Why it exists:
 

Most “IoT labs” are a VM and a web login. Real devices fail on the header row: UART left live, U-Boot unlocked, SPI dumps, BLE leaking, audio in-band. DVRPi is a physical board with those classes of bug built in. Eleven challenges.

 

Write-ups in the repo when you want the answer, not before.

GPL-3.0. Built by Exploit Security. Last firmware notes: May 2025.
 

What you need:

​

• Raspberry Pi 4B (this image is not a 3 / 5 / Zero image)

• 64 GB microSD (recommended)

• Host that can run xz, dd, sha256sum (Linux is simplest)

• UART adapter, jumper wires, and a BLE-capable machine for later challenges

• Optional: scope / glitch rig if you intend to do challenge 02 properly

​

Training and custom CTFs:
 

If you want this style of lab for a team, different hardware, your product’s bus, a week-long internal CTF, that is billed work, not the public image.

Schedule a meeting to discuss
 

Repo, license, issues: github.com/exploitsecurityio/DVRPi.