DVRPi is an intentionally broken Raspberry Pi 4B firmware. It teaches the same paths we use on IoT, routers and industrial controllers: serial consoles, bootloaders, side channels, radios and sloppy services. Educational use only. Do not put it on a production network or on the public internet. It will get owned.
Why it exists
Most “IoT labs” are a VM and a web login. Real devices fail on the header row: UART left live, U-Boot unlocked, SPI dumps, BLE leaking, audio in-band. DVRPi is a physical board with those classes of bug built in. Eleven challenges.
Write-ups in the repo when you want the answer, not before.
GPL-3.0. Built by Exploit Security. Last firmware notes: May 2025.
What you need
-
Raspberry Pi 4B (this image is not a 3 / 5 / Zero image)
-
64 GB microSD (recommended)
-
Host that can run xz, dd, sha256sum (Linux is simplest)
-
UART adapter, jumper wires, and a BLE-capable machine for later challenges
-
Optional: scope / glitch rig if you intend to do challenge 02 properly
Training and custom CTFs
If you want this style of lab for a team, different hardware, your product’s bus, a week-long internal CTF, that is billed work, not the public image.
Schedule a meeting to discuss
Repo, licence, issues: github.com/exploitsecurityio/DVRPi.
