Skill: Embedded RTOS Security

Supplementary Files:

• payloads.md — Command catalogue for VxWorks WDB RPC/Wind debug agent exploitation (Urgent/11 CVEs CVE-2019-12256/12258/12260, IPstack flaws), QNX Neutrino Qnet/qconn/procfs exploitation, FreeRTOS+TCP CVE-2018-16528 stack attacks, ThreadX/Azure RTOS bug matrix, Zephyr Kconfig/Bluetooth host CVEs, Mbed OS uVisor/Pelion, TI-RTOS/BIOS, MicroC/OS-II/III, NuttX, RIOT, Contiki-NG, plus hardware attack surfaces (JTAG/UART/SWD enumeration via JTAGulator/Shikra/J-Link/Black Magic Probe, OpenOCD target control, voltage/clock glitching via ChipWhisperer/NewAE, side-channel analysis with GreatFET/HydraBus/Bus Pirate) — 11 sections, 60+ code blocks.
• test-cases.md — Structured test cases (lab bring-up, JTAG/UART enumeration, OpenOCD target attach, VxWorks WDB RPC fingerprint/exploit, FreeRTOS+TCP CVE PoC, QNX qconn/procfs enumeration, Zephyr Bluetooth host stack fuzz, ChipWhisperer voltage glitch on secure boot, RTOS binary static analysis with Ghidra/IDA, scheduler priority inversion, Renode system emulation, MPU bypass via heap corruption) — 12 cases across 6 categories.
• guides/embedded-rtos-security-playbook.md — End-to-end RTOS red team playbook covering architecture comparison (monolithic kernel vs microkernel vs real-time executive), the full RTOS attack surface map (debug agent, network stack, IPC, scheduler, MMU/MPU), real CVE deep dives (VxWorks Urgent/11 by JSOF 2019, FreeRTOS+TCP by Zimperium 2018, Zephyr Bluetooth 2019-2023), hardware lab setup (JTAGulator, Shikra, J-Link, ST-Link, Black Magic Probe, OpenOCD, Bus Pirate, GreatFET), glitching rig (ChipWhisperer, NewAE, GlitchIP), emulation (Renode, QEMU system, angr symbolic execution), defensive guidance (MPU/MMU enablement, stack canaries, ASLR-on-MCUs, secure boot), RTOS MITRE ATT&CK for Cloud + ICS mapping, and RTOS secure boot + Trusted Execution Environment (TEE) analysis.
• guides/embedded-rtos-security-deep-dive.md — Hands-on VxWorks WDB RPC exploitation lab: WDB RPC protocol reverse engineering, MODE_ANY unauthenticated escalation, memory read/write primitives via wdbCtxRead/wdbCtxWrite, task spawn RCE via wdbTaskSpawn, four Urgent/11 CVE PoCs (CVE-2019-12256/12258/12260/12264), QEMU lab setup, Wireshark Lua dissector for WDB RPC, network-level detection and defense bypass, three capture-the-flag scenarios with progressive difficulty.
• guides/freertos-tcp-vulnerability-research.md — FreeRTOS+TCP CVE reproduction and fuzzing lab: POSIX simulator build with TAP networking, IP-task architecture and heap_4.c internals, four Zimperium 2018 CVE PoCs (CVE-2018-16525/16528/16529/16603), AFL harness for IP-task packet fuzzing, angr symbolic execution for variant discovery, Diaphora and Ghidra BSim patch diffing methodology, field hardening for devices that cannot upgrade.

Summary

Real-Time Operating System (RTOS) security covers the exploitation of deterministic operating systems used in safety-critical and embedded devices — VxWorks, QNX Neutrino, FreeRTOS (+ FreeRTOS+TCP), ThreadX/Azure RTOS, Zephyr, Arm Mbed OS, TI-RTOS/SYS/BIOS, MicroC/OS-II and III, NuttX, RIOT OS, and Contiki-NG. These operating systems are the runtime for avionics (ARINC-653 partitions on VxWorks 653 and LynxOS-178), automotive ECUs (QNX on multiple IVI platforms, AUTOSAR OS on OSEK derivatives), industrial controllers (VxWorks, MicroC/OS on PLCs, RTU/IED firmware), medical devices (ThreadX on infusion pumps, QNX on MRI consoles), IoT networking gear (FreeRTOS on consumer routers and Zigbee radios, Zephyr on 802.15.4 sensors), and aerospace/military systems (VxWorks, INTEGRITY-178B, Deos). Unlike a general-purpose OS, an RTOS sacrifices isolation for determinism: a single memory corruption, debug-agent exposure, or scheduler flaw often gives the attacker direct code execution in the highest-privilege supervisor/handler mode on the device.

Tools: IDA Pro, Ghidra, Binary Ninja, radare2/r2macho, OpenOCD, J-Link/ST-Link/Black Magic Probe/JTAGulator/Shikra, binwalk/firmwalker/FACT, QEMU system/Renode, angr, ChipWhisperer (NewAE), GreatFET/HydraBus/Bus Pirate, flashrom, strace/ltrace/perf.

Domain: embedded-rtos-security

MITRE ATT&CK: T1548-Abuse Elevation Control Mechanism (MPU bypass, debug agent escalation), T1068-Exploitation for Privilege Escalation (scheduler, kernel), T1055-Proccess Injection (task corruption, heap spray), T1049-System Network Connections (WDB RPC, qconn discovery), T1210-Exploitation of Remote Services (RTOS network stack), T1499-Endpoint Denial of Service (priority inversion, RTO deadlock)

Description

An RTOS is the OS layer between the silicon and a deterministic application: where a general-purpose OS optimizes for fairness, throughput, and isolation, an RTOS optimizes for guaranteed worst-case latency, predictable scheduling, and minimal interrupt jitter. That mandate produces four architectural properties that shape every attack in this domain:

1. Determinism over isolation. The kernel reserves CPU time slices via fixed-priority preemptive scheduling (rate-monotonic in VxWorks, EDF in some MicroC/OS-III deployments, priority inheritance for bound priority inversion in POSIX/QNX). Tasks share the same flat address space more often than not — MicroC/OS-II has no MMU support, FreeRTOS is MMU-optional until V10.3+, and even QNX's microkernel pays a per-message context-switch tax that many IoT deployments trade away by running everything in kernel mode. A single task compromise is, in many RTOS deployments, a full-device compromise.

2. Debug agents as the standard remote attack surface. Every major RTOS ships a debug agent intended for development: VxWorks has WDB (Wind River Debug Agent) exposed over UDP port 17185 speaking the Wind River Debug RPC protocol; QNX has qconn on TCP 8000 used by Momentics and the QNX System Information Viewer; FreeRTOS Plus has TCP-only GDB stubs enabled by default in vendor SDKs; ThreadX has NetX Debug Agent and Azure RTOS adds the ThreadX TraceX server; TI-RTOS ships ROV (Runtime Object Viewer) accessible over UART/Ethernet. These agents were never intended for production, but OEM shipping profiles routinely leave them listening on the WAN interface. The 2019 Urgent/11 vulnerabilities (JSOF, CVE-2019-12256 stack overflow in the WBD RPC parser, CVE-2019-12258 Memory Pool Allocator overflow, CVE-2019-12260 DHCPv4 client overflow) demonstrated that the WDB agent and the WIND IP stack together expose unauthenticated, remote-code-execution attack surface on over 200 million devices — including Schneider Electric Modicon PLCs, OTN systems in healthcare, and multiple aerospace platforms.

3. The network stack is the kernel. On VxWorks the WIND IP stack runs in kernel context. On FreeRTOS the FreeRTOS+TCP stack (FreeRTOS_IP.c, FreeRTOS_Sockets.c, FreeRTOS_DHCP.c) runs in a single "IP-task" with kernel-equivalent privileges. On Zephyr the networking subsystem lives in the kernel's net_core context. A buffer overflow in any of these is a kernel-mode RCE — there is no userland boundary to fall back to. The 2018 Zimperium disclosures (CVE-2018-16528 FreeRTOS_SendPing heap overflow, CVE-2018-16529 FreeRTOS_recvfrom do-not-fragment handling, CVE-2018-16525 IP fragmentation UAF, CVE-2018-16603 TCP SYN queue overflow) demonstrated unauthenticated, single-packet RCE across an estimated 4 billion FreeRTOS+TCP-enabled devices.

4. The hardware is part of the threat model. Real-time devices ship with JTAG/SWD/ETM debug interfaces, UART consoles, and unprotected external flash because they are mandatory for factory programming and field debug. Even when secure boot closes the "flash via JTAG" path, the underlying silicon primitives — ARM's Debug Authentication Mode (DAM), the JTAG-DP DPIDR access port, the Cortex-M TPIU trace port — are themselves a battle frontier. Voltage glitching (ChipWhisperer), clock glitching, and EM fault injection bypass secure boot, attestation, and key extraction on a daily basis in modern labs.

The combination is what makes RTOS security its own discipline: you do not get to choose between software exploitation and hardware exploitation — a real RTOS engagement requires both, because the network stack exploit lands you in kernel mode and the secure-boot bypass is what got you the firmware to begin with. The VxWorks Urgent/11 disclosure, the FreeRTOS+TCP Zimperium report, the multiple Zephyr Bluetooth host CVEs (CVE-2019-17500, CVE-2020-10019, CVE-2021-3329, CVE-2022-3821), and the ongoing stream of ThreadX NetX DUO CVEs (CVE-2021-2924, CVE-2023-34625) all share the same shape: a remote or local attacker exploits the IP/Bluetooth stack or debug agent to gain supervisor privileges on a device that has no separation kernel, no MPU enforcement on the compromised task, and no ASLR to randomize the target address.

Difference from firmware-reverse: Firmware-reverse covers generic firmware image acquisition (binwalk signature scan, sasquatch/jefferson filesystem extraction, FACT and firmwalker scanning) and generic full-system emulation (firmadyne, qemu-system). Embedded-rtos-security assumes the firmware image is already extracted and goes one layer deeper: identifying the RTOS, fingerprinting version via debug agent banner, exploiting RTOS-specific components (WDB RPC protocol, qconn, FreeRTOS IP-task, ThreadX NetX, Zephyr Bluetooth host), and leveraging RTOS-specific hardware attacks (priority inversion, MPU bypass, scheduler abuse). The boundary: binwalk/unblob extraction → firmware-reverse; once you know the image contains VxWorks 6.9 and you're targeting the WDB agent on UDP 17185, you're in embedded-rtos-security.

Difference from iot-pentest: IoT-pentest covers the application-layer IoT protocols (MQTT, CoAP, AMQP, LwM2M, AWS IoT Device SDK, OCF) and the cloud back-end. Embedded-rtos-security covers the RTOS that sits underneath those protocols — the FreeRTOS TCP/IP stack that carries the MQTT traffic, the ThreadX NetX DUO stack that carries the LwM2M traffic, the Zephyr networking subsystem that carries CoAP. IoT-pentest is "what the device says over MQTT"; embedded-rtos-security is "the IP stack underneath the MQTT client that has its own 4 CVEs."

Difference from hardware-security: Hardware-security covers generic chip-level debug interfaces (JTAG/UART/SWD enumeration), glitching (voltage, clock, EM), and side-channel (power analysis via ChipWhisperer, Riscure Inspector). Embedded-rtos-security applies those techniques to RTOS-specific targets — JTAG access to dump FreeRTOS task control blocks, glitch attacks to bypass the QNX kernel boot signature, power analysis to recover ThreadX NetX crypto keys. The overlap is the lab gear; the difference is the target.

Difference from binary-reverse: Binary-reverse covers general disassembly and decompilation methodology across architectures (ARM, MIPS, x86, RISC-V). Embedded-rtos-security applies binary analysis to RTOS-specific artifacts — VxWorks VxWorks symbol table (vxworks.sym), QNX qnx_bootstrap ELF segments, FreeRTOS linker map for task stack layout, ThreadX _tx_block_pool heap structures, Zephyr Kconfig build artifacts. The same Ghidra session produces different findings depending on whether the analyst knows they're looking at a microkernel vs a flat-address-space RTOS.

Difference from scada-ics-security: SCADA covers industrial control protocols (Modbus, DNP3, S7comm, OPC UA, IEC 61850, GOOSE). Many SCADA devices run on VxWorks or MicroC/OS, but the SCADA layer is the application; embedded-rtos-security is the OS underneath. The overlap is Schneider Modicon PLCs running VxWorks (Urgent/11); embedded-rtos-security owns the WDB agent exploit, scada-ics-security owns the Modbus function code exploitation.

Use Cases

• VxWorks WDB debug agent exploitation: Identify a device running VxWorks (banner UDP 17185, TCP 17185, broadcast fingerprint), map the WIND IP stack version, exploit the Urgent/11 chain (CVE-2019-12256 stack overflow in wdbDbgArchLib.c, CVE-2019-12258 memory pool allocator overflow, CVE-2019-12260 DHCP client dhcpClientOptionGet overflow) for unauthenticated remote code execution on a Schneider Modicon PLC or an ABB RTU.
• FreeRTOS+TCP stack exploitation: Identify a device running FreeRTOS+TCP (often via DHCP option 60 strings, banner signatures in TCP/IP response timing, or filesystem strings indicating FreeRTOS), exploit the Zimperium chain (CVE-2018-16528 SendPing heap overflow, CVE-2018-16603 TCP SYN flood exhaustion, CVE-2018-16525 IP fragment reassembly UAF) for kernel-mode RCE in the IP-task.
• QNX Neutrino microkernel exploitation: Identify QNX Neutrino (procnto-smp-instr on boot, qconn on 8000, the Qnet protocol on TCP/UDP 4000), exploit qconn weak authentication, abuse procfs (/proc/<pid>/as for arbitrary process memory access given CAP_SYS_ADMIN-equivalent credentials), or compromise a QNX Momentics IDE-launched binary via the Slinger/jqconn trusted channel.
• ThreadX / Azure RTOS exploitation: Identify ThreadX (filesystem strings, banner), exploit NetX DUO CVEs (CVE-2021-2924 HTTP server overflow, CVE-2023-34625 IPv6 ND prefix corruption), abuse the ThreadX block-pool allocator for heap-style attacks, or compromise Azure RTOS's HTTPS/REST server features added by the OpenAMP migration.
• Zephyr RTOS exploitation: Identify Zephyr (Kconfig build artifacts in the firmware filesystem, Bluetooth HCI vendor strings), exploit Bluetooth host-stack CVEs (CVE-2019-17500 L2CAP heap overflow, CVE-2020-10019 GATT handler UAF, CVE-2022-3821 HCI ACL buffer overflow), or attack the Zephyr networking subsystem (CoAP server, LwM2M client).
• Mbed OS exploitation: Identify Mbed OS (Pelion Device Management strings, uVisor traces), exploit uVisor enclave bypass, attack the Pelion Cloud client (HTTPS over mbedTLS with the FSF certificate chain), or compromise mbed-cli build artifacts.
• TI-RTOS / SYS/BIOS exploitation: Identify TI-RTOS (BIOS task scheduler signatures, XDC tools artifacts, the C6000/C2000 boot signature), exploit the NDK TCP/IP stack, abuse ROV (Runtime Object Viewer) debug exposure over UART/Ethernet.
• MicroC/OS-II / III exploitation: Identify MicroC/OS (heap signature, OSTaskCreate runtime strings), exploit the absence of MMU/MPU enforcement (the OS does not enforce task isolation), abuse the lack of address randomization for trivial ROP on a task stack.
• NuttX / RIOT / Contiki-NG exploitation: Identify these smaller RTOSes (often on 6LoWPAN / 802.15.4 sensors), exploit their TCP/IP stacks (NuttX BSD-derivative, RIOT GNRC, Contiki uIP), attack the 6LoWPAN mesh layer.
• Hardware-assisted exploitation: Enumerate JTAG/SWD/ETM via JTAGulator or Shikra, attach via OpenOCD + J-Link/ST-Link/Black Magic Probe, dump FreeRTOS task control blocks, patch the secure boot fuse via voltage glitching with ChipWhisperer, or perform power-analysis key extraction on an mbedTLS AES implementation.
• RTOS firmware static analysis: Use Ghidra/IDA Pro with RTOS-specific loader scripts (VxWorks symbol recovery, FreeRTOS linker map import, ThreadX heap layout reconstruction) to identify memory corruption primitives, locate the WDB agent or qconn binary, and build the exploit chain.
• RTOS emulation and symbolic execution: Use Renode (which has first-class VexRiscv / LiteX support and is the canonical multi-RTOS emulator) or qemu-system to boot the RTOS in an emulated environment for repeatable dynamic analysis, then use angr to symbolically explore the WDB agent RPC parser or the FreeRTOS DHCP option handler for input-to-crash paths.

Core Tools

Disassembly and Static Analysis

Tool	Purpose	Command Example
IDA Pro (Hex-Rays)	Commercial disassembler with ARM/MIPS/RISC-V/PowerPC support and decompiler; standard for VxWorks symbol table recovery	idat64 -A -B vxworks_image.bin
Ghidra (NSA)	Free, scriptable decompiler with RTOS-specific loaders (VxWorks, FreeRTOS linker maps, ELF QNX bootstrap); preferred for collaborative analysis	ghidraRun then File > Import File
Binary Ninja (Vector 35)	Modern API-first decompiler with strong IL; preferred for scripting RTOS heap analysis	binaryninja vxworks.bin
radare2 / r2macho	Open-source CLI reverse engineering; r2macho adds Mach-O for Apple platforms; preferred for embedded ARM Cortex-M	r2 -A -a arm -b 32 vxworks.bin

Hardware Attack

Tool	Purpose	Command Example
OpenOCD	Open On-Chip Debugger; speaks JTAG/SWD to ARM Cortex-M/R/A, MIPS, RISC-V; controls target via GDB	openocd -f interface/jlink.cfg -f target/stm32f4x.cfg
J-Link (Segger)	Commercial JTAG/SWD probe; first-class RTOS awareness (FreeRTOS, ThreadX, Zephyr)	JLinkExe -device STM32F407VG -if SWD -speed 4000
ST-Link (STMicro)	Vendor JTAG/SWD probe, native to STM32 ecosystem	st-flash --reset read image.bin 0x08000000 0x100000
Black Magic Probe	Open-source JTAG/SWD probe with built-in GDB server; preferred for FreeRTOS-aware debugging on Cortex-M	arm-none-eabi-gdb -ex 'target extended-remote /dev/ttyACM0'
JTAGulator (Joe Grand)	One-shot JTAG/UART pin enumeration from an unknown PCBA; recovers TCK/TMS/TDI/TDO and TX/RX/GND from any of up to 24 pins	jtagulator (interactive)
Shikra (Xipiter)	Multi-protocol tool: JTAG, UART, SPI, I2C, CAN; primary lab tool for unknown embedded devices	shikra --jtag-scan

Firmware Extraction and Analysis

Tool	Purpose	Command Example
binwalk	Signature scanning for embedded images (identifies VxWorks bootrom, RTOS compression layers)	binwalk -Me firmware.bin
firmwalker	Filesystem vulnerability scanner (locates VxWorks target/config, FreeRTOS FreeRTOSConfig.h, ThreadX tx_api.h strings)	bash firmwalker.sh /tmp/squashfs-root/ report.txt
FACT (Firmware Analysis and Comparison Tool)	Web-UI-driven firmware analysis framework; identifies RTOS by heuristic and runs CVE matching	fact_start

Emulation and Dynamic Analysis

Tool	Purpose	Command Example
QEMU system	Full-system emulation of ARM, MIPS, PowerPC, RISC-V; boot an RTOS image in qemu-system-arm -M versatilepb	qemu-system-arm -M lm3s6965evb -kernel nuttx.bin -nographic
Renode (Antmicro)	Multi-node emulation designed for embedded; first-class support for VexRiscv, LiteX, STM32, NXP, TI Tiva; preferred for RTOS multi-core emulation	renode path/to/zephyr.resc
angr	Symbolic execution framework; explores WDB agent RPC parsers and FreeRTOS DHCP option handlers for input-to-crash paths	python3 -m angr explore_wdb.py

Fault Injection and Side-Channel

Tool	Purpose	Command Example
ChipWhisperer (NewAE)	Open-source voltage/clock glitching and power analysis platform; the canonical SCA tool for Cortex-M secure-boot bypass	cw.run(cw.glitch.Glitcher, 'power_trace')
GreatFET (Great Scott Gadgets)	USB multi-tool for SWD/JTAG/SPI/I2C; companion to HackRF for embedded interop	greatfet fw -r dump.bin
HydraBus / Bus Pirate	Open-source multi-protocol bridges for UART/SPI/I2C/1-Wire enumeration	hydrabus (interactive)

Flash and Trace

Tool	Purpose	Command Example
flashrom	SPI NOR/NAND/eMMC programmer; reads external flash via hardware programmers (CH341A, dediprog, Bus Pirate)	flashrom -p ch341a_spi -r flash_dump.bin
strace / ltrace / perf	Userspace tracing on Linux-based RTOS (NuttX POSIX, QNX Neutrino, RT-Linux)	strace -f -e trace=network -p $(pidof qconn)

---

Methodology

RTOS Attack Chain

Fingerprinting            Debug Agent Exploit          Kernel/Task Compromise        Persistence
(Banner/Behavior)   (WDB RPC, qconn, GDB stub)   (RCE in IP-task, MPU bypass)   (Patch image / OTA)
       |                       |                              |                              |
       v                       v                              v                              v
  UDP 17185 banner       WDB_MODE_ANY exploit            Heap overflow in IP-task      Modify vxWorks image
  qconn TCP 8000         Urgent/11 chain                 Task TCB overwrite            Patch secure boot
  DHCP option 60         FreeRTOS DHCPv4 RCE             Scheduler priority inversion  Hook OTA update flow
  Bluetooth HCI banner   Zephyr GATT UAF                 MPU region re-configure       Survive factory reset

Phase Details:

1. Fingerprinting: Identify the RTOS via network banner (VxWorks WDB banner on UDP 17185, qconn banner on TCP 8000), DHCP option 60 vendor class identifier, filesystem strings in extracted firmware, Bluetooth HCI vendor/version response, or symbol recovery via binwalk + VxWorks loader. Determine version (VxWorks 5.5/6.x/7, FreeRTOS 8/9/10/11, ThreadX 5.x/6.x). Cross-reference against published CVE catalog (Urgent/11, Zimperium 2018, Azure RTOS advisories 2023).

2. Debug Agent Exploit: If WDB is exposed (default VxWorks < 6.9.4 ships with WDB_MODE_ANY allowing unauthenticated read/write/execute), use the WDB RPC protocol directly to call tgtPing, read arbitrary memory via wdbCtxRead, write memory via wdbCtxWrite, or spawn a task with wdbTaskSpawn. QNX qconn supports the QConnect protocol with optional authentication that OEMs routinely disable; exploitation includes posix_spawn of a root shell. FreeRTOS GDB stubs (when enabled) accept monitor commands for memory access without authentication.

3. Kernel/Task Compromise: When no debug agent is exposed, attack the IP stack directly. Urgent/11 stack overflow in wdbDbgArchLib.c (CVE-2019-12256) is triggered by a malformed WDB RPC packet even with WDB disabled in some builds. FreeRTOS+TCP SendPing heap overflow (CVE-2018-16528) is triggered by an ICMP echo with a malicious payload length. Zephyr L2CAP heap overflow (CVE-2019-17500) is triggered by an L2CAP signal packet with oversized information payload. After RCE, escalate privileges within the flat RTOS address space: all FreeRTOS tasks share the same address space (no MMU by default), so userland is already kernel-mode. On QNX microkernel, abuse procfs after obtaining any process credentials to read arbitrary process memory via /proc/<pid>/as.

4. Persistence: Modify the firmware image on the external SPI flash (after gaining write access via flashrom-on-target or a vendor-supplied update mechanism). Patch the WDB agent to require authentication. Hook the OTA update mechanism to deliver attacker-controlled firmware. On VxWorks, hook usrAppInit to spawn an attacker task at boot. On Zephyr, abuse the MCUboot serialized update flow.

Debug Agent vs Network Stack Workflow

DEBUG AGENT PATH                                  NETWORK STACK PATH
(preferred — fewer prerequisites)                 (when debug agent is closed)

1. nmap UDP 17185 / TCP 8000 / TCP 3333           1. Identify IP/Bluetooth stack (vendor strings)
2. WDB RPC tgtPing                                2. Craft single-packet PoC (ICMP, L2CAP, IPv6 ND)
3. wdbCtxRead target_nv_params                    3. Trigger heap overflow → ROP → task spawn
4. wdbTaskSpawn revshell_task                     4. Pivot to other network services
5. Dump full RAM via WDB                          5. Leverage for lateral movement in plant

---

Practical Steps

For detailed commands and payloads see payloads.md, and for the complete test checklist see test-cases.md. Below is a summary of core operations for each phase.

1. VxWorks WDB Fingerprint