sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

ONB · FirmwareStatic scanner: EMBA + binwalk + cve-bin-tool (firmware image analysis) #151

New Issue
Open
opened 2026-07-12 21:56:21 +00:00 by sharang · 0 comments
sharang commented 2026-07-12 21:56:21 +00:00
Owner
Copy Link
Copy Source

Part of #118. Implement the FirmwareStatic scanner (the #128 stub) for firmware images using EMBA + binwalk + cve-bin-tool.

Context

For firmware images (bare-metal .bin, Yocto .wic/rootfs, extracted firmware) we need image-level static analysis: unpack the filesystem, enumerate components, map CVEs, find secrets and weak configs.

Approach

  • Unpack: binwalk (extract rootfs/filesystems from the image).
  • Analyze: EMBA (firmware security analyzer — components, cve-bin-tool CVE mapping, hardcoded creds/secrets, insecure configs, outdated packages) + cve-bin-tool over binaries.
  • Emit findings + SBOM entries keyed to the target, same shape as the code SAST path.

Test targets (OSS)

IoTGoat, extracted OpenWrt/router firmware, Yocto-built .wic images.

Depends

Firmware ingest (#120, computes the sha256 = tramiton reconciliation key), the FirmwareStatic scanner stub (#128), CS-A2 (EMBA + cve-bin-tool + binwalk).

Part of #118. Implement the `FirmwareStatic` scanner (the #128 stub) for firmware **images** using EMBA + binwalk + cve-bin-tool. ## Context For firmware *images* (bare-metal `.bin`, Yocto `.wic`/rootfs, extracted firmware) we need image-level static analysis: unpack the filesystem, enumerate components, map CVEs, find secrets and weak configs. ## Approach - **Unpack:** binwalk (extract rootfs/filesystems from the image). - **Analyze:** **EMBA** (firmware security analyzer — components, cve-bin-tool CVE mapping, hardcoded creds/secrets, insecure configs, outdated packages) + cve-bin-tool over binaries. - Emit findings + SBOM entries keyed to the target, same shape as the code SAST path. ## Test targets (OSS) IoTGoat, extracted OpenWrt/router firmware, Yocto-built `.wic` images. ## Depends Firmware ingest (#120, computes the sha256 = tramiton reconciliation key), the `FirmwareStatic` scanner stub (#128), CS-A2 (EMBA + cve-bin-tool + binwalk).
sharang added this to the Onboarding v1 milestone 2026-07-12 21:56:21 +00:00
sharang added the onboardingenhancement labels 2026-07-12 21:56:21 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P0-demo
CERTifAI P0 demo build tickets (CS-*)
 bug
critical
enhancement
epic
Tracking issue spanning multiple sub-issues
 high
infrastructure
onboarding
Multi-target onboarding wizard redesign
 performance
security
v0.3.0
No labels enhancement onboarding
Milestone
No items
No Milestone Onboarding v1
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#151