Agent Plugins Marketplace
← All plugins

firmware-reverse-engineering

v0.2.0

Firmware extraction, static analysis, Ghidra reverse engineering, emulation, and security reporting skills.

CodexClaude Code5 Skills

By Hussein MuhaisenLicense: Apache-2.0215 GitHub starsUpdated last month

Directory evidence

Runtimes
Codex and Claude Code
Parsed components
5 skill or MCP entries
Source updated
Sep 7, 2026
Manifest status
Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install firmware-reverse-engineering for Codex and Claude Code

Installs for the current user
codex plugin marketplace add OrbitCurve/firmware-reverse-engineering
codex plugin marketplace upgrade firmware-reverse-engineering
codex plugin add firmware-reverse-engineering@firmware-reverse-engineering

Paste and run these commands in a terminal with Codex. They add and refresh the firmware-reverse-engineering catalog, then install this plugin.

Compatibility: the page URL and API slug “firmware-reverse-engineering” remain stable.

  • Codex: firmware-reverse-engineering@agent-plugin-marketplace → firmware-reverse-engineering@firmware-reverse-engineering

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually
git clone https://github.com/OrbitCurve/firmware-reverse-engineering

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is plugins/firmware-reverse-engineering/.

Plugin files

plugins/firmware-reverse-engineering/
├── .codex-plugin/plugin.json
├── .claude-plugin/plugin.json
├── skills/firmware-emulation/SKILL.md
├── skills/firmware-extraction/SKILL.md
├── skills/firmware-security-reports/SKILL.md
├── skills/firmware-static-analysis/SKILL.md
└── skills/ghidra-re/SKILL.md

Included Skills5

firmware-emulationskills/firmware-emulation/SKILL.md

Comprehensive firmware dynamic analysis and emulation using QEMU (user-mode and system-mode), GDB debugging, network traffic analysis, and automated tools (Firmadyne/FirmAE). Use when the agent needs to run extracted firmware for dynamic analysis. Covers: (1) Deciding between automated vs manual emulation approaches, (2) QEMU user-mode emulation for individual binaries, (3) QEMU system-mode emulation for full firmware stack, (4) Advanced GDB debugging with gdb-multiarch, (5) Network traffic capture and protocol analysis, (6) MITM attacks and traffic manipulation, (7) Automated emulation with Firmadyne/FirmAE, (8) Troubleshooting boot failures and network issues. Requires extracted firmware (use firmware-extraction skill first). Complements firmware-static-analysis skill with runtime behavior observation.

firmware-extractionskills/firmware-extraction/SKILL.md

Extract firmware images and embedded filesystems using unblob first, summarize its JSON report, and investigate unresolved regions with Binwalk or filesystem-specific tools. Use for device dumps and manufacturer update images, including nested, unsupported, encrypted, or damaged formats. For individual ELF analysis use firmware-static-analysis; for execution use firmware-emulation.

firmware-security-reportsskills/firmware-security-reports/SKILL.md

Evidence-based security report generation for firmware assessments. Use when the agent needs to create technical security reports from firmware analysis. Covers: (1) Full penetration test reports with executive summaries and technical details, (2) Individual vulnerability findings with CVSS 3.1 scoring, (3) Working notes for documentation during assessment, (4) Integration with firmware analysis skills (extraction, static analysis, Ghidra RE, emulation). Outputs to markdown and PDF formats. Technical audience only. Includes templates for findings, PoC code, remediation guidance, and evidence documentation.

firmware-static-analysisskills/firmware-static-analysis/SKILL.md

Systematic static analysis of ELF firmware binaries using command-line tools (file, strings, readelf, objdump, xxd). Use when the agent needs to perform initial reconnaissance on firmware/embedded binaries before reverse engineering, specifically for (1) Identifying architecture and binary characteristics, (2) Extracting metadata, strings, and imports, (3) Analyzing symbols, sections, and entry points, (4) Understanding binary structure and dependencies, (5) Generating structured analysis reports. Covers ARM, MIPS, x86, RISC-V, PowerPC architectures. Does NOT handle firmware extraction/unpacking (use separate skill for that).

ghidra-reskills/ghidra-re/SKILL.md

Expert-level Ghidra reverse engineering for firmware binaries with emphasis on stripped binary analysis, automated function discovery, cryptographic routine identification, authentication logic detection, and vulnerability hunting. Use when the agent needs to perform deep static analysis of firmware binaries in Ghidra. Covers: (1) Stripped binary analysis techniques (function discovery via prologues, xrefs, string tracing), (2) Type recovery and structure reconstruction, (3) Automated analysis via Python scripting (Ghidra API), (4) Cryptographic function identification (AES, MD5, SHA constants), (5) Authentication and authorization function discovery, (6) Vulnerability detection (buffer overflows, format strings, command injection, manual data-flow verification), (7) Decompiler enhancement and custom type propagation, (8) Integration with emulation workflow. Assumes expert RE knowledge. Complements firmware-static-analysis (basic recon) and firmware-emulation (dynamic analysis).

Plugin manifests2

plugins/firmware-reverse-engineering/.codex-plugin/plugin.json
{
  "name": "firmware-reverse-engineering",
  "version": "0.2.0",
  "description": "Firmware extraction, static analysis, Ghidra reverse engineering, emulation, and security reporting skills.",
  "author": {
    "name": "Hussein Muhaisen",
    "url": "https://github.com/husseinmuhaisen"
  },
  "repository": "https://github.com/OrbitCurve/firmware-reverse-engineering",
  "keywords": [
    "firmware",
    "reverse-engineering",
    "ghidra",
    "qemu",
    "security"
  ],
  "skills": "./skills/",
  "interface": {
    "displayName": "Firmware Reverse Engineering",
    "shortDescription": "Firmware extraction, analysis, emulation, and reporting.",
    "longDescription": "Firmware extraction, static analysis, Ghidra reverse engineering, emulation, and security reporting skills.",
    "developerName": "OrbitCurve",
    "category": "Security",
    "capabilities": [
      "Read",
      "Write"
    ],
    "defaultPrompt": [
      "Analyze the structure of this firmware image.",
      "Inspect an extracted firmware binary in Ghidra.",
      "Draft a report from my firmware assessment findings."
    ]
  },
  "license": "Apache-2.0"
}
plugins/firmware-reverse-engineering/.claude-plugin/plugin.json
{
  "name": "firmware-reverse-engineering",
  "version": "0.2.0",
  "description": "Firmware extraction, static analysis, Ghidra reverse engineering, emulation, and security reporting skills.",
  "author": {
    "name": "Hussein Muhaisen",
    "url": "https://github.com/husseinmuhaisen"
  },
  "repository": "https://github.com/OrbitCurve/firmware-reverse-engineering",
  "keywords": [
    "firmware",
    "reverse-engineering",
    "ghidra",
    "qemu",
    "security"
  ],
  "skills": "./skills/",
  "license": "Apache-2.0"
}

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[firmware-reverse-engineering on Agent Plugins Marketplace](https://pluginsmp.com/plugins/firmware-reverse-engineering)