Bare Metal vs. Operating Systems

▶ Watch (1:10)

Bare metal microcontrollers lack privilege separation. They run lightweight schedulers, not Linux kernels. Firmware extracted via JTAG or SWD is a raw binary, often stripped of symbols. Direct register access is common. Davis showed a flow diagram ranking bare metal developers above embedded Linux and Windows users. The key difference: no MMU, no process isolation. Every function can touch any memory address.

ARM Assembly and Thumb Mode

▶ Watch (5:06)

ARM uses a reduced instruction set. Registers R0-R12 are general purpose. R13 (stack pointer), R14 (link register), and R15 (program counter) are special. Thumb mode mixes 16-bit and 32-bit instructions. The last bit of an instruction determines the mode switch. Davis recommended Ghidra’s aggressive instruction finder and GEF (GDB Enhanced Features) for stepping through ARM assembly. He demonstrated a simple function prologue, epilogue, and branch instructions.

Firmware Development: Hard Way vs. Easy Way

▶ Watch (11:09)

Initializing a single GPIO on an STM32 requires setting a peripheral clock, configuring the mode, and enabling pull-up resistors. The hard way uses direct register writes with bitwise logic. The easy way uses ST’s HAL (Hardware Abstraction Layer). Davis showed a UART setup with HAL: one structure and one function call. Understanding both layers helps reverse engineers recognize HAL patterns in disassembly.

Tools for Recovering Source Code

▶ Watch (15:54)

Ghidra imports raw binaries with Cortex-M endianness. Davis adds a flash mirror block and configures memory maps from datasheets. The SVD Loader (by Level Down Security) parses XML register descriptions and populates the memory map with peripheral names. Typeloader parses HAL header files to create data types for UART handles and other objects. BSIM (Binary Similarity) from NSA builds a database of known function signatures. It can identify RTOS calls like osThreadNew in seconds, letting the analyst skip library code and focus on the application.

Notable Quotes

if you can do firmware, you’re uh the best programmer SolaSec · ▶ 3:10

it’s just plain fun SolaSec · ▶ 3:27

I wrote this code, so it’s pretty easy to reverse engineer your own code SolaSec · ▶ 18:36

Key Takeaways

  • Bare metal firmware lacks OS protections; direct register access is the norm.
  • ARM Thumb mode complicates disassembly but Ghidra’s aggressive finder handles it.
  • SVD Loader and Typeloader automate peripheral and HAL type recognition in Ghidra.
  • BSIM quickly identifies RTOS and library functions, saving hours of manual analysis.

About the Speaker(s)

Caleb Davis is a founding member of SolaSec, a cybersecurity consulting firm specializing in advanced penetration testing for embedded and connected systems. Based in Dallas/Fort Worth, he holds a degree in Electrical Engineering from the University of Texas at Tyler and is a patent-holding expert with vast experience in hardware and firmware security. Caleb leads deep technical assessments across a range of high-impact industries, including medical devices, automotive, industrial control systems, ATMs and financial terminals, aerospace components, and consumer electronics. His work focuses on secure design, trusted boot processes, cryptographic implementations, and threat modeling, helping organizations integrate security throughout the development lifecycle and align with industry and regulatory standards.