https://cybertoolchain.io/tools/emba New releases and features in EMBA, tracked by The Cyber Toolchain. en Tue, 03 Nov 2026 09:20:59 GMT https://github.com/e-m-b-a/emba/releases/tag/v2.0.5-ice-edt https://github.com/e-m-b-a/emba/releases/tag/v2.0.5-ice-edt Tue, 03 Nov 2026 09:20:59 GMT EMBA adds component URL fields to JSON config and binary fragment test cases to strengthen firmware component detection⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Add component URL to the JSON config output for identified firmware components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Add version detection support for the `iw` wireless utility component, expanding binary component identification coverage. • EMBA's CycloneDX SBOM output now includes valid license entries for identified components. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/v2.0.4-summer_edition https://github.com/e-m-b-a/emba/releases/tag/v2.0.4-summer_edition Mon, 21 Sep 2026 14:57:31 GMT EMBA v2.0.4 migrates to binwalk-ng, makes the local connector endpoint configurable, and expands CSV logging across all modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Makes the local connector endpoint configurable via the change introduced in PR #2069.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Moves `MIN_TCP_SERV` to defaults and allows it to be adjusted via scanning profiles. • Migrates firmware extraction from binwalk to the actively maintained `binwalk-ng` fork. • Completes CSV output logging across all modules for structured, machine-readable results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/v2.0.3-legacy-time https://github.com/e-m-b-a/emba/releases/tag/v2.0.3-legacy-time Tue, 21 Jul 2026 08:29:26 GMT EMBA v2.0.3 adds legacy SSL/TLS support to reach end-of-life devices modern OpenSSL can no longer connect to. • Supports legacy SSL/TLS ciphers during live analysis, enabling vulnerability detection on old embedded devices that modern OpenSSL rejects. • Expands CSV log output across additional modules for richer machine-readable reporting. • Adds entropy file checking to aid detection of encrypted or compressed firmware regions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/v2.0.2-big-2k https://github.com/e-m-b-a/emba/releases/tag/v2.0.2-big-2k Mon, 08 Jun 2026 06:59:00 GMT EMBA v2.0.2 adds P26 S-Record extraction module and LocalAI-based AI integration for offline firmware analysis. • Adds `P26` extraction module for processing S-Record format files • Switches AI integration to `LocalAI` for local hardware execution without token costs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/v2.0.1-interactor https://github.com/e-m-b-a/emba/releases/tag/v2.0.1-interactor Thu, 30 Apr 2026 13:01:47 GMT EMBA v2.0.1-interactor adds the s130 module for generating interactive firmware dependency maps • Adds the `s130` module to generate an interactive dependency map of firmware components • Updates installer and docker workflows for improved robustness and internal check stability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/v2.0.0-A-brave-new-world https://github.com/e-m-b-a/emba/releases/tag/v2.0.0-A-brave-new-world Tue, 16 Dec 2025 10:59:51 GMT v2.0.0-A-brave-new-world adds Dependency Track API integration, a new emulation kernel, Java analysis capabilities, and the EMBA launcher. • Add integration of the Dependency Track API to automatically upload and process generated SBOMs • Add the EMBA launcher for simplified execution workflows • Add Java decompilation and security analysis capabilities to improve SBOM generation • Switch to NVDv2 for CVE database queries • Update system emulation engine kernel from 4.1 to 4.14.336 LTS • Add Rocky Linux support for the EMBA environment Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/v1.5.2-SBOM-next-generation-EMBA https://github.com/e-m-b-a/emba/releases/tag/v1.5.2-SBOM-next-generation-EMBA Tue, 11 Mar 2025 08:38:32 GMT EMBA v1.5.2 adds CVE-bin-tool integration for SBOM generation and VEX support via module f17 • SBOM VEX (Vulnerability Exploitability eXchange) support is available via `f17`, integrated into the main SBOM output or available as a separated file Breaking changes: • The `f20` module has been removed; users must migrate to `f17` for CVE-bin-tool integration and SBOM generation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/v1.5.1-rise-from-the-dead https://github.com/e-m-b-a/emba/releases/tag/v1.5.1-rise-from-the-dead Tue, 17 Dec 2024 12:11:58 GMT EMBA v1.5.1 adds Rust binwalk as the initial extraction engine and enhances SBOM generation capabilities. • Integrates the rewritten Rust-based `binwalk` (v3) as the initial extractor in the extraction pipeline • Enhances the `SBOM` engine with a new JSON output format, dependency handling, untracked file inclusion, and optimized static version detection Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/v1.5.0-SBOMdorado https://github.com/e-m-b-a/emba/releases/tag/v1.5.0-SBOMdorado Tue, 22 Oct 2024 11:07:47 GMT EMBA v1.5.0-SBOMdorado adds broad SBOM support for RPM, DEB, PIP, npm, and other package managers via binary analysis • Adds support for extracting SBOM data from Linux distribution identification, RPM packages, Debian packages, OpenWRT packages, Python PIP/requirements/poetry/wheel, FreeBSD pkg, Java archives, Alpine APK, Rust cargo.lock, Ruby gem, and npm JavaScript packages Breaking changes: • Switches from `docker-compose` to `docker compose` which may break scripts relying on the old binary name Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.4.2-Summertime https://github.com/e-m-b-a/emba/releases/tag/1.4.2-Summertime Fri, 09 Aug 2024 07:39:50 GMT EMBA v1.4.2 introduces a new S18 module for capa analysis with ATT&CK support. • Adds the `S18_capa_checker.sh` module to analyze executable files using capa and map findings to MITRE ATT&CK techniques Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.4.1-white-rabbit https://github.com/e-m-b-a/emba/releases/tag/1.4.1-white-rabbit Mon, 17 Jun 2024 12:28:36 GMT EMBA 1.4.1 adds EPSS integration and a netcat listener to the emulation engine • `EPSS` integration enables Exploit Prediction Scoring System data in analysis results • Adds an optional `netcat` listener capability to the system emulation engine for debugging • Emulation engine now uses Linux kernel 4.1.52 and Busybox 1.36.1 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.4.0-ICS-testing-edt https://github.com/e-m-b-a/emba/releases/tag/1.4.0-ICS-testing-edt Tue, 05 Mar 2024 10:04:32 GMT EMBA v1.4.0 adds static perl analysis via zarn and toolchain identification for ICS/OT firmware scanning. • New static perl analysis via zarn (module S27_perl_check.sh) • Toolchain identification support • Extended binary analysis via semgrep in module s16 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.3.2-EMBArk_is_here https://github.com/e-m-b-a/emba/releases/tag/1.3.2-EMBArk_is_here Tue, 12 Dec 2023 13:07:38 GMT EMBA introduces EMBArk enterprise environment, CveXplore integration for CVE identification, and R2 bin cache support • Introduces EMBArk, an enterprise-ready open source firmware security analysis environment built on top of EMBA • Replaces the previous cve-search integration with a new `CveXplore` integration for more stable CVE identification • Improves diff mode with threading and enhanced reporting capabilities for firmware comparison Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.3.1-diff-all-the-firmwares https://github.com/e-m-b-a/emba/releases/tag/1.3.1-diff-all-the-firmwares Wed, 01 Nov 2023 14:06:40 GMT EMBA 1.3.1 adds firmware diffing mode via the `-o` flag to compare two firmware images • Adds the ability to specify a second firmware image with the `-o` parameter in EMBA for firmware diffing • Introduces firmware diffing modules that extract and find differences between two firmware images, using radare2 for binary files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.3.0-AI-for-EMBA https://github.com/e-m-b-a/emba/releases/tag/1.3.0-AI-for-EMBA Tue, 25 Jul 2023 09:49:34 GMT EMBA v1.3.0-AI-for-EMBA adds AI-assisted firmware analysis and several new modules (Hexagon, Lighttpd). • Adds a new Lighttpd analysis module to detect configuration issues in Lighttpd web servers. • Enables CSV export for findings from p59, p60, and p70 modules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.2.3-RIP-binwalk https://github.com/e-m-b-a/emba/releases/tag/1.2.3-RIP-binwalk Thu, 11 May 2023 13:53:27 GMT Unblob becomes the main firmware extractor; adds R2 decompiler integration and Lua script analysis support. • Uses Unblob as the primary extraction framework, with binwalk retained only as a fallback • Adds R2 decompiler integration for extracted firmware binaries • Adds Lua script analysis support via a new live module • Adds UPnP live module for network device discovery during scanning Breaking changes: • binwalk is no longer the main extraction framework; Unblob takes over as the default extractor Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.2.2-bluehat https://github.com/e-m-b-a/emba/releases/tag/1.2.2-bluehat Tue, 14 Mar 2023 20:26:53 GMT EMBA 1.2.2 adds Lighttpd and Android APK analysis modules, CSV export for more findings, and wordlist support for JTR cracking • Enables CSV export for findings generated by modules `p59`, `p60`, and `p70` • Adds wordlist support to the JTR password cracking module via parameter `s109` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.2.1 https://github.com/e-m-b-a/emba/releases/tag/1.2.1 Thu, 02 Feb 2023 07:02:36 GMT EMBA 1.2.1 adds Packetstorm/Snyk PoC sources, Hexagon architecture support, kernel symbol verification, and `-k` for kernel-only tests. • `emba.sh` renamed to `emba` • Adds Packetstorm as a PoC/Exploit source for SBOM matching • Adds Snyk as a PoC/Exploit source for SBOM matching • New kernel vulnerability verification via Symbols and kernel compilation • Adds Hexagon architecture support in system-mode emulation • Adds `-k` flag to allow running kernel config tests only Breaking changes: • The `emba.sh` entrypoint script is renamed to `emba`; existing scripts or aliases pointing to `emba.sh` will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.2.0-London-Calling https://github.com/e-m-b-a/emba/releases/tag/1.2.0-London-Calling Mon, 05 Dec 2022 12:17:30 GMT EMBA v1.2.0 adds system-mode emulation for ARM64/MIPS64/x86, QEMU QCOW2 extraction, Trickest blacklists, and improved detection modules. • Adds system-mode emulation support for ARM64, MIPS64, and x86 architectures • Integrates Metasploit into system-mode emulation workflows • Adds a new extraction module for QEMU QCOW2 firmware images • Introduces Kernel config identification, extraction, and testing capabilities • Implements a module blacklisting feature to disable specific analysis modules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.1.3-Metasploit-Edt https://github.com/e-m-b-a/emba/releases/tag/1.1.3-Metasploit-Edt Thu, 27 Oct 2022 07:48:32 GMT EMBA adds Metasploit Framework integration to its system emulation engine for automated vulnerability scanning. • Adds `Metasploit` framework support within the EMBA `system emulation` engine, enabling automatic exploitation checks during firmware analysis Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.1.2-Knight-Rider-Edt https://github.com/e-m-b-a/emba/releases/tag/1.1.2-Knight-Rider-Edt Tue, 04 Oct 2022 07:27:38 GMT EMBA v1.1.2 adds NIOS2 architecture support, Zyxel firmware extraction, and Semgrep-based bash checking. • `NIOS2` architecture detection and analysis in the scan pipeline. • `P22_Zyxel_zip_decrypt.sh` module for extracting Zyxel encrypted firmwares. • Semgrep integration into `modules/S20_shell_check.sh` for improved bash vulnerability checking. • Module blacklisting capability to skip specific analysis modules during execution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.1.1 https://github.com/e-m-b-a/emba/releases/tag/1.1.1 Wed, 31 Aug 2022 16:51:38 GMT Adds mipsn32 emulation support and experimental UEFI firmware analysis to EMBA • Enables `mipsn32` architecture support in the user-mode emulation module (step s115) for broader device firmware compatibility • Introduces experimental UEFI firmware analysis via steps p35 and s02 using FwHunt integration • Improves SBOM generation in step f21 with CycloneDX output format support • Enhances kernel analysis in step s24 by leveraging vmlinuz-to-elf for ELF conversion Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.1.0-Las-Vegas-Edt https://github.com/e-m-b-a/emba/releases/tag/1.1.0-Las-Vegas-Edt Mon, 01 Aug 2022 11:52:43 GMT EMBA 1.1.0 adds `-Q` system-mode emulation, `-B` status bar, new S99 grepit module, and P21 Buffalo decryptor. • `-Q` switch enables the complete reworked system-mode emulation environment • `-B` option enables a new status bar during execution • Support for Ubuntu 22.04 LTS in default installation mode • Experimental WSL support added to default installation mode • New S99 grepit testing module introduced • New P21 buffalo_decryptor extractor module added • Massive speed improvements for module s106 and s110 Breaking changes: • Removed modules S30 and S103 are no longer available Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.0.3 https://github.com/e-m-b-a/emba/releases/tag/1.0.3 Fri, 15 Jul 2022 18:25:00 GMT EMBA 1.0.3 adds Ubuntu Jammy support, new STACS+JTR password cracking module and Gtfobins SUID detection. • Adds ubuntu:jammy (22.04 LTS) as a supported default installation environment • Introduces a new John the ripper password cracking module that operates on hashes identified via STACS in module s108 • Enables Gtfobins integration within the SUID detection module s40 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.0.2 https://github.com/e-m-b-a/emba/releases/tag/1.0.2 Fri, 08 Jul 2022 19:16:18 GMT EMBA v1.0.2 adds Foscam/Buffalo decryption and -y/-j CLI flags • `-y` flag to automatically overwrite log directories during scanning. • New firmware decryption modules for Foscam devices. • New firmware decryption module for Buffalo devices. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba https://github.com/e-m-b-a/emba/releases/tag/1.0.1 https://github.com/e-m-b-a/emba/releases/tag/1.0.1 Tue, 14 Jun 2022 10:27:54 GMT EMBA 1.0.1 introduces S99-grepit module for CRASS analysis and expanded CSV logging • Introduces `S99-grepit` module leveraging the `crass` grep-it.sh script for enhanced firmware analysis • Expands CSV logging capabilities to capture more detailed scan metrics Breaking changes: • The `FACT extractor` module has been removed from the toolchain Full history on Cyber Toolchain: https://cybertoolchain.io/tools/emba