Abstract: A method of establishing a hardware identity of a coordinating device in a wireless network is provided. A standard PHY preamble is modified to a preamble that can be received by the coordinating device having an expected hardware configuration. The modified PHY preamble is transmitted with an association request by a joining device. In response to not receiving a reply containing an association response from the coordinating device by the joining device, determining the hardware configuration of the coordinating device is not the expected hardware configuration. A further method of characterizing a hardware identity of a device in a wireless network is also provided. A request with a modified PHY preamble is transmitted to a device. If a reply is received from the device, characterizing the device as a first hardware type. And, if a reply is not received, characterizing the device as not the first hardware type.

Abstract: A method of establishing a hardware identity of a coordinating device in a wireless network is provided. A standard PHY preamble is modified to a preamble that can be received by the coordinating device having an expected hardware configuration. The modified PHY preamble is transmitted with an association request by a joining device. In response to not receiving a reply containing an association response from the coordinating device by the joining device, determining the hardware configuration of the coordinating device is not the expected hardware configuration. A further method of characterizing a hardware identity of a device in a wireless network is also provided. A request with a modified PHY preamble is transmitted to a device. If a reply is received from the device, characterizing the device as a first hardware type. And, if a reply is not received, characterizing the device as not the first hardware type.

Abstract: Embodiments of the invention provide a method for disassembling firmware. A binary firmware image is received. If portions of the image are compressed, those portions are uncompressed. The binary firmware image is divided using a sliding window into a plurality of segments. Segments of the plurality of segments are classified as file types. Code file types are identified among the classified segments of the plurality of segments. Code architectures of the identified code file types of the classified plurality of segments are then classified. At least the classified code file types of the binary firmware image are disassembled based on the classified code architecture. The disassembled binary firmware image is evaluated for malware.