EMBA

No entries match these filters. Clear filters

1. v2.0.5-ice-edt Nov 3, 2026 · issue 130

   EMBA adds component URL fields to JSON config and binary fragment test cases to strengthen firmware component detection⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.5-ice-edt https://github.com/e-m-b-a/emba.git
   # already have the repo? check out this version:
   $ git checkout v2.0.5-ice-edt

   ⤢
   • Add component URL to the JSON config output for identified firmware components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Add version detection support for the iw wireless utility component, expanding binary component identification coverage.
   • EMBA's CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output now includes valid license entries for identified components.
   • Add component URL to the JSON config output for identified firmware components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

2. v2.0.4-summer_edition Sep 21, 2026 · issue 082

   EMBA v2.0.4 migrates to binwalk-ng, makes the local connector endpoint configurable, and expands CSV logging across all modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.4-summer_edition https://github.com/e-m-b-a/emba.git
   # already have the repo? check out this version:
   $ git checkout v2.0.4-summer_edition

   ▶ ⤢
   • Makes the local connector endpoint configurable via the change introduced in PR #2069.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Moves MIN_TCP_SERV to defaults and allows it to be adjusted via scanning profiles.
   • Migrates firmware extraction from binwalk to the actively maintained binwalk-ng fork.
   • Completes CSV output logging across all modules for structured, machine-readable results.
   • Makes the local connector endpoint configurable via the change introduced in PR #2069.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

3. v2.0.3-legacy-time Jul 21, 2026 · issue 021

   EMBA v2.0.3 adds legacy SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS support to reach end-of-life devices modern OpenSSL can no longer connect to.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.3-legacy-time https://github.com/e-m-b-a/emba.git
   # already have the repo? check out this version:
   $ git checkout v2.0.3-legacy-time

   ⤢
   • Supports legacy SSL/TLS ciphers during live analysis, enabling vulnerability detection on old embedded devices that modern OpenSSL rejects.
   • Expands CSV log output across additional modules for richer machine-readable reporting.
   • Adds entropy file checking to aid detection of encrypted or compressed firmware regions.

   3 details in Everything

4. v2.0.2-big-2k Jun 8, 2026 · release notes

   EMBA v2.0.2 adds P26 S-Record extraction module and LocalAI-based AI integration for offline firmware analysis.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.2-big-2k https://github.com/e-m-b-a/emba.git
   # already have the repo? check out this version:
   $ git checkout v2.0.2-big-2k

   • Adds P26 extraction module for processing S-Record format files
   • Switches AI integration to LocalAI for local hardware execution without token costs

   2 details in Everything

5. v2.0.1-interactor Apr 30, 2026 · release notes

   EMBA v2.0.1-interactor adds the s130 module for generating interactive firmware dependency maps

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.1-interactor https://github.com/e-m-b-a/emba.git
   # already have the repo? check out this version:
   $ git checkout v2.0.1-interactor

   • Adds the s130 module to generate an interactive dependency map of firmware components
   • Updates installer and docker workflows for improved robustness and internal check stability

   2 details in Everything

6. v2.0.0-A-brave-new-world Dec 16, 2025 · release notes

   v2.0.0-A-brave-new-world adds Dependency Track API integration, a new emulation kernel, Java analysis capabilities, and the EMBA launcher.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.0-A-brave-new-world https://github.com/e-m-b-a/emba.git
   # already have the repo? check out this version:
   $ git checkout v2.0.0-A-brave-new-world

   • Add integration of the Dependency Track API to automatically upload and process generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
   • Add the EMBA launcher for simplified execution workflows
   • Add Java decompilation and security analysis capabilities to improve SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation
   • Switch to NVDv2 for CVE database queries
   • Update system emulation engine kernel from 4.1 to 4.14.336 LTS

   +1 more show less

   • Add Rocky Linux support for the EMBA environment

   6 details in Everything

7. v1.5.2-SBOM-next-generation-EMBA Mar 11, 2025 · release notes

   EMBA v1.5.2 adds CVE-bin-tool integration for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation and VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. support via module f17

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.5.2-SBOM-next-generation-EMBA https://github.com/e-m-b-a/emba.git
   # already have the repo? check out this version:
   $ git checkout v1.5.2-SBOM-next-generation-EMBA

   • SBOM VEX (Vulnerability Exploitability eXchangeVulnerability Exploitability eXchangeA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.) support is available via f17, integrated into the main SBOM output or available as a separated file

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !The f20 module has been removed; users must migrate to f17 for CVE-bin-tool integration and SBOM generation
8. v1.5.1-rise-from-the-dead Dec 17, 2024 · release notes

   EMBA v1.5.1 adds Rust binwalk as the initial extraction engine and enhances SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation capabilities.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.5.1-rise-from-the-dead https://github.com/e-m-b-a/emba.git
   # already have the repo? check out this version:
   $ git checkout v1.5.1-rise-from-the-dead

   └──▷ TRY IT
   Leverage the speed of the new Rust binwalk engine for initial firmware extraction during an analysis run.
   copy

   $ ./emba -l ~/log -f ~/firmware

   • Integrates the rewritten Rust-based binwalk (v3) as the initial extractor in the extraction pipeline
   • Enhances the SBOM engine with a new JSON output format, dependency handling, untracked file inclusion, and optimized static version detection

   2 details in Everything

9. v1.5.0-SBOMdorado Oct 22, 2024 · release notes

   EMBA v1.5.0-SBOMdorado adds broad SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. support for RPM, DEB, PIP, npm, and other package managers via binary analysis

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.5.0-SBOMdorado https://github.com/e-m-b-a/emba.git
   # already have the repo? check out this version:
   $ git checkout v1.5.0-SBOMdorado

   • Adds support for extracting SBOM data from Linux distribution identification, RPM packages, Debian packages, OpenWRT packages, Python PIP/requirements/poetry/wheel, FreeBSD pkg, Java archives, Alpine APK, Rust cargo.lock, Ruby gem, and npm JavaScript packages

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !Switches from docker-compose to docker compose which may break scripts relying on the old binary name
10. 1.4.2-Summertime Aug 9, 2024 · release notes

    EMBA v1.4.2 introduces a new S18 module for capa analysis with ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.4.2-Summertime https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.4.2-Summertime

    └──▷ HOW TO FIND IT
    Run EMBA on a firmware image with the new capa module enabled via the scan profile.
    📍./emba -l ~/log -f ~/firmware -p ./scan-profiles/quick-scan.emba
    • Adds the S18_capa_checker.sh module to analyze executable files using capa and map findings to MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. techniques

    1 detail in Everything

11. 1.4.1-white-rabbit Jun 17, 2024 · release notes

    EMBA 1.4.1 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. integration and a netcat listener to the emulation engine

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.4.1-white-rabbit https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.4.1-white-rabbit

    • EPSS integration enables Exploit Prediction Scoring SystemExploit Prediction Scoring SystemExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. data in analysis results
    • Adds an optional netcat listener capability to the system emulation engine for debugging
    • Emulation engine now uses Linux kernel 4.1.52 and Busybox 1.36.1

    3 details in Everything

12. 1.4.0-ICS-testing-edt Mar 5, 2024 · release notes

    EMBA v1.4.0 adds static perl analysis via zarn and toolchain identification for ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments./OT firmware scanning.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.4.0-ICS-testing-edt https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.4.0-ICS-testing-edt

    • New static perl analysis via zarn (module S27_perl_check.sh)
    • Toolchain identification support
    • Extended binary analysis via semgrep in module s16

    3 details in Everything

13. 1.3.2-EMBArk_is_here Dec 12, 2023 · release notes

    EMBA introduces EMBArk enterprise environment, CveXplore integration for CVE identification, and R2 bin cache support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.3.2-EMBArk_is_here https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.3.2-EMBArk_is_here

    • Introduces EMBArk, an enterprise-ready open source firmware security analysis environment built on top of EMBA
    • Replaces the previous cve-search integration with a new CveXplore integration for more stable CVE identification
    • Improves diff mode with threading and enhanced reporting capabilities for firmware comparison

    3 details in Everything

14. 1.3.1-diff-all-the-firmwares Nov 1, 2023 · release notes

    EMBA 1.3.1 adds firmware diffing mode via the -o flag to compare two firmware images

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.3.1-diff-all-the-firmwares https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.3.1-diff-all-the-firmwares

    └──▷ TRY IT
    Compare the source code of two different firmware releases to identify silent patches or added features.
    copy

    $ emba -i firmware1.bin -o firmware2.bin

    • Adds the ability to specify a second firmware image with the -o parameter in EMBA for firmware diffing
    • Introduces firmware diffing modules that extract and find differences between two firmware images, using radare2 for binary files

    2 details in Everything

15. 1.3.0-AI-for-EMBA Jul 25, 2023 · release notes

    EMBA v1.3.0-AI-for-EMBA adds AI-assisted firmware analysis and several new modules (Hexagon, Lighttpd).

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.3.0-AI-for-EMBA https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.3.0-AI-for-EMBA

    • Adds a new Lighttpd analysis module to detect configuration issues in Lighttpd web servers.
    • Enables CSV export for findings from p59, p60, and p70 modules.

    2 details in Everything

16. 1.2.3-RIP-binwalk May 11, 2023 · release notes

    Unblob becomes the main firmware extractor; adds R2 decompiler integration and Lua script analysis support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.2.3-RIP-binwalk https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.2.3-RIP-binwalk

    • Uses Unblob as the primary extraction framework, with binwalk retained only as a fallback
    • Adds R2 decompiler integration for extracted firmware binaries
    • Adds Lua script analysis support via a new live module
    • Adds UPnP live module for network device discovery during scanning

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !binwalk is no longer the main extraction framework; Unblob takes over as the default extractor
17. 1.2.2-bluehat Mar 14, 2023 · release notes

    EMBA 1.2.2 adds Lighttpd and Android APK analysis modules, CSV export for more findings, and wordlist support for JTR cracking

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.2.2-bluehat https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.2.2-bluehat

    • Enables CSV export for findings generated by modules p59, p60, and p70
    • Adds wordlist support to the JTR password cracking module via parameter s109

    2 details in Everything

18. 1.2.1 Feb 2, 2023 · release notes

    EMBA 1.2.1 adds Packetstorm/Snyk PoC sources, Hexagon architecture support, kernel symbol verification, and -k for kernel-only tests.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.2.1 https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.2.1

    └──▷ USE IT
    Scan only the kernel configuration without full system emulation to save time
    shell copy

    ./emba -k /path/to/kernel/config

    • emba.sh renamed to emba
    • Adds Packetstorm as a PoC/Exploit source for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. matching
    • Adds Snyk as a PoC/Exploit source for SBOM matching
    • New kernel vulnerability verification via Symbols and kernel compilation
    • Adds Hexagon architecture support in system-mode emulation

    +1 more show less

    • Adds -k flag to allow running kernel config tests only

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The emba.sh entrypoint script is renamed to emba; existing scripts or aliases pointing to emba.sh will break on upgrade.
19. 1.2.0-London-Calling Dec 5, 2022 · release notes

    EMBA v1.2.0 adds system-mode emulation for ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead./MIPS64/x86, QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. QCOW2 extraction, Trickest blacklists, and improved detection modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.2.0-London-Calling https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.2.0-London-Calling

    • Adds system-mode emulation support for ARM64, MIPS64, and x86 architectures
    • Integrates Metasploit into system-mode emulation workflows
    • Adds a new extraction module for QEMU QCOW2 firmware images
    • Introduces Kernel config identification, extraction, and testing capabilities
    • Implements a module blacklisting feature to disable specific analysis modules

    5 details in Everything

20. 1.1.3-Metasploit-Edt Oct 27, 2022 · release notes

    EMBA adds Metasploit Framework integration to its system emulation engine for automated vulnerability scanning.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.3-Metasploit-Edt https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.1.3-Metasploit-Edt

21. 1.1.2-Knight-Rider-Edt Oct 4, 2022 · release notes

    EMBA v1.1.2 adds NIOS2 architecture support, Zyxel firmware extraction, and Semgrep-based bash checking.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.2-Knight-Rider-Edt https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.1.2-Knight-Rider-Edt

    • NIOS2 architecture detection and analysis in the scan pipeline.
    • P22_Zyxel_zip_decrypt.sh module for extracting Zyxel encrypted firmwares.
    • Semgrep integration into modules/S20_shell_check.sh for improved bash vulnerability checking.
    • Module blacklisting capability to skip specific analysis modules during execution.

    4 details in Everything

22. 1.1.1 Aug 31, 2022 · release notes

    Adds mipsn32 emulation support and experimental UEFIUEFIA firmware specification maintained by the UEFI Forum that replaces legacy BIOS, defining how an OS and hardware initialize at boot. Cyber tools target or hook it to inspect pre-OS execution environments. firmware analysis to EMBA

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.1 https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.1.1

    └──▷ TRY IT
    Analyze a firmware image that uses the mipsn32 architecture by forcing the user-mode emulation step.
    copy

    $ emba -p <path_to_firmware> --steps s115

    Run the new experimental UEFI analysis modules against a firmware binary.
    copy

    $ emba -p <path_to_firmware> --steps p35,s02

    Generate an SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. format during the software bill of materialssoftware bill of materialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. phase.
    copy

    $ emba -p <path_to_firmware> --steps f21

    • Enables mipsn32 architecture support in the user-mode emulation module (step s115) for broader device firmware compatibility
    • Introduces experimental UEFI firmware analysis via steps p35 and s02 using FwHunt integration
    • Improves SBOM generation in step f21 with CycloneDX output format support
    • Enhances kernel analysis in step s24 by leveraging vmlinuz-to-elf for ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. conversion

    4 details in Everything

23. 1.1.0-Las-Vegas-Edt Aug 1, 2022 · release notes

    EMBA 1.1.0 adds -Q system-mode emulation, -B status bar, new S99 grepit module, and P21 Buffalo decryptor.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.0-Las-Vegas-Edt https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.1.0-Las-Vegas-Edt

    └──▷ USE IT
    Run EMBA in system-mode emulation to analyze firmware binaries safely.
    shell copy

    emba -e <firmware_image> -Q

    Enable the visual status bar while scanning large images to track progress.
    shell copy

    emba -e <firmware_image> -B

    • -Q switch enables the complete reworked system-mode emulation environment
    • -B option enables a new status bar during execution
    • Support for Ubuntu 22.04 LTS in default installation mode
    • Experimental WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. support added to default installation mode
    • New S99 grepit testing module introduced

    +2 more show less

    • New P21 buffalo_decryptor extractor module added
    • Massive speed improvements for module s106 and s110

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed modules S30 and S103 are no longer available
24. 1.0.3 Jul 15, 2022 · release notes

    EMBA 1.0.3 adds Ubuntu Jammy support, new STACS+JTR password cracking module and Gtfobins SUID detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.3 https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.0.3

    • Adds ubuntu:jammy (22.04 LTS) as a supported default installation environment
    • Introduces a new John the ripper password cracking module that operates on hashes identified via STACS in module s108
    • Enables Gtfobins integration within the SUID detection module s40

    3 details in Everything

25. 1.0.2 Jul 8, 2022 · release notes

    EMBA v1.0.2 adds Foscam/Buffalo decryption and -y/-j CLI flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.2 https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.0.2

    • -y flag to automatically overwrite log directories during scanning.
    • New firmware decryption modules for Foscam devices.
    • New firmware decryption module for Buffalo devices.

    3 details in Everything

26. 1.0.1 Jun 14, 2022 · release notes

    EMBA 1.0.1 introduces S99-grepit module for CRASS analysis and expanded CSV logging

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.1 https://github.com/e-m-b-a/emba.git
    # already have the repo? check out this version:
    $ git checkout 1.0.1

    • Introduces S99-grepit module leveraging the crass grep-it.sh script for enhanced firmware analysis
    • Expands CSV logging capabilities to capture more detailed scan metrics

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The FACT extractor module has been removed from the toolchain