Skip to content
Toolkit for implant attack of IoT devices
Shell Python Batchfile Java
Branch: master
Clone or download
Latest commit ac3e5ba Sep 6, 2018
Type Name Latest commit message Commit time
Failed to load latest commit information.
HardwareTools Add files via upload Aug 27, 2018
resources Add files via upload Sep 6, 2018
toolkit add plugins Aug 27, 2018
LICENSE Create LICENSE Aug 27, 2018 update Sep 6, 2018 Add HardwareTools/ Aug 23, 2018

py3.6 MIT


IoT-Implant-Toolkit is a framework of useful tools for malware implantation research of IoT devices. It is a toolkit consisted of essential software tools on firmware modification, serial port debugging, software analysis and stable spy clients. With an easy-to-use and extensible shell-like environment, IoT-Implant-Toolkit is a one-stop-shop toolkit simplifies complex procedure of IoT malware implantation.

In our research, we have succcessfully implanted Trojans in eight devices including smart speakers, cameras, driving recorders and mobile translators with IoT-Implant-Toolkit.

A demo video below:

How to use


Make sure you have git, python3 and setuptools installed.
For audio processing and playing, you should install alsa(built-in in linux), sox and ffplay. On ubuntu18.04:

$ sudo apt install sox ffmpeg 

Download source code from our Github:

$ git clone

Set up environment and install dependencies:

$ cd IoT-Implant-Toolkit/
$ python3 install


Run the toolkit:

$ python3 -B
 _____   _______   _____                 _             _       _______          _ _    _ _   
|_   _| |__   __| |_   _|               | |           | |     |__   __|        | | |  (_) |  
  | |  ___ | |______| |  _ __ ___  _ __ | | __ _ _ __ | |_ ______| | ___   ___ | | | ___| |_ 
  | | / _ \| |______| | | '_ ` _ \| '_ \| |/ _` | '_ \| __|______| |/ _ \ / _ \| | |/ / | __|
 _| || (_) | |     _| |_| | | | | | |_) | | (_| | | | | |_       | | (_) | (_) | |   <| | |_ 
|_____\___/|_|    |_____|_| |_| |_| .__/|_|\__,_|_| |_|\__|      |_|\___/ \___/|_|_|\_\_|\__|
                                  | |                                                        
                      A Framework for IoT implantation research.

                                   by Marvel Team

            list - List all tools
            run - Run a specific tool
            exit - Exit


Three commands supported:
list: list all plugins
run: run a specific plugin with "run [plugin] [parameters]"
exit: exit


Each software tool acts as a plugin which can be easily added into the framework.

There are more than ten plugins in four categories, including topics on serial port debugging, firmware pack&unpack, software analysis, and implanted spy programs.

List of Plugins

Existing plugins in our framework:

Categories Tools Descriptions Reference
Serial port debugging pyserial modem control and terminal emulation program
Serial port debugging find correct baudrate
Firmware Pack&Unpack mksquashfs create and extract Squashfs filesystem
Firmware Pack&Unpack mkbootimg_tools Unpack&repack boot.img for Android
Firmware Pack&Unpack cramfs make cramfs filesystem
Firmware Pack&Unpack mountimg mount&unmount ext4 filesystems for Android system.img&data.img On our github
Software Analysis setools-android setools for Android with sepolicy-inject
Software Analysis crosscomplie crosscompile toolchain for arm on our Github later
Software Analysis odex unpack Odex to smali for Android on our Github
Binary implant spy client&server a stable spy client and server, source and pre-built bins on our Github
Binary implant denoise tool denoise tool for audio porcess on our Github

Create new plugins

Code structure:         #Startup script
--outputs/                       #Default folder of outputs
      |---basic/                 #Basic plugin class defination
      |---cli/                   #Shell-like cli defination
      |---toollist/              #Auto updating toollist of plugins 
      |---firmware/              #Plugins for firmware modification
      |---implant/               #Plugins for generate spy programs
      |---serialport/            #Plugins for serial port debugging
      |---software/              #Plugins for software analysis especially for Android
  |---tools/                     #Other tools

Create [newplugin].py in corresponding folder(category) and define init attributes to add a new plugin to IoT-Implant-Toolkit.The framework will detect new plugin automatically when startup.

Other tools

Hardware tools

Essential hardware tools for malware implantation research.See pictures in HardwareTools/ .

Name Description
Soldering Iron Solder tools
Solder Wire Solder tools
Solder Paste Solder tools
Solder Wick Solder tools
Hot Air Gun Solder tools
Reballing Tool Reballing tool
usb to ttl Debug / Console cable
Dupont Wire Electrical wire
EPROM Burner Programmer Burner Programmer

Other useful software tools

We have not added more plugins due to time limitation.

Chart below are tools not fits our framework, but may be useful.

We hope that IoT-Implant-Tookit will be an essential toolkit in malware implantation.

Categories Tools Descriptions Reference
Firmware Analysis binwalk a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images
Firmware Modify firmware mod kit a collection of scripts and utilities to extract and rebuild linux based firmware images
Cross Compiler buildroot Cross Compiler for arm mips powerpc
You can’t perform that action at this time.