● CASE STUDY · IDENTIUM TECH SOLUTIONS
Firmware Reverse-Engineering
Down to the metal: decompiling readers to own the stack.
OVERVIEW
Two deep reverse-engineering efforts underpinning the whole product line: the IF9A/IHZ4 UHF reader firmware (an HC32F460 Cortex-M4 host MCU driving a ThingMagic Mercury M6e radio) and the CX1500N handheld's MediaTek Android 12 firmware.
THE CHALLENGE
To build reliable software on top of vendor hardware, and eventually ship custom firmware, I needed to understand exactly how these devices work internally. None of it was documented, and much of it was obfuscated or in another language.
WHAT I BUILT
- 01
Headless Ghidra decompilation of the reader app firmware, producing a documented command set, JSON schemas, AT commands and the .slfw container format (18-byte header + raw ARM image + 4-byte CRC).
- 02
Determined firmware integrity is a CRC rather than a cryptographic signature, meaning custom firmware needs no private key, and wrote a Python SLFW parser/packer to prove it.
- 03
Unpacked the CX1500N's A/B dynamic partitions with SP Flash Tool and analysed AVB/verified-boot to understand what flashing custom images requires.
- 04
Attempted a hardware SWD bootloader read-out (blocked by flash read-out protection) and documented everything in a formal, management-readable report.
OUTCOME
The low-level knowledge that lets Identium's software own its hardware end to end. Genuinely deep embedded work behind the polished apps.