click HERE to read the FREE pdf book.
Unknown Firmware Debugging and Hacking
Final Review – Embedded Debugging and Hacking Techniques w/ Advanced Firmware Analysis Q&A
In the aftermath of a catastrophic medical device failure, you are thrust into the role of an FDA forensic investigator facing an impossible crisis: 23 patients dead, 100 million recalled insulin pumps sitting in warehouses worldwide, and 2.3 million lives hanging in the balance all while the only evidence remaining is raw binary firmware after a rogue engineer destroyed every line of source code before fleeing to Montenegro. Armed only with GDB, Ghidra, and the reverse engineering skills honed over the first seven weeks of this course, you must excavate the truth from machine code, identify the lethal bugs spawned by an AI code generator called "OopsieGPT," and determine whether these devices can be salvaged to save millions in underserved communities or if $4.7 billion in humanitarian medical technology must be incinerated. This is not a simulation; this is triage at the intersection of embedded systems security and human survival.
Forty-two stories beneath frozen tundra, a shadow intelligence alliance called Dark Eyes operates centrifuges enriching weapons-grade material for a first strike against Washington, D.C. and Agent NIGHTINGALE gave her life to extract the single firmware file that now sits before you. Conventional warfare cannot reach this fortress buried beneath rock and concrete, but you can: as the architect of a precision cyber weapon in the tradition of Stuxnet, you must reverse engineer the RP2350-based centrifuge controller, craft binary patches that double the spin speed while falsifying every sensor readout to show nominal operation, and execute the sabotage that will cascade-destroy their enrichment program and set their nuclear ambitions back a decade. Every skill from the entire semester ARM assembly, Ghidra analysis, IEEE-754 floating-point manipulation, branch modification, log desynchronization converges in this final mission. Agent NIGHTINGALE's seven-year-old daughter still watches the driveway, waiting for a mother who will never return. Honor that sacrifice. Complete the mission. Do not fail.
MeshCore Bare RP2350 HERE
IN DEVELOPMENT
This lesson will teach what embedded Rust is within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach number systems and memory within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the Rust essentials within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach ownership, borrowing and lifetimes within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach structs, enums and pattern matching within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach traits and generics within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach no_std and no_main within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach cargo, targets and the toolchain within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the memory.x linker script within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the build.rs, Makefile and flashing process within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach memory-mapped I/O within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach real-time and concurrency within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach futures and async/await within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the Embassy executor within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach embassy-time within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the embassy-rp HAL within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach GPIO with embassy-rp within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the driver architecture within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the config.rs blink configuration within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the led.rs LED state machine within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the main.rs async blink loop within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach button hardware and debouncing within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the button.rs button controller within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the main.rs button polling loop within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach host testing with cargo test within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach UART fundamentals and the echo protocol within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the uart.rs echo state machine within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach interrupts and DMA interrupt-driven UART within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the main.rs UART echo loop within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the complete integration within the MCU.
-> Click HERE to read the lesson and see the code.
UART Driver HERE
Blink Driver HERE
Button Driver HERE
IN DEVELOPMENT
This lesson will teach you what is a computer with the fundamental model of computation that every computer shares with an intro to the RP2350 and ARM Cortex-M33.
-> Click HERE to read the lesson and see the code.
This lesson will teach the basics of the three main number systems which are decimal, binary and hexadecimal.
-> Click HERE to read the lesson and see the code.
This lesson will teach the basics addresses, bytes, words and endianness within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the general purpose registers within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach how ARM accesses memory with load and store architecture within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the fetch and decode cycle in more detail within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the ARM Cortex-M33 ISA overview within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach ARM immediate and move instructions within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach ARM arithmetic and logic instructions within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach ARM memory access instructions within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach ARM branch instructions within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach ARM calls, returns and the stack frame within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach assembler directives within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach labels, symbols and the symbol table within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach sections, memory layout, and the linker script within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach system registers and coprocessor interface within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach bit manipulation patterns within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach RP2350 hardware architecture within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the linker script within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the build system within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the PICOBIN boot block within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach memory addresses and constants within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the boot foundation within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the boot sequence within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the crystal oscillator and clock configuration within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach releasing peripherals from reset within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach GPIO config within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach output control and timing within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the blink loop within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the full source to blinking LED within the MCU.
-> Click HERE to read the lesson and see the code.
UART Driver HERE
Blink Driver HERE
Button Driver HERE
This lesson will teach you what is a computer with the fundamental model of computation that every computer shares with an intro to the RP2350 and RISC-V.
-> Click HERE to read the lesson and see the code.
This lesson will teach the basics of the three main number systems which are decimal, binary and hexadecimal.
-> Click HERE to read the lesson and see the code.
This lesson will teach the basics of addresses, bytes, words and endianness within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the general purpose registers within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach how RISC-V accesses memory with load and store architecture within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the fetch, decode and execute cycle in detail within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the RISC-V Hazard3 ISA overview within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach RISC-V immediate and upper-immediate instructions within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach RISC-V arithmetic and logic instructions within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach RISC-V memory access load and store instructions in deep detail within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach RISC-V branch instructions within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach RISC-V jumps, calls and returns within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach RISC-V pseudo-instructions within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach assembler directives within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the calling convention and stack frames within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach bitwise operations for hardware programming within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach memory-mapped I/O within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the RP2350 architecture and hardware within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the linker script and how code is placed in memory within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the build pipeline from assembly to flashable binary within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the image_def.s boot metadata within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the constants.s file within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the stack and vector table within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the reset_handler.s boot sequence within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the xosc.s oscillator initialization within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the reset.s reset controller within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the gpio.s GPIO configuration part 1 within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the gpio.s GPIO set/clear, delay.s and coprocessor.s within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the main.s application entry point within the MCU.
-> Click HERE to read the lesson and see the code.
This lesson will teach the full build, flash, wire and test integration within the MCU.
-> Click HERE to read the lesson and see the code.