OPERATION TELESCREEN

September 24, 2026 ยท View on GitHub

Operation TELESCREEN


FREE Reverse Engineering Self-Study Course HERE

FREE Embedded Hacking Course HERE


OPERATION TELESCREEN

The Ministry's Surveillance Backbone

The finale after OPERATION COLD IRON

A Raspberry Pi 5 teaching lab that rebuilds a captured nation-state camera/router - real Linux, the same four partitions as the real device, and a hardened AEAD channel - written in the house C style.


LEGAL DISCLAIMER: The information, tools, and code provided in this repository and course are strictly for educational, research, and defensive purposes only.

You are explicitly prohibited from using any materials contained herein to access, test, modify, or exploit any device, network, or system that you do not own 100% or for which you do not have explicit, documented, and legally binding authorization to interact with.

By using this repository and course, you acknowledge and agree that:

  1. Any illegal, unauthorized, or malicious use of this information is solely your responsibility.
  2. The author(s) and contributor(s) of this repository and course shall not be held liable for any damages, legal repercussions, criminal charges, or unauthorized actions resulting from the use, misuse, or abuse of the contents herein.
  3. You will comply with all applicable local, state, national, and international laws regarding cybersecurity and computer fraud.

IF YOU DO NOT AGREE WITH THESE TERMS, DO NOT USE THIS REPOSITORY AND COURSE.


WHERE THIS FITS

TELESCREEN is the surveillance backbone of the Ministry - the Linux/RP5 appliance that watches the industrial edge built in OPERATION COLD IRON. It is the finale after OPERATION COLD IRON: that saga teaches the bare-metal ARM device (the Cortex-M33 cold-chain monitor); TELESCREEN builds the application-class ARM system (Cortex-A76, RP5/Linux) that watches over it. OPERATION COLD IRON is a planned ten-act saga (still in development); TELESCREEN is what comes after all ten, and teaches the same defect classes one level deeper. The whole saga is ARM - the same architecture, one level up.

workplatformrole in the story
OPERATION COLD IRONARM Cortex-M33 (RP2350)the Ministry's cold-chain edge - Act I (saga in development)
TELESCREEN (this repo)ARM Cortex-A76 (Raspberry Pi 5)the surveillance backbone that watches it
CTF_telescreenARM Cortex-A76 (Raspberry Pi 5)the same device, compromised

THE MINISTRY

The Ministry runs the state: the surveillance, the cold chain, the gates, the pipelines. NorthPharma is one of its deniable industrial fronts; FROSTLINE does the work no letterhead will admit to. Against them stands WHITEOUT. OPERATION COLD IRON is the Ministry's industrial edge; TELESCREEN is the wall unit that watches it - the surveillance backbone that comes after the ten acts.


THE COMPANION CTF

This repository is the defended device. The compromised one - the same node with the defects left in - lives in the companion repository:

Learn the defect here, then go break it there.


What This Is

TELESCREEN is a full embedded-security curriculum built around one artifact: a captured surveillance camera/router whose firmware is laid out in four flash partitions (boot, bootargs, kernel, rootfs). Students carve the image, reverse the boot chain, open the rootfs, find the backdoors, break the exfiltration crypto, and then build an RP5 replica that boots the same four-partition layout with a hardened AES-256-GCM channel.

This project is format-identical to the real camera: same mtdparts, same CRC-protected U-Boot environment, same vendor kernel container, same JFFS2 filesystem, same offsets and sizes. The only differences are the two closed first-stage ROMs (camera BootROM vs RP5 VideoCore) and the SoC behind the kernel.


Hardware

See PARTS.md for the full bill of materials: a stock RP5 runs the router, backdoor, and crypto labs; a camera module is optional for the video lab.


How to Use This Repository

  1. Absolute beginner? Start at Volume 31 to install Docker, the JDK, and Ghidra on Windows, Linux, or macOS.
  2. Want the hands-on RE? Build the target and start reversing: the firmware README and ghidra README, then Volume 33.
  3. Want the theory? Read the core volumes 01-30 in order.
  4. Want the answers? ghidra/RESOLUTION_MAP.md and Appendix J - but reverse each function yourself first.

Every document is linked below.


The Curriculum - every document in this repository

Read in order. Every title below is a link to the file.

Start here - prerequisites and the RE workflow

#documentteaches
3131-prerequisites-and-install.mdVolume 31 - Prerequisites and Installation (Windows, Linux, macOS)
3232-bench-firmware-and-extraction.mdVolume 32 - The Bench, the Four Images, and Extraction
3333-ghidra-nation-state-re.mdVolume 33 - Ghidra and the Nation-State RE Workflow

Core volumes 01-30

#volumeteaches
0101-world-and-threat.mdVolume 01: World and Threat
0202-the-four-partitions.mdVolume 02: The Four Partitions
0303-flash-silicon.mdVolume 03: The Image Store
0404-carve-and-verify.mdVolume 04: Carve and Verify
0505-first-stage-boot.mdVolume 05: First-Stage Boot
0606-u-boot.mdVolume 06: U-Boot
0707-environment-crc.mdVolume 07: Environment CRC
0808-kernel-container.mdVolume 08: Kernel Container
0909-device-tree.mdVolume 09: Device Tree
1010-command-line-and-mount.mdVolume 10: Command Line and Mount
1111-jffs2-nodes.mdVolume 11: JFFS2 Nodes
1212-jffs2-in-place-patch.mdVolume 12: JFFS2 In-Place Patch
1313-userland-boot.mdVolume 13: Userland Boot
1414-http-dispatcher.mdVolume 14: HTTP Dispatcher
1515-system-sites.mdVolume 15: system() Sites
1616-backdoor-catalogue.mdVolume 16: Backdoor Catalogue
1717-weak-kdf.mdVolume 17: Weak KDF
1818-aead-fundamentals.mdVolume 18: AEAD Fundamentals
1919-aes-256-gcm-on-rp5.mdVolume 19: AES-256-GCM on RP5
2020-xchacha20-poly1305.mdVolume 20: XChaCha20-Poly1305
2121-x25519-and-hkdf.mdVolume 21: X25519 and HKDF
2222-ed25519-identity.mdVolume 22: Ed25519 Identity
2323-argon2id.mdVolume 23: Argon2id
2424-rp5-as-a-router.mdVolume 24: RP5 as a Router
2525-rp5-as-a-camera.mdVolume 25: RP5 as a Camera
2626-building-the-images.mdVolume 26: Building the Images
2727-flash-and-verify.mdVolume 27: Flash and Verify
2828-blue-team-detection.mdVolume 28: Blue-Team Detection
2929-ethics-and-law.mdVolume 29: Ethics and Law
3030-appendix.mdVolume 30: Appendix
  • WEEK12_CORTEX_A_RE.md - Week 12: Cortex-A Reverse Engineering - Finding the Reset Handler and main() in a Stripped Binary

Appendices A-J

letterappendixrole
AA-functions.mdAppendix A: Function Catalogue
BB-aarch64-disasm.mdAppendix B: Full AArch64 Disassembly
CC-source-listing.mdAppendix C: Full Source Listing
DD-scripts-listing.mdAppendix D: Tooling Source Listing
EE-test-listing.mdAppendix E: Test Suite Listing
FF-constants.mdAppendix F: Constants, Configs, and Check Values
GG-api-reference.mdAppendix G: Per-Function API Reference
HH-annotated-disasm.mdAppendix H: Annotated AArch64 Disassembly
II-test-catalogue.mdAppendix I: Test Catalogue
JJ-ghidra-function-resolution.mdAppendix J - Function-by-Function Reverse Engineering

Module-by-module reference (docs/modules/)

Guided walkthroughs (docs/walkthrough/)

Reverse-engineering artefacts

artefactrole
firmware/README.mdthe stripped ARM64 target and the answer key
firmware/build_target.shbuilds the target (cross-platform, pinned container)
ghidra/README.mdthe Ghidra workspace and how to use it
ghidra/RESOLUTION_MAP.mdevery function -> its real name + the proving rule
ghidra/resolution.jsonthe resolution data, machine-readable
ghidra/resolve_functions.pyregenerates the resolution map
ghidra/gen_appendix_j.pyregenerates Appendix J
docs/appendix/J-ghidra-function-resolution.mdthe per-function RE report

The Code (src/, include/)

Written in the exact house C style (// MIT header with Author/Email/GitHub/File/Desc/Created, Allman braces, Doxygen /** @brief ... */, static internals, g_ globals, u literals).

modulefilesrole
daemonteled.h/.cthe TELESCREEN application (router + camera + beacon)
AEADaead.h/.cAES-256-GCM and XChaCha20-Poly1305 behind one API
key agreementkex.h/.cX25519 + HKDF-SHA256
identityidentity.h/.cEd25519 device identity
partitionspartition.h/.ccarve and identify the four images
environmentenv.h/.cU-Boot env CRC read/verify/edit
containercontainer.h/.cthe vendor kernel container
jffs2jffs2.h/.cJFFS2 nodes and crc32_le
beaconbeacon.h/.cthe exfiltration channel (weak and hardened)
collectorcollector.h/.cthe local lab sink
cameracamera.h/.cUVC camera URL helpers (RTSP + MJPEG)

The Tooling (scripts/)

scriptrole
verify_telescreen.pyverifies artifact hashes and the four-partition layout
build_images.pybuilds the four images from a rootfs tree
assemble_image.pyassembles a whole-flash image from the four partition files
carve.pycarves a whole-flash image into the four partitions
weak_decrypt.pythe Ministry key schedule, recovered and demonstrated
test_image_roundtrip.pybuild -> assemble -> verify -> carve regression test
ghidra/tests/test_resolution.pyasserts the function-resolution invariants

The Four Partitions (locked)

mtd0  boot      0x000000  128 KiB    U-Boot (+ first stage on the camera)
mtd1  bootargs  0x020000   64 KiB    U-Boot environment, CRC32(LE) + key=value\0
mtd2  kernel    0x030000 1792 KiB    vendor container -> real Linux Image
mtd3  rootfs    0x1F0000 14400 KiB   JFFS2, little-endian, crc32_le nodes

mtdparts=sfc:128K(boot),64K(bootargs),1792K(kernel),14400K(rootfs)


Build

# 1. The reverse-engineering target (stripped ARM64 ELF + answer key).
#    Runs in a pinned linux/arm64 container, so the bytes are identical on
#    Windows x64, Linux x64, and macOS arm64.
./firmware/build_target.sh

# 2. The Ghidra project (import + full auto-analysis + save) and the exports.
./ghidra/make_project.sh
./ghidra/decompile.sh
python3 ghidra/resolve_functions.py     # -> ghidra/RESOLUTION_MAP.md
python3 ghidra/gen_appendix_j.py        # -> docs/appendix/J-...md

# 3. The RP5 lab (application + tools).
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build

# 4. The four firmware images (host).
python3 scripts/build_images.py --uboot <u-boot.bin> --kernel <kernel> \
    --rootfs <rootfs-tree>/ --out images/
python3 scripts/verify_telescreen.py --image images/full.img

Full instructions for every step are in Volume 31.


Reference Device (the TELESCREEN on RP5)

attributevalue
boardRaspberry Pi 5
SoCBCM2712 (Cortex-A76)
image storemicroSD / NVMe (holds the four images)
bootloaderU-Boot 2024.07 (RP5 build)
kernelLinux 6.6
rootfsJFFS2 (read-only)
cameraUSB webcam (UVC, /dev/video0)
applicationteled (the TELESCREEN daemon)
exfil sinklocal collector (lab-sink)

Ethics

This is an educational lab on hardware you own, isolated from any network, with a local collector. The engineers who built the silicon are teachers; the surveillance is the crime. Use these skills lawfully and only on authorised hardware.


Next

OPERATION TELESCREEN CTF


License

MIT License