EMBA

EMBA is a firmware security analyzer designed for IoT and embedded device assessments. It extracts firmware images (using binwalk, unblob, and custom extractors), identifies the operating system and architecture, and performs both static and dynamic analysis. Static analysis includes binary hardening checks (NX, PIE, RELRO, stack canaries), known CVE matching against extracted software versions, password hash extraction, certificate analysis, and sensitive string detection. The dynamic analysis module uses QEMU emulation to actually boot extracted firmware and test running services for vulnerabilities — a capability that sets EMBA apart from simpler firmware scanners. EMBA generates detailed HTML reports with severity-rated findings, CVE references, and remediation guidance. It supports ARM, MIPS, x86, and PowerPC architectures. With over 3,000 GitHub stars, EMBA is the most comprehensive open-source firmware analysis framework available, used by security researchers auditing routers, cameras, industrial controllers, and other embedded devices.