emba

Why we included this project

EMBA takes a raw firmware image and runs it through the entire security workflow: extraction, static analysis, dynamic checks in an emulator, SBOM generation, and a browsable web report of the findings. That pipeline is what saves penetration testers and product security engineers time, since it replaces the usual assembly of separate unpacking, binary inspection, and CVE correlation tools. The scanner surfaces hard-coded passwords, outdated software components, insecure binaries, and potentially vulnerable scripts, and the report gives enough context to decide where to dig deeper. It runs from the command line and is written in Bash, which makes it easy to slot into both one-off assessments and repeatable CI-style testing for teams working on IoT or industrial devices. If firmware security is a regular part of your job rather than a rare exercise, this is a good foundation for a consistent testing baseline.