Engineering NotesAugust 28, 2026

A reproducible firmware research workflow

How I structure firmware extraction and reverse-engineering notes so every conclusion can be traced back to an artifact.
Keep the untouched image, record a cryptographic hash, and do analysis on copies. A later patch or extraction should always be traceable to the original bytes. Offsets, strings, signatures, regions, and checksums are observations. The role of an unknown structure is an interpretation until there is stronger evidence. Writing them separately prevents a plausible guess from becoming an undocumented assumption.

Research path

  1. Acquire image
  2. Hash + preserve
  3. Extract structures
  4. Analyze
  5. Validate on hardware
Low-level firmware work has a different failure model from normal application code. Before changing a device, document the known-good image, recovery path, programmer or interface requirements, and the exact write/verify sequence. Screenshots are useful, but machine-readable logs, hashes, scripts, and small parsers are better long-term evidence because they can be rerun when the firmware changes.