Eleven hardware bugs on one physical board.

DVRPi is a hardware training platform designed, built and sold by Exploit Security for security teams, training providers and product companies that need real embedded attack surface to practise on, not a VM with a web login.

View the repository

Training and custom CTFs

Need the same approach pointed at your own product? We build custom labs different hardware, your product’s bus, a week-long internal CTF as a scoped engagement.

Why we built it

Most “IoT labs” are a VM and a web login. Real devices fail on the header row: UART left live, U-Boot unlocked, SPI dumps, BLE leaking, audio in-band.

We built DVRPi as a physical board with those classes of bug designed in eleven challenges, each mapped to a real-world failure.

We use it to train client teams, and we sell it to organisations that want the same hardware on their own bench.

Repository and licence

Firmware notes, write-ups and issue tracking live in the repository. Licensed GPL-3.0.

https://github.com/exploitsecurityio/DVRPi ->

What you need

Raspberry Pi 4B (this image is not a 3 / 5 / Zero image)
64 GB microSD (recommended)
Host that can run xz, dd, sha256sum (Linux is simplest)
UART adapter, jumper wires, and a BLE-capable machine for later challenges
Optional: scope / glitch rig if you intend to do challenge 02 properly