Introduction to IoT Firmware Reverse Engineering

Free Diversity PreCon workshop on September 23rd. Learn how to analyze closed-source firmware on a common IoT platform.

This hands-on workshop shows what is really happening inside an IoT device. You will learn how to inspect compiled firmware and uncover useful information with Ghidra. On a Raspberry Pi Pico 2 W, you will flash and debug firmware. You will also manipulate program execution to reveal hidden functionality. After the workshop, you will be able to apply static and dynamic firmware analysis to your own targets. The workshop is aimed at beginners, no previous embedded or hardware experience is required.

Trainer

Jiska is a wireless and mobile security researcher who leads a research group at the Hasso Plattner Institute. She reverse engineers wireless firmware and proprietary protocols. Moreover, she investigates iOS internals and analyzes the security of widely used IoT devices.

Venue

This workshop will take place September 23, 2026 on-site at German OWASP Day 2026 in Karlsruhe.

Booking

As a Diversity Precon workshop, dedicated to diverse attendees, this 1-day reverse engineering workshop is free for all attendees! For further details, check the website - registration will be available soon.

Topic Overview

• Introduction to embedded firmware and the Raspberry Pi Pico 2 W platform.
• Static analysis of Pico firmware using tools such as Ghidra and IDA.
• Flashing custom firmware onto a Raspberry Pi Pico 2 W.
• Debugging firmware using a second Pico for dynamic analysis.
• Manipulating control flow during debugging to trigger hidden functionality.

Training Prerequisites

• Basic programming knowledge, ideally C/C++, but other languages will work as a base as well.
• Basic familiarity with command line tools.
• No prior embedded or hardware experience required.

What to Bring

• Laptop (Windows/Linux/macOS) with at least 8GB of RAM that can run Visual Studio Code with the Raspberry Pi Pico extension.
• Internet connection and permissions to install additional software.
• We will provide you with a Pico 2 W throughout the training, so no other hardware to bring from your side :)

Who should attend?

This training is aimed at anyone interested in firmware and IoT security, including up and coming pen testers, security or vulnerability researchers, or IoT device developers.