VCA-RE-101 — Reverse Engineering of Embedded Systems

Course Overview

Students progress from physical-layer printed-circuit-board characterization, through serial-protocol and debug-interface analysis (SPI, I²C, UART, JTAG, SWD), to SoC boot-sequence recovery, firmware extraction, binary reverse engineering, patch-and-reflash, and the trust architectures that defend against these techniques. The course is appropriate preparation for offensive security research, defensive firmware assurance, hardware-trojan analysis, supply-chain integrity evaluation, and forensic device examination.

Learning Outcomes

On completion, graduates are able to:

1. Characterize an unknown printed circuit board by systematic physical measurement.
2. Identify SPI, I²C, UART, JTAG, and SWD protocols from observed bus waveforms.
3. Discover undocumented on-chip debug interfaces and verify discovered pinouts through independent methods.
4. Extract firmware from serial non-volatile memory using industry-standard programmers, with redundant-read cryptographic verification.
5. Analyze firmware images using binwalk, Ghidra, radare2, and QEMU.
6. Describe secure-boot and root-of-trust architectures, their threat models, and their practical attack surface.
7. Modify and reflash firmware to a target device while preserving recoverability to factory state.
8. Produce publication-quality technical reports suitable for USENIX Security, IEEE S&P, DEFCON, or coordinated-disclosure submission.

Schedule

Capstone oral defenses are held in Finals Week.

Assessment and Credential

Eleven laboratory exercises 55% · midterm practical exam Week 6 15% · capstone written report 20% · capstone oral defense 10%. A minimum grade of B− on capstone components is required to earn the VCA-RE-101 Certificate of Completion. The program is independent; no affiliation with, or endorsement by, any government academy or university is claimed or implied.

Equipment, Software, and Reading

Every student maintains a personal hardware workstation. A small inventory of shared instruments is provided per two-student team, and a larger course-level inventory is held by the program. All host software is free; the instructor supplies a prepared Docker container with extraction and analysis tooling. Hardware prices verified April 2026.

Compute Path (choose one)

Option A — Personal VM-capable laptop. macOS, Windows 10+, or Linux with at least 8 GB RAM and a VM that supports USB passthrough (VMware, VirtualBox, UTM, or Hyper-V). Chromebooks, tablets, and laptops below 8 GB are not supported on this path.

Option B — Raspberry Pi 5 (rent or buy from the program). Pi 5 8 GB kit with instructor-baked fwlab SD card, PSU, and case — about $250 to purchase outright, or a flat rental per cohort (refundable on return). Students interact with the Pi via any SSH-capable device — laptop, tablet, Chromebook, or older machine — or via a lab-provided keyboard-and-monitor station at the bench during proctored sessions.

Equipment per Student (Personal Workstation)

Equipment per Two-Student Team (Shared)

Equipment per Course (Instructor / Facility)

Software

All software listed below is free. The fwlab container is built from a public Dockerfile in the course repository and distributed to each student at the start of Week 1.

Required Texts

1. van Woudenberg, J. and O'Flynn, C. The Hardware Hacking Handbook: Breaking Embedded Security with Hardware Attacks. No Starch Press, 2021. ISBN 978-1593278748.
2. Dang, B., Gazet, A., and Bachaalany, E. Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation. Wiley, 2014. ISBN 978-1118787311.
3. Kleidermacher, D. and Kleidermacher, M. Embedded Systems Security: Practical Methods for Safe and Secure Software and Systems Development. Newnes, 2012. ISBN 978-0123868862.

Recommended Texts and Primary Literature

Recommended: Eagle, The IDA Pro Book (No Starch, 2011); Yiu, The Definitive Guide to ARM Cortex-M0 / M0+ (Newnes, 2015); Anderson, Security Engineering, 3rd ed. (Wiley, 2020), chapters 18 and 20. Selected peer-reviewed papers, IEEE and JEDEC standards, ARM architecture references, and vendor datasheets are assigned per week; the full bibliography is distributed when the cohort starts.

Prerequisites and Student Profile

VCA-RE-101 is calibrated for graduate-register academic rigor and proceeds at the pace of a working engineering course. It is intended for practicing engineers and analysts who will apply embedded-systems reverse engineering in professional work; it does not devote lecture time to remedial instruction in its prerequisite areas.

Ideal Learner Profile

• Early-career firmware or hardware engineer
• Defense-industrial-base hardware or supply-chain analyst
• Government civilian security researcher
• Advanced practitioner seeking professional calibration and a completion credential

Required Knowledge, Skills, and Abilities

Knowledge — what you must already understand

• Undergraduate-level electronic circuits: Ohm's law, voltage dividers, CMOS logic levels, pull-up / pull-down behavior, bypass capacitance
• Digital logic at the level of clock edges, logic-level thresholds, and voltage domains (5 V, 3.3 V, 1.8 V, 1.2 V)
• Operating-system fundamentals: processes, filesystems, permissions, and the Linux boot sequence at a conceptual level
• Number-system literacy: binary, hexadecimal, byte order
• Basic networking vocabulary at a recognition level (TCP/IP, MAC addressing, Ethernet framing)

Skills — what you must already be able to do

• Read and follow a component datasheet end to end
• Operate at a Unix shell with proficiency: navigation, redirection, piping, process management, remote access over SSH
• Use git to version-control text and small binary artifacts
• Read C source code (pointers, structs, switch statements); write small scripts in Python or Bash
• Operate a digital multimeter to measure voltage and verify continuity

Abilities — the dispositions the course assumes

• Methodological patience — hardware work is iterative; failure is a normal, expected, and instructive state
• Documentation discipline — lab notebook entries, instrument serial numbers, cryptographic hashes of every artifact
• Self-directed learning — the capstone is an independent, multi-week engagement
• Willingness to produce written technical prose at publication register

Skills Developed During the Course (Not Required on Entry)

Students do not need to arrive with any of the following. Each is taught in place.

• Soldering — the primary capstone extraction is non-destructive, using SOIC clips; a hot-air desolder demonstration is given but not graded
• ARM assembly reading — introduced in Week 4 and developed in Week 9
• SoC boot architecture — taught in Week 5
• Static binary analysis with Ghidra and radare2 — taught across Weeks 8 and 9
• Firmware carving, filesystem extraction, and repackaging — taught in Weeks 8 and 10
• Coordinated vulnerability disclosure practice — taught in Week 11

Who Is Not Well Matched

• Students who have never used a Unix terminal
• Students who find troubleshooting physical systems frustrating rather than engaging
• Pure web or application developers with no embedded or systems-programming exposure
• Students seeking a fast-paced certification badge rather than graduate-register instruction

Readiness Self-Check

Prospective students uncertain of any answer are invited to email academy@virtuscybersecurity.com with a note about their background and we can help calibrate readiness.