I was really interested in getting into performing exploits to install my own code on devices, instead of waiting for others. I figure its a great way for me to learn about security on devices like phones. Sadly there is nothing online about this. I hear about it, but no tutorials. Any advice on where to go to learn this?

  • I think you should be more specific - as each device is different, how you exploit or pentest each device is inherently different. At least technically. Many of the principles are of course the same as with all clients, be it a Windows computer or an Android device.
    – efr4k
    Mar 7, 2012 at 12:09
  • @ephrack I apologize for that. I was hoping for a point in the right direction so to speak, and not exactly how to do it on one platform. Though if you are proficient in a specific platform, by all means please send me some info as I am willing to learn.
    – Andy
    Mar 7, 2012 at 20:32
  • No need to apologize :) I like the question, but maybe it should be broken into multiple more specific ones. And I too am very interested in this topic. For reference I've been testing Android apps and this might point you in the right direction for that: intrepidusgroup.com/insight/2011/05/androidaudittools and wsec.be/blog/2011/10/05/adventures-in-pentesting-android-apps
    – efr4k
    Mar 8, 2012 at 11:55

1 Answer 1


Finding exploits which allow you to run your own code on platforms like these is very difficult. You would need to be fluent in the native language of the platform, almost certainly in addition to being fluent in assembly for whatever architecture it was running on. Failing that, you'd need a very good understanding of the hardware by reverse engineering what you had, as well as the right kit yourself to perhaps modify the code on FPGA's or flash chips to load your own stuff.

The software route typically involves getting a dump of the systems firmware and looking for buffer overflow exploits. These allow you to load your own code into memory and have an otherwise inert program execute it for you.

The hardware route usually involves extracting chips and reprogramming them or taking advantage of some kind of design 'flaw' which allows you to trick the existing software on the platform to doing something you want that it wouldn't otherwise do. A good example of this is geohot's original PS3 exploit, where he used a switch to stop the kernel's memory deallocation messages getting through, allowing him access to kernel pages he could read and write to and execute with ring 0 priveleges!

  • I really appreciate the advice! And I agree, but I am willing to learn it. Could you direct me to a tutorial on how to get a dump of a systems software? I am aware this won't be the same for every device, so maybe of one you know. In my case, the software route would be the best option for me to explore and learn.
    – Andy
    Mar 7, 2012 at 20:36
  • One such example that springs to mind is the Nintendo DS. I did find a guide where the guy prised off the DS' firmware chip which I think was actually the internals of an SD card, and managed to read it as it talked to the DS' motherboard by soldering an SD card reader in parallel to it. It's tricky stuff but that's the only start I can think of. I'm afraid I can't find a direct link right now but I found it by being active in the portables general hacker forums and IRC channels. That's your best place to look. :)
    – deed02392
    Mar 8, 2012 at 9:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .