Summary
Correlating several weak signals into one finding is the part a firmware scan leaves undone.
EMBA produces a great deal of output, and the individually-unremarkable items are where the real problem usually hides — a SUID binary is fine, a weak credential is fine, the two together are not. An engine that combines signals and then explains the path between them turns a report you skim into a report you act on. Working from stored output rather than re-scanning also means the analysis is cheap to repeat as your questions change.
What it is
A reader for EMBA's firmware analysis output. It parses results you already have rather than running the scan again, then normalises and reasons over them.
What you get
- Parsing EMBA results across kernel, services, credentials, crypto, the software bill of materials, binaries and more
- Filesystem-aware analysis covering SUID binaries, secrets, weak crypto and exposed services
- A correlation engine that combines several signals into one high-risk finding
- An engine that explains the attack path behind a finding
Requirements
Linux with Python 3.10 or newer and EMBA itself. It works against existing output, so no rescan is required.