EMBA

What it is

A command-line firmware security analyzer for embedded Linux and other firmware. It covers the full process: firmware extraction, static analysis, dynamic analysis through emulation, SBOM generation, and a web-based vulnerability report.

What it helps with

- Extracting firmware images for analysis
- Spotting insecure binaries, outdated components, vulnerable scripts, and hard-coded passwords
- Emulating firmware for dynamic analysis
- Building an SBOM and an HTML report for further review

Who it's for

Penetration testers, product security teams, developers, and product managers responsible for embedded devices.

Worth knowing

EMBA is Linux only. The project recommends running it in a virtual machine with a current Kali Linux, using the default Docker mode; the prepared Docker image is about 20 GB. Authorized use only: analyze only firmware you own or have permission to test.

Do I need special hardware?
No, EMBA works on firmware image files rather than on a connected device.

How does it compare with binwalk, Flipper Zero, or Proxmark3?
In our view binwalk is a focused extraction tool while EMBA runs a full analysis pipeline, and Flipper Zero and Proxmark3 are hardware for working with devices directly.